joyce8/EMBER2024-capa huggingface dataset:
Function at 0x494b00
Capabilities:
Hash data using fnv

Disassembly:
mov rax, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov edx, dword [rsp + 8]
xor ebx, ebx
jmp 0x494b21
movzx esi, byte [rax + rbx]
inc rbx
imul edx, edx, 0x1000193
xor edx, esi
cmp rcx, rbx
jg 0x494b12
mov dword [rsp + 0x28], edx
ret

Function at 0x4b30e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x4b3226
sub rsp, 0x18
mov qword [rsp + 0x10], rbp
lea rbp, [rsp + 0x10]
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x4b31ed
mov rdx, qword [rsp + 0x38]
nop dword [rax + rax]
cmp rcx, rdx
ja 0x4b3220
mov rdx, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x40]
cmp rdx, rbx
jne 0x4b31b4
mov rsi, qword [rsp + 0x20]
movzx edi, byte [rsi + 0x400]
movzx r8d, byte [rsi + 0x401]
lea rax, [rcx - 1]
mov r9, qword [rsp + 0x30]
cmp rax, r9
jae 0x4b31f7
xor eax, eax
jmp 0x4b3197
movzx r9d, byte [rbx + rax]
inc edi
movzx r10d, dil
mov r11d, dword [rsi + r10*4]
add r8d, r11d
movzx r12d, r8b
mov r13d, dword [rsi + r12*4]
mov dword [rsi + r10*4], r13d
mov dword [rsi + r12*4], r11d
lea r10d, [r11 + r13]
movzx r10d, r10b
xor r9d, dword [rsi + r10*4]
mov byte [rdx + rax], r9b
inc rax
cmp rcx, rax
jg 0x4b3162
mov byte [rsi + 0x400], dil
mov byte [rsi + 0x401], r8b
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
nop
mov rsi, rdx
lea rdi, [rcx + rbx]
lea rdi, [rdi - 1]
cmp rdx, rdi
ja 0x4b31e5
mov rdx, rbx
lea rdi, [rcx + rsi]
lea rdi, [rdi - 1]
cmp rbx, rdi
jbe 0x4b31ff
mov rbx, rdx
mov rdx, rsi
nop dword [rax + rax]
jmp 0x4b3138
mov rdx, rsi
jmp 0x4b3138
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
mov rcx, r9
call fcn.00466e00
lea rax, [0x004e0c20]
mov qword [rsp], rax
lea rax, [0x0052da28]
mov qword [rsp + 8], rax
call fcn.00435ce0
nop dword [rax + rax]
call fcn.00466e80
nop
call fcn.00464c20
jmp fcn.004b30e0
Function at 0x1400072b0
Capabilities:
Access peb ldr_data
Encrypt data using speck
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x2e8
movaps xmmword [rsp + 0x2d0], xmm6
movabs r12, 0xcbf29ce484222325
movabs r14, 0x1d12a89b9e723ff5
lea rcx, [0x1400ce915]
jmp 0x1403ad930

Function at 0x140008210
Capabilities:
Access peb ldr_data
Encrypt data using speck
Get kernel32 base address
Parse pe header

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x38
movabs r14, 0xcbf29ce484222325
lea rcx, [0x1400ce987]
jmp 0x1403af4da

Function at 0x140034380
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x7a8
movaps xmmword [rsp + 0x790], xmm6
mov qword [rsp + 0x60], rcx
lea rcx, [0x1400cea2b]
jmp fcn.1403fb042

Function at 0x1400ec79a
Capabilities:
Encode data using base64

Disassembly:
jmp fcn.1404e170d
push rbx
and al, bh
shrd ax, di, 0x1d
sub rsp, 0x20
adc r9w, r8w
test r8, r8
mov r9b, dil
mov bh, 0x88
movsxd rbx, r15d
movzx r9d, dx
lea rbx, [0x1400bae30]
mov edx, 0x2400
mov al, 0x4c
not ax
cmovne rbx, r8
shl ah, cl
stc
or al, r9b
mov eax, 0x3ff
add edx, r9d
cmp dword [rbx], 0
jmp 0x1404e6dcc
jne 0x1404e6e77
cmp dx, ax
jmp 0x1404e6dda
ja 0x1404e6e02
and qword [rbx], 0
jmp 0x1404e6de9
call fcn.1404b575b
mov dword [rax], 0x2a
or rax, 0xffffffffffffffff
jmp 0x1404e6dfd
jmp 0x1404e6ec9
mov r8d, 0x2800
dec dx
movsx rdx, di
mov edx, r9d
stc
cmp dx, 0x721c
add r9w, r8w
test r14b, r9b
cmp r9w, ax
jmp 0x1404e6e28
ja 0x1404e6e58
shl edx, 0xa
jmp 0x1404e6e36
and edx, 0xfc9ffc00
test r15, 0x1de95ce8
add edx, 0x10000
cmc
mov dword [rbx], edx
sub eax, eax
jmp 0x1404e6e53
jmp 0x1404e6ec9
mov r8, rbx
cmp r14b, dil
inc ebx
add rsp, 0x20
movsx rbx, r13w
movzx ebx, r13w
pop rbx
jmp 0x1404e6e72
jmp 0x1400ec79a
cmp dx, ax
jmp 0x1404e6e7f
ja 0x1404e6de0
and qword [rsp + 0x40], 0
movsxd rdx, esi
movzx r8d, di
lea r8, [rsp + 0x40]
and dx, 0x6081
movzx edx, r10w
mov edx, r9d
test r12b, bpl
clc
stc
and edx, 0xffff23ff
add edx, dword [rbx]
jmp 0x1404e6eb5
call 0x1400ec79a
and qword [rbx], 0
movsx rbx, r10w
xadd bx, bx
cmp rdi, r15
add rsp, 0x20
bswap bx
xchg rbx, rbx
pop rbx
ret
Function at 0x14012b30b
Capabilities:
Enumerate pe sections

