joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140003c90
Capabilities:
Parse pe header

Disassembly:
push rbx
sub rsp, 0x40
mov qword [rsp + 0x58], rdx
mov rbx, r8
xor edx, edx
test rcx, rcx
je 0x140003cc4
cmp word [rcx], 0x5a4d
jne 0x140003cc4
movsxd rax, dword [rcx + 0x3c]
cmp eax, 0x400
jg 0x140003cc4
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140003cc4
mov edx, dword [rcx + 0x28]
add rdx, qword [rsp + 0x58]
mov rcx, rbx
call fcn.140003bd0
test eax, eax
jne 0x140003ce0
xor eax, eax
add rsp, 0x40
pop rbx
ret
mov rcx, rbx
call fcn.140003c40
test rax, rax
je 0x140003cd5
lea rdx, [rax + 0x10]
lea rax, [rsp + 0x38]
mov rcx, qword [rbx]
mov r9d, 8
mov qword [rsp + 0x20], rax
lea r8, [rsp + 0x58]
mov qword [rsp + 0x38], 0
call fcn.140004483
not eax
shr eax, 0x1f
add rsp, 0x40
pop rbx
ret

Function at 0x140004390
Capabilities:
Execute syscall

Disassembly:
pop rax
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
sub rsp, 0x28
mov rcx, r10
call fcn.140004330
add rsp, 0x28
mov rcx, qword [rsp + 8]
mov rdx, qword [rsp + 0x10]
mov r8, qword [rsp + 0x18]
mov r9, qword [rsp + 0x20]
mov r10, rcx
syscall
ret

Function at 0x1400047e4
Capabilities:
Allocate or change rwx memory

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x50
mov rax, qword [0x14055f678]
xor ebx, ebx
add rax, 0x18
mov r12, rcx
mov ecx, dword [0x14055f674]
mov rsi, rdx
mov rdi, r8
cmp ebx, ecx
jge 0x140004832
mov rdx, qword [rax]
cmp r12, rdx
jb 0x14000482a
mov r8, qword [rax + 8]
mov r8d, dword [r8 + 8]
add rdx, r8
cmp r12, rdx
jb 0x140004919
inc ebx
add rax, 0x28
jmp 0x14000480a
mov rcx, r12
call fcn.140005011
mov rbp, rax
test rax, rax
jne 0x140004851
mov rdx, r12
lea rcx, str.Address__p_has_no_image_section
call fcn.140004780
movsxd rbx, ebx
mov rax, qword [0x14055f678]
xor edx, edx
imul rbx, rbx, 0x28
add rax, rbx
mov dword [rax], edx
mov qword [rax + 0x20], rbp
call fcn.1400050bf
mov edx, dword [rbp + 0xc]
mov r8d, 0x30
lea rcx, [rax + rdx]
mov rax, qword [0x14055f678]
lea rdx, [rsp + 0x20]
mov qword [rax + rbx + 0x18], rcx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
jne 0x1400048b3
mov rax, qword [0x14055f678]
mov edx, dword [rbp + 8]
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov r8, qword [rax + rbx + 0x18]
call fcn.140004780
mov eax, dword [rsp + 0x44]
lea edx, [rax - 4]
and edx, 0xfffffffb
je 0x140004913
lea edx, [rax - 0x40]
and edx, 0xffffffbf
je 0x140004913
cmp eax, 2
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x38]
mov r8d, 0x40
mov eax, 4
cmove r8d, eax
add rbx, qword [0x14055f678]
mov qword [rbx + 8], rcx
mov r9, rbx
mov qword [rbx + 0x10], rdx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x140004913
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.__VirtualProtect_failed_with_code_0x_x
mov edx, eax
call fcn.140004780
inc dword [0x14055f674]
mov ecx, edi
mov rdi, r12
rep movsb byte [rdi], byte [rsi]
add rsp, 0x50
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
Function at 0x140004d40
Capabilities:
Get thread local storage value

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x20
lea rdi, [0x14055f6e0]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x14055f6c0]
test rbx, rbx
je 0x140004d8c
mov ecx, dword [rbx]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
test rsi, rsi
je 0x140004d86
test eax, eax
jne 0x140004d86
mov rax, qword [rbx + 8]
mov rcx, rsi
call rax
mov rbx, qword [rbx + 0x10]
jmp 0x140004d5e
mov rcx, rdi
add rsp, 0x20
pop rbx
pop rsi
pop rdi
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]

