joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140488d30
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
sub rsp, 0x48
movdqa xmmword [rsp + 0x30], xmm6
mov r9d, r8d
mov eax, dword [rcx + 0x58]
cmp eax, r8d
cmovb r9d, eax
mov eax, r9d
sub eax, edx
cmp eax, 2
jb 0x140488f45
mov r8d, edx
or byte [rcx + 0xb4], 0x20
mov rdx, qword [rcx + 0x68]
mov r11d, 0xffffffff
cmp r9d, r8d
je 0x140488f33
cmp dword [rcx + 0x1c], 2
jne 0x140488d9d
cmp r9d, r8d
jbe 0x140488f33
mov esi, r8d
mov eax, r9d
mov r10, rax
sub r10, rsi
cmp r10, 9
jae 0x140488dc2
mov r10, rsi
jmp 0x140488f06
lea eax, [r9 - 1]
lea rax, [rax + rax*4]
mov r10d, r8d
lea r10, [r10 + r10*4]
mov r10d, dword [rdx + r10*4 + 8]
mov r11d, dword [rdx + rax*4 + 8]
cmp r10d, r11d
cmovb r11d, r10d
jmp 0x140488f33
mov edi, r10d
and edi, 7
mov r11d, 8
cmovne r11, rdi
sub r10, r11
add r10, rsi
add r11, rsi
sub r11, rax
lea rsi, [rsi + rsi*4]
lea rsi, [rdx + rsi*4]
add rsi, 0x94
pcmpeqd xmm1, xmm1
movdqa xmm0, xmmword [0x140599730]
pcmpeqd xmm2, xmm2
nop dword [rax]
movd xmm3, dword [rsi - 0x50]
movd xmm4, dword [rsi - 0x64]
punpckldq xmm4, xmm3
movd xmm3, dword [rsi - 0x78]
movd xmm5, dword [rsi - 0x8c]
punpckldq xmm5, xmm3
punpcklqdq xmm5, xmm4
movd xmm3, dword [rsi]
movd xmm4, dword [rsi - 0x14]
punpckldq xmm4, xmm3
movd xmm3, dword [rsi - 0x28]
movd xmm6, dword [rsi - 0x3c]
punpckldq xmm6, xmm3
punpcklqdq xmm6, xmm4
movdqa xmm3, xmm1
movdqa xmm4, xmm5
pxor xmm4, xmm0
pxor xmm1, xmm0
pcmpgtd xmm4, xmm1
pand xmm3, xmm4
pandn xmm4, xmm5
movdqa xmm1, xmm4
por xmm1, xmm3
movdqa xmm3, xmm2
movdqa xmm4, xmm6
pxor xmm4, xmm0
pxor xmm2, xmm0
pcmpgtd xmm4, xmm2
pand xmm3, xmm4
pandn xmm4, xmm6
movdqa xmm2, xmm4
por xmm2, xmm3
add rsi, 0xa0
add r11, 8
jne 0x140488e00
movdqa xmm3, xmm1
pxor xmm3, xmm0
movdqa xmm4, xmm2
pxor xmm4, xmm0
pcmpgtd xmm4, xmm3
pand xmm1, xmm4
pandn xmm4, xmm2
por xmm4, xmm1
pshufd xmm1, xmm4, 0xee
movdqa xmm2, xmm4
pxor xmm2, xmm0
movdqa xmm3, xmm1
pxor xmm3, xmm0
pcmpgtd xmm3, xmm2
pand xmm4, xmm3
pandn xmm3, xmm1
por xmm3, xmm4
pshufd xmm1, xmm3, 0x55
movdqa xmm2, xmm3
pxor xmm2, xmm0
pxor xmm0, xmm1
pcmpgtd xmm0, xmm2
pand xmm3, xmm0
pandn xmm0, xmm1
por xmm0, xmm3
movd r11d, xmm0
sub rax, r10
lea r10, [r10 + r10*4]
lea r10, [rdx + r10*4]
add r10, 8
nop word cs:[rax + rax]
mov esi, dword [r10]
cmp r11d, esi
cmovae r11d, esi
add r10, 0x14
dec rax
jne 0x140488f20
mov dword [rsp + 0x20], r11d
mov dword [rsp + 0x28], 3
call fcn.14034bed0
movaps xmm6, xmmword [rsp + 0x30]
add rsp, 0x48
pop rdi
pop rsi
ret
Function at 0x14049e6b0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0xd8
mov dword [rsp + 0x3c], r9d
mov r15, rdx
mov r12d, dword [rsp + 0x170]
mov r13d, dword [rsp + 0x148]