Disassembly:
je 0x140205e30
mov edx, dword [rax + 0xc]
cmp r10, rdx
jmp 0x140284cb5
jb 0x140216aeb
inc r9d
clc
cmc
add rax, 0x28
cmp r9d, r11d
jmp 0x140205e2a
movsxd r8, dword [rcx + 0x3c]
cmc
sub r9d, r9d
bt r10d, esp
xchg r10w, ax
sbb r11b, 0xc8
lea r8, [r8 + rcx]
sbb eax, eax
or r10b, spl
mov r10, rdx
sub r11b, 0x3d
ror ax, cl
movzx eax, word [r8 + 0x14]
mov r11b, 0x26
and r11d, 0x2f0a3baf
movzx r11d, word [r8 + 6]
add rax, 0x18
stc
add rax, r8
stc
test r11d, r11d
jmp 0x14010da0a
jb 0x14010da10
xor eax, eax
jmp 0x140216aeb
ret
jb 0x1401251df
mov ecx, dword [rax + 8]
add ecx, edx
stc
cmp r10, rcx
jmp 0x1401251d9
Function at 0x1401b2bfc
Capabilities:
Parse pe header

Disassembly:
jmp 0x1404b130d
sub r8d, r8d
stc
clc
sub edx, edx
jmp 0x1400fe3f2

Function at 0x1401e024b
Capabilities:
Parse pe header

Disassembly:
jmp 0x1404b130d
xor r8d, r8d
movsx dx, ah
movzx edx, r13w
movsx edx, bx
lea edx, [r8 + 2]
jmp 0x1401d48d5
mov qword [rsp + 8], rbx
mov dword [rsp + 0x18], r8d
seto bh
xchg rbx, rbx
mov dword [rsp + 0x10], edx
btc rbx, r14
push rbp
mov rbp, rsp
rol ebx, cl
movsx ebx, bp
sub rsp, 0x50
movzx rbx, r12w
mov ebx, ecx
test r13b, r12b
stc
test r8d, r8d
jmp 0x1404b1344
jne 0x1404b13dc
xor ecx, ecx
jmp 0x1404b1351
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
jmp 0x1404b135f
je 0x1404b13dc
mov ecx, 0x5a4d
cmp word [rax], cx
jmp 0x1404b1372
jne 0x1404b13dc
movsxd rcx, dword [rax + 0x3c]
cmp r15, rsi
lea rcx, [rcx + rax]
test r8, r13
cmp dword [rcx], 0x4550
jmp 0x1404b1391
jne 0x1404b13dc
mov eax, 0x20b
test esi, 0x7b9f4ef2
cmp word [rcx + 0x18], ax
jne 0x1404b13dc
cmp dword [rcx + 0x84], 0xe
jmp 0x1404b13b8
jbe 0x1404b13dc
cmp dword [rcx + 0xf8], 0
jmp 0x1404b13ca
je 0x1404b13dc
mov ecx, ebx
jmp 0x1404b13d7
call fcn.1404b11ce
lea rax, [rbp + 0x18]
movsxd rcx, esi
mov byte [rbp + 0x28], 0
mov qword [rbp - 0x20], rax
movzx eax, di
lea r9, [rbp - 0x2c]
cwd
bswap cx
lea rax, [rbp + 0x20]
mov qword [rbp - 0x18], rax
lea r8, [rbp - 0x20]
cmova ax, r14w
cdq
lea rax, [rbp + 0x28]
mov qword [rbp - 0x10], rax
rdtsc
movsx rax, r10w
cdqe
lea rdx, [rbp - 0x28]
cwde
movsx rax, sp
mov cx, ax
mov eax, 2
not rcx
movsxd rcx, r10d
movsx ecx, ax
lea rcx, [rbp - 0x30]
jmp 0x1404b143c
mov dword [rbp - 0x2c], eax
jmp 0x1404b1444
mov dword [rbp - 0x28], eax
jmp 0x1404b144c
call fcn.1404b1601
cmp dword [rbp + 0x20], 0
jmp 0x1404b145a
je 0x1404b1478
mov rbx, qword [rsp + 0x60]
bsr rbp, rcx
bts bp, r12w
movsx rbp, di
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
jmp 0x1404b147f
call fcn.1404b1278
int3
Function at 0x1401e35f9
Capabilities:
Access peb ldr_data

