joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14019b4e8
Capabilities:
Parse pe header

Disassembly:
jmp 0x1404ae1eb
xor r8d, r8d
setl dl
lea edx, [r8 + 2]
jmp 0x14017a07c
mov qword [rsp + 8], rbx
xor bx, 0x13cd
bswap rbx
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
shl ebx, cl
push rbp
adc ebp, ecx
rol bpl, 0xe9
mov rbp, rsp
xor bx, 0x6422
bsf ebx, r15d
bsr rbx, rdx
sub rsp, 0x50
sal ebx, cl
mov ebx, ecx
cmp r11b, r12b
test r14w, r14w
jmp 0x1404ae22e
test r8d, r8d
jne 0x1404ae2c9
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
jmp 0x1404ae247
je 0x1404ae2c9
mov ecx, 0x5a4d
test cx, r13w
cmp word [rax], cx
jmp 0x1404ae25e
jne 0x1404ae2c9
movsxd rcx, dword [rax + 0x3c]
cmc
lea rcx, [rcx + rax]
test r12d, 0x15883fc2
cmp dword [rcx], 0x4550
jmp 0x1404ae27f
jne 0x1404ae2c9
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jmp 0x1404ae293
jne 0x1404ae2c9
cmp dword [rcx + 0x84], 0xe
jmp 0x1404ae2a5
jbe 0x1404ae2c9
cmp dword [rcx + 0xf8], 0
jmp 0x1404ae2b7
je 0x1404ae2c9
mov ecx, ebx
jmp 0x1404ae2c4
call fcn.1404ae0b4
lea rax, [rbp + 0x18]
movzx r9d, r8w
bswap dx
mov r9, 0x92b767b
mov byte [rbp + 0x28], 0
mov r8d, ebp
mov qword [rbp - 0x20], rax
movsxd rdx, esi
cwd
lea r9, [rbp - 0x2c]
movsxd rax, ebx
cbw
cdqe
lea rax, [rbp + 0x20]
mov qword [rbp - 0x18], rax
movzx eax, ax
mov rcx, r14
cdqe
lea r8, [rbp - 0x20]
bswap dx
movsxd rax, ebp
xchg dh, al
lea rax, [rbp + 0x28]
cwd
movzx rdx, r8w
mov rdx, 0x4a3b6d17
mov qword [rbp - 0x10], rax
lea rdx, [rbp - 0x28]
sete al
jmp 0x1404ae337
mov eax, 2
cmovp ecx, r10d
movsx rcx, r9w
mov rcx, r12
lea rcx, [rbp - 0x30]
jmp 0x1404ae350
mov dword [rbp - 0x2c], eax
jmp 0x1404ae358
mov dword [rbp - 0x28], eax
jmp 0x1404ae360
call fcn.1404ae504
cmp dword [rbp + 0x20], 0
jmp 0x1404ae36e
je 0x1404ae38b
mov rbx, qword [rsp + 0x60]
movsxd rbp, edi
rcr bpl, 0x91
add rsp, 0x50
pop rbp
jmp 0x1404ae38a
ret
mov ecx, ebx
jmp 0x1404ae392
call fcn.1404ae15f
int3

Function at 0x14019ef8b
Capabilities:
Encrypt data using speck
Resolve function by parsing pe exports

Disassembly:
jmp 0x140442faf
mov rcx, qword [rcx]
jmp 0x14015fbac
push rsi
adc al, bpl
xor ax, bp
shl sil, cl
push rdi
cmovp si, r8w
sub rsp, 0x28
cmc
mov rsi, rcx
shr rax, 0xe9
btc ax, r10w
mov rcx, qword [rcx + 0x18]
sbb ah, 0x33
bswap ax
bt eax, esp
mov rax, qword [rcx]
test r13b, 0xac
sub edx, edx
cmp sil, 0x87
xor r8d, r8d
jmp 0x140442ff2
call qword [rax + 0x188]
mov edi, eax
lea rcx, [rsi + 0x30]
jmp 0x140443003
call fcn.140456c51
test edi, edi
jmp 0x14044300f
je 0x140443051
cmp edi, 0x8899000c
jmp 0x140443020
jne 0x140443066
mov rcx, rsi
btc di, cx
bts di, r14w
add rsp, 0x28
movsx si, r11b
jmp 0x140443042
pop rdi
movzx esi, dx
pop rsi
jmp 0x14044304c
jmp fcn.140442c88
nop
dec si
mov sil, 3
add rsp, 0x28
pop rdi
movsx esi, bx
movzx esi, r9w
pop rsi
ret
mov ecx, edi
bsr esi, r9d
