joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14000d768
Capabilities:
Enumerate pe sections

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x58
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x60]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
movzx eax, word [rax + 0x14]
mov rcx, qword [rsp + 0x30]
lea rax, [rcx + rax + 0x18]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0
jmp 0x14000d7d3
mov eax, dword [rsp + 0x20]
inc eax
mov dword [rsp + 0x20], eax
mov rax, qword [rsp + 0x28]
add rax, 0x28
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x30]
movzx eax, word [rax + 6]
cmp dword [rsp + 0x20], eax
jge 0x14000d843
mov rax, qword [rsp + 0x28]
mov eax, dword [rax + 0x24]
and eax, 0x20
test eax, eax
je 0x14000d83e
mov rax, qword [rsp + 0x28]
mov eax, dword [rax + 0xc]
mov rcx, qword [rsp + 0x60]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x28]
mov eax, dword [rax + 0x10]
mov rcx, qword [rsp + 0x38]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x48], rax
mov r8, qword [rsp + 0x48]
mov rdx, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x68]
call fcn.140015288
movzx eax, al
test eax, eax
je 0x14000d83e
jmp 0x14000d843
jmp 0x14000d7bb
mov rcx, qword [rsp + 0x68]
call fcn.140002cac
add rsp, 0x58
ret

Function at 0x14001ff48
Capabilities:
Access peb ldr_data
Get number of processors
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
sub rsp, 0x218
lea rcx, [0x1400c91f0]
jmp 0x140399769

Function at 0x14002502c
Capabilities:
Get number of processors
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
call fcn.140001df1
cmp cl, ah
jmp fcn.14039c5b8

Function at 0x14002d460
Capabilities:
Encrypt data using rc4 prga

Disassembly:
call fcn.1400514fc
adc eax, 0xe9cccccc
sal byte [rdi], 1
add byte [rdi], dh
invalid

Function at 0x14002d954
Capabilities:
Hash data with crc32

Disassembly:
pushfq
add qword [rsp + 8], 0xffffffffbfba3e6b
call fcn.1400299ee
push rdi
jmp fcn.1403aadb1

Function at 0x14002f17c
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov r10, qword [rsp + 8]
not r8w
jns 0x14000d60f
stosb byte [rdi], al
jmp fcn.1403ad66d

Function at 0x14002fa9f
Capabilities:
Parse pe header

Disassembly:
sub r8d, r8d
lea edx, [r8 + 2]
jmp 0x14004f3de
jmp fcn.1400a98a8

Function at 0x140035ddc
Capabilities:
Encrypt data using rc4 prga

Disassembly:
call fcn.14003886c
test eax, 0x35aee9e6
sub al, byte [rax]
add byte [rcx + 0x35aee9e6], ch
cmp byte [rax], al
push rsi
imul ecx, ebp, 0xcfda8215
jrcxz 0x140035e08
invalid
nop
invalid
int1
je 0x140035e29
or ebx, 0x30
sbb al, 0xbc
sub dl, dl
cmpsd dword [rsi], dword [rdi]
jrcxz 0x140035e1d
out 0xcd, eax
call 0x18cb0417f
invalid
invalid
sbb al, 0x3e
mov bh, 0xdf
sahf
movsd dword [rdi], dword [rsi]
jrcxz 0x140035de9
jge 0x140035dd7
push rdx
sbb al, 0xae
scasb al, byte [rdi]
invalid
Function at 0x14003b118
Capabilities:
Execute anti-debugging instructions
Resolve function by parsing pe exports

Disassembly:
pushfq
add qword [rsp + 8], 0xffffffffbfc685f1
push r15
movabs r15, 0xbc3f0f9df39a861a
push r12
test r15w, 0xa199
movabs r12, 0x3b8b832528a7fe07
mov qword [rsp + 0x18], 0x45869a36
mov r15, qword [rsp + 8]
call fcn.140002ebd
jle 0x1400782cb
cld
mov esp, ecx
jmp fcn.1403c21cf
mov r8d, 0x6d22658b
mov r8, qword [rsp + r8 - 0x6d226573]
mov qword [rsp + 0x18], 0x4d5894b0
push qword [rsp + 8]
popfq
lea rsp, [rsp + 0x18]
call fcn.1402ab923
push rbp
invalid

