joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140075560
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x140
mov rax, qword [0x1400de438]
xor rax, rsp
mov qword [rsp + 0x130], rax
lea ebx, [rdx - 1]
mov rdi, rcx
call fcn.1400757d0
cmp ebx, 0xa
ja case.default.0x1400755a7
lea rcx, [0x140000000]
movsxd rax, ebx
mov edx, dword [rcx + rax*4 + 0x757a4]
add rdx, rcx
jmp rdx
mov r8d, Ordinal_265
lea rdx, [rsp + 0x20]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea rdx, [rsp + 0x20]
mov rcx, rdi
call fcn.1400758b0
jmp case.default.0x1400755a7
mov r8d, Ordinal_265
lea rdx, [rsp + 0x20]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea rdx, [rsp + 0x20]
mov rcx, rdi
call fcn.1400758b0
lea rcx, [rdi + 0x18]
lea rdx, [0x1400a2b28]
call qword [sym.imp.mfc140.dll_Ordinal_1507]
lea rcx, [rdi + 0x10]
lea rdx, [0x1400a2b28]
call qword [sym.imp.mfc140.dll_Ordinal_1507]
jmp case.default.0x1400755a7
mov edx, 0x104
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea rcx, [rsp + 0x20]
mov rax, 0xffffffffffffffff
cmp byte [rcx + rax + 1], 0
lea rax, [rax + 1]
jne 0x140075631
cmp byte [rsp + rax + 0x20], 0x5c
je 0x1400756b4
lea rcx, [rsp + 0x20]
dec rcx
nop dword [rax + rax]
cmp byte [rcx + 1], 0
lea rcx, [rcx + 1]
jne 0x140075650
jmp 0x1400756aa
mov edx, 0x104
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea rcx, [rsp + 0x20]
mov rax, 0xffffffffffffffff
nop dword [rax + rax]
cmp byte [rcx + rax + 1], 0
lea rax, [rax + 1]
jne 0x140075680
cmp byte [rsp + rax + 0x20], 0x5c
je 0x1400756b4
lea rcx, [rsp + 0x20]
dec rcx
nop word [rax + rax]
cmp byte [rcx + 1], 0
lea rcx, [rcx + 1]
jne 0x1400756a0
movzx eax, word [0x1400a2f18]
mov word [rcx], ax
lea rdx, [rsp + 0x20]
mov rcx, rdi
call fcn.1400758b0
jmp case.default.0x1400755a7
lea rdx, [rsp + 0x20]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetTempPathA]
lea rdx, [rsp + 0x20]
mov rcx, rdi
call fcn.1400758b0
jmp case.default.0x1400755a7
lea rdx, str.Desktop
jmp 0x140075778
lea rdx, str.Favorites
jmp 0x140075778
lea rdx, [rsp + 0x20]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetTempPathA]
lea rdx, [0x1400b8914]
lea rcx, [rsp + 0x20]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__tempnam]
lea r8, [rsp + 0x20]
mov rbx, rax
sub r8, rax
mov rdx, rax
movzx ecx, byte [rdx]
mov byte [r8 + rdx], cl
lea rdx, [rdx + 1]
test cl, cl
jne 0x140075730
lea rdx, [rsp + 0x20]
mov rcx, rdi
call fcn.1400758b0
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
jmp case.default.0x1400755a7
lea rdx, str.AppData
jmp 0x140075778
lea rdx, str.Common_AppData
mov rcx, rdi
call fcn.140075450
jmp case.default.0x1400755a7
lea rdx, str.Personal
mov rcx, rdi
call fcn.140075340
mov rcx, qword [rsp + 0x130]
xor rcx, rsp
call fcn.14008bb30
mov rbx, qword [rsp + 0x158]
add rsp, 0x140
pop rdi
ret
Function at 0x14008d200
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14008d24a