inc dil
movabs r8, 0xad4a5352d2edebd0
clc
movsx rsi, r10w
mov dl, 3
add dil, 0xf1
movsx rsi, bp
mov r9d, 0x54
and dil, 0x91
movzx esi, r12w
xor sil, 0x30
add rsp, 0x28
pop rdi
pop rsi
jmp fcn.1403ac523
Function at 0x1401fc260
Capabilities:
Parse pe header

Disassembly:
jne 0x1401d0fb3
movsxd rdx, dword [rcx + 0x3c]
cmc
lea rdx, [rdx + rcx]
jmp 0x14028c107
jne 0x1401d0fb3
sub eax, eax
mov ecx, 0x20b
test r15d, 0x58849b3
cmp word [rdx + 0x18], cx
not al
mov al, r10b
sete al
ret
xor eax, eax
jmp 0x140250f5c
mov eax, 0x5a4d
cmc
clc
cmp word [rcx], ax
jmp 0x140114c55
ret
cmp dword [rdx], 0x4550
jmp 0x1401bea9c

Function at 0x1401fc954
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
cmp r9b, cl
cmp cl, 0x6a
xor edx, edx
jmp 0x1404ae1eb

Function at 0x1402343cd
Capabilities:
Encrypt data using rc4 prga

Disassembly:
test r9d, r9d
jmp 0x140101a00
inc rcx
cmp r12w, dx
cmc
test cl, r10b
cmp r8d, ecx
je 0x14024e089
cmp byte [r11 + rcx*4], r10b
jmp 0x14026c00d
je 0x14024e089
movzx r10d, byte [rdx]
movsxd r8, r10d
movzx r8w, r14b
movzx r8d, sp
mov r8d, r9d
sub ecx, ecx
jmp 0x14010754e
jne 0x1400e0872
test r9d, r9d
je 0x14024e089
lea ecx, [r9 - 1]
cmp r8b, r11b
cmp ecx, 3
jmp 0x1402896d0
jmp 0x1400ef8f9
cmp r8d, 2
jmp 0x140104734
jne 0x1400ef8e5
movzx eax, byte [r11 + rcx*4 + 2]
cmp al, byte [rdx + 2]
jne 0x1400ef8e5
mov byte [r11 + rcx*4 + 3], 0
movzx r10d, byte [rdx]
jmp 0x140233f04
jmp 0x1400ef8e5
mov r10, qword [rcx]
movsx r9, bp
add r9b, 0x95
bsr r11w, sp
mov r11, qword [rcx + 0x18]
mov r9d, dword [r10 + 4]
imul r9d, dword [r10]
jmp 0x140114c38
jne 0x1402618c8
jmp 0x14024e089
ret
jne 0x1402896f5
test r9b, 3
je 0x14024e089
and r9d, 3
movsxd rax, r12d
rcr rax, 0xe7
sub ax, 0x68e6
xor ecx, ecx
btr rax, r8
nop word cs:[rax + rax]
sbb al, 0x14
movzx eax, byte [r11 + rcx*2]
cmp al, byte [rdx]
setne al
neg al
mov byte [r11 + rcx*2 + 1], al
inc rcx
cmp r14b, 0xaa
cmp r9d, ecx
jmp 0x1402413a4
jne 0x1400ef8e5
movzx eax, byte [r11 + rcx*4 + 1]
stc
cmp al, byte [rdx + 1]
jmp 0x1402230d4
jb 0x14026189d
mov r8d, r9d
dec r10d
and r8d, 0xfffffffc
inc r10w
nop word cs:[rax + rax]
xor r10b, sil
movzx ecx, byte [r11]
test rsp, rdi
xchg r10b, r10b
cmp cl, byte [rdx]
setne cl
movzx r10d, byte [r11 + 2]
setne cl
stc
clc
neg cl
stc
test spl, 0xb7
mov byte [r11 + 1], cl
xchg cl, cl
cmp r10b, byte [rdx]
sete cl
setne cl
neg cl
mov byte [r11 + 3], cl
adc ch, 0xc9
movzx cx, spl
movsx ecx, bx
movzx ecx, byte [r11 + 4]
cmp cl, byte [rdx]
setl cl
setne cl
neg cl
test r10w, 0x52fb
cmc
cmp r13b, r15b
mov byte [r11 + 5], cl
rol ch, cl
shl cx, 0xd0
movzx ecx, byte [r11 + 6]
cmp al, 0xbd
cmp cl, byte [rdx]
setne cl
neg cl
test r15b, 0x1a
clc
mov byte [r11 + 7], cl
cmc
cmp ax, 0x12c
add r11, 8
test r14w, 0x6c42
cmp al, r9b
add r8d, 0xfffffffc
jmp 0x140261897
Function at 0x1403bd130
Capabilities:
Execute anti-debugging instructions