Function at 0x14003be98
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov r10, qword [rsp + r10*4 - 0x3e40024c]
mov qword [rsp + 0x10], 0xffffffffe9604c05
push qword [rsp + 8]
popfq
lea rsp, [rsp + 0x10]
call fcn.140304831
mov r15b, 1
sbb byte [rcx], al
add byte [rax], bl
loop 0x14003be93
add byte [rcx - 0x163333be], cl
invalid

Function at 0x1400430d4
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp], 0x46df4b22
call fcn.14034bf13
pop rsi
xchg ebx, eax
stosb byte [rdi], al
add dword [rax], ebx
add dword [rax], eax
sbb byte [rdx + 0xa010000], ah
add dword [rax], eax
or al, byte [rdx - 0x5170000]
invalid

Function at 0x140047d88
Capabilities:
Encode data using base64
Encrypt data using speck
Execute anti-debugging instructions

Disassembly:
push rdx
mov r11, qword [rsp + 0x18]
mov qword [rsp + 0x18], 0x18a35785
push qword [rsp + 0x10]
popfq
lea rsp, [rsp + 0x18]
call fcn.140304831
add dword [rcx], ebx
or al, byte [rax]
sbb dword [rcx + rcx], esi
sbb dword [rax + rcx], esp
sbb dword [rdi + rax], edx
sbb dword [rsi + rax], esi
add byte [rcx], bl
xor dl, byte [0x141117f63]
add byte [0x129047deb], cl
invalid

Function at 0x14004a740
Capabilities:
Execute anti-debugging instructions

Disassembly:
call fcn.1400307b5
add dword [rax], eax
jmp fcn.1403dc19a

Function at 0x14004d8a8
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
not rbp
call fcn.1400502f7
mov ebp, 0xe9cccc5f
mov edx, 0x6000393c
ret

Function at 0x14004e3a4
Capabilities:
Parse pe header

Disassembly:
jne 0x14002bad2
movsxd rdx, dword [rcx + 0x3c]
jmp 0x14005c15d
mov eax, 0x5a4d
cmp r10b, 0x12
cmp word [rcx], ax
jmp 0x140001eea
lea rdx, [rdx + rcx]
cmp dword [rdx], 0x4550
jne 0x14002bad2
sub eax, eax
mov ecx, 0x20b
xor al, 0x3e
cmp word [rdx + 0x18], cx
sete al
ret

Function at 0x140051f2c
Capabilities:
Encode data using base64
Execute anti-debugging instructions

Disassembly:
push r13
movabs r13, 0x409ca22db4b19e29
call fcn.140047269
push rbx
jmp fcn.1403e9545

Function at 0x140054e40
Capabilities:
Resolve function by parsing pe exports

Disassembly:
call fcn.14004101c
xlatb
cmpsb byte [rsi], byte [rdi]
movabs al, byte [0xfc6c4400399840e9]
div ah
mov esp, 0xc6fbfb68
invalid
Function at 0x140054fb4
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push r13
push rdi
push rcx
mov qword [rsp + 0x18], 0xffffffff8b324dbc
lea rsp, [rsp + 0x18]
lea esp, [rsp + 0x18]
call fcn.1402eb7a1
jo 0x140054fa2
or al, byte [rax + rax]
add al, 0
or dh, byte [rsi + rax]
add byte [rdx], cl
xor al, byte [rsi]
jo 0x140054f96
invalid
enter 0xfffffffffffffc59, 0xffffffffffffffff
add ah, cl
jmp fcn.1403ee927

Function at 0x1400592ec
Capabilities:
Execute anti-debugging instructions

Disassembly:
call fcn.14004d9ac
sbb dword [rdx], 0xfae9cccc
invalid

Function at 0x14005ecac
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push qword [rsp + 0x10]
popfq
lea rsp, [rsp + 0x28]
call fcn.1402ecb68
jmp fcn.1403ffd4e

Function at 0x140062b6c
Capabilities:
Encrypt data using rc4 prga

Disassembly:
shr dx, 0xb7
js 0x140062b4d
add qword [rsp], 0xffffffffbfffedb3
call fcn.14006599c
pushfq
cmp ecx, 0x38ffab8
ja 0x140069a1c
sub eax, 0xe9cccccc
invalid
mov rcx, qword [rsp + 0x18]
mov qword [rsp + 0x18], 0x4dd19a90
push qword [rsp]
popfq
lea rsp, [rsp + 0x18]
call fcn.1402ab923

Function at 0x14006bdfc
Capabilities:
Encode data using base64
Execute anti-debugging instructions

