joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1403c8683
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rsi
movzx eax, r13w
xor al, bl
movsx ax, r11b
push rdi
sbb si, 0x7508
movzx di, r9b
sal ax, cl
push rbx
and esi, 0x2be84b5e
sub rsp, 0x20
mov rsi, rcx
rcr eax, 0xd3
lea rax, [0x1400be020]
mov qword [rcx], rax
mov rdi, qword [rcx + 0x78]
cmc
jmp 0x1403c86c2
test rdi, rdi
je 0x1403c86f3
mov rcx, rdi
call fcn.1401377ae
mov rcx, rdi
jmp 0x1403c86db
call fcn.1401a1728
mov qword [rsi + 0x78], 0
movzx rax, r13w
setae ah
bts rax, rax
mov rax, qword [rsi + 0x70]
cmp rax, 8
jb 0x1403c8773
mov rcx, qword [rsi + 0x58]
lea rdx, [rax + rax]
add rdx, 2
test edx, esi
cmp rdx, 0x1000
jmp 0x1403c871b
jb 0x1403c876e
mov rbx, qword [rcx - 8]
cmc
stc
add rcx, 0xfffffffffffffff8
cmp r9b, 0x6c
sub rcx, rbx
test ax, 0x56d4
cmp rcx, 0x20
jmp 0x1403c873f
jae 0x1403c88d5
add rax, rax
sub rcx, r13
add ecx, 0x5fae020f
add rax, 0x29
mov cx, 0x6b65
cwd
mov rdx, rax
movzx ecx, r13w
cmovs cx, sp
mov rcx, rbx
jmp 0x1403c876e
call fcn.1401d61ed
movaps xmm0, xmmword [0x1400bd3f0]
sar bx, cl
shld rax, r11, 0xf6
movups xmmword [rsi + 0x68], xmm0
rcr rbx, 0x50
mov word [rsi + 0x58], 0
lea rax, [0x1400bdb70]
shl bh, cl
mov qword [rsi], rax
movzx rdi, bp
mov rdi, qword [rsi + 0x40]
shrd bx, r9w, 0x33
bswap ebx
movzx rbx, si
mov rbx, qword [rsi + 0x48]
test dl, dil
cmp rdi, rbx
jmp 0x1403c87bf
jne 0x1403c87dc
jmp 0x1403c881d
add rdi, 8
cmp rdi, rbx
jmp 0x1403c87d6
je 0x1403c8809
mov rcx, qword [rdi]
test r12b, al
clc
test rcx, rcx
jmp 0x1403c87eb
je 0x1403c87ca
mov rax, qword [rcx]
mov edx, 1
jmp 0x1403c87fe
call qword [rax + 0xb8]
jmp 0x1403c87ca
mov rdi, qword [rsi + 0x40]
cmp rdi, qword [rsi + 0x48]
je 0x1403c881d
mov qword [rsi + 0x48], rdi
clc
stc
test rdi, rdi
jmp 0x1403c8825
je 0x1403c88b3
mov rdx, qword [rsi + 0x50]
sub rdx, rdi
cmp rdx, 0x1000
jmp 0x1403c883e
jb 0x1403c8882
mov rax, qword [rdi - 8]
cmc
stc
add rdi, 0xfffffffffffffff8
jmp 0x1403c8856
sub rdi, rax
stc
test r15b, bl
cmp rdi, 0x20
jae 0x1403c88d5
add rdx, 0x27
bts rdi, r11
sal cx, cl
not dil
mov rdi, rax
rol ecx, 0x4d
cmp r14d, 0x486f48ce
add rsi, 0x40
movsx rcx, r15w
mov rcx, rdi
call fcn.1401d61ed
xorps xmm0, xmm0
movups xmmword [rsi], xmm0
bsr rdi, r10
rol bl, cl
clc
mov qword [rsi + 0x10], 0
rcl di, 0xb1
ror sil, cl
btr di, r10w
add rsp, 0x20
movzx rsi, bp
setbe dil
pop rbx
movsxd rsi, edx
pop rdi
jmp 0x1403c88ce
pop rsi
jmp 0x1403c88d4
ret
call fcn.1404b907c
int3
Function at 0x1403eace7
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
stc
push r14
or r14, rdx
rcr r14b, 0xa6
push rsi
push rdi
movsx r14d, dx
xor r14b, spl
push rbx
sub rsp, 0x90
movzx rdi, r13w
movaps xmmword [rsp + 0x80], xmm6
mov r14, rcx
mov dword [rcx + 8], 0
test spl, r11b
shl bx, cl
movsx di, r12b