Disassembly:
push rsi
xadd esi, esi
push rdi
bsr rsi, r8
rcl si, cl
push rbx
btc edi, ebp
xor si, 0x5713
and di, 0x33d8
sub rsp, 0x70
mov rdi, rdx
jmp 0x1403bd156
mov rsi, rcx
movzx rdx, r8w
xchg rdx, rdx
mov rdx, r8
jmp 0x1403bd168
call fcn.140191906
lea rax, [0x1400bddb0]
cmovbe rcx, r9
mov qword [rsi], rax
movsx ecx, bx
lea rcx, [rsi + 0x40]
xorps xmm0, xmm0
movups xmmword [rsi + 0x40], xmm0
mov qword [rsi + 0x50], 0
mov qword [rsi + 0x58], 7
test spl, dil
cmp rcx, rdi
je 0x1403bd21c
mov rbx, qword [rdi + 0x10]
test edx, esp
cmp qword [rdi + 0x18], 8
jmp 0x1403bd1b5
jb 0x1403bd1c0
mov rdi, qword [rdi]
cmc
clc
cmp rbx, 7
jmp 0x1403bd1c9
jbe 0x1403bd1e8
mov rdx, rbx
movsx r9d, sp
mov r9, rdi
jmp 0x1403bd1de
call fcn.1403bcbf0
jmp 0x1403bd21c
mov qword [rsi + 0x50], rbx
cwd
lea r8, [rbx + rbx]
jmp 0x1403bd1fc
mov rdx, rdi
jmp 0x1403bd204
call fcn.1404a0829
mov word [rsi + rbx*2 + 0x40], 0
movzx ecx, r9w
cmovge cx, cx
movsx ecx, r8w
mov dword [rsi + 0x60], 0
mov cl, r15b
movzx cx, r12b
mov ecx, 0x18
jmp 0x1403bd235
call fcn.140444d48
mov rdi, rax
cdqe
movzx rdx, r15w
rdtsc
movabs rax, 0x699f8472d420abd6
cwd
mov cl, r10b
setno ch
mov qword [rsp + 0x30], rax
movabs rax, 0x111de33110e68edf
mov cl, r11b
bswap dx
xchg edx, edx
mov qword [rsp + 0x38], rax
setns ah
rdtsc
movabs rax, 0x4764a407847292c7
bswap cx
not dx
setne dh
mov qword [rsp + 0x40], rax
xchg dh, ch
movabs rcx, 0x199eee0663371024
movsx dx, bh
cdq
mov qword [rsp + 0x48], rcx
movzx edx, r14w
movabs rdx, 0x69f08415d445ab85
jmp 0x1403bd2b9
mov qword [rsp + 0x50], rdx
movabs rdx, 0x1154e36410c68eba
jmp 0x1403bd2cd
mov qword [rsp + 0x58], rdx
jmp 0x1403bd2d7
mov qword [rsp + 0x60], rax
not rax
movsx ax, dh
movzx eax, cx
mov qword [rsp + 0x68], rcx
movsxd rax, r12d
lea rax, [rsp + 0x50]
movaps xmm0, xmmword [rsp + 0x30]
jmp 0x1403bd2fd
xorps xmm0, xmmword [rax]
movaps xmmword [rsp + 0x30], xmm0
jmp 0x1403bd30a
movaps xmm0, xmmword [rsp + 0x40]
jmp 0x1403bd314
xorps xmm0, xmmword [rax + 0x10]
movaps xmmword [rsp + 0x40], xmm0
jmp 0x1403bd32b
mov dword [rsp + 0x20], 0
lea rdx, [rsp + 0x30]
cmovns ecx, eax
movzx r9, bp
movss xmm2, dword [0x1400bd548]
movsx cx, r14b
movzx cx, r11b
movzx r9, ax
mov rcx, rdi
mov r9d, 0x1f4
jmp 0x1403bd363
call fcn.14044270b
mov qword [rsi + 0x68], rdi
mov rax, rsi
and di, 0x48ea
rol bx, cl
btc bx, di
add rsp, 0x70
movsx rdi, cx
xchg dil, sil
pop rbx
xchg si, di
jmp 0x1403bd38f
pop rdi
mov si, 0xd23
seto sil
movsxd rsi, r15d
pop rsi
jmp 0x1403bd3a1
ret
Function at 0x1403bde7e
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rsi
sete sil
dec eax
push rdi
movsxd rsi, edx
rcr si, 0x9d
push rbx
sub rsp, 0x20
ror sil, 0x47
shr ah, cl
mov rsi, rcx
shrd eax, esp, 0x83
lea rax, [0x1400bdab0]
mov qword [rcx], rax
mov rax, qword [rcx + 0x88]
cmp rax, 8
jb 0x1403bdf25
mov rcx, qword [rsi + 0x70]