Disassembly:
call fcn.140053243
sub eax, 0x67e9cc9b
mov dl, 0x3a
add byte [rcx], al
invalid

Function at 0x14006f244
Capabilities:
Log keystrokes via polling

Disassembly:
movabs r12, 0x35847d07aa9abd06
add r12w, r12w
mov qword [rsp + 0x18], 0x1a3a46bc
mov r12, qword [rsp + 8]
call fcn.140029799
shufps xmm1, xmmword [rbx + 0x2d], 0xe9
invalid

Function at 0x14006fd9c
Capabilities:
Execute anti-debugging instructions

Disassembly:
shl bp, 0xcb
sub bpl, 0x3b
mov rbp, qword [rsp + 0x18]
mov qword [rsp + 0x18], 0xfffffffffd604c0d
push qword [rsp + 0x10]
popfq
lea rsp, [rsp + 0x18]
call fcn.14025bf52
add dword [rdx], ebx
add al, byte [rax]
sbb al, byte [rcx]
adc eax, dword [rax]
adc eax, 0x31e96635
fnstsw word [rdx]
add byte [rdi + 0x4fa936f1], bl
and ebx, esi
leave
shr dword es:[rbp - 0xc59348b], cl
mul dword [rdi + 0x1ff7e6cb]
mov ebx, 0xc586cc33
pop rsp
sub eax, edi
cmpsb byte [rsi], byte [rdi]
hlt
Function at 0x140076744
Capabilities:
Execute anti-debugging instructions

Disassembly:
movss dword [rax + 0x20], xmm0
jmp 0x14006cc0a
mov rax, qword [rsp + 8]
jmp 0x1400789d6
mov byte [rax + 0x94], 0
mov rax, qword [rsp + 0x10]
jmp 0x14006d327
xorps xmm0, xmm0
jmp 0x140019349
comiss xmm0, dword [rax + 4]
jae 0x140040f22
mov rax, qword [rsp + 8]
jmp 0x14004ec03
call fcn.140006eb8
xorps xmm0, xmm0
jmp 0x140074196
mov rax, qword [rsp + 8]
jmp 0x140064c04
movzx r10w, r10b
xor r10d, r10d
not r10b
jae 0x140076716
mov byte [rax + 0x95], 0
bswap ax
movsxd rax, r8d
cbw
mov rax, qword [rsp + 0x10]
jmp 0x140041120
mov rax, qword [rsp + 8]
jmp 0x140077ae9
mov byte [rax + 0x95], 2
jmp 0x140004cc3
jmp 0x140097319
cvttss2si eax, dword [rax]
cvtsi2ss xmm0, eax
mov rax, qword [rsp + 8]
jmp 0x140001ef9
comiss xmm0, dword [rax]
jae 0x140053e0c
mov rax, qword [rsp + 8]
jmp 0x14001569c
jo 0x140076716
neg r10d
not r10w
mov r10, qword [rsp + 8]
jbe 0x140036ac0
add dword [rdx], eax
add dword [rax], eax
add dl, byte [rax]
add byte [rcx - 0x4f2f09f8], cl
add ecx, ebp
wait
sub bh, bl
dec esp
jmp fcn.140428aeb
mov byte [rax + 0x94], 2
lahf
seta al
mov rax, qword [rsp + 8]
jmp 0x140097309
mov byte [rax + 0x97], 0
jmp 0x14000157c
mov byte [rax + 0x97], 0
not al
nop
movzx ax, r10b
mov rax, qword [rsp + 0x10]
jmp 0x140018741

Function at 0x14008d83c
Capabilities:
Execute anti-debugging instructions

Disassembly:
push r15
pushfq
movabs r15, 0x9e2f39125e89adaa
mov qword [rsp + 0x10], 0x455f65d3
mov r15, qword [rsp + 8]
popfq
lea rsp, [rsp + 8]
call fcn.14025bf52
jmp fcn.14044e475

Function at 0x1400947c4
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
sub edx, edx
jmp fcn.1400a98a8

Function at 0x14009741c
Capabilities:
Allocate thread local storage

Disassembly:
push qword [rsp + 8]
popfq
lea rsp, [rsp + 0x20]
call fcn.14028cf49
fcom qword [rcx - 0x16333334]
invalid
push rsi
cmp al, 0