Disassembly:
cmovb r8, rdx
test ax, ax
jmp 0x1400f7532
mov rax, qword gs:[0x30]
mov rax, qword [rax + 0x60]
add r9, 0x403501f3
mov r8, 0x375959e2
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
movzx r8d, word [rax + 0x58]
btr r9w, r15w
cmp r8, rdx
movsx r9d, r14w
cmovae r8, rdx
mov r9, qword [rax + 0x60]
bsr r11d, ebx
movzx r11d, word [r9]
sbb r10w, 0x3cdf
lea r10, [0x1400b8f10]
test r11, 0x53664cdd
cmc
test r11w, r11w
jmp 0x14018bdfb
je 0x140241b11
xor edx, edx
lea r9, [0x1400b8f10]
cmp r8, rdx
je 0x140241b1a
mov word [rcx], ax
sar ax, 0x5e
add rcx, 2
movzx eax, word [r9 + rdx*2 + 2]
inc rdx
cmc
test ax, ax
jmp 0x140241b08
cmovb r8, rdx
jmp 0x14020ad28
jne 0x14018be13
sub r8, rax
test r8, r8
je 0x14012d50c
mov word [r10], 0
bt rax, rbx
movzx eax, word [0x1400b8f10]
stc
cmp rdx, 0x104
mov r8b, r14b
movsx r8w, dl
bswap r8d
mov r8d, 0x104
jmp 0x1400f2781
je 0x14012d502
mov word [r10], r11w
xchg r11b, r11b
add r10, 2
dec r11b
movsx r11d, sp
setb r11b
movzx r11d, word [r9 + rax*2 + 2]
jmp 0x1402588d8
je 0x1400f6c70
cmp rdx, 0x104
movzx r8, si
bswap r8w
mov r8w, 0x293f
mov r8d, 0x104
jmp 0x140112cb5
je 0x14012d4f9
xor eax, eax
cmp edx, edx
test eax, edi
test esi, 0x79c55cdd
nop word [rax + rax]
cmp r8, rax
jmp 0x14017e49f
movzx eax, word [0x1400b8f10]
test ax, ax
jmp 0x140189def
jmp 0x1400f7538
jne 0x1400f7541
sub r8, rdx
test r8, r8
je 0x140241b1f
mov word [rcx], 0
ret
inc rax
test dh, 0x1c
test r11w, r11w
jmp 0x14012d4f0

Function at 0x1401e7b28
Capabilities:
Parse pe header

Disassembly:
xor eax, eax
ret
jne 0x140119c18
sub eax, eax
sub cl, r14b
shr rcx, 2
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
xchg al, al
sete al
sete al
jmp 0x14020ec3a
mov eax, 0x5a4d
cmp r14b, 0xc9
test r15b, al
cmp word [rcx], ax
jne 0x140119c18
movsxd rdx, dword [rcx + 0x3c]
cmc
cmp r8, r12
lea rdx, [rdx + rcx]
cmc
stc
cmp bh, 0x56
cmp dword [rdx], 0x4550
jmp 0x14019ab9e
ret
Function at 0x14020833c
Capabilities:
Encrypt data using rc4 prga