movzx edi, byte [rsp + 0x158]
movzx ebx, byte [rsp + 0x150]
mov rax, qword [0x1406a7e00]
xor rax, rsp
mov qword [rsp + 0xd0], rax
mov esi, r8d
lea rax, str.BUSGSOPG
mov ebp, dword [rax + rsi*4]
mov qword [rsp + 0x40], rcx
mov rcx, qword [rcx]
mov edx, ebp
call fcn.1404858e0
mov r14d, eax
shl rsi, 4
add r15, rsi
add r15, 0x20
movzx eax, bl
movzx ecx, dil
movzx edx, byte [rsp + 0x160]
movzx r8d, byte [rsp + 0x168]
lea eax, [rax + rcx*2]
lea eax, [rax + rdx*4]
lea eax, [rax + r8*8]
xor ebx, ebx
movzx esi, ax
jmp 0x14049e75b
add ebx, eax
cmp eax, 0x20
jne 0x14049e7ec
mov dword [rsp + 0x4c], 0x20
mov rax, qword [rsp + 0x40]
mov rcx, qword [rax]
lea rax, [rsp + 0x50]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x4c]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], ebx
mov edx, ebp
mov r8d, dword [rsp + 0x3c]
mov r9d, dword [rsp + 0x140]
call fcn.1404857b0
mov eax, dword [rsp + 0x4c]
test eax, eax
je 0x14049e7ec
xor edi, edi
jmp 0x14049e7ba
inc rdi
mov ecx, eax
cmp rdi, rcx
jae 0x14049e750
cmp dword [rsp + rdi*4 + 0x50], r14d
jae 0x14049e7b0
mov rcx, r15
call fcn.14049e820
mov dword [rax + 4], r13d
movzx ecx, word [rsp + rdi*4 + 0x50]
mov word [rax], cx
movzx ecx, word [rax + 2]
and ecx, 0xfffffff0
or ecx, esi
mov word [rax + 2], cx
mov dword [rax + 8], r12d
mov eax, dword [rsp + 0x4c]
jmp 0x14049e7b0
mov rcx, qword [rsp + 0xd0]
xor rcx, rsp
call fcn.1405602f0
nop
add rsp, 0xd8
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x14049ff90
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x48
movdqa xmmword [rsp + 0x30], xmm6
mov rbx, rcx
mov rcx, qword [rdx + 0x20]
cmp byte [rcx + 0x50], 0
je 0x1404a0023
mov rsi, r8
mov rdi, rdx
test byte [rcx + 0x18], 0x40
jne 0x1404a0036
mov dword [rdi + 0x84], 0
mov r14d, dword [rbx + 4]
bswap r14d
test r14d, r14d
je 0x1404a0023
add rbx, 8
xor r15d, r15d
lea r12, [0x1405d7500]
mov eax, dword [rsi + 4]
cmp r15, rax
jae 0x1404a001e
mov rax, r15
shl rax, 4
add rax, qword [rsi + 8]
mov qword [rdi + 0x78], rax
mov rcx, rbx
mov rdx, rdi
call fcn.1404a4530
mov rax, qword [rdi + 0x20]
cmp byte [rax + 0x50], 0
je 0x1404a0023
mov eax, dword [rbx + 4]
bswap eax
add rbx, rax
inc r15
cmp r15, r14
jne 0x14049ffe0
jmp 0x1404a0023
mov rax, r12
jmp 0x14049fff3
movaps xmm6, xmmword [rsp + 0x30]
add rsp, 0x48
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
mov r9d, dword [rcx + 0x58]
cmp r9, 2
jb 0x14049ffbc
or byte [rcx + 0xb4], 0x20
mov rdx, qword [rcx + 0x68]
cmp dword [rcx + 0x1c], 2
jne 0x1404a0068
cmp r9d, 9
jae 0x1404a0085
mov r8d, 0xffffffff
xor eax, eax
jmp 0x1404a01c3
lea eax, [r9 - 1]
lea rax, [rax + rax*4]
mov r10d, dword [rdx + 8]
mov r8d, dword [rdx + rax*4 + 8]
cmp r10d, r8d
cmovb r8d, r10d
jmp 0x1404a01e8