lea rdx, [rax + rax]
test cl, r15b
clc
add rdx, 2
cmc
cmp rdx, 0x1000
jb 0x1403bdf20
mov rbx, qword [rcx - 8]
cmc
add rcx, 0xfffffffffffffff8
cmc
sub rcx, rbx
cmp r10w, 0x253a
cmp rcx, 0x20
jae 0x1403be08a
lea rax, [rax + rax]
bsf dx, r10w
sal cx, cl
cmc
add rax, 0x29
jmp 0x1403bdf12
mov rdx, rax
movzx ecx, r12w
cmovle rcx, rsi
mov rcx, rbx
call fcn.140237311
movaps xmm0, xmmword [0x1400bd3f0]
mov al, 0x7a
movups xmmword [rsi + 0x80], xmm0
dec bh
mov word [rsi + 0x70], 0
rcr di, cl
sar di, cl
cmp sil, r12b
lea rax, [0x1400bdb70]
mov dil, 0xc3
mov qword [rsi], rax
inc rdi
mov rdi, qword [rsi + 0x40]
rcl bh, 0x8d
mov rbx, qword [rsi + 0x48]
cmp dl, spl
jmp 0x1403bdf6d
cmp rdi, rbx
jne 0x1403bdf8d
jmp 0x1403bdfd8
add rdi, 8
cmp rdi, rbx
jmp 0x1403bdf87
je 0x1403bdfbc
mov rcx, qword [rdi]
clc
cmc
cmp rsi, rdi
test rcx, rcx
jmp 0x1403bdf9d
je 0x1403bdf7b
mov rax, qword [rcx]
cdq
mov edx, 1
jmp 0x1403bdfb1
call qword [rax + 0xb8]
jmp 0x1403bdf7b
mov rdi, qword [rsi + 0x40]
jmp 0x1403bdfc5
cmp rdi, qword [rsi + 0x48]
jmp 0x1403bdfce
je 0x1403bdfd8
mov qword [rsi + 0x48], rdi
test rdi, rdi
je 0x1403be065
mov rdx, qword [rsi + 0x50]
cmc
sub rdx, rdi
cmp rdx, 0x1000
jb 0x1403be033
mov rax, qword [rdi - 8]
add rdi, 0xfffffffffffffff8
cmp r15w, 0x46ae
sub rdi, rax
cmp rdi, 0x20
jmp 0x1403be010
jae 0x1403be08a
add rdx, 0x27
or dil, 0xce
shr dil, cl
movsxd rdi, r12d
mov rdi, rax
xor cx, 0x684b
adc ch, 0x92
cmp r14w, cx
add rsi, 0x40
jmp 0x1403be03f
mov rcx, rdi
jmp 0x1403be047
call fcn.140237311
xorps xmm0, xmm0
movups xmmword [rsi], xmm0
movzx rdi, bp
mov qword [rsi + 0x10], 0
sal dil, 0xd5
adc bx, sp
add rsp, 0x20
movzx esi, r13w
movsx di, spl
pop rbx
movzx rdi, di
mov esi, ebx
setae sil
pop rdi
cmovs si, r10w
pop rsi
jmp 0x1403be089
ret
call fcn.1404b3352
int3
Function at 0x1403c255e
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rsi
cmp bpl, 0x3f
shl al, cl
push rdi
sal sil, cl
push rbx
rcl rax, cl
dec di
sub rsp, 0x20
dec si
mov rsi, rcx
lea rax, [0x1400be020]
sar di, cl
mov qword [rcx], rax
rcr edi, 0x37
mov rdi, qword [rcx + 0x78]
cmc
test rdi, rdi
jmp 0x1403c2597
je 0x1403c25cb
mov rcx, rdi
jmp 0x1403c25a5
call fcn.14021bc00
mov rcx, rdi
jmp 0x1403c25b2
call fcn.1401612e0
mov qword [rsi + 0x78], 0
bsf rax, r14
sal ax, 0x1d
bts rax, r14
mov rax, qword [rsi + 0x70]
cmp rax, 8
jmp 0x1403c25d8
jb 0x1403c2650
mov rcx, qword [rsi + 0x58]
cmp r14b, al
lea rdx, [rax + rax]
cmp spl, r15b
test r15b, 0xfe
add rdx, 2
stc
test r8, 0x48267767
cmp rdx, 0x1000
jmp 0x1403c2608
jb 0x1403c264b
mov rbx, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
clc
cmc
test esi, r9d
sub rcx, rbx
cmp rcx, 0x20
jae 0x1403c27d4
lea rax, [rax + rax]
add rax, 0x29
not cx
movsx ecx, r10w
cwd
mov rdx, rax
movzx rcx, r13w
movsx ecx, bx
mov rcx, rbx
jmp 0x1403c264b
call fcn.140237311
movaps xmm0, xmmword [0x1400bd3f0]