mov qword [rcx + 0x10], 0
clc
bsf rbx, rdx
mov rdi, qword [rcx + 0x18]
mov rbx, qword [rcx + 0x20]
cmp rdi, rbx
jmp 0x1403ead43
je 0x1403eae10
lea r15, [0x1400beb30]
jmp 0x1403ead55
xorps xmm6, xmm6
jmp 0x1403ead8e
lea rsi, [rdi + 0x18]
call fcn.1401d61ed
movups xmmword [rsi], xmm6
cmp ax, 0x6287
test r12b, 0xe2
mov qword [rsi + 0x10], 0
cmp r14b, r11b
add rdi, 0x30
cmp rdi, rbx
jmp 0x1403ead88
je 0x1403eae00
mov qword [rdi], r15
and rcx, rbp
sal ecx, cl
mov rcx, qword [rdi + 0x18]
test rcx, rcx
jmp 0x1403eada2
je 0x1403ead7c
mov rdx, qword [rdi + 0x28]
cmp bl, r10b
test bh, bh
sub rdx, rcx
cmp r14w, 0x281c
jmp 0x1403eadc0
cmp rdx, 0x1000
jmp 0x1403eadcc
jb 0x1403ead5d
mov rax, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
cmp r12b, r9b
sub rcx, rax
jmp 0x1403eade5
cmp rcx, 0x20
jae 0x1403eaf78
add rdx, 0x27
mov rcx, rax
jmp 0x1403eadfb
jmp 0x1403ead5d
mov rax, qword [r14 + 0x18]
mov qword [r14 + 0x20], rax
nop
cbw
movsx eax, r11w
mov qword [r14 + 0x30], 0
mov ah, 0x40
lea rax, [0x1400bed70]
jmp 0x1403eae27
mov qword [rsp + 0x28], rax
jmp 0x1403eae31
xorps xmm0, xmm0
movups xmmword [rsp + 0x38], xmm0
adc cx, r10w
movups xmmword [rsp + 0x48], xmm0
movups xmmword [rsp + 0x58], xmm0
mov ah, 0x5d
stc
sbb al, 0x29
movups xmmword [rsp + 0x68], xmm0
sar ax, cl
or al, r11b
shl cl, 0x30
mov qword [rsp + 0x78], 0
or cl, bpl
rcr al, 0x90
movzx cx, r14b
mov dword [rsp + 0x30], 0
lea rax, [r14 + 0x38]
mov dword [r14 + 0x40], 0
lea rcx, [rsp + 0x28]
cmp rax, rcx
jmp 0x1403eae90
je 0x1403eaf18
lea rcx, [r14 + 0x48]
cmc
sub edx, edx
cmp bpl, r11b
xor r8d, r8d
call fcn.1403ecc3b
lea rcx, [r14 + 0x60]
mov rdx, qword [rsp + 0x50]
btc r8, rcx
btr r8d, r13d
mov r8, qword [rsp + 0x58]
sub r8, rdx
sar r8, 5
jmp 0x1403eaeca
call fcn.1403ecc3b
add r14, 0x78
adc r8, 0x48cd6c0e
and r8b, 0xdd
bswap dx
mov rdx, qword [rsp + 0x68]
ror ch, 0xd1
mov r8, qword [rsp + 0x70]
and ch, 0x6b
sub r8, rdx
adc ecx, 0x4f3803f4
sar cx, 0xd8
btc cx, 0xe9
sar r8, 5
movzx ecx, r8w
mov rcx, r14
jmp 0x1403eaf13
call fcn.1403ecc3b
lea rcx, [rsp + 0x28]
jmp 0x1403eaf22
call fcn.1403eca5b
movaps xmm6, xmmword [rsp + 0x80]
shrd r14, rbp, 0x40
ror r14, cl
bsf r15, r11
add rsp, 0x90
movsx bx, dl
not rsi
movzx rsi, bp
pop rbx
movsxd r15, esp
jmp 0x1403eaf5b
pop rdi
pop rsi
movsx r14w, r14b
pop r14
movzx r15d, dx
setge r15b
movsx r15, bx
pop r15
jmp 0x1403eaf77
ret
call fcn.1404b907c
int3
Function at 0x1403ed3ff
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
cmc
push r14
clc
stc
push rsi
clc
cmp r13d, 0x3cfa1d9c
push rdi
adc dil, spl
xadd edi, edi
push rbx
sbb dil, 0xd
stc
adc rdi, 0x3dbc78ea
sub rsp, 0x30
movaps xmmword [rsp + 0x20], xmm6
bts edi, r13d
movzx di, al
xor di, 0x47be
mov rdi, qword [rcx]
cmc
test rdi, rdi
jmp 0x1403ed445
je 0x1403ed5c4
mov r14, rcx