Function at 0x1400974ed
Capabilities:
Enumerate pe sections

Disassembly:
je 0x14006a9c4
movsxd r8, dword [rcx + 0x3c]
adc r10b, 0x84
not ax
and r10b, r12b
xor r9d, r9d
setnp r10b
not r11b
shl ax, cl
add r8, rcx
mov r10, rdx
movzx eax, word [r8 + 0x14]
movzx r11d, word [r8 + 6]
clc
add rax, 0x18
cmp r9w, 0x90a4
stc
cmc
add rax, r8
test edx, r15d
test r11d, r11d
jmp 0x1400699c9

Function at 0x140098414
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
jae 0x14005ba07
jbe 0x140098403
push qword [rsp + 8]
popfq
lea rsp, [rsp + 0x18]
call fcn.14028cf49
sub al, 0xcc
jmp fcn.14045e6f0

Function at 0x14009960c
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbp
pushfq
movabs rbp, 0x44b21d1e2791149f
shl bpl, 0xa1
call fcn.140043b79
pop rsi
adc eax, 0xe9cccca9
mov ebp, 0x31003c70
int3
Function at 0x1400a1998
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov eax, 0x1050
call fcn.1400b7139
sub rsp, rax
mov rax, qword [0x1400d9018]
xor rax, rsp
mov qword [rsp + 0x1040], rax
mov r15, r8
mov rbp, rdx
mov rbx, rcx
call fcn.1400acc30
xor edi, edi
movsxd r14, eax
cmp dword [rbx + 0x10], edi
jne 0x1400a19e7
mov rax, rbp
jmp 0x1400a1aef
mov rax, qword [rbx]
mov rcx, r14
sub rax, qword [rbx + 8]
and ecx, 0x3f
cqo
mov rbx, r14
sub rax, rdx
sar rbx, 6
sar rax, 1
mov r9, r15
lea r12, [rcx + rcx*8]
mov rsi, rax
lea rax, [0x140000000]
xor r8d, r8d
mov rdx, qword [rax + rbx*8 + 0xdb290]
mov ecx, r14d
mov rdx, qword [rdx + r12*8 + 0x30]
call fcn.1400ad0b0
mov r13, rax
lea rax, [0x140000000]
mov rcx, qword [rax + rbx*8 + 0xdb290]
cmp r13, qword [rcx + r12*8 + 0x30]
jne 0x1400a1aeb
mov rcx, qword [rcx + r12*8 + 0x28]
lea r9, [rsp + 0x30]
mov r8d, 0x1000
mov qword [rsp + 0x20], rdi
lea rdx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1400a1aeb
mov r9, r15
xor r8d, r8d
mov rdx, rbp
mov ecx, r14d
call fcn.1400ad0b0
test rax, rax
js 0x1400a1aeb
mov eax, dword [rsp + 0x30]
cmp rsi, rax
jg 0x1400a1aeb
lea rdx, [rsp + 0x40]
add rdx, rax
lea rcx, [rsp + 0x40]
test rsi, rsi
je 0x1400a1add
lea r8, [0x140000000]
cmp rcx, rdx
jae 0x1400a1add
cmp byte [rcx], 0xd
jne 0x1400a1ac3
lea rax, [rdx - 1]
cmp rcx, rax
jae 0x1400a1ad2
cmp byte [rcx + 1], 0xa
jne 0x1400a1ad2
inc rcx
jmp 0x1400a1ad2
movzx eax, byte [rcx]
movsx rax, byte [rax + r8 + 0xd9340]
add rcx, rax
inc rdi
inc rcx
cmp rdi, rsi
jne 0x1400a1aa5
lea rax, [rsp + 0x40]
sub rcx, rax
lea rax, [rcx + r13]
jmp 0x1400a1aef
or rax, 0xffffffffffffffff
mov rcx, qword [rsp + 0x1040]
xor rcx, rsp
call fcn.140098c70
mov rbx, qword [rsp + 0x1090]
add rsp, 0x1050