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14008d24a
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14008d24a
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14008d24a
cmp dword [rcx + 0x84], 0xe
jbe 0x14008d24a
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14008d24c
xor al, al
add rsp, 0x28
ret
Function at 0x1400072b0
Capabilities:
Access peb ldr_data
Encode data using base64
Encrypt data using speck
Get number of processors
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x2e8
movaps xmmword [rsp + 0x2d0], xmm6
movabs r12, 0xcbf29ce484222325
movabs r14, 0x1d12a89b9e723ff5
lea rcx, [0x1400ce915]
jmp 0x1403b2cde

Function at 0x140008210
Capabilities:
Access peb ldr_data
Encrypt data using speck
Get kernel32 base address
Parse pe header

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x38
movabs r14, 0xcbf29ce484222325
lea rcx, [0x1400ce987]
jmp 0x1403b48ec
Function at 0x14010855b
Capabilities:
Encrypt data using rc4 prga

Disassembly:
ret
jne 0x1401ffcb4
movzx eax, byte [r11 + rcx*4 + 1]
cmp r8b, r8b
stc
cmp al, byte [rdx + 1]
jne 0x1401ffcb4
movzx eax, byte [r11 + rcx*4 + 2]
cmp spl, 0xb9
cmp al, byte [rdx + 2]
jmp 0x140205c63
jne 0x14012939a
jmp 0x1400e0193
je 0x1400e0193
lea ecx, [r9 - 1]
clc
test bpl, dl
cmp ecx, 3
jmp 0x1401ec86f
mov r10, qword [rcx]
mov r11, qword [rcx + 0x18]
rol r9b, cl
dec r9b
mov r9d, dword [r10 + 4]
imul r9d, dword [r10]
test r14b, r15b
jmp 0x140227759
mov byte [r11 + rcx*2 + 1], al
jmp 0x140123008
inc rcx
stc
test r15b, r10b
cmp r9d, ecx
jmp 0x1400e232c
jmp 0x14029b251
je 0x1400e0193
and r9d, 3
xor ecx, ecx
nop word cs:[rax + rax]
xor ax, 0x7fc0
movzx eax, byte [r11 + rcx*2]
cmc
stc
cmp al, byte [rdx]
setne al
clc
neg al
jmp 0x14011a0d1
jb 0x140250a64
mov r8d, r9d
rcl rcx, 0x3a
inc ch
and r8d, 0xfffffffc
rcl r10b, cl
sub r10b, r13b
rcl r10, 0x3c
nop word cs:[rax + rax]
movsx r10w, r15b
movsx r10d, bp
movzx ecx, byte [r11]
inc r10b
ror r10w, cl
cmp cl, byte [rdx]
setno r10b
movzx r10d, byte [r11 + 2]
not cl
xchg cl, cl
setne cl
jmp 0x1402939d3
cmp cl, byte [rdx]
setne cl
cmp al, r14b
test bpl, 0xfd
neg cl
test r13b, 0xc8
mov byte [r11 + 5], cl
rol cl, 0x27
setg cl
movzx ecx, byte [r11 + 6]
stc
cmp cl, byte [rdx]
setne cl
jmp 0x140238a52
inc rcx
cmp r8d, ecx
jmp 0x14029b24b
jne 0x1401ffcb4
mov byte [r11 + rcx*4 + 3], 0
cmovle r10d, r15d
movsx r10w, r14b
sets r10b
movzx r10d, byte [rdx]
jmp 0x140290c90
cmp r8d, 2
jmp 0x1402536d9
neg cl
cmp r13w, 0x68e5
stc
mov byte [r11 + 7], cl
add r11, 8
clc
cmp rsp, r8
test spl, r11b
add r8d, 0xfffffffc
jmp 0x140250a5e
jne 0x1401ec8a3
test r9b, 3
jmp 0x140129380
jne 0x140260a80
test r9d, r9d
jmp 0x1400ea2ac
test r9d, r9d
jmp 0x14029189c
jmp 0x1401ffcb4
je 0x1400e0193
movzx r10d, byte [rdx]
bt r8, 1
rol r8b, cl
xadd r8w, r8w
mov r8d, r9d
cmp rbp, 0x74eb08f4
cmc
clc
sub ecx, ecx
jmp 0x1401233ea
neg cl
test r13b, sil
mov byte [r11 + 1], cl
cmp r10b, byte [rdx]
setne cl