mov rbx, qword [rcx + 8]
jmp 0x1403ed45c
cmp rdi, rbx
jmp 0x1403ed464
je 0x1403ed557
lea r15, [0x1400bed10]
jmp 0x1403ed476
movaps xmm6, xmmword [0x1400bd400]
jmp 0x1403ed482
jmp 0x1403ed4b9
call fcn.1401d61ed
movups xmmword [rdi + 0x20], xmm6
cmp r10b, 0xd9
test rax, 0x35863e9e
mov byte [rdi + 0x10], 0
cmc
test r13b, bl
add rdi, 0x50
test r10w, r10w
cmc
cmp rdi, rbx
jmp 0x1403ed4b3
je 0x1403ed54b
mov qword [rdi], r15
movsxd rcx, r9d
xchg ch, cl
movsx cx, cl
lea rcx, [rdi + 0x38]
call fcn.1403e6e8c
mov rax, qword [rdi + 0x28]
cmp rax, 0x10
jmp 0x1403ed4db
jb 0x1403ed48c
mov rcx, qword [rdi + 0x10]
adc rdx, 0x413b07ea
movzx edx, r14w
xor edx, 0x7d56326f
lea rdx, [rax + 1]
cmp rdx, 0x1000
jmp 0x1403ed506
jb 0x1403ed487
mov rsi, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rsi
cmc
jmp 0x1403ed51d
cmp rcx, 0x20
jmp 0x1403ed526
jae 0x1403ed60a
add rax, 0x28
movsx dx, bpl
mov rdx, rax
movsx rcx, dx
movsx ecx, r12w
xchg cx, cx
mov rcx, rsi
jmp 0x1403ed487
mov rdi, qword [r14]
rcr dx, 0x75
shld dx, dx, 0x9e
mov rdx, qword [r14 + 0x10]
cmp r13w, 0x158b
stc
sub rdx, rdi
cmc
cmp rdx, 0x1000
jb 0x1403ed5a0
mov rax, qword [rdi - 8]
jmp 0x1403ed57c
add rdi, 0xfffffffffffffff8
cmp r10b, r12b
test r10b, 0x13
sub rdi, rax
cmp rdi, 0x20
jmp 0x1403ed593
jae 0x1403ed60a
add rdx, 0x27
mov rdi, rax
mov rcx, rdi
jmp 0x1403ed5a8
call fcn.1401d61ed
xorps xmm0, xmm0
movups xmmword [r14], xmm0
mov qword [r14 + 0x10], 0
jmp 0x1403ed5c4
movaps xmm6, xmmword [rsp + 0x20]
add di, 0x42c
rol rdi, cl
bt r15w, 0xbe
add rsp, 0x30
movzx r14w, cl
setle r15b
pop rbx
mov r14b, 0xf
not r15w
movsx r14, r12w
pop rdi
pop rsi
movzx r15d, r10w
pop r14
movsx r15w, r11b
movzx r15w, dil
pop r15
jmp 0x1403ed609
ret
call fcn.1404b907c
int3
Function at 0x1403f48cb
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r14
shrd ax, r12w, 0xb2
or r14w, r12w
btr ax, 0x68
push rsi
push rdi
sbb si, 0x1b3b
shrd r14, rcx, 0x67
shr r14d, 0x6d
push rbx
sub rsp, 0x28
rcl bl, cl
mov rbx, rdx
rcr ah, 3
and rax, 0x627a1f69
inc sil
mov r14, rcx
or ax, 0x773f
movsx esi, bp
lea rsi, [rdx + r8]
adc al, sil
xor al, r11b
mov eax, dword [rcx + 8]
test r15b, r13b
jmp 0x1403f4922
test al, 2
jmp 0x1403f4929
jne 0x1403f49d5
mov dil, 1
test bpl, 0x88
stc
test al, 4
jmp 0x1403f493e
je 0x1403f4b1a
lea rax, [rbx + 1]
cmc
cmp rax, rsi
jmp 0x1403f4951
ja 0x1403f4b10
mov byte [rbx], 0x12
mov rcx, qword [r14 + 0x40]
cmp r8w, 0x5b81
stc
cmp rcx, 0x80
jmp 0x1403f4971
jb 0x1403f4ac8
nop word cs:[rax + rax]
movsxd rdx, edi
lea rdx, [rax + 1]
test r13w, bp
cmc
cmp rdx, rsi
ja 0x1403f4b10
mov ebx, ecx
jmp 0x1403f49a0
or bl, 0x80
test bl, r8b
mov byte [rax], bl
mov rbx, rcx
shr rbx, 7
btr ax, r15w
mov rax, rdx
test r8, rbp
stc
cmp rcx, 0x3fff
mov rcx, rbx
jmp 0x1403f49ca
ja 0x1403f4984
jmp 0x1403f4ad8