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400ad15c
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
movsxd r15, ecx
lea r9, [0x1400db290]
mov rax, r15
mov rbp, r15
and eax, 0x3f
sar rbp, 6
mov ecx, 4
xor esi, esi
mov r14, rdx
lea rdi, [rax + rax*8]
mov rax, qword [r9 + rbp*8]
lea r13d, [rcx + 6]
mov r10, qword [rax + rdi*8 + 0x28]
test r8, r8
je 0x1400ad1b3
cmp word [rdx], r13w
jne 0x1400ad1b3
or byte [rax + rdi*8 + 0x38], cl
jmp 0x1400ad1b8
and byte [rax + rdi*8 + 0x38], 0xfb
lea r8, [rdx + r8*2]
mov rbx, r14
cmp r14, r8
jae 0x1400ad2dd
mov r11d, 0xd
lea r12d, [r11 - 0xb]
movzx ecx, word [rdx]
cmp cx, 0x1a
je 0x1400ad2fe
lea r9, [rdx + 2]
cmp cx, r11w
je 0x1400ad1f1
mov rdx, r9
mov word [rbx], cx
jmp 0x1400ad218
cmp r9, r8
jae 0x1400ad228
cmp word [r9], r13w
mov rax, r12
mov ecx, 4
cmove rax, rcx
add rdx, rax
mov eax, r13d
cmp word [r9], r13w
cmovne ax, r11w
mov word [rbx], ax
mov rax, r12
add rbx, rax
cmp rdx, r8
jb 0x1400ad1d2
jmp 0x1400ad2dd
lea r9, [rsp + 0x80]
mov qword [rsp + 0x20], rsi
mov r8d, r12d
lea rdx, [rsp + 0x70]
mov rcx, r10
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1400ad2d2
cmp dword [rsp + 0x80], esi
je 0x1400ad2d2
lea r8, [0x1400db290]
mov rax, qword [r8 + rbp*8]
test byte [rax + rdi*8 + 0x38], 0x48
je 0x1400ad2aa
movzx eax, word [rsp + 0x70]
cmp ax, r13w
jne 0x1400ad27a
mov word [rbx], r13w
jmp 0x1400ad2da
mov ecx, 0xd
mov word [rsp + 0x78], ax
mov word [rbx], cx
mov rax, qword [r8 + rbp*8]
lea rcx, [rax + rdi*8]
mov al, byte [rsp + rsi + 0x78]
mov byte [rcx + rsi + 0x3a], al
inc rsi
cmp rsi, r12
jl 0x1400ad287
mov rax, qword [r8 + rbp*8]
mov byte [rax + rdi*8 + 0x3c], r13b
jmp 0x1400ad2da
cmp word [rsp + 0x70], r13w
jne 0x1400ad2b7
cmp rbx, r14
je 0x1400ad274
mov rdx, 0xfffffffffffffffe
mov ecx, r15d
lea r8d, [rdx + 3]
call fcn.1400ad0b8
cmp word [rsp + 0x70], r13w
je 0x1400ad2dd
mov ecx, 0xd
mov word [rbx], cx
add rbx, r12
sub rbx, r14
sar rbx, 1
lea eax, [rbx + rbx]
mov rbx, qword [rsp + 0x88]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
lea r8, [0x1400db290]
mov rdx, qword [r8 + rbp*8]
mov al, byte [rdx + rdi*8 + 0x38]
test al, 0x40
jne 0x1400ad2d7
or al, r12b
mov byte [rdx + rdi*8 + 0x38], al
jmp 0x1400ad2dd
Function at 0x14037612b
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 8], rcx
jmp 0x140376138
sub rsp, 0x18
test bpl, 0xb
cmp qword [rsp + 0x20], 0
jmp 0x14037614b
jne 0x140376158
sub eax, eax
jmp 0x1403761da
mov rax, qword [rsp + 0x20]
clc
cmp r15, r12
mov qword [rsp], rax
lahf
cdqe
mov rax, qword [rsp]
cmc
movzx eax, word [rax]