mov eax, r9d
and eax, 7
mov r8d, 8
cmovne r8, rax
mov rax, r9
sub rax, r8
lea r8, [rdx + 0x94]
pcmpeqd xmm1, xmm1
movdqa xmm0, xmmword [0x140599730]
mov r10, rax
pcmpeqd xmm2, xmm2
movd xmm3, dword [r8 - 0x50]
movd xmm4, dword [r8 - 0x64]
punpckldq xmm4, xmm3
movd xmm3, dword [r8 - 0x78]
movd xmm5, dword [r8 - 0x8c]
punpckldq xmm5, xmm3
punpcklqdq xmm5, xmm4
movd xmm3, dword [r8]
movd xmm4, dword [r8 - 0x14]
punpckldq xmm4, xmm3
movd xmm3, dword [r8 - 0x28]
movd xmm6, dword [r8 - 0x3c]
punpckldq xmm6, xmm3
punpcklqdq xmm6, xmm4
movdqa xmm3, xmm1
movdqa xmm4, xmm5
pxor xmm4, xmm0
pxor xmm1, xmm0
pcmpgtd xmm4, xmm1
pand xmm3, xmm4
pandn xmm4, xmm5
movdqa xmm1, xmm4
por xmm1, xmm3
movdqa xmm3, xmm2
movdqa xmm4, xmm6
pxor xmm4, xmm0
pxor xmm2, xmm0
pcmpgtd xmm4, xmm2
pand xmm3, xmm4
pandn xmm4, xmm6
movdqa xmm2, xmm4
por xmm2, xmm3
add r8, 0xa0
add r10, 0xfffffffffffffff8
jne 0x1404a00b5
movdqa xmm3, xmm1
pxor xmm3, xmm0
movdqa xmm4, xmm2
pxor xmm4, xmm0
pcmpgtd xmm4, xmm3
pand xmm1, xmm4
pandn xmm4, xmm2
por xmm4, xmm1
pshufd xmm1, xmm4, 0xee
movdqa xmm2, xmm4
pxor xmm2, xmm0
movdqa xmm3, xmm1
pxor xmm3, xmm0
pcmpgtd xmm3, xmm2
pand xmm4, xmm3
pandn xmm3, xmm1
por xmm3, xmm4
pshufd xmm1, xmm3, 0x55
movdqa xmm2, xmm3
pxor xmm2, xmm0
pxor xmm0, xmm1
pcmpgtd xmm0, xmm2
pand xmm3, xmm0
pandn xmm0, xmm1
por xmm0, xmm3
movd r8d, xmm0
mov r10, r9
sub r10, rax
lea rax, [rax + rax*4]
lea rax, [rdx + rax*4]
add rax, 8
mov r11d, dword [rax]
cmp r8d, r11d
cmovae r8d, r11d
add rax, 0x14
dec r10
jne 0x1404a01d5
mov dword [rsp + 0x20], r8d
mov dword [rsp + 0x28], 2
xor r8d, r8d
call fcn.14034bed0
jmp 0x14049ffbc
Function at 0x1404a0320
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x48
movdqa xmmword [rsp + 0x30], xmm6
mov rbx, rcx
mov rcx, qword [rdx + 0x20]
cmp byte [rcx + 0x50], 0
je 0x1404a03b3
mov rsi, r8
mov rdi, rdx
test byte [rcx + 0x18], 0x40
jne 0x1404a03c6
mov dword [rdi + 0x84], 0
mov r14d, dword [rbx + 4]
bswap r14d
test r14d, r14d
je 0x1404a03b3
add rbx, 8
xor r15d, r15d
lea r12, [0x1405d7500]
mov eax, dword [rsi + 4]
cmp r15, rax
jae 0x1404a03ae
mov rax, r15
shl rax, 4
add rax, qword [rsi + 8]
mov qword [rdi + 0x78], rax
mov rcx, rbx
mov rdx, rdi
call fcn.1404a72e0
mov rax, qword [rdi + 0x20]
cmp byte [rax + 0x50], 0
je 0x1404a03b3
mov eax, dword [rbx + 4]
bswap eax
add rbx, rax
inc r15
cmp r15, r14
jne 0x1404a0370
jmp 0x1404a03b3
mov rax, r12
jmp 0x1404a0383
movaps xmm6, xmmword [rsp + 0x30]
add rsp, 0x48
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
mov r9d, dword [rcx + 0x58]
cmp r9, 2
jb 0x1404a034c
or byte [rcx + 0xb4], 0x20
mov rdx, qword [rcx + 0x68]
cmp dword [rcx + 0x1c], 2
jne 0x1404a03f8
cmp r9d, 9
jae 0x1404a0415
mov r8d, 0xffffffff