stc
cmp r14b, r9b
test al, r12b
neg cl
cmp ax, r8w
mov byte [r11 + 3], cl
shl cx, cl
shld ecx, ecx, 0xe5
movzx ecx, byte [r11 + 4]
stc
jmp 0x1401fb89c
je 0x1400e0193
cmp byte [r11 + rcx*4], r10b
jmp 0x1400e01b8
Function at 0x140121c89
Capabilities:
Access peb ldr_data
Encrypt data using rc4 prga
Get number of processors

Disassembly:
je 0x1400e65e7
mov word [r10], 0
rcl rax, cl
movzx eax, word [0x1400b8f10]
cmp rdx, 0x104
mov r8d, 0x104
jmp 0x14022c8c6
jne 0x14018b01d
sub r8, rax
jmp 0x140119883
ret
test r8, r8
jmp 0x1400e65d8
movzx eax, word [0x1400b8f10]
clc
stc
test ax, ax
jmp 0x14029b4d0
mov r8d, 0x104
jmp 0x140218b10
je 0x140119883
xor eax, eax
cmc
jmp 0x14018b017
nop word [rax + rax]
cmp r8, rax
jmp 0x1401d192a
mov rax, qword gs:[0x30]
sub r8w, 0x4cc6
mov rax, qword [rax + 0x60]
bsf r9, rdi
mov r11b, r8b
rcr r10w, cl
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
and r11, 0x2e1e7e38
sar r11b, cl
movzx r11, bx
movzx r8d, word [rax + 0x58]
xor r11b, dil
bts r10, r11
cmp r8, rdx
setns r9b
movzx r11w, dl
cmovae r8, rdx
movzx r10w, sil
sar r9w, 0x3f
mov r9, qword [rax + 0x60]
btc r10w, 0x3d
movzx r11d, word [r9]
shl r10b, cl
shrd r10d, r10d, 0xda
rcl r10b, 0x83
lea r10, [0x1400b8f10]
test bp, bx
stc
cmp r15b, 0xb3
test r11w, r11w
jmp 0x14015929a
jne 0x1401ea0d6
sub r8, rdx
test r8, r8
jmp 0x1401f0d28
jmp 0x140205c54
je 0x1400e65de
mov word [r10], r11w
sal r11b, 0xb8
shl r11w, cl
add r10, 2
movzx r11w, r8b
sets r11b
jmp 0x14026d1c4
je 0x1401f0d2e
mov word [rcx], ax
sbb al, 0x59
add ax, r12w
add rcx, 2
mov rax, 0x32612882
movsx eax, bp
movzx eax, word [r9 + rdx*2 + 2]
inc rdx
clc
cmp rbx, 0x79dd1955
test ax, ax
jmp 0x1401a5ffa
cmp r8, rdx
jmp 0x1401da056
je 0x14010fe64
mov word [rcx], 0
jmp 0x14010fe64
je 0x1401a6003
sub edx, edx
lea r9, [0x1400b8f10]
cmc
jmp 0x1401ea0d6
cmovb r8, rdx
jmp 0x1401b6411
cmovb r8, rdx
cmp al, r10b
clc
cmp ch, 0xe9
test ax, ax
jmp 0x140205c4e
inc rax
test r14w, r9w
test r11b, 0xb9
test r11w, r11w
jmp 0x140104428
movzx r11d, word [r9 + rax*2 + 2]
jmp 0x14022eb54
je 0x140191868
cmp rdx, 0x104
movsxd r8, r9d
setg r8b
jmp 0x14013a278
Function at 0x1401cafa8
Capabilities:
Parse pe header

Disassembly:
jmp 0x1404b6794
xor r8d, r8d
bswap dx
lea edx, [r8 + 2]
jmp 0x14010ca91
mov qword [rsp + 8], rbx
mov dword [rsp + 0x18], r8d
movzx ebx, dx
shr bx, 0x5d
movzx rbx, dx
mov dword [rsp + 0x10], edx
movsxd rbx, r12d
cmp bpl, 0x39
stc
push rbp
mov rbp, rsp
bt bx, 0xf8
rcl rbx, cl
sub rsp, 0x50
bts bx, r14w
or bx, 0x4b0f
mov ebx, ecx
test r8d, r8d
jmp 0x1404b67d9
jne 0x1404b6871
sub ecx, ecx
jmp 0x1404b67e6
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
jmp 0x1404b67f4
je 0x1404b6871
mov ecx, 0x5a4d
jmp 0x1404b6804
cmp word [rax], cx
jmp 0x1404b680c
jne 0x1404b6871
movsxd rcx, dword [rax + 0x3c]
stc
lea rcx, [rcx + rax]
jmp 0x1404b6820
cmp dword [rcx], 0x4550
jne 0x1404b6871
mov eax, 0x20b
cmc
cmp word [rcx + 0x18], ax