cmp eax, 0x5a4d
jmp 0x14037617a
je 0x14037618c
sub eax, eax
jmp 0x140376187
jmp 0x1403761da
mov rax, qword [rsp]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
clc
jmp 0x1403761a3
lea rcx, [rcx + rax]
add ax, 0xf98e
mov rax, rcx
mov qword [rsp + 8], rax
mov rax, qword [rsp + 8]
cmp dword [rax], 0x4550
jmp 0x1403761c3
je 0x1403761d5
xor eax, eax
jmp 0x1403761d0
jmp 0x1403761da
mov rax, qword [rsp + 8]
add rsp, 0x18
jmp 0x1403761e3
ret
Function at 0x1403aa4cb
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
cmp r10b, 0x27
push rsi
cmp eax, 0x86bddd33
test r8w, 0x9d9d
push rdi
sub rsp, 0x68
cmp qword [rsp + 0x88], 0
jmp 0x1403aa4fd
je 0x1403aa522
mov rax, qword [rsp + 0x88]
jmp 0x1403aa510
mov rax, qword [rax]
mov qword [rsp + 0x38], rax
jmp 0x1403aa51d
jmp 0x1403aa592
mov rax, qword [rsp + 0x80]
movzx ecx, cx
bswap cx
xchg cx, cx
mov qword [rsp + 0x40], rax
inc cl
mov qword [rsp + 0x20], 0xffffffffffffffff
setae ch
inc qword [rsp + 0x20]
bts ax, r10w
bswap cx
neg rax
mov rax, qword [rsp + 0x40]
movsx cx, bh
movsx ecx, ax
or ch, dh
mov rcx, qword [rsp + 0x20]
cmp byte [rax + rcx], 0
jne 0x1403aa546
mov rax, qword [rsp + 0x20]
movzx ecx, r8w
movzx cx, ch
inc rax
movzx rcx, dx
mov qword [rsp + 0x38], rax
mov cl, bpl
mov ch, 0xa5
mov rax, qword [rsp + 0x38]
not rcx
mov cl, r9b
jmp 0x1403aa5a2
mov qword [rsp + 0x50], rax
lahf
setg al
movsx ax, bl
mov rax, qword [rsp + 0x90]
mov rcx, r14
movzx rcx, r10w
xchg ecx, ecx
mov qword [rsp + 0x48], rax
jmp 0x1403aa5ca
mov qword [rsp + 0x28], 0xffffffffffffffff
cbw
inc qword [rsp + 0x28]
mov rax, qword [rsp + 0x48]
shr ecx, 0x30
sar ch, cl
xor rcx, r14
mov rcx, qword [rsp + 0x28]
cmp byte [rax + rcx], 0
jmp 0x1403aa5f5
jne 0x1403aa5d5
mov rax, qword [rsp + 0x28]
jmp 0x1403aa605
inc rax
test di, si
mov qword [rsp + 0x30], rax
bts eax, r15d
adc al, r12b
mov rax, qword [rsp + 0x30]
cmp qword [rsp + 0x50], rax
jae 0x1403aa674
mov rcx, qword [rsp + 0x80]
call fcn.1403b3bcb
mov rcx, qword [rsp + 0x30]
jmp 0x1403aa63e
call fcn.1403b3b23
mov qword [rsp + 0x80], rax
cmp qword [rsp + 0x88], 0
je 0x1403aa674
mov rax, qword [rsp + 0x88]
mov rcx, qword [rsp + 0x30]
cmovb rsi, r11
movzx esi, ax
mov qword [rax], rcx
mov ax, cx
mov rdi, qword [rsp + 0x80]
jmp 0x1403aa681
mov rsi, qword [rsp + 0x90]
movzx ecx, si
mov rcx, qword [rsp + 0x30]
not ax
movsx rax, di
mov al, r12b
rep movsb byte [rdi], byte [rsi]
mov rax, qword [rsp + 0x80]
inc edi
shr sil, 0x15
add rsp, 0x68
pop rdi
pop rsi
jmp 0x1403aa6b6
ret
Function at 0x1403aac6b
Capabilities:
Hash data with crc32