xor eax, eax
jmp 0x1404a0553
lea eax, [r9 - 1]
lea rax, [rax + rax*4]
mov r10d, dword [rdx + 8]
mov r8d, dword [rdx + rax*4 + 8]
cmp r10d, r8d
cmovb r8d, r10d
jmp 0x1404a0578
mov eax, r9d
and eax, 7
mov r8d, 8
cmovne r8, rax
mov rax, r9
sub rax, r8
lea r8, [rdx + 0x94]
pcmpeqd xmm1, xmm1
movdqa xmm0, xmmword [0x140599730]
mov r10, rax
pcmpeqd xmm2, xmm2
movd xmm3, dword [r8 - 0x50]
movd xmm4, dword [r8 - 0x64]
punpckldq xmm4, xmm3
movd xmm3, dword [r8 - 0x78]
movd xmm5, dword [r8 - 0x8c]
punpckldq xmm5, xmm3
punpcklqdq xmm5, xmm4
movd xmm3, dword [r8]
movd xmm4, dword [r8 - 0x14]
punpckldq xmm4, xmm3
movd xmm3, dword [r8 - 0x28]
movd xmm6, dword [r8 - 0x3c]
punpckldq xmm6, xmm3
punpcklqdq xmm6, xmm4
movdqa xmm3, xmm1
movdqa xmm4, xmm5
pxor xmm4, xmm0
pxor xmm1, xmm0
pcmpgtd xmm4, xmm1
pand xmm3, xmm4
pandn xmm4, xmm5
movdqa xmm1, xmm4
por xmm1, xmm3
movdqa xmm3, xmm2
movdqa xmm4, xmm6
pxor xmm4, xmm0
pxor xmm2, xmm0
pcmpgtd xmm4, xmm2
pand xmm3, xmm4
pandn xmm4, xmm6
movdqa xmm2, xmm4
por xmm2, xmm3
add r8, 0xa0
add r10, 0xfffffffffffffff8
jne 0x1404a0445
movdqa xmm3, xmm1
pxor xmm3, xmm0
movdqa xmm4, xmm2
pxor xmm4, xmm0
pcmpgtd xmm4, xmm3
pand xmm1, xmm4
pandn xmm4, xmm2
por xmm4, xmm1
pshufd xmm1, xmm4, 0xee
movdqa xmm2, xmm4
pxor xmm2, xmm0
movdqa xmm3, xmm1
pxor xmm3, xmm0
pcmpgtd xmm3, xmm2
pand xmm4, xmm3
pandn xmm3, xmm1
por xmm3, xmm4
pshufd xmm1, xmm3, 0x55
movdqa xmm2, xmm3
pxor xmm2, xmm0
pxor xmm0, xmm1
pcmpgtd xmm0, xmm2
pand xmm3, xmm0
pandn xmm0, xmm1
por xmm0, xmm3
movd r8d, xmm0
mov r10, r9
sub r10, rax
lea rax, [rax + rax*4]
lea rax, [rdx + rax*4]
add rax, 8
mov r11d, dword [rax]
cmp r8d, r11d
cmovae r8d, r11d
add rax, 0x14
dec r10
jne 0x1404a0565
mov dword [rsp + 0x20], r8d
mov dword [rsp + 0x28], 2
xor r8d, r8d
call fcn.14034bed0
jmp 0x1404a034c
Function at 0x1404bed80
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0xb0
mov rax, qword [0x1406a7e00]
xor rax, rsp
mov qword [rsp + 0xa8], rax
cmp dword [rdx + 0x2c], 0
jne 0x1404befab
mov r14, r8
mov rdi, rdx
mov rsi, rcx
lea rbx, [rcx + 2]
mov rcx, qword [rdx + 8]
mov rax, qword [rdx + 0x10]
mov r15, rbx
sub r15, rcx
sub rax, rcx
cmp rax, r15
setl al
cmp r15, 0x7fffffff
ja 0x1404bef9a
test al, al
jne 0x1404befa4
mov rax, rbx
cmp rbx, rcx
je 0x1404bedfc
xor edx, edx
mov r8, r15
call fcn.140562a70
mov rax, qword [rdi + 8]
add r15, rax
mov qword [rdi + 8], r15
test rax, rax
je 0x1404befab
mov eax, dword [r14 + 0x10]
test eax, eax
je 0x1404bef5b
mov ecx, dword [r14 + 0x30]
test ecx, ecx
je 0x1404bef5b
mov rdx, qword [r14 + 8]
movzx r9d, word [rdx]
rol r9w, 8
mov r8, qword [r14 + 0x28]
movzx r10d, word [r8]
rol r10w, 8
movzx r9d, r9w
movzx ebp, r10w
sub ebp, r9d
cmp eax, 1