jmp 0x1404b683b
jne 0x1404b6871
cmp dword [rcx + 0x84], 0xe
jmp 0x1404b684d
jbe 0x1404b6871
cmp dword [rcx + 0xf8], 0
jmp 0x1404b685f
je 0x1404b6871
mov ecx, ebx
jmp 0x1404b686c
call fcn.1404b6652
lea rax, [rbp + 0x18]
cdq
mov byte [rbp + 0x28], 0
movzx dx, r12b
sets ch
mov qword [rbp - 0x20], rax
cmovno rcx, r10
rdtsc
lea r9, [rbp - 0x2c]
lea rax, [rbp + 0x20]
mov qword [rbp - 0x18], rax
lea r8, [rbp - 0x20]
bswap ecx
lea rax, [rbp + 0x28]
movsx rdx, ax
setp cl
mov qword [rbp - 0x10], rax
bswap cx
movzx rcx, di
jmp 0x1404b68b9
lea rdx, [rbp - 0x28]
mov ah, 0x8a
mov eax, 2
bswap rcx
lea rcx, [rbp - 0x30]
jmp 0x1404b68d1
mov dword [rbp - 0x2c], eax
jmp 0x1404b68d9
mov dword [rbp - 0x28], eax
call fcn.1404b6a8b
cmp dword [rbp + 0x20], 0
jmp 0x1404b68ea
je 0x1404b6909
mov rbx, qword [rsp + 0x60]
test r11w, 0x2de6
add rsp, 0x50
movzx ebp, si
pop rbp
jmp 0x1404b6908
ret
mov ecx, ebx
jmp 0x1404b6910
call fcn.1404b670d
int3

Function at 0x1401d8446
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x1404b6794
Function at 0x140216faa
Capabilities:
Enumerate pe sections

Disassembly:
movsxd r8, dword [rcx + 0x3c]
or rax, r11
movsxd r10, r12d
xor r9d, r9d
add r8, rcx
movsx r11d, r9w
movzx r11w, r11b
sal r10w, cl
mov r10, rdx
bsf ax, r12w
movzx eax, word [r8 + 0x14]
dec r11
btc r11d, ecx
stc
movzx r11d, word [r8 + 6]
test rdx, rbx
clc
add rax, 0x18
cmc
add rax, r8
cmp r9w, ax
clc
test r11d, r11d
je 0x1402371e2
mov edx, dword [rax + 0xc]
cmp r11, 0x129001e9
cmp rdi, r9
cmp r10, rdx
jmp 0x14025ebb3
jb 0x140216ffb
xor eax, eax
ret
jb 0x1402739ba
mov ecx, dword [rax + 8]
test ax, 0x303a
add ecx, edx
cmp dx, 0x21c8
cmc
stc
cmp r10, rcx
jmp 0x1402739b4
jb 0x1402371e4
inc r9d
add rax, 0x28
test r8b, r10b
cmc
cmp r9d, r11d
jmp 0x1402371dc

Function at 0x14021e6e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
ret
jmp 0x14025fb09
movzx edx, word [rcx]
rol r8b, cl
sub r10d, r10d
mov r8d, r10d
movzx r9, dx
movsx r9w, al
cmovae r9w, r13w
mov r9, rcx
jmp 0x140238bc0
lea eax, [rdx - 0x41]
test r8b, 0x65
cmc
cmp r15b, bl
cmp ax, 5
jmp 0x14025faf3
jmp 0x14025fb3d
lea eax, [rdx - 0x61]
lea r9, [r9 + 2]
cmp ebx, 0x6577326c
cmp ax, 5
jmp 0x14025ce8e
ja 0x140224acc
mov eax, 0xffd9
jmp 0x1401282d3
ja 0x14025fb17
mov eax, 0xfff9
sub cl, r15b
btc cx, 0xc2
shl cl, 0
add dx, ax
rol rcx, 0xd9
sar ch, 0xf8
cmp si, r9w
shl r8d, 4
shld cx, dx, 0x33
add ch, 0x68
movzx ecx, dx
xor dl, 0x11
add r8d, 0xffffffd0
stc
shl dx, 0x40
ror dh, 0xc6
movzx edx, word [r9]
add r8d, ecx
cmc
test dx, dx
jmp 0x140277e36
jne 0x14023d283
mov eax, r8d
jmp 0x1400f5251

Function at 0x140246276
Capabilities:
Encrypt data using speck
Get number of processors
Resolve function by parsing pe exports

Disassembly:
mov rcx, qword [rcx]
jmp 0x14044b7d7
push rsi
cwde
and esi, r8d
mov rsi, r8
push rdi
ror rax, 0x3d
sub rsp, 0x28
shld ax, ax, 0xae
movsx eax, bx
mov rsi, rcx
mov rcx, qword [rcx + 0x18]
ror al, cl