Function at 0x140004f40
Capabilities:
Parse pe header

Disassembly:
xor eax, eax
cmp word [rcx], 0x5a4d
jne 0x140004f63
movsxd rdx, dword [rcx + 0x3c]
add rcx, rdx
cmp dword [rcx], 0x4550
jne 0x140004f63
xor eax, eax
cmp word [rcx + 0x18], 0x20b
sete al
ret

Function at 0x140004f64
Capabilities:
Enumerate pe sections

Disassembly:
xor r8d, r8d
movsxd rax, dword [rcx + 0x3c]
add rcx, rax
movzx eax, word [rcx + 0x14]
movzx r9d, word [rcx + 6]
lea rax, [rcx + rax + 0x18]
cmp r8d, r9d
jae 0x140004f9e
mov r10d, dword [rax + 0xc]
mov rcx, r10
cmp rdx, r10
jb 0x140004f95
add ecx, dword [rax + 8]
cmp rdx, rcx
jb 0x140004fa0
inc r8d
add rax, 0x28
jmp 0x140004f7c
xor eax, eax
ret

Function at 0x140005011
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r9, qword [0x14055b770]
mov r8, rcx
mov rcx, r9
call fcn.140004f40
test eax, eax
je 0x14000503d
mov rdx, r8
mov rcx, r9
sub rdx, r9
add rsp, 0x28
jmp fcn.140004f64
xor eax, eax
add rsp, 0x28
ret
Function at 0x1400032d0
Capabilities:
Write file on windows

Disassembly:
push rsi
push rbx
sub rsp, 0x38
mov rbx, rcx
lea rax, [rsp + 0x58]
mov ecx, 2
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x68], r9
mov qword [rsp + 0x28], rax
call fcn.140009dd0
mov r8d, 0x1b
mov edx, 1
lea rcx, str.Mingw_w64_runtime_failure:_n
mov r9, rax
call sub.msvcrt.dll_fwrite
mov rsi, qword [rsp + 0x28]
mov ecx, 2
call fcn.140009dd0
mov rdx, rbx
mov rcx, rax
mov r8, rsi
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
nop
nop dword [rax]

Function at 0x140003340
Capabilities:
Allocate or change rwx memory

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x50
movsxd rsi, dword [0x1400100a4]
mov rbx, rcx
test esi, esi
jle 0x140003470
mov rax, qword [0x1400100a8]
xor r9d, r9d
add rax, 0x18
nop word [rax + rax]
mov r8, qword [rax]
cmp rbx, r8
jb 0x14000338b
mov rdx, qword [rax + 8]
mov edx, dword [rdx + 8]
add r8, rdx
cmp rbx, r8
jb 0x140003415
add r9d, 1
add rax, 0x28
cmp r9d, esi
jne 0x140003370
mov rcx, rbx
call fcn.140003d90
mov rdi, rax
test rax, rax
je 0x140003492
mov rax, qword [0x1400100a8]
lea rbx, [rsi + rsi*4]
shl rbx, 3
add rax, rbx
mov qword [rax + 0x20], rdi
mov dword [rax], 0
call fcn.140003ed0
mov edx, dword [rdi + 0xc]
mov r8d, 0x30
lea rcx, [rax + rdx]
mov rax, qword [0x1400100a8]
lea rdx, [rsp + 0x20]
mov qword [rax + rbx + 0x18], rcx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x140003477
mov eax, dword [rsp + 0x44]
lea edx, [rax - 0x40]
and edx, 0xffffffbf
je 0x14000340e
lea edx, [rax - 4]
and edx, 0xfffffffb
jne 0x140003420
add dword [0x1400100a4], 1
add rsp, 0x50
pop rbx
pop rsi
pop rdi
ret
cmp eax, 2
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x38]
mov r8d, 0x40
mov eax, 4
cmove r8d, eax
add rbx, qword [0x1400100a8]
mov qword [rbx + 8], rcx
mov r9, rbx
mov qword [rbx + 0x10], rdx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x14000340e
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.__VirtualProtect_failed_with_code_0x_x
mov edx, eax
call fcn.1400032d0
nop dword [rax]
xor esi, esi
jmp 0x140003398
mov rax, qword [0x1400100a8]
mov edx, dword [rdi + 8]
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov r8, qword [rax + rbx + 0x18]
call fcn.1400032d0
mov rdx, rbx
lea rcx, str.Address__p_has_no_image_section
call fcn.1400032d0
nop
nop word cs:[rax + rax]
nop dword [rax]