je 0x1404beea6
mov r9d, ecx
dec r9d
je 0x1404beea6
add ecx, 0xfffffffe
add eax, 0xfffffffe
xor r9d, r9d
nop
movzx r10d, byte [r8 + r9*2 + 2]
movzx r11d, byte [r8 + r9*2 + 3]
movzx r15d, byte [rdx + r9*2 + 2]
shl r15d, 8
movzx r12d, byte [rdx + r9*2 + 3]
or r12d, r15d
shl r10d, 8
or r10d, r11d
sub r10d, r12d
xor r10w, bp
jne 0x1404bef5b
cmp eax, r9d
je 0x1404beea6
mov r10, r9
inc r10
cmp ecx, r9d
mov r9, r10
jne 0x1404bee60
mov word [rsi], 0x100
mov rax, qword [r14 + 0x30]
mov qword [rsp + 0x90], rax
movups xmm0, xmmword [r14]
movups xmm1, xmmword [r14 + 0x10]
movups xmm2, xmmword [r14 + 0x20]
movaps xmmword [rsp + 0x80], xmm2
movaps xmmword [rsp + 0x70], xmm1
movaps xmmword [rsp + 0x60], xmm0
lea rax, [0x14061f8e8]
mov qword [rsp + 0x98], rax
cmp dword [rdi + 0x2c], 0
jne 0x1404befab
lea rax, [rsi + 6]
mov rcx, qword [rdi + 8]
mov r14, rax
sub r14, rcx
cmp r14, 0x7fffffff
ja 0x1404befa4
mov rdx, qword [rdi + 0x10]
sub rdx, rcx
cmp rdx, r14
jl 0x1404befa4
cmp rax, rcx
je 0x1404bef2e
xor edx, edx
mov r8, r14
call fcn.140562a70
mov rax, qword [rdi + 8]
add r14, rax
mov qword [rdi + 8], r14
test rax, rax
je 0x1404befab
lea r8, [rsp + 0x60]
mov rcx, rbx
mov rdx, rdi
call fcn.1404bf6c0
test al, al
je 0x1404befab
rol bp, 8
mov word [rsi + 4], bp
mov sil, 1
jmp 0x1404befad
mov word [rsi], 0x200
mov rax, qword [r14 + 0x30]
mov qword [rsp + 0x50], rax
movups xmm0, xmmword [r14]
movups xmm1, xmmword [r14 + 0x10]
movups xmm2, xmmword [r14 + 0x20]
movaps xmmword [rsp + 0x40], xmm2
movaps xmmword [rsp + 0x30], xmm1
movaps xmmword [rsp + 0x20], xmm0
lea r8, [rsp + 0x20]
mov rcx, rsi
mov rdx, rdi
call fcn.1404bf430
mov esi, eax
jmp 0x1404befad
mov al, 1
test al, al
je 0x1404bede6
mov dword [rdi + 0x2c], 4
xor esi, esi
mov rcx, qword [rsp + 0xa8]
xor rcx, rsp
call fcn.1405602f0
mov eax, esi
add rsp, 0xb0
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
Function at 0x1404c0280
Capabilities:
Encode data using xor
Resolve function by fin8 fasthash

Disassembly:
push rsi
push rdi
push rbx
movabs rdx, 0x880355f21e6d1965
movabs rax, 0x2127599bf4325c37
mov r9d, dword [rcx + 0x10]
mov r8, qword [rcx + 8]
mov r10, r9
shr r10, 3
mov r11d, r9d
and r11d, 0xfffffff8
add r11, r8
mov rsi, r9
imul rsi, rdx
mov ecx, 0xf437ffe6
xor rcx, rsi
test r8b, 7
je 0x1404c030b
cmp r9d, 8
jb 0x1404c034c
shl r10, 3
xor esi, esi
nop word cs:[rax + rax]
mov rdi, qword [r8 + rsi]
mov rbx, rdi
shr rbx, 0x17
xor rbx, rdi
imul rbx, rax
xor rcx, rbx
shr rbx, 0x2f
xor rcx, rbx
imul rcx, rdx
add rsi, 8
cmp r10, rsi
jne 0x1404c02e0
jmp 0x1404c0349
cmp r9d, 8
jb 0x1404c034c
shl r10, 3
xor esi, esi
nop word [rax + rax]
mov rdi, qword [r8 + rsi]
mov rbx, rdi
shr rbx, 0x17
xor rbx, rdi
imul rbx, rax
xor rcx, rbx