mov rax, qword [rcx]
jmp 0x14044b805
sub edx, edx
xor r8d, r8d
jmp 0x14044b80f
call qword [rax + 0x188]
mov edi, eax
not cl
mov cl, bh
lea rcx, [rsi + 0x30]
call fcn.14045f3f3
test edi, edi
jmp 0x14044b82b
je 0x14044b862
cmp edi, 0x8899000c
jmp 0x14044b83c
jne 0x14044b87d
mov rcx, rsi
jmp 0x14044b852
add rsp, 0x28
pop rdi
pop rsi
jmp 0x14044b85d
jmp fcn.14044b494
nop
test r8b, r14b
add rsp, 0x28
bswap rdi
mov edi, 0x40f60dae
mov sil, sil
pop rdi
pop rsi
jmp 0x14044b87c
ret
mov ecx, edi
mov dl, 0xad
movsxd rsi, ecx
or sil, 5
movabs r8, 0xad4a5352d2edebd0
bsf di, r8w
cmp cx, 0x129c
movsxd rdi, r13d
mov dl, 3
or rsi, 0x445636d
mov r9d, 0x54
movsx esi, sp
add rsp, 0x28
movsx di, spl
pop rdi
movsxd rsi, r8d
jmp 0x14044b8c3
pop rsi
jmp 0x14044b8c9
jmp fcn.1403b4efd

Function at 0x14027a099
Capabilities:
Parse pe header

Disassembly:
ret
ret
add rdx, rcx
cmp ebp, r12d
cmp dword [rdx], 0x4550
jne 0x140267a26
sub eax, eax
sar ch, 0x77
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
mov al, bpl
sete al
jmp 0x1401c93b4
xor eax, eax
jmp 0x1401ab715
mov eax, 0x5a4d
test bpl, r9b
cmp word [rcx], ax
jne 0x140267a26
movsxd rdx, dword [rcx + 0x3c]
jmp 0x1401d1019
Function at 0x1403c2bed
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
push r14
cmp r8b, 0x9a
stc
push r12
push rsi
push rdi
mov r12b, 0x75
push rbx
bt r12d, 0x7c
sub rsp, 0x28
mov r12, r8
clc
cmp r9w, dx
test r10w, r9w
test rdx, rdx
jmp 0x1403c2c1b
je 0x1403c2e42
mov r15, rdx
bswap rbx
sar bh, cl
mov rbx, rcx
clc
xor esi, esi
jmp 0x1403c2c34
jmp 0x1403c2c78
mov rcx, rdi
movzx dx, bpl
mov rdx, r14
call fcn.1403c0abe
mov eax, dword [rbx + rsi + 0x58]
cmp r13w, ax
mov dword [r12 + rsi + 0x58], eax
mov rax, qword [rbx + rsi + 0x50]
stc
mov qword [r12 + rsi + 0x50], rax
add rsi, 0x60
jmp 0x1403c2c6a
dec r15
jmp 0x1403c2c72
je 0x1403c2e39
mov eax, dword [rbx + rsi + 8]
test bpl, 0x94
cmp rbp, 0x13d77351
mov dword [r12 + rsi + 8], eax
cmp r12w, di
jmp 0x1403c2c95
cmp r12, rbx
jmp 0x1403c2c9d
je 0x1403c2c49
cmp qword [rbx + rsi + 0x28], 0x10
jmp 0x1403c2cae
jb 0x1403c2cc3
mov r9, qword [rbx + rsi + 0x10]
jmp 0x1403c2cbe
jmp 0x1403c2cdc
lea r9, [rbx + rsi]
bsf rax, r8
cwde
rcl r14b, cl
add r9, 0x10
cmp bx, r9w
btr ax, 0xe4
lea r14, [r12 + rsi]
add ax, r14w
dec dil
or rdi, 0x38697056
add r14, 0x10
xor ah, bh
mov rdi, qword [rbx + rsi + 0x20]
bsf eax, r13d
bts eax, r15d
mov rax, qword [r12 + rsi + 0x28]
cmp r15b, dl
jmp 0x1403c2d0e
cmp rax, rdi
jmp 0x1403c2d16
jae 0x1403c2d36
mov rcx, r14
jmp 0x1403c2d24
mov rdx, rdi
jmp 0x1403c2d2c
call fcn.1403c0abe
jmp 0x1403c2d8a
cmp rax, 0x10
jmp 0x1403c2d3f
jb 0x1403c2d4f
mov r14, qword [r12 + rsi + 0x10]
jmp 0x1403c2d4f
mov qword [r12 + rsi + 0x20], rdi
movsxd rdx, edi
movzx cx, r11b
movsx r8, bx
mov rcx, r14
not dl
movsx r8w, dil
mov rdx, r9
mov r8, rdi
jmp 0x1403c2d75
call fcn.1404a8f08
mov byte [r14 + rdi], 0
xchg r14w, r14w
shl r14, cl
dec r14w