test r8, r8
jmp 0x1403f49dd
jle 0x1403f4b10
mov byte [rbx], 0xa
movzx cx, r9b
inc rbx
stc
mov rcx, qword [r14 + 0x20]
test bh, 0xb9
cmp rcx, 0x80
jmp 0x1403f4a02
jb 0x1403f4a6e
nop dword [rax + rax]
lea rax, [rbx + 1]
cmc
cmp r15, 0x34725080
test dx, r13w
cmp rax, rsi
jmp 0x1403f4a28
ja 0x1403f4b10
mov edx, ecx
cmp sil, 0x9a
or dl, 0x80
test r9b, 0xdd
mov byte [rbx], dl
sub dh, ah
bts ebx, r12d
mov rdx, rcx
movsxd rbx, r9d
shr rdx, 7
mov rbx, rax
cmp r10b, 0x59
cmp rcx, 0x3fff
mov rcx, rdx
jmp 0x1403f4a63
ja 0x1403f4a10
jmp 0x1403f4a7a
mov rax, rbx
ror dx, 0xdd
mov rdx, rcx
xchg ch, ch
lea rcx, [rax + 1]
cmc
cmp rcx, rsi
jmp 0x1403f4a87
ja 0x1403f4b10
mov byte [rax], dl
mov r8, qword [r14 + 0x20]
test r9b, 0x1e
lea rbx, [rcx + r8]
jmp 0x1403f4aa1
cmp rbx, rsi
jmp 0x1403f4aa9
ja 0x1403f4b10
cmp qword [r14 + 0x28], 0x10
jmp 0x1403f4ab9
jb 0x1403f4b49
mov rdx, qword [r14 + 0x10]
jmp 0x1403f4b4d
mov rdx, rax
cmovae ebx, eax
and rbx, 0xa2d3b0f
mov rbx, rcx
lea rcx, [rdx + 1]
cmp r8d, esi
test spl, r8b
cmp rcx, rsi
jmp 0x1403f4aea
ja 0x1403f4b10
mov byte [rdx], bl
not r8
mov r8, qword [r14 + 0x40]
cwde
test r14w, bp
lea rax, [rcx + r8]
cmp rax, rsi
jmp 0x1403f4b0a
jbe 0x1403f4b5b
xor edi, edi
add sil, 0xa
movsx rax, r8w
mov eax, edi
rcl si, cl
sar rbx, cl
add rsp, 0x28
not r14w
movsxd rdi, ecx
movzx rsi, r11w
pop rbx
movsx edi, r11w
movzx si, dl
xchg r14, rdi
pop rdi
pop rsi
mov r14b, 0x73
movzx r14d, sp
pop r14
ret
lea rdx, [r14 + 0x10]
call fcn.1404a64ba
mov eax, dword [r14 + 8]
jmp 0x1403f492f
cmp qword [r14 + 0x48], 0x10
jb 0x1403f4b74
mov r14, qword [r14 + 0x30]
jmp 0x1403f4b6f
jmp 0x1403f4b7b
add r14, 0x30
movsx edx, cx
mov rdx, r14
jmp 0x1403f4b83
call fcn.1404a64ba
jmp 0x1403f4b1a
Function at 0x1403f8b42
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
push r14
shrd r14d, r8d, 0xb5
btc r14w, 0x84
cmp r13b, 0xeb
push r12
sal r14w, 0x55
btr r14d, 0xc2
push rsi
push rdi
sbb r14b, r15b
push rbx
bsf r14w, di
dec r14b
btc r14w, r13w
sub rsp, 0x28
sal r14d, 0x17
bt r14d, r13d
jmp 0x1403f8b85
mov r14, r8
test rdx, rdx
jmp 0x1403f8b90
je 0x1403f8d79
mov rdi, rdx
mov r12, rcx
xor ebx, ebx
jmp 0x1403f8ba3
jmp 0x1403f8bd8
mov rcx, r15
xchg dh, dl
not dh
movzx dx, r14b
mov rdx, rsi
jmp 0x1403f8bbc
call fcn.1403bdd70
add rbx, 0x50
jmp 0x1403f8bca
dec rdi
jmp 0x1403f8bd2
je 0x1403f8d6b
mov eax, dword [r12 + rbx + 8]
stc
jmp 0x1403f8be8
mov dword [r14 + rbx + 8], eax
jmp 0x1403f8bf5
cmp r14, r12
je 0x1403f8bc1
cmp qword [r12 + rbx + 0x28], 0x10
jb 0x1403f8c14
mov r9, qword [r12 + rbx + 0x10]
jmp 0x1403f8c28
lea r9, [r12 + rbx]
cbw
bts rsi, rbp
add r9, 0x10
cwde
movsx ax, sil
lea r15, [r14 + rbx]
add r15, 0x10
sar esi, 9
shl rsi, cl
mov rsi, qword [r12 + rbx + 0x20]
shrd eax, r14d, 0x8b
mov rax, qword [r14 + rbx + 0x28]
cmp rax, rsi