rol ebx, 0xdd
cmp ax, 0x3fd2
movups xmmword [rsi + 0x68], xmm0
shr dil, 0xc5
xor edi, r15d
mov word [rsi + 0x58], 0
sal rax, 0x8f
shrd bx, si, 0x2b
lea rax, [0x1400bdb70]
test r12w, r14w
movzx bx, dl
sub di, 0x9f0
mov qword [rsi], rax
bt di, r13w
mov rdi, qword [rsi + 0x40]
mov bx, 0x3b8b
cmp r11w, 0x5627
mov rbx, qword [rsi + 0x48]
jmp 0x1403c26b1
cmp rdi, rbx
jne 0x1403c26d6
jmp 0x1403c2732
add rdi, 8
cmc
test rbp, rdx
stc
cmp rdi, rbx
jmp 0x1403c26d0
je 0x1403c2713
mov rcx, qword [rdi]
jmp 0x1403c26e8
test rcx, rcx
jmp 0x1403c26f0
je 0x1403c26bf
mov rax, qword [rcx]
movzx dx, bpl
mov edx, 1
jmp 0x1403c2708
call qword [rax + 0xb8]
jmp 0x1403c26bf
mov rdi, qword [rsi + 0x40]
cmp bp, r14w
test bpl, 0x1d
cmp rdi, qword [rsi + 0x48]
je 0x1403c2732
mov qword [rsi + 0x48], rdi
jmp 0x1403c2732
test rdi, rdi
jmp 0x1403c273a
je 0x1403c27c8
mov rdx, qword [rsi + 0x50]
jmp 0x1403c274e
sub rdx, rdi
cmp rdx, 0x1000
jmp 0x1403c275d
jb 0x1403c2797
mov rax, qword [rdi - 8]
stc
cmc
add rdi, 0xfffffffffffffff8
sub rdi, rax
test bpl, dl
jmp 0x1403c2778
cmp rdi, 0x20
jmp 0x1403c2781
jae 0x1403c27d4
add rdx, 0x27
sal edi, cl
mov rdi, rax
sbb ch, 0x10
sar cx, 0x2e
add rsi, 0x40
movsx cx, r14b
cmovl cx, r15w
mov rcx, rdi
jmp 0x1403c27ad
call fcn.140237311
xorps xmm0, xmm0
movups xmmword [rsi], xmm0
rol dil, cl
mov qword [rsi + 0x10], 0
jmp 0x1403c27c8
add rsp, 0x20
movzx rbx, r8w
pop rbx
pop rdi
pop rsi
ret
call fcn.1404b3352
int3
Function at 0x1403dcd1b
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rsi
push rdi
push rbx
mov r9, rcx
stc
movzx r10d, ax
lea r8, [r8 + rdx]
sal r10d, 0x72
add r10d, 0x214a3db2
mov dword [rcx + 8], 0
btr r10, 0xf8
sub eax, eax
xor ecx, ecx
adc r10b, 0xd7
xor r10, r11
shr r10w, cl
nop word cs:[rax + rax]
lea r10, [rdx + 1]
test dh, al
stc
clc
cmp r10, r8
jmp 0x1403dcd6c
ja 0x1403dcff1
movzx edi, byte [rdx]
sal dx, cl
shl dx, 0xdd
cwd
mov edx, edi
stc
cmp edx, r13d
and edx, 0x7f
stc
jmp 0x1403dcd8d
shl rdx, cl
cmp dil, sil
cmp esp, 0x6c7a238e
add rax, rdx
add rcx, 7
bsr dx, r10w
btr dx, 0xbd
mov dx, 0xcf0
mov rdx, r10
jmp 0x1403dcdbd
test dil, dil
js 0x1403dcd5c
mov rcx, rax
cmp r15, 0x640622ff
and rcx, 0xfffffffffffffff8
test sp, 0x74d
stc
and eax, 7
jmp 0x1403dcde3
cmp rcx, 8
jmp 0x1403dcdec
je 0x1403dcf39
cmp rax, 1
jmp 0x1403dcdfb
jg 0x1403dce2b
test rax, rax
jmp 0x1403dce09
je 0x1403dcede
cmp eax, 1
jmp 0x1403dce17
jne 0x1403dcff1
lea rdx, [r10 + 8]
jmp 0x1403dce26
jmp 0x1403dcf28
cmp eax, 5
jmp 0x1403dce33
je 0x1403dcf24
cmp eax, 2
jne 0x1403dcff1
mov rsi, r10
rol ah, cl
sub edi, edi
adc ah, 0x21
ror ax, 0xc8
xor ecx, ecx
movsxd rax, r13d
sub ah, 0x29
nop word cs:[rax + rax]
bt ax, 0x1e
lea rax, [rsi + 1]
stc
cmp rax, r8
jmp 0x1403dce75
ja 0x1403dcff1
mov r11, rdi
movzx ebx, byte [rsi]
ror si, 0x6a
sbb si, 0x4ee0
setne sil
mov edx, ebx
and edx, 0x7f
shl rdx, cl