shr rbx, 0x2f
xor rcx, rbx
imul rcx, rdx
add rsi, 8
cmp r10, rsi
jne 0x1404c0320
mov r8, r11
and r9d, 7
dec r9
cmp r9, 6
ja case.default.0x1404c036a
xor r10d, r10d
lea r11, [0x1404c03fc]
movsxd r9, dword [r11 + r9*4]
add r9, r11
jmp r9
movzx r10d, byte [r8 + 6]
shl r10, 0x30
movzx r9d, byte [r8 + 5]
shl r9, 0x28
or r10, r9
movzx r9d, byte [r8 + 4]
shl r9, 0x20
xor r10, r9
movzx r9d, byte [r8 + 3]
shl r9, 0x18
xor r10, r9
movzx r9d, byte [r8 + 2]
shl r9, 0x10
xor r10, r9
movzx r9d, byte [r8 + 1]
shl r9, 8
xor r10, r9
movzx r8d, byte [r8]
mov r9, r10
shr r9, 0x17
xor r9, r10
xor r9, r8
imul r9, rax
mov r8, r9
shr r8, 0x2f
xor r8, r9
xor rcx, r8
imul rcx, rdx
mov rdx, rcx
shr rdx, 0x17
xor rdx, rcx
imul rdx, rax
mov rax, rdx
shr rax, 0x2f
xor eax, edx
shr rdx, 0x20
sub eax, edx
pop rbx
pop rdi
pop rsi
ret
Function at 0x1404c1850
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x70
mov rax, qword [0x1406a7e00]
xor rax, rsp
mov qword [rsp + 0x68], rax
cmp dword [rdx + 0x2c], 0
jne 0x1404c19cc
mov rdi, r8
mov rsi, rdx
mov rbx, rcx
lea r14, [rcx + 2]
mov rcx, qword [rdx + 8]
mov rax, qword [rdx + 0x10]
mov r15, r14
sub r15, rcx
sub rax, rcx
cmp rax, r15
setl al
cmp r15, 0x7fffffff
ja 0x1404c19bb
test al, al
jne 0x1404c19c5
mov rax, r14
cmp r14, rcx
je 0x1404c18c6
xor edx, edx
mov r8, r15
call fcn.140562a70
mov rax, qword [rsi + 8]
add r15, rax
mov qword [rsi + 8], r15
xor ebp, ebp
test rax, rax
je 0x1404c19ce
mov eax, dword [rdi + 0x10]
test rax, rax
je 0x1404c194b
mov rcx, qword [rdi + 8]
lea rdx, [rax + rax]
xor r8d, r8d
mov ebp, 0xfffffffe
mov r10d, 1
xor r9d, r9d
xor r11d, r11d
nop dword [rax]
movzx r15d, word [rcx + r8]
rol r15w, 8
movzx r15d, r15w
cmp ebp, r15d
movzx r12d, r9b
mov r9d, r12d
cmova r9d, r10d
cmp ebp, 0xfffffffe
cmove r9d, r12d
inc ebp
xor r12d, r12d
cmp ebp, r15d
setne r12b
add r11d, r12d
add r8, 2
mov ebp, r15d
cmp rdx, r8
jne 0x1404c1900
lea ebp, [r11 + r11*2]
test r9b, 1
sete cl
jmp 0x1404c194d
mov cl, 1
cmp eax, ebp
seta al
xor cl, 1
or cl, al
movzx eax, cl
shl eax, 8
add eax, 0x100
mov word [rbx], ax
movzx eax, ah
cmp ax, 2
je 0x1404c1996
cmp eax, 1
jne 0x1404c19cc
movups xmm0, xmmword [rdi]
movups xmm1, xmmword [rdi + 0x10]
movaps xmmword [rsp + 0x50], xmm1
movaps xmmword [rsp + 0x40], xmm0
lea r8, [rsp + 0x40]
mov rcx, r14
mov rdx, rsi
call fcn.1404c1da0
jmp 0x1404c19b7
movups xmm0, xmmword [rdi]
movups xmm1, xmmword [rdi + 0x10]
movaps xmmword [rsp + 0x30], xmm1
movaps xmmword [rsp + 0x20], xmm0
lea r8, [rsp + 0x20]
mov rcx, rbx
mov rdx, rsi
call fcn.1404c19f0
mov ebp, eax
jmp 0x1404c19ce
mov al, 1
test al, al
je 0x1404c18b0
mov dword [rsi + 0x2c], 4
xor ebp, ebp
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.1405602f0