jmp 0x1403f8c4d
jae 0x1403f8c75
mov rcx, r15
bswap dx
movsx dx, r15b
jmp 0x1403f8c63
mov rdx, rsi
jmp 0x1403f8c6b
call fcn.1403bdd70
jmp 0x1403f8cbc
cmp rax, 0x10
jmp 0x1403f8c7e
jb 0x1403f8c8d
mov r15, qword [r14 + rbx + 0x10]
mov r8w, r8w
mov qword [r14 + rbx + 0x20], rsi
cqo
mov rcx, r15
movzx rdx, r13w
mov rdx, rbp
mov rdx, r9
mov r8, rsi
jmp 0x1403f8ca9
call fcn.1404a64ba
mov byte [r15 + rsi], 0
clc
neg si
bts si, r14w
mov rsi, qword [r12 + rbx + 0x40]
jmp 0x1403f8cc6
cmp qword [r12 + rbx + 0x48], 0x10
jb 0x1403f8cdc
mov r9, qword [r12 + rbx + 0x30]
jmp 0x1403f8cf6
lea r9, [r12 + rbx]
movzx eax, r14w
add r9, 0x30
and ah, 0x83
movzx eax, r15w
mov rax, 0x5ce90186
lea r15, [r14 + rbx]
sub rax, 0x8d225d6
xadd ah, al
and al, r9b
add r15, 0x30
sbb ah, 0x6d
xor ax, dx
mov rax, qword [r14 + rbx + 0x48]
jmp 0x1403f8d1b
cmp rax, rsi
jmp 0x1403f8d23
jb 0x1403f8ba8
cmp rax, 0x10
jmp 0x1403f8d32
jb 0x1403f8d46
mov r15, qword [r14 + rbx + 0x30]
xchg cl, dl
movsx rcx, r10w
not r8
mov qword [r14 + rbx + 0x40], rsi
cmovno edx, edx
mov rcx, r15
mov rdx, r9
mov r8, rsi
call fcn.1404a64ba
mov byte [r15 + rsi], 0
jmp 0x1403f8d66
jmp 0x1403f8bc1
add r14, rbx
btc ax, 0x78
xchg dil, al
dec si
mov rax, r14
shl dil, 0xdd
cmp r15w, bp
add rsp, 0x28
jmp 0x1403f8d95
pop rbx
cmovbe r14w, r9w
mov si, 0x36b5
movsxd r12, ecx
pop rdi
xchg r14d, esi
jmp 0x1403f8daf
pop rsi
cmovg r14d, edx
movsx r14, di
jmp 0x1403f8dbd
pop r12
not r14b
setge r15b
movsx r14w, dil
pop r14
pop r15
jmp 0x1403f8dd4
ret
Function at 0x14042e95f
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rsi
xor si, r8w
movsx esi, r14w
push rdi
xor di, 0x74e4
btr si, bp
sub rsp, 0x28
movsxd rsi, edx
and si, r11w
mov rsi, rcx
cmova rdi, r12
movzx edi, dx
cwd
and dl, 0x78
movzx edx, word [rcx + rdi*4 + 0x834]
test dx, dx
jmp 0x14042e99c
js 0x14042e9af
mov rcx, rsi
jmp 0x14042e9aa
call fcn.14042e95f
movsxd rcx, dword [rsi + 0x8860]
cmp ecx, dword [rsi + 0x8858]
jmp 0x14042e9c1
jge 0x14042eb63
movsxd rax, dword [rsi + 0x885c]
shl rdx, cl
add rax, rcx
mov r8, qword [rsi + 8]
movzx rcx, r10w
rol ecx, 0xf2
adc dl, 0x59
lea edx, [rax + 3]
test eax, eax
cmovle rcx, rdi
movsx cx, r11b
cmovns edx, eax
mov rcx, qword [rsi + 0x18]
cmc
cmp di, 0x7ed2
sar edx, 2
movsxd rdx, edx
clc
mov byte [rcx + rdx], 1
sbb dh, 0xe4
movsx edx, dx
btr dx, 0x19
mov rdx, qword [rsi + 0x8838]
movzx edi, byte [rsi + rdi*4 + 0x837]
cmp byte [rdx + rdi*4 + 3], 0x81
jmp 0x14042ea2c
jb 0x14042ea80
movzx ecx, byte [rdx + rdi*4 + 2]
test r8b, r8b
mov byte [r8 + rax], cl
movzx ecx, byte [rdx + rdi*4 + 1]
cmc
jmp 0x14042ea4d
mov byte [r8 + rax + 1], cl
bsf ecx, r9d
bsr cx, bx
cmp r8w, 0x7e9
movzx ecx, byte [rdx + rdi*4]
mov byte [r8 + rax + 2], cl
shld rcx, rax, 0xc8
ror cl, cl
shl ch, cl
movzx ecx, byte [rdx + rdi*4 + 3]