lea rdi, [rdi + rdx]
add rcx, 7
mov rsi, rax
cmp r10d, 0x662078fd
test bl, bl
jmp 0x1403dceaf
js 0x1403dce68
lea rdx, [rdx + r11]
lea rdx, [rdx + rax]
jmp 0x1403dcec8
cmp rdx, r8
jmp 0x1403dced0
cmova rdx, rax
jmp 0x1403dced9
jmp 0x1403dcd41
mov rax, r10
shld edx, ebp, 0x26
nop
rcl rdx, cl
movsx rdx, r13w
bts dx, si
lea rdx, [rax + 1]
cmc
clc
cmp rdx, r8
jmp 0x1403dcf00
ja 0x1403dcff1
cmp byte [rax], 0
movzx rax, r8w
movsx rax, r11w
mov rax, rdx
jmp 0x1403dcf19
js 0x1403dcef2
jmp 0x1403dcd41
lea rdx, [r10 + 4]
cmp rdx, r8
cmova rdx, r10
jmp 0x1403dcf34
jmp 0x1403dcd41
cmp eax, 2
jmp 0x1403dcf41
jne 0x1403dcff1
mov dword [r9 + 8], 2
movzx esi, cx
and dl, r8b
stc
mov rsi, r10
cwd
bsf dx, bp
sub eax, eax
btc dx, r8w
sub ecx, ecx
cmova dx, ax
bt dx, r12w
nop word [rax + rax]
rcr edx, cl
movsx dx, r11b
lea rdx, [rsi + 1]
cmp rdx, r8
ja 0x1403dcff1
movzx r11d, byte [rsi]
or dil, 0x18
mov edi, r11d
shr esi, cl
and edi, 0x7f
shl rdi, cl
dec esi
sub sil, 0x9b
lea rax, [rax + rdi]
clc
add rcx, 7
shr sil, 0xb5
dec sil
mov rsi, rdx
stc
cmp al, r15b
test r11b, r11b
jmp 0x1403dcfc3
js 0x1403dcf7e
mov qword [r9 + 0x10], rdx
test r10b, dl
cmc
stc
mov qword [r9 + 0x18], rax
cmp dx, r12w
cmc
lea rdx, [rdx + rax]
cmp sil, dl
cmc
cmp rdx, r8
jmp 0x1403dcfeb
jbe 0x1403dcd41
cmp r10, r8
bswap ebx
xchg bx, di
seta al
movzx rdi, r15w
pop rbx
not rsi
movzx edi, dx
pop rdi
xchg sil, sil
not sil
pop rsi
jmp 0x1403dd014
ret
Function at 0x1403e72ba
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
jmp 0x1403e72cd
push r14
push rsi
push rdi
xor edi, r15d
push rbx
sal dil, 0x2b
sub rsp, 0x30
bswap di
movaps xmmword [rsp + 0x20], xmm6
and di, di
movsx rdi, r15w
and dil, 0xe1
mov rdi, qword [rcx]
cmp r9b, 0xfa
cmp ah, bh
test rdi, rdi
jmp 0x1403e7301
je 0x1403e747a
mov r14, rcx
movzx bx, r12b
mov rbx, qword [rcx + 8]
stc
cmp r15, 0x493b3be3
cmc
cmp rdi, rbx
jmp 0x1403e7324
je 0x1403e73f6
lea r15, [0x1400bed10]
movaps xmm6, xmmword [0x1400bd400]
jmp 0x1403e7360
call fcn.140237311
movups xmmword [rdi + 0x20], xmm6
test cx, r8w
mov byte [rdi + 0x10], 0
add rdi, 0x50
cmp rdi, rbx
jmp 0x1403e735a
je 0x1403e73f3
mov qword [rdi], r15
movsx rcx, ax
movsx cx, dil
movzx ecx, si
lea rcx, [rdi + 0x38]
call fcn.1403e0b96
mov rax, qword [rdi + 0x28]
test spl, sil
cmp rax, 0x10
jb 0x1403e7342
mov rcx, qword [rdi + 0x10]
ror edx, cl
clc
lea rdx, [rax + 1]
cmc
test r12w, r13w
jmp 0x1403e739e
cmp rdx, 0x1000
jmp 0x1403e73aa
jb 0x1403e733d
mov rsi, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
cmp spl, 0xd3
sub rcx, rsi
cmc
cmp r8w, 0x5842
cmp rcx, 0x20
jmp 0x1403e73cf
jae 0x1403e74c0
add rax, 0x28
movsx ecx, r11w
mov rdx, rax
movsx cx, r14b
not cx
mov cl, r14b
mov rcx, rsi
jmp 0x1403e733d
mov rdi, qword [r14]
mov rdx, qword [r14 + 0x10]
cmp r8b, 0xa5
test sp, ax
sub rdx, rdi
cmp rdx, 0x1000
jmp 0x1403e7410
jb 0x1403e744e