mov r14, qword [rbx + rsi + 0x40]
cmp qword [rbx + rsi + 0x48], 0x10
jb 0x1403c2daa
mov r9, qword [rbx + rsi + 0x30]
jmp 0x1403c2da5
jmp 0x1403c2db6
lea r9, [rbx + rsi]
shl di, cl
cmc
add r9, 0x30
lea rdi, [r12 + rsi]
rol rax, cl
rcr rax, 0xd1
add rdi, 0x30
add ax, r11w
cmp dh, bh
add ax, 0x6bbf
mov rax, qword [r12 + rsi + 0x48]
cmp rax, r14
jmp 0x1403c2ddc
jb 0x1403c2c39
cmp rax, 0x10
jmp 0x1403c2deb
jb 0x1403c2e00
mov rdi, qword [r12 + rsi + 0x30]
movzx rdx, bp
mov ch, ah
cmova cx, bx
mov qword [r12 + rsi + 0x40], r14
cdq
movzx r8w, r8b
mov r8b, 1
mov rcx, rdi
setp dh
cmovnp dx, bp
xchg dl, dh
mov rdx, r9
mov r8, r14
jmp 0x1403c2e25
call fcn.1404a8f08
mov byte [rdi + r14], 0
jmp 0x1403c2e34
jmp 0x1403c2c49
lea r12, [r12 + rsi]
shl dil, 0x82
clc
mov rax, r12
ror r15w, 0x8c
rcr bh, 0xd8
add rsp, 0x28
setno bl
movsx r12w, bpl
not bl
pop rbx
bswap r15w
pop rdi
setns r15b
movsx si, dil
pop rsi
movzx r14, r15w
bswap r15w
pop r12
jmp 0x1403c2e7e
pop r14
movzx r15d, r9w
pop r15
jmp 0x1403c2e8b
ret
Function at 0x1403c6ba1
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rsi
shr sil, cl
movzx rax, r9w
rol al, 0x23
push rdi
sal al, 0xbc
push rbx
adc sil, r13b
sub rsp, 0x20
shr rax, cl
sub si, 0x40ff
bsf si, si
mov rsi, rcx
or ah, 0xe
add al, 0x9c
shld ax, sp, 0x56
lea rax, [0x1400bdab0]
cmp r10b, cl
mov qword [rcx], rax
inc eax
mov rax, qword [rcx + 0x88]
cmp rax, 8
jmp 0x1403c6bf0
jb 0x1403c6c69
mov rcx, qword [rsi + 0x70]
cmp r10b, 0x24
and dl, 0xcc
lea rdx, [rax + rax]
clc
stc
add rdx, 2
stc
jmp 0x1403c6c11
cmp rdx, 0x1000
jmp 0x1403c6c1d
jb 0x1403c6c64
mov rbx, qword [rcx - 8]
test spl, 0xc9
test dx, r10w
add rcx, 0xfffffffffffffff8
cmp r8b, r11b
clc
sub rcx, rbx
jmp 0x1403c6c40
cmp rcx, 0x20
jmp 0x1403c6c49
jae 0x1403c6dcc
add rax, rax
add rax, 0x29
movsxd rcx, r10d
mov rdx, rax
mov rcx, rbx
jmp 0x1403c6c64
call fcn.1401f8216
movaps xmm0, xmmword [0x1400bd3f0]
jmp 0x1403c6c75
movups xmmword [rsi + 0x80], xmm0
bt edi, 0x9d
mov word [rsi + 0x70], 0
or bl, r12b
shld rax, r13, 0x2c
movzx bx, bpl
lea rax, [0x1400bdb70]
cmovle edi, r10d
mov qword [rsi], rax
clc
jmp 0x1403c6ca7
mov rdi, qword [rsi + 0x40]
xor bh, 0x96
test r12, 0x57ef1559
movzx rbx, r15w
mov rbx, qword [rsi + 0x48]
clc
cmp rdi, rbx
jmp 0x1403c6cc6
jne 0x1403c6ce4
jmp 0x1403c6d25
add rdi, 8
stc
cmp rdi, rbx
jmp 0x1403c6cde
je 0x1403c6d09
mov rcx, qword [rdi]
clc
test rcx, rcx
je 0x1403c6cd1
mov rax, qword [rcx]
mov edx, 1
jmp 0x1403c6cfe
call qword [rax + 0xb8]
jmp 0x1403c6cd1
mov rdi, qword [rsi + 0x40]
cmp rdi, qword [rsi + 0x48]
jmp 0x1403c6d16
je 0x1403c6d25
mov qword [rsi + 0x48], rdi
cmp di, r11w
clc
test rdi, rdi
jmp 0x1403c6d2d
je 0x1403c6db9
mov rdx, qword [rsi + 0x50]
sub rdx, rdi
cmp rdx, 0x1000
jmp 0x1403c6d46
jb 0x1403c6d8b
mov rax, qword [rdi - 8]
add rdi, 0xfffffffffffffff8
test r8b, cl
clc
cmp rbx, r10
sub rdi, rax
clc
test r10d, r8d
cmp r12b, 0x9b
cmp rdi, 0x20
jmp 0x1403c6d6f