Disassembly:
jne 0x140283344
mov byte [r11 + rcx*4 + 3], 0
movsx r10, r15w
movzx r10d, byte [rdx]
jmp 0x140210960
mov byte [r11 + rcx*2 + 1], al
inc rcx
cmp r9d, ecx
jmp 0x140124c67
je 0x1400f65ef
lea ecx, [r9 - 1]
cmp ecx, 3
jmp 0x1401e01f4
ret
cmp al, byte [rdx + 1]
jmp 0x14012c90c
jne 0x140234770
jmp 0x1400f65ef
jne 0x140243d25
test r9d, r9d
jmp 0x1400ef406
jne 0x140283344
movzx eax, byte [r11 + rcx*4 + 2]
cmp al, r8b
cmp r12w, 0x3987
cmp al, byte [rdx + 2]
jmp 0x1400e00a6
jb 0x14023474c
mov r8d, r9d
rcl cl, 0xfd
sbb r10w, 0x7f2
and r8d, 0xfffffffc
add cl, 0xe
sub r10w, r15w
nop word cs:[rax + rax]
or r10b, 0x74
movzx ecx, byte [r11]
stc
rcl r10b, 0xa0
cmp cl, byte [rdx]
movzx r10d, byte [r11 + 2]
setne cl
cmc
stc
neg cl
mov byte [r11 + 1], cl
and cl, r12b
shl cl, cl
cmp r10b, byte [rdx]
jmp 0x1401e1c98
setne cl
cmc
clc
neg cl
cmp r10b, 0xa6
mov byte [r11 + 3], cl
bsr ecx, r14d
rcl cx, 0x75
movzx ecx, byte [r11 + 4]
jmp 0x14027be90
mov r10, qword [rcx]
movsx r9d, r11w
btr r11w, 3
mov r11, qword [rcx + 0x18]
cmp r15b, bpl
xor r9, rbx
bt r9, 0xe2
mov r9d, dword [r10 + 4]
stc
cmc
imul r9d, dword [r10]
cmp r8d, 2
jmp 0x140124cac
jmp 0x140283344
mov byte [r11 + 5], cl
movzx ecx, byte [r11 + 6]
cmp cl, byte [rdx]
mov cl, 0xe7
jmp 0x14023dbe4
jne 0x1401e0223
test r9b, 3
je 0x1400f65ef
and r9d, 3
xor ecx, ecx
bt rax, 0x34
nop word cs:[rax + rax]
test bpl, dil
rcl al, cl
movzx eax, byte [r11 + rcx*2]
cmp al, byte [rdx]
setne al
test edx, 0x3eb80420
stc
neg al
jmp 0x1400e93c5
je 0x1400f65ef
movzx r10d, byte [rdx]
mov r8d, r9d
sub ecx, ecx
jmp 0x14029510f
setne cl
test bx, 0x7a2e
clc
neg cl
test al, 0x87
mov byte [r11 + 7], cl
add r11, 8
cmc
add r8d, 0xfffffffc
jmp 0x140234746
test r9d, r9d
jmp 0x14023c2ac
jne 0x140283344
movzx eax, byte [r11 + rcx*4 + 1]
jmp 0x1400fe8fc
cmp cl, byte [rdx]
mov cl, 0x69
setne cl
clc
neg cl
jmp 0x140213762
inc rcx
cmp r8w, bp
cmp r14b, 0
test sil, r10b
cmp r8d, ecx
jmp 0x140295109
je 0x1400f65ef
cmp byte [r11 + rcx*4], r10b
jmp 0x14026fab8
Function at 0x140225d1b
Capabilities:
Encrypt data using speck
Resolve function by parsing pe exports