mov rax, qword [rdi - 8]
cmp r8b, sil
add rdi, 0xfffffffffffffff8
jmp 0x1403e7426
sub rdi, rax
cmp r14d, esi
cmp rdi, 0x20
jae 0x1403e74c0
add rdx, 0x27
movzx rcx, r8w
mov rdi, rax
bswap cx
movzx cx, r15b
jmp 0x1403e744e
mov rcx, rdi
jmp 0x1403e7456
call fcn.140237311
xorps xmm0, xmm0
movups xmmword [r14], xmm0
add bl, r15b
mov qword [r14 + 0x10], 0
bsf rbx, r11
sal si, 0xd5
movsx r15w, dl
movaps xmm6, xmmword [rsp + 0x20]
and bl, ch
btc bx, di
add rsp, 0x30
movsx rsi, r8w
bswap r14d
pop rbx
movsxd rdi, ebx
movsx si, bpl
movzx r15, dx
pop rdi
movsx r14w, r15b
pop rsi
movsx r14w, al
cmovl r14d, r10d
jmp 0x1403e74b2
pop r14
movsx r15d, r10w
pop r15
jmp 0x1403e74bf
ret
call fcn.1404b3352
int3
Function at 0x1403f29d7
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
test r10b, r14b
push r14
sub r14b, 0xfd
xor r14b, 0x23
neg r14d
push r12
adc r14b, 0xc6
stc
shl r14b, cl
push rsi
movzx r14d, r11w
xadd r14b, r14b
push rdi
btr r14w, r15w
stc
bsf r14w, r11w
push rbx
xadd r14b, r14b
dec r14b
movsx r14d, dx
sub rsp, 0x28
add r14b, bpl
mov r14, r8
test rdx, rdx
jmp 0x1403f2a26
je 0x1403f2c2f
mov rdi, rdx
shrd r12w, bp, 0xfc
bt r12w, bx
mov r12, rcx
cmp dx, 0x1ccf
test r14w, di
sub ebx, ebx
jmp 0x1403f2a4d
jmp 0x1403f2a79
mov rcx, r15
cdq
movzx edx, r14w
mov rdx, rsi
jmp 0x1403f2a62
call fcn.1403b7db3
add rbx, 0x50
jmp 0x1403f2a70
dec rdi
je 0x1403f2c25
mov eax, dword [r12 + rbx + 8]
cmc
test r14, 0x3f44dbd
mov dword [r14 + rbx + 8], eax
cmc
clc
test r12w, 0x3114
cmp r14, r12
jmp 0x1403f2a9b
je 0x1403f2a67
cmp qword [r12 + rbx + 0x28], 0x10
jmp 0x1403f2aac
jb 0x1403f2ac1
mov r9, qword [r12 + rbx + 0x10]
jmp 0x1403f2abc
jmp 0x1403f2ad1
lea r9, [r12 + rbx]
add r9, 0x10
not sil
btr r15w, bx
lea r15, [r14 + rbx]
rol eax, 0x3c
btc si, 0x82
lahf
add r15, 0x10
mov rsi, qword [r12 + rbx + 0x20]
mov ax, 0x18d8
or al, 0x80
ror al, 0x73
mov rax, qword [r14 + rbx + 0x28]
cmp rax, rsi
jmp 0x1403f2afd
jae 0x1403f2b24
mov rcx, r15
movsx dx, sil
mov rdx, 0x5ca9024e
mov rdx, rsi
jmp 0x1403f2b1a
call fcn.1403b7db3
jmp 0x1403f2b69
cmp rax, 0x10
jb 0x1403f2b3a
mov r15, qword [r14 + rbx + 0x10]
movsxd rcx, ebx
movzx r8, si
mov qword [r14 + rbx + 0x20], rsi
mov rcx, r15
cqo
cmovne r8, rbp
mov r8, r9
mov rdx, r9
movsxd r8, r8d
mov r8, rsi
jmp 0x1403f2b59
call fcn.1404a0829
mov byte [r15 + rsi], 0
and esi, esp
sar sil, 0xeb
mov rsi, qword [r12 + rbx + 0x40]
test esi, 0x5e600ec9
cmp qword [r12 + rbx + 0x48], 0x10
jmp 0x1403f2b7f
jb 0x1403f2b94
mov r9, qword [r12 + rbx + 0x30]
jmp 0x1403f2b8f
jmp 0x1403f2bae
lea r9, [r12 + rbx]
cmc
cmp di, r12w
add r9, 0x30
rcl r15w, cl
test r14b, 0x4f
shrd ax, bp, 0x9c
lea r15, [r14 + rbx]
test r14b, 0x67
btr ax, bp
add r15, 0x30
movsx rax, r14w
sub al, r11b
mov rax, qword [r14 + rbx + 0x48]
cmp rax, rsi
jmp 0x1403f2bd2
jb 0x1403f2a52
cmp rax, 0x10
jmp 0x1403f2be1
jb 0x1403f2bf0