jae 0x1403c6dcc
add rdx, 0x27
rcl cx, 0xf7
add dil, 0xa3
mov rdi, rax
bt cx, cx
shl ch, 0x10
add rsi, 0x40
mov ch, cl
sete cl
movzx cx, r10b
mov rcx, rdi
call fcn.1401f8216
xorps xmm0, xmm0
movups xmmword [rsi], xmm0
rcl bx, cl
stc
mov qword [rsi + 0x10], 0
dec sil
mov bl, r15b
add rsp, 0x20
pop rbx
not dil
movzx edi, r15w
movsx rdi, di
pop rdi
pop rsi
ret
call fcn.1404bb982
int3
Function at 0x1403e5abc
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rsi
add r9b, 3
rcr r10d, cl
push rdi
rol r10b, 0xe5
push rbx
or r10, rax
sub r10b, r9b
mov r9, rcx
btr r10w, 0xa
lea r8, [r8 + rdx]
not r10w
btc r10w, 0x13
inc r10w
mov dword [rcx + 8], 0
sub eax, eax
cmp r9w, r13w
sbb r10b, 0x4b
rcl r10d, cl
xor ecx, ecx
bsf r10w, r8w
movsx r10w, cl
nop word cs:[rax + rax]
shr r10d, 0x58
inc r10b
and r10w, 0x257a
lea r10, [rdx + 1]
cmc
test r8, 0x153a7c80
cmp r10, r8
jmp 0x1403e5b38
ja 0x1403e5d92
movzx edi, byte [rdx]
mov edx, edi
and edx, 0x7f
shl rdx, cl
jmp 0x1403e5b4e
lea rax, [rax + rdx]
clc
btc dx, 0x2a
xchg dh, dh
add rcx, 7
dec dh
rcr dh, 0x14
movzx edx, ax
mov rdx, r10
stc
test r12b, r8b
test dil, dil
jmp 0x1403e5b75
js 0x1403e5b24
mov rcx, rax
and rcx, 0xfffffffffffffff8
cmp spl, dil
and eax, 7
cmp r14b, cl
clc
cmp r15d, 0x5a1f5666
cmp rcx, 8
jmp 0x1403e5b9c
je 0x1403e5cd1
cmp rax, 1
jmp 0x1403e5bab
jg 0x1403e5bd6
test rax, rax
je 0x1403e5c74
cmp eax, 1
jmp 0x1403e5bc2
jne 0x1403e5d92
lea rdx, [r10 + 8]
jmp 0x1403e5bd1
jmp 0x1403e5cc0
cmp eax, 5
je 0x1403e5cb1
cmp eax, 2
jmp 0x1403e5be7
jne 0x1403e5d92
mov rsi, r10
rol ah, 0xbc
lahf
not ah
xor edi, edi
sub ecx, ecx
nop word cs:[rax + rax]
cmc
lea rax, [rsi + 1]
stc
cmp r15b, bl
cmp rax, r8
jmp 0x1403e5c16
ja 0x1403e5d92
mov r11, rdi
ror dx, cl
inc bl
movzx edx, cx
movzx ebx, byte [rsi]
movzx dx, spl
bts rdx, r14
mov edx, ebx
shr si, cl
and edx, 0x7f
shl rdx, cl
lea rdi, [rdi + rdx]
sar si, cl
shl rsi, 0x24
cmp r9b, 0xd5
add rcx, 7
mov rsi, rax
test bl, bl
js 0x1403e5c06
add rdx, r11
lea rdx, [rdx + rax]
cmp rdx, r8
jmp 0x1403e5c6b
cmova rdx, rax
jmp 0x1403e5af2
mov rax, r10
movsx edx, sp
add edx, eax
nop
lea rdx, [rax + 1]
stc
cmp r15b, dil
test r8b, cl
cmp rdx, r8
jmp 0x1403e5c91
ja 0x1403e5d92
cmp byte [rax], 0
mov eax, 0x9a32068
movzx rax, di
mov rax, rdx
js 0x1403e5c7e
jmp 0x1403e5af2
lea rdx, [r10 + 4]
stc
cmp r14d, edx
test r8, 0x2a03596e
cmp rdx, r8
jmp 0x1403e5cc8
cmova rdx, r10
jmp 0x1403e5af2
cmp eax, 2
jmp 0x1403e5cd9
jne 0x1403e5d92
mov dword [r9 + 8], 2
mov rsi, r10
sbb dl, r15b
or rdx, 0x1b3643d8
setne dh
xor eax, eax
dec dx
rol dl, cl
cdq
xor ecx, ecx
bswap rdx
sal rdx, 0x6a
cqo
nop word [rax + rax]
lea rdx, [rsi + 1]
cmp r10b, r12b
cmp rdx, r8
jmp 0x1403e5d1f
ja 0x1403e5d92
movzx r11d, byte [rsi]
shrd si, bp, 0x5a
mov edi, r11d
xor rsi, rbx
or sil, r12b
or si, 0xd55
and edi, 0x7f
test ebp, ecx
shl rdi, cl
bsr si, di
or si, bp
add rax, rdi
sal sil, cl
clc
jmp 0x1403e5d57
add rcx, 7