Disassembly:
jmp 0x140446202
mov rcx, qword [rcx]
jmp 0x1401500f7
push rsi
sal ah, cl
adc rsi, 0x45ce3eea
shrd si, bp, 0xa6
push rdi
sub rsp, 0x28
movzx rax, r13w
mov rsi, rcx
movsx ax, r8b
movzx eax, r9w
mov rcx, qword [rcx + 0x18]
adc al, r10b
mov rax, qword [rcx]
stc
test r12b, 0xd
sub edx, edx
sub r8d, r8d
jmp 0x14044623f
call qword [rax + 0x188]
mov edi, eax
movzx cx, spl
xchg ch, ch
lea rcx, [rsi + 0x30]
jmp 0x140446257
call fcn.140459e0c
test edi, edi
je 0x14044629d
cmp edi, 0x8899000c
jmp 0x14044626f
jne 0x1404462c4
mov rcx, rsi
bts rdi, r10
add rsp, 0x28
movzx edi, sp
not rsi
mov di, di
pop rdi
movsx rsi, r14w
jmp 0x140446297
pop rsi
jmp fcn.140445ee3
nop
cmovge rdi, rsi
dec sil
rcr rsi, cl
add rsp, 0x28
movzx rsi, ax
pop rdi
movsx si, dil
movzx esi, si
mov si, 0x2fbb
pop rsi
jmp 0x1404462c3
ret
mov ecx, edi
movabs r8, 0xad4a5352d2edebd0
movsx r9d, r15w
bts r9w, bp
mov dl, 3
bswap rdi
not r9d
xor esi, 0x3aef3cd0
mov r9d, 0x54
movsx rsi, di
inc dil
add rsp, 0x28
mov sil, 0x33
movzx esi, ax
pop rdi
movzx esi, cx
jmp 0x140446307
pop rsi
jmp 0x14044630d
jmp fcn.1403afa94
Function at 0x1403cd3fb
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
push r14
push r13
bts r15w, r11w
add r14b, 0x52
push r12
push rsi
adc r12w, ax
push rdi
adc r13b, r15b
rol si, 0x99
mov r12b, 0x62
push rbx
movzx r14, r15w
sub rsp, 0x30
movaps xmmword [rsp + 0x20], xmm6
and r14b, 0x41
bt r15w, dx
jmp 0x1403cd438
mov r15, r9
btr r13d, 0xaa
mov r12, r8
mov r14, rdx
movzx esi, dx
sar r13b, 0x79
mov r13, rcx
mov rsi, qword [rcx]
cmc
clc
test rsi, rsi
je 0x1403cd5ac
mov rbx, qword [r13 + 8]
cmc
jmp 0x1403cd468
cmp rsi, rbx
jmp 0x1403cd470
je 0x1403cd542
movaps xmm6, xmmword [0x1400bd3f0]
jmp 0x1403cd482
jmp 0x1403cd4b6
call fcn.1401ba130
movups xmmword [rsi + 0x10], xmm6
cmp r13w, 0x713b
test bl, r12b
mov word [rsi], 0
test dx, r12w
clc
add rsi, 0x20
clc
cmp rsi, rbx
jmp 0x1403cd4b0
je 0x1403cd533
mov rax, qword [rsi + 0x18]
test r10w, 0x5539
cmp rax, 8
jb 0x1403cd48c
mov rcx, qword [rsi]
xor rdx, 0x3d1a6e49
btr dx, r15w
sub dl, r8b
lea rdx, [rax + rax]
add rdx, 2
cmp bh, 2
cmp rdx, 0x1000
jmp 0x1403cd4f3
jb 0x1403cd487
mov rdi, qword [rcx - 8]
stc
add rcx, 0xfffffffffffffff8
sub rcx, rdi
cmp rcx, 0x20
jmp 0x1403cd50e
jae 0x1403cd633
add rax, rax
and ch, 0x5e
add rax, 0x29
mov rdx, rax
not cl
movsxd rcx, edx
mov rcx, rdi
jmp 0x1403cd52e
jmp 0x1403cd487
mov rsi, qword [r13]
jmp 0x1403cd542
mov rdx, qword [r13 + 0x10]
sub rdx, rsi
cmp r11w, r13w
cmc
clc
cmp rdx, 0x1000
jb 0x1403cd59f
mov rax, qword [rsi - 8]
cmp sp, r14w
test r8, rsp
test r11w, 0x2e36
add rsi, 0xfffffffffffffff8
stc
test r13, rax
cmp ebp, r8d
sub rsi, rax
cmp r14, rdx
cmc
cmp rsi, 0x20
jae 0x1403cd633
add rdx, 0x27
not sil
movsx ecx, dx
mov rsi, rax
movzx ecx, r13w
movsx cx, r10b
mov rcx, rsi
jmp 0x1403cd5a7
call fcn.1401ba130
mov qword [r13], r14
rol dil, cl
shl r12, 5
shl dil, 0xf9
add r12, r14
inc sil
mov qword [r13 + 8], r12
bts di, dx
shr r12b, cl
shl r15, 5
add r15, r14
btr rbx, 0xe
shl di, 0xb9
mov qword [r13 + 0x10], r15
rcr r12b, 0xc9
stc
movzx si, dl
movaps xmm6, xmmword [rsp + 0x20]
shr r14, 0xaa
add esi, 0x59571994
btc r15w, r9w
add rsp, 0x30
xchg r15b, sil
movzx edi, bx
pop rbx
mov r13, rsi
jmp 0x1403cd610
pop rdi
pop rsi
pop r12
movsxd r13, esi
xchg r13w, r15w
not r13b
pop r13
bswap r15w
cmovg r14w, bp