Function at 0x140003a00
Capabilities:
Get thread local storage value

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
lea r12, [0x140010100]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x1400100e0]
test rbx, rbx
je 0x140003a5c
mov rbp, qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax]
mov ecx, dword [rbx]
call rbp
mov rsi, rax
call rdi
test eax, eax
jne 0x140003a53
test rsi, rsi
je 0x140003a53
mov rax, qword [rbx + 8]
mov rcx, rsi
call rax
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x140003a38
mov rcx, r12
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
Function at 0x140003d90
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov rdx, qword [0x14000c9e0]
xor eax, eax
cmp word [rdx], 0x5a4d
jne 0x140003db0
movsxd r8, dword [rdx + 0x3c]
add r8, rdx
cmp dword [r8], 0x4550
je 0x140003db8
ret
cmp word [r8 + 0x18], 0x20b
jne 0x140003db0
movzx eax, word [r8 + 0x14]
sub rcx, rdx
lea rax, [r8 + rax + 0x18]
movzx r8d, word [r8 + 6]
test r8w, r8w
je 0x140003e0d
lea edx, [r8 - 1]
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
nop word cs:[rax + rax]
mov r8d, dword [rax + 0xc]
mov rdx, r8
cmp rcx, r8
jb 0x140003e04
add edx, dword [rax + 8]
cmp rcx, rdx
jb 0x140003db0
add rax, 0x28
cmp rax, r9
jne 0x140003df0
xor eax, eax
ret

Function at 0x140003e10
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x14000c9e0]
xor ecx, ecx
cmp word [rax], 0x5a4d
jne 0x140003e2f
movsxd rdx, dword [rax + 0x3c]
add rax, rdx
cmp dword [rax], 0x4550
je 0x140003e38
mov eax, ecx
ret
cmp word [rax + 0x18], 0x20b
jne 0x140003e2f
movzx ecx, word [rax + 6]
mov eax, ecx
ret

Function at 0x140003ed0
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x14000c9e0]
xor edx, edx
cmp word [rax], 0x5a4d
jne 0x140003eef
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
je 0x140003ef8
mov rax, rdx
ret
cmp word [rcx + 0x18], 0x20b
cmove rdx, rax
mov rax, rdx
ret
Function at 0x1400072b0
Capabilities:
Access peb ldr_data
Encrypt data using speck
Get number of processors
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x2e8
movaps xmmword [rsp + 0x2d0], xmm6
movabs r12, 0xcbf29ce484222325
movabs r14, 0x1d12a89b9e723ff5
lea rcx, [0x1400ce915]
jmp 0x1403acf5b

Function at 0x140008210
Capabilities:
Access peb ldr_data
Encode data using xor
Encrypt data using speck
Get kernel32 base address
Parse pe header

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x38
movabs r14, 0xcbf29ce484222325
lea rcx, [0x1400ce987]
jmp 0x1403aeaf8

Function at 0x1400e3022
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov rdx, rcx
cmovp ecx, edx
mov rcx, 0x56b16f47
movsxd rcx, r14d
lea rcx, [0x1400ba2a8]
jmp 0x1400e482f
jmp fcn.1404b49f9

Function at 0x140109ec2
Capabilities:
Parse pe header

Disassembly:
jmp 0x1404b0e14
xor r8d, r8d
jmp 0x140116d6e
xor edx, edx
jmp 0x1400ff1a0
Function at 0x1401c966a
Capabilities:
Access peb ldr_data