Disassembly:
mov dword [rsp + 0x18], r8d
shld ax, r11w, 0xe
stc
rol ax, 0x9b
mov qword [rsp + 0x10], rdx
shl eax, cl
sar al, 0xa9
mov qword [rsp + 8], rcx
movsx eax, ax
or ax, bp
sub rsp, 0x28
mov eax, dword [rsp + 0x40]
jmp 0x1403aac9d
not eax
jmp 0x1403aaca4
mov dword [rsp], eax
cmovbe ax, cx
mov rax, qword [rsp + 0x30]
jmp 0x1403aacb5
mov qword [rsp + 8], rax
movzx ax, r11b
movsx eax, di
lea rax, [0x1400c95e0]
jmp 0x1403aacce
mov qword [rsp + 0x18], rax
cwde
movsx ax, dil
mov rax, qword [rsp + 0x38]
jmp 0x1403aace3
mov qword [rsp + 0x10], rax
mov rax, qword [rsp + 0x38]
dec rax
cmc
cmp cl, r12b
mov qword [rsp + 0x38], rax
cmp sil, cl
stc
cmp qword [rsp + 0x10], 0
jmp 0x1403aad08
je 0x1403aada0
mov eax, dword [rsp]
xor dl, 0x8b
shr eax, 8
btc rdx, rbp
bsr cx, r8w
sub ecx, r13d
mov ecx, dword [rsp]
rol dh, cl
movsx edx, r14w
and ecx, 0xff
movzx edx, di
cmc
mov rdx, qword [rsp + 8]
jmp 0x1403aad42
movzx edx, byte [rdx]
xor ecx, edx
mov ecx, ecx
movzx edx, r10w
sal dl, 0xf
shr rdx, cl
mov rdx, qword [rsp + 0x18]
cmp r10b, 0xa3
xor eax, dword [rdx + rcx*4]
jmp 0x1403aad64
mov dword [rsp + 4], eax
lahf
setb ah
cdqe
mov rax, qword [rsp + 8]
jmp 0x1403aad78
inc rax
jmp 0x1403aad80
mov qword [rsp + 8], rax
cmovl ax, cx
movzx eax, ax
bswap ax
mov eax, dword [rsp + 4]
mov dword [rsp], eax
jmp 0x1403aad9b
jmp 0x1403aacd9
mov eax, dword [rsp]
stc
not eax
cmc
add rsp, 0x28
jmp 0x1403aadb0
ret
Function at 0x1403ac0d6
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x20], r9
bt ax, 0x23
mov qword [rsp + 0x18], r8
add ah, 0xb3
sar ax, cl
jmp 0x1403ac0f0
mov dword [rsp + 0x10], edx
btr eax, 0xbd
mov qword [rsp + 8], rcx
rcr ah, 0x3b
sub rsp, 0x48
setp cl
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x28], rax
movzx rax, sp
movsxd rax, dword [rsp + 0x58]
cmovle cx, r12w
mov rcx, qword [rsp + 0x50]
cmc
lea rax, [rcx + rax*2]
jmp 0x1403ac130
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
sub rax, 2
cmp qword [rsp + 0x28], rax
jmp 0x1403ac148
jae 0x1403ac224
cmp qword [rsp + 0x68], 0
je 0x1403ac176
mov rax, qword [rsp + 0x68]
test r9w, 0xf981
clc
cmp qword [rsp + 0x60], rax
jmp 0x1403ac170
jae 0x1403ac224
mov rax, qword [rsp + 0x60]
movsx eax, byte [rax]
cmp ah, ah
test eax, eax
jmp 0x1403ac187
je 0x1403ac224
mov r8, qword [rsp + 0x68]
movsx dx, dl
cwd
movzx cx, sil
mov rdx, qword [rsp + 0x60]
movzx rcx, bx
mov cl, 0xad
lea rcx, [rsp + 0x20]
jmp 0x1403ac1b2
call fcn.1403ab711
cdqe
and ch, 0x2d
movzx cx, r8b
sub cl, 0x85
mov rcx, qword [rsp + 0x60]
lea rcx, [rcx + rax]
sub ax, dx
mov rax, rcx
mov qword [rsp + 0x60], rax
test di, 0x2e3d
cmp dword [rsp + 0x20], 0
jne 0x1403ac1ed
jmp 0x1403ac224
mov rax, qword [rsp + 0x28]
stc
xchg ecx, ecx
movzx ecx, word [rsp + 0x20]
mov word [rax], cx
test dl, ah
rcl ax, cl
mov rax, qword [rsp + 0x28]
cmp bp, 0x5c13
add rax, 2
jmp 0x1403ac215
mov qword [rsp + 0x28], rax
jmp 0x1403ac21f
jmp 0x1403ac135
sub eax, eax
or cl, 0x93
jmp 0x1403ac232
mov rcx, qword [rsp + 0x28]
mov word [rcx], ax
cmp qword [rsp + 0x70], 0
jmp 0x1403ac245
je 0x1403ac26b
mov rax, qword [rsp + 0x70]
xor cx, r9w
inc ch
mov rcx, qword [rsp + 0x60]
test dx, si
mov qword [rax], rcx