pop r14
pop r15
jmp 0x1403cd632
ret
call fcn.1404b63f8
int3
Function at 0x1403dbea4
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
bt r15w, 0xbe
push r14
bts r15w, sp
add r15b, 0xf9
push r13
sbb r15b, 0x29
mov r14b, 0x64
push r12
or r13b, dl
push rsi
mov r12, rsi
or r15, 0x5c9e78c6
push rdi
shr r15b, 0x4e
push rbp
or r13w, 0x5f09
push rbx
and r13w, di
sub rsp, 0x38
rol r15d, cl
jmp 0x1403dbeed
movaps xmmword [rsp + 0x20], xmm6
sbb bh, 0x69
rcl rbx, 0xcc
xor r13w, 0x6417
mov r14, r9
rcr r12w, 0x12
mov r12b, 0x67
mov r15, r8
bsf r12w, sp
shr r12w, 0x85
movsx r13d, r15w
mov r12, rdx
inc r13b
mov r13, rcx
movsxd rbx, r8d
or bl, bpl
sub bl, r10b
mov rbx, qword [rcx]
cmp r8b, 0xe9
cmp ah, ah
test rbx, rbx
jmp 0x1403dbf3e
je 0x1403dc077
mov rdi, qword [r13 + 8]
cmp rbx, rdi
jmp 0x1403dbf50
je 0x1403dc01d
lea rsi, [0x1400beb30]
jmp 0x1403dbf62
xorps xmm6, xmm6
jmp 0x1403dbf97
lea rbp, [rbx + 0x18]
jmp 0x1403dbf73
call fcn.1401ba130
movups xmmword [rbp], xmm6
stc
cmp dx, cx
mov qword [rbp + 0x10], 0
clc
stc
add rbx, 0x30
cmp rbx, rdi
je 0x1403dc014
mov qword [rbx], rsi
movzx rcx, cx
shld ecx, ebp, 0x96
rol ch, cl
mov rcx, qword [rbx + 0x18]
test rcx, rcx
jmp 0x1403dbfb0
je 0x1403dbf8a
mov rdx, qword [rbx + 0x28]
test r13b, 0x1e
sub rdx, rcx
cmp rdx, 0x1000
jmp 0x1403dbfcd
jb 0x1403dbf6a
mov rax, qword [rcx - 8]
cmp sp, si
cmc
cmp si, 0x163
add rcx, 0xfffffffffffffff8
test r12w, sp
sub rcx, rax
cmp rcx, 0x20
jmp 0x1403dbff4
jae 0x1403dc119
add rdx, 0x27
mov ecx, r10d
xchg rcx, rcx
movzx ecx, si
mov rcx, rax
jmp 0x1403dc00f
jmp 0x1403dbf6a
mov rbx, qword [r13]
bts dx, r8w
mov rdx, qword [r13 + 0x10]
sub rdx, rbx
cmp rdx, 0x1000
jmp 0x1403dc030
jb 0x1403dc06a
mov rax, qword [rbx - 8]
cmp bl, dil
cmp r8b, 0xaa
add rbx, 0xfffffffffffffff8
jmp 0x1403dc04b
sub rbx, rax
cmp rbx, 0x20
jae 0x1403dc119
add rdx, 0x27
mov rbx, rax
movsx cx, r8b
movsxd rcx, esp
setge ch
mov rcx, rbx
jmp 0x1403dc072
call fcn.1401ba130
mov qword [r13], r12
rcl bh, cl
lea rax, [r15 + r15*2]
shl rax, 4
xchg bl, r15b
lea rax, [rax + r12]
mov qword [r13 + 8], rax
rcr ah, 0x64
bts rsi, r14
lea rax, [r14 + r14*2]
jmp 0x1403dc0a3
shl rax, 4
shld ebx, r9d, 0x77
lea rax, [rax + r12]
mov qword [r13 + 0x10], rax
bts rbp, rsi
movaps xmm6, xmmword [rsp + 0x20]
sbb di, ax
add rsp, 0x38
cmovae r14, r8
movzx ebp, r9w
jmp 0x1403dc0d1
pop rbx
movsxd rsi, r9d
pop rbp
movsx rsi, dx
movzx r13w, dl
mov r14w, 0x2e83
pop rdi
mov r15, r14
movsxd r13, ebp
movzx si, r11b
pop rsi
bswap r13d
pop r12
mov r13b, 0xc6
movsx r15w, bl
bswap r13d
pop r13
pop r14
jmp 0x1403dc111
pop r15
jmp 0x1403dc118
ret
call fcn.1404b63f8
int3
Function at 0x1403e02e6
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rsi
movsx r9d, ax
shr r10b, 0x22
push rdi
setb r9b
bswap r10w
push rbx
shl r9d, 0x7a
sbb r9b, 0xe3
mov r9, rcx
bswap r10d
xadd r10w, r10w
lea r8, [r8 + rdx]
mov dword [rcx + 8], 0
cmc
btc r10, r11
sub eax, eax
jmp 0x1403e0327
sub ecx, ecx
sets r10b
movsx r10d, sp
nop word cs:[rax + rax]
rcl r10w, cl
lea r10, [rdx + 1]
jmp 0x1403e034a
cmp r10, r8
jmp 0x1403e0352
ja 0x1403e05a7
movzx edi, byte [rdx]
btr edx, r14d
movsx dx, r10b
bsr dx, di
mov edx, edi
cmc
and edx, 0x7f
shl rdx, cl
clc
add rax, rdx
bts dx, r13w
or dx, r11w
add rcx, 7
mov rdx, r10
test dil, dil
jmp 0x1403e038d
js 0x1403e0341
mov rcx, rax
jmp 0x1403e039b