mov r15, qword [r14 + rbx + 0x30]
movsx edx, r14w
mov qword [r14 + rbx + 0x40], rsi
movsx dx, al
mov cl, r14b
jmp 0x1403f2c01
mov rcx, r15
cwd
mov rdx, r9
mov r8, rsi
jmp 0x1403f2c11
call fcn.1404a0829
mov byte [r15 + rsi], 0
jmp 0x1403f2c20
jmp 0x1403f2a67
lea r14, [r14 + rbx]
xor eax, ebp
shr ax, 0xc6
mov rax, r14
stc
btr ebx, ebx
sal r15w, 0xb7
add rsp, 0x28
pop rbx
xchg r12, rdi
movzx r12, r12w
pop rdi
movsx r12w, r10b
xchg r15, r14
pop rsi
xchg r14, r12
mov r12, 0x27e726c4
pop r12
pop r14
movsx r15, sp
movsx r15w, cl
cmovnp r15d, esp
pop r15
jmp 0x1403f2c73
ret
Function at 0x140428ae0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rsi
clc
adc sil, r14b
push rdi
and sil, r12b
ror esi, 0x48
sub rsp, 0x28
sbb si, bx
shld si, r11w, 0x46
mov rsi, rcx
cmovg edi, ebx
movzx edi, dx
shrd dx, si, 0xe0
cdq
movzx edx, word [rcx + rdi*4 + 0x834]
stc
clc
test dx, dx
js 0x140428b28
mov rcx, rsi
jmp 0x140428b23
call fcn.140428ae0
movsxd rcx, dword [rsi + 0x8860]
test r14b, 0x7c
cmp ecx, dword [rsi + 0x8858]
jmp 0x140428b3e
jge 0x140428cca
movsxd rax, dword [rsi + 0x885c]
sbb rdx, 0x6d1538cb
movzx edx, r11w
neg r8b
add rax, rcx
mov r8, qword [rsi + 8]
xor rdx, 0x5094074c
lea edx, [rax + 3]
sar ecx, cl
cmc
test eax, eax
xchg rcx, rcx
movzx ecx, sp
movzx cx, ch
cmovns edx, eax
rol cl, 0xb8
xchg ecx, ecx
mov rcx, qword [rsi + 0x18]
sar edx, 2
movsxd rdx, edx
clc
mov byte [rcx + rdx], 1
mov rdx, qword [rsi + 0x8838]
cmp esp, r12d
movzx edi, byte [rsi + rdi*4 + 0x837]
cmc
cmp byte [rdx + rdi*4 + 3], 0x81
jmp 0x140428bad
jb 0x140428be6
movzx ecx, byte [rdx + rdi*4 + 2]
mov byte [r8 + rax], cl
and ecx, ebx
movsx ecx, r10w
movzx ecx, byte [rdx + rdi*4 + 1]
mov byte [r8 + rax + 1], cl
movsx ecx, dx
movzx ecx, byte [rdx + rdi*4]
stc
mov byte [r8 + rax + 2], cl
rcl cl, 7
movzx ecx, byte [rdx + rdi*4 + 3]
mov byte [r8 + rax + 3], cl
mov eax, dword [rsi + 0x885c]
cmc
add eax, 4
mov dword [rsi + 0x885c], eax
cmp eax, dword [rsi + 0x8854]
jl 0x140428cca
mov ecx, dword [rsi + 0x884c]
or ax, 0x4b04
shl ah, cl
mov eax, dword [rsi + 0x8858]
stc
cmc
mov dword [rsi + 0x885c], ecx
bts cx, bp
mov ecx, dword [rsi + 0x8860]
stc
test r9w, si
cmp r11w, 0x1882
add ecx, dword [rsi + 0x8844]
mov dword [rsi + 0x8860], ecx
clc
test r11b, r9b
cmp ecx, eax
jmp 0x140428c48
jl 0x140428cca
mov ecx, dword [rsi + 0x8840]
clc
nop dword [rax]
clc
test bp, 0x354d
test ecx, ecx
jmp 0x140428c69
jle 0x140428cca
mov edx, dword [rsi + 0x8864]
clc
shl edx, cl
mov dword [rsi + 0x8844], edx
test r9, r12
sar edx, 1
stc
cmp r8b, 0x12
test rsi, r13
add edx, dword [rsi + 0x8850]
jmp 0x140428c96
mov dword [rsi + 0x8860], edx
jmp 0x140428ca1
dec ecx
jmp 0x140428cb0
mov dword [rsi + 0x8840], ecx
cmp sil, 0xc
test rbx, r15
cmp edx, eax
jmp 0x140428cc4
jge 0x140428c62
add rsp, 0x28
movsx rsi, r13w
movsx edi, di
pop rdi
pop rsi
jmp 0x140428cdc
ret