mov byte [r8 + rax + 3], cl
clc
bswap ax
mov eax, dword [rsi + 0x885c]
jmp 0x14042ea93
add eax, 4
mov dword [rsi + 0x885c], eax
stc
test r15w, r15w
cmc
cmp eax, dword [rsi + 0x8854]
jmp 0x14042eaad
jl 0x14042eb63
mov ecx, dword [rsi + 0x884c]
shl rax, cl
stc
and al, r10b
mov eax, dword [rsi + 0x8858]
test r12b, bpl
jmp 0x14042eace
mov dword [rsi + 0x885c], ecx
jmp 0x14042ead9
mov ecx, dword [rsi + 0x8860]
jmp 0x14042eae6
add ecx, dword [rsi + 0x8844]
mov dword [rsi + 0x8860], ecx
cmp ecx, eax
jmp 0x14042eaf9
jl 0x14042eb63
mov ecx, dword [rsi + 0x8840]
test r9w, bp
nop dword [rax]
cmp edi, eax
test ecx, ecx
jmp 0x14042eb19
jle 0x14042eb63
mov edx, dword [rsi + 0x8864]
clc
cmp ah, 0x51
shl edx, cl
clc
mov dword [rsi + 0x8844], edx
jmp 0x14042eb37
sar edx, 1
add edx, dword [rsi + 0x8850]
mov dword [rsi + 0x8860], edx
jmp 0x14042eb4a
dec ecx
cmc
test sil, sil
mov dword [rsi + 0x8840], ecx
cmp edx, eax
jmp 0x14042eb5d
jge 0x14042eb12
add rsp, 0x28
movsxd rsi, r12d
bswap rsi
pop rdi
movzx rsi, r15w
cmovns rsi, r11
pop rsi
jmp 0x14042eb7c
ret
Function at 0x140437ebc
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
push r14
setnp r15b
push rsi
movzx r15w, r9b
push rdi
rcl r15b, cl
push rbx
mov r15b, 0xdd
sub rsp, 0x20
movsx r15d, di
not r15w
mov r15, 0x16ef59b2
mov r15, rcx
xorps xmm0, xmm0
movups xmmword [rcx], xmm0
adc al, r12b
mov qword [rcx + 0x10], 0
ror bh, cl
mov rcx, qword [rdx + 8]
movsxd rbx, r14d
stc
cmp bx, 0x7794
mov rax, qword [rdx]
mov rbx, rcx
sub rbx, rax
sub rcx, rax
jmp 0x140437f19
je 0x140438043
js 0x140438076
mov r14, rdx
test r12b, al
sar rbx, 6
stc
test r11w, 0x557c
test sil, spl
cmp rcx, 0xfc1
jmp 0x140437f45
jb 0x140437f74
or rcx, 0x27
jmp 0x140437f54
call fcn.14044ae17
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
jmp 0x140437f66
mov qword [rdi - 8], rax
jmp 0x140437f6f
jmp 0x140437f82
call fcn.14044ae17
mov rdi, rax
movsxd rsi, edi
shl sil, cl
mov qword [r15], rdi
movzx si, r8b
xor rsi, 0x54321bdb
stc
mov qword [r15 + 8], rdi
movzx rsi, sp
cmovb si, sp
shl rbx, 6
adc si, r8w
rol rsi, 0x71
stc
add rbx, rdi
mov qword [r15 + 0x10], rbx
not bh
bswap rsi
setno sil
mov rbx, qword [r14]
movzx rsi, si
mov rsi, qword [r14 + 8]
jmp 0x140437fec
add rdi, 0x40
jmp 0x140437fde
add rbx, 0x40
clc
test rsi, 0x4a224c8f
cmp esp, eax
cmp rbx, rsi
jmp 0x140437ff4
je 0x140438039
mov qword [rdi + 0x38], 0
cmovg ecx, r9d
sal ecx, 0x3a
mov rcx, qword [rbx + 0x38]
test rcx, rcx
jmp 0x140438015
je 0x140437fcb
mov rax, qword [rcx]
xchg dh, dh
mov dx, di
movsx edx, si
mov rdx, rdi
call qword [rax]
mov qword [rdi + 0x38], rax
jmp 0x140438034
jmp 0x140437fcb
mov qword [r15 + 8], rdi
rcl bl, 0xf2
movsxd rax, edx
mov rax, r15
rcr r15b, cl
bsr r14d, r15d
add rsp, 0x20
pop rbx
mov r14b, r15b
bswap rsi
cmovl si, r14w
pop rdi