and rcx, 0xfffffffffffffff8
and eax, 7
cmp rcx, 8
jmp 0x1403e03ab
je 0x1403e04ea
cmp rax, 1
jmp 0x1403e03ba
jg 0x1403e03e5
test rax, rax
jmp 0x1403e03c8
je 0x1403e049a
cmp eax, 1
jne 0x1403e05a7
lea rdx, [r10 + 8]
jmp 0x1403e03e0
jmp 0x1403e04d4
cmp eax, 5
jmp 0x1403e03ed
je 0x1403e04d0
cmp eax, 2
jmp 0x1403e03fb
jne 0x1403e05a7
mov rsi, r10
movzx rax, r15w
xor edi, edi
sub ecx, ecx
nop word cs:[rax + rax]
lea rax, [rsi + 1]
clc
cmp sil, dl
cmp rax, r8
ja 0x1403e05a7
mov r11, rdi
movzx ebx, byte [rsi]
bsr dx, sp
bts rdx, rsp
mov edx, ebx
rcl esi, cl
sal esi, 0x57
xor si, 0x64dc
and edx, 0x7f
shl rdx, cl
rol sil, 0x46
movzx esi, r8w
bt rsi, r13
lea rdi, [rdi + rdx]
shrd rsi, rsp, 0x80
add rcx, 7
cmp spl, 0xc0
mov rsi, 0x72e47957
mov rsi, rax
clc
test bl, bl
jmp 0x1403e0477
js 0x1403e0417
add rdx, r11
stc
add rdx, rax
cmp rdx, r8
jmp 0x1403e048c
cmova rdx, rax
jmp 0x1403e0495
jmp 0x1403e031c
mov rax, r10
nop
lea rdx, [rax + 1]
jmp 0x1403e04a8
cmp rdx, r8
ja 0x1403e05a7
cmp byte [rax], 0
movsxd rax, ecx
movzx ax, ah
mov al, 0x33
mov rax, rdx
jmp 0x1403e04c5
js 0x1403e049f
jmp 0x1403e031c
lea rdx, [r10 + 4]
cmp rdx, r8
jmp 0x1403e04dc
cmova rdx, r10
jmp 0x1403e04e5
jmp 0x1403e031c
cmp eax, 2
jmp 0x1403e04f2
jne 0x1403e05a7
mov dword [r9 + 8], 2
sub dl, r15b
rol si, cl
cmc
mov rsi, r10
bts rdx, rbp
bts edx, esp
xor eax, eax
shl dx, cl
cdq
sub ecx, ecx
nop word [rax + rax]
clc
lea rdx, [rsi + 1]
test bpl, dil
cmp rdx, r8
jmp 0x1403e052f
ja 0x1403e05a7
movzx r11d, byte [rsi]
ror dil, cl
add sil, 0xbb
stc
mov edi, r11d
cmovge si, r13w
dec si
and edi, 0x7f
shl sil, 0xf7
neg rsi
shl rdi, cl
mov sil, 0xb4
bts si, r11w
add rax, rdi
movsx esi, bx
add rcx, 7
movsx esi, r10w
movzx si, dl
mov rsi, rdx
test r11b, r11b
jmp 0x1403e057e
js 0x1403e0520
mov qword [r9 + 0x10], rdx
stc
test cl, 0xc4
mov qword [r9 + 0x18], rax
add rdx, rax
clc
cmp cx, 0x74ee
cmp rdx, r8
jmp 0x1403e05a1
jbe 0x1403e031c
cmp r10, r8
movzx rsi, r11w
seta al
seta al
bswap di
mov bl, r12b
pop rbx
movzx rsi, r13w
xchg sil, dil
not rdi
pop rdi
mov sil, 0xbf
pop rsi
jmp 0x1403e05cf
ret
Function at 0x1403e546f
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
sbb r15b, 0x32
push r14
sub r14b, 0x97
rcl r14b, cl
push r13
cmp bpl, r12b
dec r14
xor r14b, r14b
push r12
not r15b
or r13, rdx
stc
push rsi
sar r13b, 0x40
push rdi
bts r15w, dx
push rbp
push rbx
not r14b
sbb bl, sil
sub rsp, 0x38
xor ebx, r14d
ror r14b, cl
btc r15d, 0x4a
movaps xmmword [rsp + 0x20], xmm6
inc bl
mov r14, r9
inc r13d
test r11b, 0x6b
mov r15, r8
mov r12, rdx
adc r13b, r10b
test dil, 0xb3
cmovs ebx, edx
mov r13, rcx
sbb bl, sil
xchg bx, bx
mov rbx, qword [rcx]
clc
test rbx, rbx
jmp 0x1403e54ea
je 0x1403e560d
mov rdi, qword [r13 + 8]
cmp rbx, rdi
jmp 0x1403e54fc
je 0x1403e55bb
lea rbp, [0x1400bed30]
movaps xmm6, xmmword [0x1400bd400]
jmp 0x1403e5515
jmp 0x1403e553d
call fcn.1401ba130
movups xmmword [rbx + 0x20], xmm6
mov byte [rbx + 0x10], 0
clc
add rbx, 0x38
test cx, si
cmp rbx, rdi
jmp 0x1403e5537
je 0x1403e55a7
mov qword [rbx], rbp
shr al, 7
mov rax, qword [rbx + 0x28]
cmp rax, 0x10
jb 0x1403e551f
mov rcx, qword [rbx + 0x10]
lea rdx, [rax + 1]
clc
cmp rdx, 0x1000
jmp 0x1403e5566
jb 0x1403e551a
mov rsi, qword [rcx - 8]
test r13b, 0x64
test spl, dil
add rcx, 0xfffffffffffffff8
sub rcx, rsi
cmp rcx, 0x20
jmp 0x1403e5587
jae 0x1403e56a1
add rax, 0x28