Disassembly:
cmp r8, rdx
jmp 0x1401feb0d
cmovb r8, rdx
stc
clc
test ax, ax
jmp 0x140211be8
test r8, r8
jmp 0x1401003ec
mov rax, qword gs:[0x30]
not r9b
sete r10b
btc r10w, 0x3f
mov rax, qword [rax + 0x60]
mov rax, qword [rax + 0x18]
sar r8d, cl
shl r11w, 0xd1
mov rax, qword [rax + 0x10]
mov r9b, 0xaa
sbb r10b, 0x3a
rcl r8d, 0x12
movzx r8d, word [rax + 0x58]
adc r11d, 0x7a8d71a5
bswap r11w
cmp r8, rdx
not r11b
movsx r9, r15w
cmovae r8, rdx
mov r9, qword [rax + 0x60]
xchg r11, r10
adc r10b, 0xcf
movzx r11d, word [r9]
sar r10w, 0xa3
lea r10, [0x1400b8f10]
test r11w, r11w
je 0x1401ba83c
sub eax, eax
nop word [rax + rax]
cmp sp, di
test si, 0x8a6
cmp r8, rax
je 0x1402173b2
mov word [r10], r11w
add r10, 2
setp r11b
movzx r11d, word [r9 + rax*2 + 2]
jmp 0x14021bce0
je 0x14011ee90
mov word [rcx], 0
jmp 0x14011ee90
ret
cmovb r8, rdx
jmp 0x1401cb715
jne 0x1400fc595
sub r8, rax
test r8, r8
jmp 0x1402173ac
movzx eax, word [0x1400b8f10]
test r15d, eax
test ax, ax
jmp 0x140227327
jmp 0x140211bee
je 0x1401003f2
mov word [rcx], ax
add rcx, 2
movzx eax, word [r9 + rdx*2 + 2]
inc rdx
cmp r10b, r15b
test ax, ax
jmp 0x140219cc0
je 0x1400f78c3
xor edx, edx
bt r9d, 0x13
lea r9, [0x1400b8f10]
jmp 0x1400ef914
je 0x1402173bb
mov word [r10], 0
rcr eax, cl
cmc
movzx eax, word [0x1400b8f10]
setae r8b
bts r8, r12
shr r8, 0x8b
cmp rdx, 0x104
movsx r8d, r15w
movzx r8d, cx
mov r8d, 0x104
jmp 0x1400f60d0
jne 0x1400ef914
sub r8, rdx
cmp rdi, r15
cmc
jmp 0x1400f78c3
inc rax
test r11w, r11w
jmp 0x1401ba833
je 0x1400fc50d
cmp rdx, 0x104
not r8b
mov r8d, 0x104
jmp 0x14019a678
Function at 0x1401c9834
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
setne dh
lea edx, [r8 + 2]
jmp 0x140237a92
jmp 0x1404b0e14
mov qword [rsp + 8], rbx
sal bx, cl
mov dword [rsp + 0x18], r8d
test cl, r8b
rcr bl, cl
mov dword [rsp + 0x10], edx
adc bh, 0x64
xor bx, 0x2451
push rbp
movzx bx, bpl
bsf rbx, r8
mov rbp, rsp
ror bl, 0x3a
sub rsp, 0x50
btc rbx, rbx
mov ebx, ecx
cmp r10b, 0x17
cmp edx, r13d
test r8d, r8d
jmp 0x1404b0e5b
jne 0x1404b0f04
xor ecx, ecx
jmp 0x1404b0e68
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
jmp 0x1404b0e76
je 0x1404b0f04
mov ecx, 0x5a4d
stc
test rdx, 0x36c133a0
cmp word [rax], cx
jmp 0x1404b0e91
jne 0x1404b0f04
movsxd rcx, dword [rax + 0x3c]
test rbp, rdi
cmp r13b, 0xf6
jmp 0x1404b0ea7
add rcx, rax
test r10w, r10w
clc
cmp dword [rcx], 0x4550
jmp 0x1404b0eba
jne 0x1404b0f04
mov eax, 0x20b
clc
test dil, spl
cmc
cmp word [rcx + 0x18], ax
jmp 0x1404b0ed3
jne 0x1404b0f04
cmp dword [rcx + 0x84], 0xe
jmp 0x1404b0ee5
jbe 0x1404b0f04
cmp dword [rcx + 0xf8], 0
jmp 0x1404b0ef7
je 0x1404b0f04
mov ecx, ebx
call fcn.1404b0ceb
lea rax, [rbp + 0x18]
xchg r8b, r8b
mov byte [rbp + 0x28], 0
cmovb edx, r10d
xchg r8b, dl
mov qword [rbp - 0x20], rax
cqo
sets dh
xchg r9w, r8w
lea r9, [rbp - 0x2c]
jmp 0x1404b0f31
lea rax, [rbp + 0x20]
setb dh
jmp 0x1404b0f3d
mov qword [rbp - 0x18], rax
movzx cx, bpl
lea r8, [rbp - 0x20]
movzx rdx, di
cwde
lea rax, [rbp + 0x28]
mov qword [rbp - 0x10], rax
mov rdx, 0x427935b1
lea rdx, [rbp - 0x28]
mov eax, 2
lea rcx, [rbp - 0x30]
jmp 0x1404b0f70
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
jmp 0x1404b0f7b
call fcn.1404b1127
cmp dword [rbp + 0x20], 0
je 0x1404b0f9a
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
jmp 0x1404b0f99
ret
mov ecx, ebx
jmp 0x1404b0fa1
call fcn.1404b0d95
int3

Function at 0x1401c9f33
Capabilities:
Encrypt data using speck
Get number of processors
Resolve function by parsing pe exports