pop rsi
pop r14
jmp 0x14043806e
pop r15
jmp 0x140438075
ret
call fcn.1403be6ab
int3
Function at 0x140438081
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r14
stc
clc
push rsi
btc esi, eax
bsf esi, ebx
mov sil, 0x58
push rdi
btr edi, edx
movsx si, r14b
push rbx
bsf si, ax
movsx edi, bx
bswap si
sub rsp, 0x28
xor dil, spl
mov rsi, rcx
mov rdi, qword [rcx + 0x28]
cmp ecx, r15d
cmp ax, 0x7b51
test rdi, rdi
je 0x1404381bb
lea r14, [rsi + 0x28]
mov rbx, qword [rsi + 0x30]
cmc
test r8w, ax
cmp r15b, sil
cmp rdi, rbx
jmp 0x1404380d9
jne 0x1404380f4
jmp 0x140438133
add rdi, 0x40
test spl, r14b
cmp rdi, rbx
je 0x140438130
mov rcx, qword [rdi + 0x38]
cmc
test rcx, rcx
jmp 0x140438101
je 0x1404380e4
cmp rdi, rcx
setne dl
movsx rax, bp
bswap ax
movzx rax, cx
mov rax, qword [rcx]
call qword [rax + 0x20]
mov qword [rdi + 0x38], 0
jmp 0x14043812b
jmp 0x1404380e4
mov rdi, qword [r14]
mov rdx, qword [rsi + 0x38]
test esp, r11d
clc
sub rdx, rdi
cmp rdx, 0x1000
jmp 0x14043814a
jb 0x140438191
mov rax, qword [rdi - 8]
jmp 0x14043815f
add rdi, 0xfffffffffffffff8
test r13b, 0x74
cmp r11, 0x7ed1595c
stc
sub rdi, rax
cmp rdi, 0x20
jmp 0x14043817b
jae 0x140438203
or rdx, 0x27
movsx di, bl
mov rdi, rax
jmp 0x140438191
mov rcx, rdi
jmp 0x140438199
call fcn.1401d61ed
xorps xmm0, xmm0
movups xmmword [r14], xmm0
movzx ecx, r10w
movsx cx, ch
mov qword [r14 + 0x10], 0
shr cl, 0x82
rcr rcx, cl
mov rcx, qword [rsi + 0x10]
cmp r11b, 0xce
test rcx, rcx
jmp 0x1404381cb
je 0x1404381e3
mov rax, qword [rcx]
call qword [rax + 0x10]
mov qword [rsi + 0x10], 0
cmc
test ax, si
add rsp, 0x28
pop rbx
movzx r14, dx
movzx r14d, r11w
not dil
pop rdi
not si
pop rsi
not r14
pop r14
jmp 0x140438202
ret
call fcn.1404b907c
int3
Function at 0x140441f8c
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
rcl ax, cl
sal eax, cl
adc al, 0x24
push r14
add ax, 0x6f1
push rsi
clc
shr al, cl
push rdi
and al, dh
cmc
push rbp
rcr eax, 0x96
push rbx
ror ax, cl
xor rax, r13
cmc
sub rsp, 0x78
cmovo esi, r13d
movsxd rsi, edi
movaps xmmword [rsp + 0x60], xmm8
cwde
movaps xmmword [rsp + 0x50], xmm7
movsx esi, r8w
cbw
movzx eax, sp
movaps xmmword [rsp + 0x40], xmm6
movsx rsi, r10w
mov rax, qword [rcx]
mov esi, dword [rax + 0x10]
jmp 0x140441fe3
xorps xmm0, xmm0
movlps qword [rsp + 0x28], xmm0
movlps qword [rsp + 0x34], xmm0
mov dword [rsp + 0x3c], 0
test esi, esi
jmp 0x140441fff
jle 0x140442205
movaps xmm7, xmm2
movsx r15w, r11b
cmovb r15w, sp
movzx r15, di
movaps xmm8, xmm1
movsx r15d, sp
movzx r15w, bpl
mov r15, rcx
jmp 0x14044202b
xorps xmm6, xmm6
xor edi, edi
mov dx, 0x2a27
lea r14, [rsp + 0x28]
movsx r8d, bx
xchg r8b, r8b
nop word cs:[rax + rax]
not cl
movsx ecx, cx
mov dl, r11b
mov rcx, r14
mov r8w, 0x1259
movsx rdx, cx
mov rdx, r15
mov r8b, r14b
not r8b
mov r8d, edi
jmp 0x140442072