mov rcx, rdi
mov rdx, rax
seto cl
mov rcx, rsi
jmp 0x1403e55a2
jmp 0x1403e551a
mov rbx, qword [r13]
bt dx, 3
ror rdx, 0x48
cmp rax, 0x1dff30e8
mov rdx, qword [r13 + 0x10]
cmc
test r9b, 0xb5
sub rdx, rbx
cmp rdx, 0x1000
jmp 0x1403e55d3
jb 0x1403e5600
mov rax, qword [rbx - 8]
cmc
cmp esp, esp
add rbx, 0xfffffffffffffff8
sub rbx, rax
jmp 0x1403e55ec
cmp rbx, 0x20
jae 0x1403e56a1
add rdx, 0x27
mov rbx, rax
mov ch, 0xee
mov rcx, rbx
jmp 0x1403e5608
call fcn.1401ba130
mov qword [r13], r12
bt ebx, r15d
imul rax, r15, 0x38
movzx bx, r11b
add rax, r12
btr rbp, 0xf7
mov qword [r13 + 8], rax
shl r15b, cl
sub dil, sil
sal ebp, cl
imul rax, r14, 0x38
movzx bx, r10b
and r15b, cl
shl si, 0x82
add rax, r12
bt rsi, 0xa9
mov qword [r13 + 0x10], rax
sbb r13w, cx
movaps xmm6, xmmword [rsp + 0x20]
rcr r12b, 0x9b
shl r13b, cl
add rsp, 0x38
bswap r14w
pop rbx
movzx bp, bpl
movsx r14d, r14w
pop rbp
jmp 0x1403e567a
pop rdi
bswap r14d
pop rsi
cmovg r14, rax
pop r12
movzx r14, bp
pop r13
pop r14
movzx r15, r8w
movsx r15d, di
movsx r15, sp
pop r15
jmp 0x1403e56a0
ret
call fcn.1404b63f8
int3
Function at 0x14042bea4
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rsi
push rdi
shrd rdi, r15, 0xd5
sub rsp, 0x28
mov rsi, rcx
sar dil, cl
movzx edi, dx
bts dx, r13w
movzx edx, word [rcx + rdi*4 + 0x834]
test dx, dx
jmp 0x14042becd
js 0x14042bee0
mov rcx, rsi
jmp 0x14042bedb
call fcn.14042bea4
movsxd rcx, dword [rsi + 0x8860]
cmc
stc
cmp ecx, dword [rsi + 0x8858]
jge 0x14042c08e
movsxd rax, dword [rsi + 0x885c]
adc r8b, 0xd4
ror r8b, cl
add rax, rcx
movsx dx, r15b
bts r8, rcx
mov r8, qword [rsi + 8]
and dl, r8b
lea edx, [rax + 3]
xor cl, r10b
test eax, eax
movzx rcx, r10w
cmovns edx, eax
mov rcx, qword [rsi + 0x18]
clc
sar edx, 2
cmc
cmp dl, 0xef
movsxd rdx, edx
cmp ch, 0x19
mov byte [rcx + rdx], 1
mov rdx, qword [rsi + 0x8838]
cmp bpl, sil
stc
movzx edi, byte [rsi + rdi*4 + 0x837]
cmp byte [rdx + rdi*4 + 3], 0x81
jmp 0x14042bf58
jb 0x14042bfa7
movzx ecx, byte [rdx + rdi*4 + 2]
mov byte [r8 + rax], cl
cmc
movzx ecx, byte [rdx + rdi*4 + 1]
clc
stc
mov byte [r8 + rax + 1], cl
movsxd rcx, r10d
bsr cx, r14w
movzx ecx, byte [rdx + rdi*4]
cmp sil, 7
cmp r14w, r15w
cmc
mov byte [r8 + rax + 2], cl
movzx ecx, byte [rdx + rdi*4 + 3]
cmp r14b, 0xee
jmp 0x14042bf9d
mov byte [r8 + rax + 3], cl
movzx ax, r11b
mov eax, dword [rsi + 0x885c]
cmp si, 0x5101
add eax, 4
test rax, r13
mov dword [rsi + 0x885c], eax
cmp r11d, 0x5ca1298e
clc
cmp eax, dword [rsi + 0x8854]
jmp 0x14042bfd1
jl 0x14042c08e
mov ecx, dword [rsi + 0x884c]
mov ax, r9w
ror ax, cl
movsx ax, sil
mov eax, dword [rsi + 0x8858]
cmc
mov dword [rsi + 0x885c], ecx
inc cl
mov ecx, dword [rsi + 0x8860]
stc
add ecx, dword [rsi + 0x8844]
jmp 0x14042c00a
mov dword [rsi + 0x8860], ecx
cmp r8, 0x492d712e
cmp ecx, eax
jmp 0x14042c01e
jl 0x14042c08e
mov ecx, dword [rsi + 0x8840]
nop dword [rax]
test ecx, ecx
jle 0x14042c08e
mov edx, dword [rsi + 0x8864]
test bh, cl
jmp 0x14042c04c
shl edx, cl
stc
test r10b, bpl
mov dword [rsi + 0x8844], edx
sar edx, 1
jmp 0x14042c060
add edx, dword [rsi + 0x8850]
jmp 0x14042c06b
mov dword [rsi + 0x8860], edx
dec ecx
jmp 0x14042c078
mov dword [rsi + 0x8840], ecx
test r13b, bl
cmp edx, eax
jmp 0x14042c088
jge 0x14042c031
add rsp, 0x28
mov dil, 0x2e
pop rdi
cmovs rsi, r10
bswap esi
mov si, 0x19a6
pop rsi
jmp 0x14042c0a6
ret