mov eax, ebp
add rsp, 0x70
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
Function at 0x1405039e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov rcx, qword [rcx + 8]
jmp 0x14050be20
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x20
mov eax, edx
and eax, 0xfffffc00
mov edi, 0xffffffff
cmp eax, 0xd800
je 0x14050bea1
mov esi, r8d
mov r14d, edx
mov rbx, rcx
mov rcx, qword [rcx + 0x20]
mov r15, qword [rcx + 8]
cmp edx, 0xffff
ja 0x14050be6e
mov rax, qword [rcx]
mov ecx, r14d
shr ecx, 6
movzx ecx, word [rax + rcx*2]
mov eax, r14d
and eax, 0x3f
add eax, ecx
jmp 0x14050be94
cmp r14d, 0x10ffff
ja 0x14050be87
cmp dword [rcx + 0x18], r14d
jle 0x14050be8e
mov edx, r14d
call fcn.140500070
jmp 0x14050be94
mov eax, dword [rcx + 0x14]
dec eax
jmp 0x14050be94
mov eax, dword [rcx + 0x14]
add eax, 0xfffffffe
cdqe
movzx ecx, word [r15 + rax*2]
cmp rcx, 1
jne 0x14050beaf
mov eax, edi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
cmp cx, word [rbx + 0x10]
jae 0x14050bee5
cmp cx, 2
jne 0x14050bf76
lea eax, [rsi - 0x1161]
cmp eax, 0x14
ja 0x14050bea1
lea eax, [r14 + r14*4]
lea eax, [r14 + rax*4]
add eax, esi
lea ecx, [rax + rax*8]
lea ecx, [rcx + rcx*2]
lea edi, [rcx + rax]
add edi, 0xffd7b964
jmp 0x14050bea1
cmp ecx, 0xfbff
ja 0x14050bea1
movzx eax, word [rbx + 0x1e]
cmp cx, ax
jb 0x14050bea1
movzx eax, ax
sub ecx, eax
sar ecx, 1
movsxd rax, ecx
add rax, rax
add rax, qword [rbx + 0x28]
cmp esi, 0x10ffff
ja 0x14050bea1
cmp esi, 0x33ff
ja 0x14050bfc2
add esi, esi
movzx edx, si
movzx ecx, word [rax]
cmp edx, ecx
jbe 0x14050bf46
nop word [rax + rax]
mov r8, rax
and ecx, 1
or ecx, 2
lea rax, [rax + rcx*2]
movzx ecx, word [r8 + rcx*2]
cmp edx, ecx
ja 0x14050bf30
mov r8d, ecx
and r8d, 0x7ffe
mov edi, 0xffffffff
cmp edx, r8d
jne 0x14050c03a
movzx edi, word [rax + 2]
test cl, 1
je 0x14050c03a
shl edi, 0x10
mov r8d, edi
jmp 0x14050c033
movzx edx, word [rbx + 0xe]
cmp dx, cx
jne 0x14050bf9d
lea eax, [rsi - 0x11a8]
cmp eax, 0x1a
ja 0x14050bea1
lea edi, [r14 + rsi]
add edi, 0xffffee59
jmp 0x14050bea1
mov eax, ecx
and eax, 0xfffffffe
add rax, qword [rbx + 0x30]
cmp cx, dx
jbe 0x14050bf07
movzx ecx, word [rax]
and ecx, 0x1f
lea rax, [rax + rcx*2]
add rax, 2
jmp 0x14050bf07
mov ecx, esi
shr ecx, 9
add ecx, 0x3400
shl esi, 6
and ecx, 0xfffe
mov edi, 0xffffffff
jmp 0x14050bfee
and edx, 1
or rdx, 2
mov r8, rdx
lea rax, [rax + rdx*2]
movzx edx, word [rax]
cmp ecx, edx
ja 0x14050bfe0
mov r8d, edx
and r8d, 0x7ffe
cmp ecx, r8d
jne 0x14050c03a
movzx r8d, word [rax + 2]
cmp r8w, si
jae 0x14050c020
mov r8d, 3
test dx, dx
js 0x14050c03a
lea rax, [rax + r8*2]
jmp 0x14050bfee
xor esi, r8d
test esi, 0xffc0
jne 0x14050c03a
and r8d, 0x3f
shl r8d, 0x10
movzx edi, word [rax + 4]