call fcn.140441c95
mov ebx, dword [rsp + 0x3c]
test ebx, ebx
jmp 0x140442082
jle 0x140442205
test edi, edi
jmp 0x14044208f
jne 0x1404420ad
movss xmm0, dword [rsp + 0x34]
jmp 0x1404420a0
addss xmm0, xmm6
ucomiss xmm0, xmm7
ja 0x140442203
movss xmm0, dword [rsp + 0x38]
jmp 0x1404420b8
addss xmm0, xmm6
ucomiss xmm0, xmm7
ja 0x1404420e4
add edi, ebx
jmp 0x1404420cc
addss xmm6, dword [rsp + 0x30]
cmp edi, esi
jmp 0x1404420d9
jl 0x140442055
jmp 0x140442205
movss xmm6, dword [rsp + 0x28]
jmp 0x1404420ef
ucomiss xmm6, xmm8
jbe 0x140442105
mov esi, edi
jmp 0x140442100
jmp 0x140442205
movss xmm0, dword [rsp + 0x2c]
jmp 0x140442110
ucomiss xmm0, xmm8
jbe 0x140442195
xor ebp, ebp
seto dh
mov esi, edi
movaps xmm7, xmm6
movzx dx, dil
xchg r8b, r8b
nop word cs:[rax + rax]
mov r8w, 0x2d0c
movzx r8, r9w
mov rcx, r15
xchg dx, r8w
mov edx, edi
xchg r8d, r8d
mov r8d, ebp
jmp 0x140442155
call fcn.14044248b
addss xmm7, xmm0
ucomiss xmm7, xmm8
ja 0x140442246
inc ebp
jmp 0x14044216f
inc esi
cmp sil, r10b
jmp 0x14044217c
movaps xmm6, xmm7
test r8w, 0x761b
test ch, dl
stc
cmp ebx, ebp
jmp 0x14044218f
jne 0x140442141
test byte [r15 + 0x1c], 4
jmp 0x14044219f
jne 0x1404421f0
lea esi, [rbx + rdi]
cmovo ax, r11w
dec esi
test spl, 2
lahf
mov rax, qword [r15]
btc ecx, ebx
not cx
movsxd rcx, esi
cmp qword [rax + 0x10], rcx
jmp 0x1404421c9
jbe 0x140442268
cmp qword [rax + 0x18], 8
jmp 0x1404421d9
jb 0x1404421e5
mov rax, qword [rax]
cmp r15b, r8b
cmp word [rax + rcx*2], 0xa
je 0x140442205
add ebx, edi
movsx si, r9b
mov esi, ebx
jmp 0x1404421fe
jmp 0x140442205
sub esi, esi
mov eax, esi
xchg r15w, si
cmp r8w, 0x41c0
movaps xmm6, xmmword [rsp + 0x40]
bswap r14d
movaps xmm7, xmmword [rsp + 0x50]
adc r15b, 0x37
bt si, 0x14
movaps xmm8, xmmword [rsp + 0x60]
add rsp, 0x78
movsx rbx, r15w
pop rbx
pop rbp
pop rdi
pop rsi
jmp 0x140442241
pop r14
pop r15
ret
mulss xmm0, dword [0x1400bd480]
addss xmm6, xmm0
ucomiss xmm6, xmm8
ja 0x140442205
inc esi
jmp 0x140442263
jmp 0x140442205
call fcn.140442624
int3
Function at 0x140447116
Capabilities:
Log keystrokes via polling

Disassembly:
sub rsp, 0x28
jmp 0x14044711f
movzx ecx, cx
call qword [sym.imp.USER32.dll_GetKeyState]
movzx eax, ax
test r13b, 0xb1
cmp eax, 0x100
mov al, bpl
setae al
clc
jmp 0x140447143
add rsp, 0x28
jmp 0x14044714c
ret

Function at 0x1404488bc
Capabilities:
Access peb ldr_data
Encrypt data using speck

Disassembly:
sub rsp, 0x28
mov rcx, qword [rcx]
bswap ax
movsxd rax, r11d
mov rax, qword [rcx]
jmp 0x1404488d1
call qword [rax + 0x28]
test eax, eax
jmp 0x1404488db
je 0x140448917
mov ecx, eax
shrd r8, r12, 0x7b
btc r8, 0x8d
test ah, 0xae
movabs r8, 0xcafa59766d7f94e
mov dl, 3
sar r9b, 0xdb
clc
mov r9d, 0x2a
cmc
clc
add rsp, 0x28
jmp 0x140448912
jmp fcn.1403b22f3
nop
add rsp, 0x28
jmp 0x140448921
ret