add si, 0x143b
bts si, sp
mov rsi, rdx
test r11b, r11b
jmp 0x1403e5d6f
js 0x1403e5d10
mov qword [r9 + 0x10], rdx
clc
test dh, 0xab
mov qword [r9 + 0x18], rax
clc
cmc
add rdx, rax
cmp r13b, dl
cmp rdx, r8
jbe 0x1403e5af2
cmp r10, r8
seta al
movsxd rsi, r15d
pop rbx
pop rdi
movzx esi, ax
movsx rsi, r9w
cmovae si, si
pop rsi
ret
Function at 0x1403eabfa
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
push r14
cmc
movzx r15d, bp
movsx r15w, bl
push r13
test bx, 0x3535
push r12
xadd r14, r12
cmp bx, 0x2a61
push rsi
and r13d, 0x73e755fe
movzx r13w, r11b
push rdi
cmc
shld r14w, di, 0x2a
push rbp
sub r14b, sil
movzx r15, bp
push rbx
rcl r14b, 0x1f
sub rsp, 0x38
rol r15b, cl
sar r15w, 0x68
movaps xmmword [rsp + 0x20], xmm6
mov r14, r9
btr r15, 0x8c
shl bh, cl
mov r15, r8
bsf r13w, ax
rcl bx, cl
movsxd rbx, esp
mov r12, rdx
mov r13, rcx
movsx ebx, r8w
ror bh, cl
mov rbx, qword [rcx]
cmp r10b, 0x5b
test rax, r10
test rbx, rbx
jmp 0x1403eac83
je 0x1403eadc9
mov rdi, qword [r13 + 8]
test rcx, r14
cmc
cmp rbx, rdi
je 0x1403ead70
lea rbp, [0x1400bed30]
jmp 0x1403eaca6
movaps xmm6, xmmword [0x1400bd400]
jmp 0x1403eacdb
call fcn.1401f8216
movups xmmword [rbx + 0x20], xmm6
mov byte [rbx + 0x10], 0
jmp 0x1403eacc5
add rbx, 0x38
jmp 0x1403eacd2
cmp rbx, rdi
je 0x1403ead61
mov qword [rbx], rbp
cdqe
rol ah, cl
mov rax, qword [rbx + 0x28]
test rcx, 0x420833
cmp rax, 0x10
jmp 0x1403eacf6
jb 0x1403eacb7
mov rcx, qword [rbx + 0x10]
btc rdx, 0x8b
xor edx, 0x2c733f95
lea rdx, [rax + 1]
cmc
cmp r15b, spl
cmp rdx, 0x1000
jmp 0x1403ead1f
jb 0x1403eacb2
mov rsi, qword [rcx - 8]
stc
test r12b, r9b
add rcx, 0xfffffffffffffff8
sub rcx, rsi
cmp rcx, 0x20
jmp 0x1403ead3d
jae 0x1403eae72
add rax, 0x28
cwd
cdq
bswap rcx
mov rdx, rax
movsx rcx, r10w
mov rcx, rsi
jmp 0x1403ead5c
jmp 0x1403eacb2
mov rbx, qword [r13]
btr edx, 0x70
bts dx, di
add rdx, rax
mov rdx, qword [r13 + 0x10]
jmp 0x1403ead7a
sub rdx, rbx
cmp rdx, 0x1000
jmp 0x1403ead89
jb 0x1403eadbc
mov rax, qword [rbx - 8]
add rbx, 0xfffffffffffffff8
cmp dx, 0x22c2
sub rbx, rax
cmp rbx, 0x20
jmp 0x1403eada8
jae 0x1403eae72
add rdx, 0x27
movsxd rbx, ebp
mov rbx, rax
movsx rcx, cx
mov rcx, rbx
jmp 0x1403eadc4
call fcn.1401f8216
mov qword [r13], r12
movsxd rbp, r15d
cmovl ebx, r14d
add ah, 0xb6
imul rax, r15, 0x38
rol di, 0xf8
sar rbx, cl
adc sil, 0x42
add rax, r12
bsf r15w, ax
mov qword [r13 + 8], rax
stc
bsr r15w, bp
cmp eax, 0x331e4888
imul rax, r14, 0x38
cmc
sal bx, cl
sbb r14b, 0x9e
add rax, r12
ror bpl, cl
mov r15w, r15w
mov qword [r13 + 0x10], rax
rcr r15w, cl
sar r15w, cl
or bx, 0x13b
movaps xmm6, xmmword [rsp + 0x20]
bswap r12w
add rsp, 0x38
setno r12b
mov dil, 0xcd
movzx r15d, sp
pop rbx
movzx rbp, r10w
pop rbp
movsx rdi, bp
pop rdi
movsx r12d, r15w
pop rsi
pop r12
movsxd r15, ecx
pop r13
movzx r14d, bp
not r14b
pop r14
movsx r15d, cx
movzx r15d, r9w
mov r15d, 0x54eb0720
pop r15
jmp 0x1403eae71
ret
call fcn.1404bb982
int3