or edi, r8d
sar edi, 1
jmp 0x14050bea1
Function at 0x14050be20
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov rcx, qword [rcx + 8]
jmp 0x14050be20
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x20
mov eax, edx
and eax, 0xfffffc00
mov edi, 0xffffffff
cmp eax, 0xd800
je 0x14050bea1
mov esi, r8d
mov r14d, edx
mov rbx, rcx
mov rcx, qword [rcx + 0x20]
mov r15, qword [rcx + 8]
cmp edx, 0xffff
ja 0x14050be6e
mov rax, qword [rcx]
mov ecx, r14d
shr ecx, 6
movzx ecx, word [rax + rcx*2]
mov eax, r14d
and eax, 0x3f
add eax, ecx
jmp 0x14050be94
cmp r14d, 0x10ffff
ja 0x14050be87
cmp dword [rcx + 0x18], r14d
jle 0x14050be8e
mov edx, r14d
call fcn.140500070
jmp 0x14050be94
mov eax, dword [rcx + 0x14]
dec eax
jmp 0x14050be94
mov eax, dword [rcx + 0x14]
add eax, 0xfffffffe
cdqe
movzx ecx, word [r15 + rax*2]
cmp rcx, 1
jne 0x14050beaf
mov eax, edi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
cmp cx, word [rbx + 0x10]
jae 0x14050bee5
cmp cx, 2
jne 0x14050bf76
lea eax, [rsi - 0x1161]
cmp eax, 0x14
ja 0x14050bea1
lea eax, [r14 + r14*4]
lea eax, [r14 + rax*4]
add eax, esi
lea ecx, [rax + rax*8]
lea ecx, [rcx + rcx*2]
lea edi, [rcx + rax]
add edi, 0xffd7b964
jmp 0x14050bea1
cmp ecx, 0xfbff
ja 0x14050bea1
movzx eax, word [rbx + 0x1e]
cmp cx, ax
jb 0x14050bea1
movzx eax, ax
sub ecx, eax
sar ecx, 1
movsxd rax, ecx
add rax, rax
add rax, qword [rbx + 0x28]
cmp esi, 0x10ffff
ja 0x14050bea1
cmp esi, 0x33ff
ja 0x14050bfc2
add esi, esi
movzx edx, si
movzx ecx, word [rax]
cmp edx, ecx
jbe 0x14050bf46
nop word [rax + rax]
mov r8, rax
and ecx, 1
or ecx, 2
lea rax, [rax + rcx*2]
movzx ecx, word [r8 + rcx*2]
cmp edx, ecx
ja 0x14050bf30
mov r8d, ecx
and r8d, 0x7ffe
mov edi, 0xffffffff
cmp edx, r8d
jne 0x14050c03a
movzx edi, word [rax + 2]
test cl, 1
je 0x14050c03a
shl edi, 0x10
mov r8d, edi
jmp 0x14050c033
movzx edx, word [rbx + 0xe]
cmp dx, cx
jne 0x14050bf9d
lea eax, [rsi - 0x11a8]
cmp eax, 0x1a
ja 0x14050bea1
lea edi, [r14 + rsi]
add edi, 0xffffee59
jmp 0x14050bea1
mov eax, ecx
and eax, 0xfffffffe
add rax, qword [rbx + 0x30]
cmp cx, dx
jbe 0x14050bf07
movzx ecx, word [rax]
and ecx, 0x1f
lea rax, [rax + rcx*2]
add rax, 2
jmp 0x14050bf07
mov ecx, esi
shr ecx, 9
add ecx, 0x3400
shl esi, 6
and ecx, 0xfffe
mov edi, 0xffffffff
jmp 0x14050bfee
and edx, 1
or rdx, 2
mov r8, rdx
lea rax, [rax + rdx*2]
movzx edx, word [rax]
cmp ecx, edx
ja 0x14050bfe0
mov r8d, edx
and r8d, 0x7ffe
cmp ecx, r8d
jne 0x14050c03a
movzx r8d, word [rax + 2]
cmp r8w, si
jae 0x14050c020
mov r8d, 3
test dx, dx
js 0x14050c03a
lea rax, [rax + r8*2]
jmp 0x14050bfee
xor esi, r8d
test esi, 0xffc0
jne 0x14050c03a
and r8d, 0x3f
shl r8d, 0x10
movzx edi, word [rax + 4]
or edi, r8d
sar edi, 1
jmp 0x14050bea1