bts cx, r9w
shr cl, cl
rol ch, 0x23
mov rax, qword [rsp + 0x50]
neg rcx
add cx, 0x188f
mov rcx, qword [rsp + 0x28]
test r12b, 0x15
test r14b, bl
cmp bpl, 9
sub rcx, rax
neg ah
rcr ah, 0xbf
cbw
mov rax, rcx
cmc
sar rax, 1
cmp edx, ebp
add rsp, 0x48
jmp 0x1403ac2a4
ret
Function at 0x1403ae4bc
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov dword [rsp + 8], ecx
sub rsp, 0x58
mov rax, qword [0x1400db970]
stc
mov qword [rsp + 0x38], rax
cmp spl, 0x99
test dx, 0x5b18
cmp dword [rsp + 0x60], 0
jmp 0x1403ae4e4
jle 0x1403ae758
mov rax, qword [rsp + 0x38]
bswap rcx
cmp r8b, r11b
add ch, 0x2d
add rax, 0x1bb8
movsx ecx, r12w
movsx rcx, r13w
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
jmp 0x1403ae518
mov eax, dword [rax]
movzx rcx, bp
movsx cx, sil
mov ch, bl
dec eax
sal cl, cl
shl cx, 0
setnp cl
cdqe
xor ch, 0x3e
imul rax, rax, 0xc
sbb cx, 0x9dbe
stc
bsf cx, bx
mov rcx, qword [rsp + 0x40]
cmc
add rax, qword [rcx + 8]
setg cl
movzx ecx, dx
mov cl, 0x32
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
mov cl, 0x99
mov ecx, dword [rax]
jmp 0x1403ae568
call fcn.14004e7f9
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x20]
mov eax, dword [rax + 8]
ror cl, cl
mov rcx, qword [rsp + 0x38]
test r13, 0xffffffff8a257b8f
lea rax, [rcx + rax + 0x1568]
jmp 0x1403ae595
mov qword [rsp + 0x30], rax
mov ax, r13w
cdqe
mov rax, qword [rsp + 0x20]
cmp dword [rax], 8
jne 0x1403ae616
mov rax, qword [rsp + 0x20]
jmp 0x1403ae5bc
cmp dword [rax + 4], 1
jmp 0x1403ae5c5
jne 0x1403ae616
mov eax, 4
movzx rdx, sp
movzx dx, ch
imul rax, rax, 0
mov ecx, 4
imul rcx, rcx, 0
cqo
movzx dx, dil
mov rdx, qword [rsp + 0x30]
jmp 0x1403ae5f6
mov r8, qword [rsp + 0x28]
jmp 0x1403ae600
movss xmm0, dword [r8 + rax + 4]
jmp 0x1403ae60c
movss dword [rdx + rcx], xmm0
jmp 0x1403ae6f3
mov rax, qword [rsp + 0x20]
cmp dx, 0xf537
test bx, r14w
cmp dword [rax], 8
jne 0x1403ae6f3
mov rax, qword [rsp + 0x20]
test dil, 0x37
test r11d, r10d
stc
cmp dword [rax + 4], 2
jmp 0x1403ae643
jne 0x1403ae6f3
mov eax, 4
and ecx, r15d
imul rax, rax, 0
adc cl, bpl
movsx r8w, r11b
mov ecx, 4
shrd r8w, bx, 0xb2
rcl r8, 0x32
add dl, r15b
imul rcx, rcx, 0
bt rdx, 0x3a
mov rdx, qword [rsp + 0x30]
movsx r8, dx
btc r8, 0x97
rol r8b, 0
mov r8, qword [rsp + 0x28]
clc
movss xmm0, dword [r8 + rax + 4]
inc r8b
movss dword [rdx + rcx], xmm0
rcr al, cl
mov eax, 4
movzx ecx, r10w
imul rax, rax, 1
movsx r8d, ax
bt dx, 8
mov ecx, 4
cdq
xchg r8b, dl
imul rcx, rcx, 1
mov rdx, qword [rsp + 0x30]
adc r8b, 0xb7
mov r8, qword [rsp + 0x28]
jmp 0x1403ae6db
movss xmm0, dword [r8 + rax + 4]
rcl eax, 0x10
movss dword [rdx + rcx], xmm0
stc
or cl, 0x95
test bp, 0xe18d
mov rax, qword [rsp + 0x38]
add rax, 0x1bb8
movzx ecx, r8w
xchg cx, cx
mov cx, 0x7639
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x48]
dec cx
movsx ecx, r12w
movsxd rcx, r15d
mov eax, dword [rax]
mov cl, r12b
mov ch, 6
dec cx
dec eax
movsx ecx, bx
movsxd rcx, r11d
mov rcx, qword [rsp + 0x48]
mov dword [rcx], eax
movsx eax, bx
mov eax, dword [rsp + 0x60]
jmp 0x1403ae743
dec eax
jmp 0x1403ae74a
mov dword [rsp + 0x60], eax
jmp 0x1403ae753
jmp 0x1403ae4da
add rsp, 0x58
jmp 0x1403ae761
ret