Disassembly:
mov rcx, qword [rcx]
jmp 0x14025a4ea
jmp 0x140445c08
push rsi
cmovle rax, r12
bts rax, rsp
push rdi
sub rsp, 0x28
bts ax, dx
mov rsi, rcx
cmp si, 0x3a38
mov rcx, qword [rcx + 0x18]
mov ax, 0x7b56
ror ax, 0x1f
mov rax, qword [rcx]
sub edx, edx
jmp 0x140445c39
sub r8d, r8d
jmp 0x140445c41
call qword [rax + 0x188]
mov edi, eax
lea rcx, [rsi + 0x30]
jmp 0x140445c52
call fcn.140459780
test edi, edi
jmp 0x140445c5e
je 0x140445c8c
cmp edi, 0x8899000c
jmp 0x140445c6f
jne 0x140445ca8
mov rcx, rsi
add rsp, 0x28
jmp 0x140445c81
pop rdi
movsx rsi, r11w
pop rsi
jmp fcn.1404458d7
nop
add rsp, 0x28
setge dil
pop rdi
movzx rsi, r12w
setns sil
mov sil, bl
pop rsi
jmp 0x140445ca7
ret
mov ecx, edi
sar dl, cl
rcr sil, 0x1a
movabs r8, 0xad4a5352d2edebd0
or dl, 0xd6
mov dl, 3
ror rdi, cl
xor sil, bpl
mov r9d, 0x54
bswap si
bsr di, r9w
add rsp, 0x28
pop rdi
movsx esi, r9w
movzx rsi, r8w
pop rsi
jmp fcn.1403af0d7
Function at 0x14020dd8e
Capabilities:
Enumerate pe sections

Disassembly:
add ecx, edx
test bl, 0x5c
cmp r8b, r10b
cmp dx, 0x3440
cmp r10, rcx
jmp 0x140108b15
jb 0x1401f6fa3
inc r9d
add rax, 0x28
cmc
test esp, ebp
cmp r11, rax
cmp r9d, r11d
jmp 0x140119b68
jb 0x14027043e
sub eax, eax
jmp 0x1401f6fa3
ret
movsxd r8, dword [rcx + 0x3c]
xor r9d, r9d
not r11b
lea r8, [r8 + rcx]
cmovl r11w, ax
xadd r11b, r11b
mov r10, rdx
movzx eax, word [r8 + 0x14]
movsx r11w, spl
movzx r11d, word [r8 + 6]
clc
stc
add rax, 0x18
test bx, 0x34bd
add rax, r8
test r11d, r11d
jmp 0x140270438
je 0x140119b6e
mov edx, dword [rax + 0xc]
cmp r10, rdx
jb 0x140108b1b
mov ecx, dword [rax + 8]
jmp 0x1400fe2bc

Function at 0x140218398
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov r8, qword [rdx]
jmp 0x140265b54
jmp fcn.1404c356f

Function at 0x1402525a8
Capabilities:
Parse pe header

Disassembly:
jne 0x1400ef77a
movsxd rdx, dword [rcx + 0x3c]
jmp 0x1402846c0
sub eax, eax
ret
ret
mov eax, 0x5a4d
cmp word [rcx], ax
jmp 0x1400e4820
add rdx, rcx
cmc
stc
cmp dword [rdx], 0x4550
jne 0x1400ef77a
xor eax, eax
and ecx, 0x5b38677a
mov ecx, 0x20b
dec al
cmp word [rdx + 0x18], cx
sete al
jmp 0x140216e8c
Function at 0x1403c55a6
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rsi
cmp r12b, dil
push rdi
push rbx
sub si, r15w
sub rsp, 0x20
bt ax, 0xc9
shl eax, 0x99
mov dil, 0xb9
mov rsi, rcx
sbb al, r15b
stc
lea rax, [0x1400be020]
or dil, r11b
mov qword [rcx], rax
ror edi, cl
sal dil, 0xc8
rcl edi, 0x52
mov rdi, qword [rcx + 0x78]
test rdi, rdi
jmp 0x1403c55e8
je 0x1403c5609
mov rcx, rdi
call fcn.140213172
mov rcx, rdi
call fcn.14017d244
mov qword [rsi + 0x78], 0
rcl al, 0x92
mov rax, qword [rsi + 0x70]
cmc
stc
cmp rax, 8
jmp 0x1403c5618
jb 0x1403c5678
mov rcx, qword [rsi + 0x58]
sar dh, 0xd9
adc dl, 1
lea rdx, [rax + rax]
test r9w, 0x4465
add rdx, 2
cmp rdx, 0x1000
jmp 0x1403c5642
jb 0x1403c5673
mov rbx, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
clc
sub rcx, rbx
clc
cmp rcx, 0x20
jae 0x1403c57c5
add rax, rax
xchg dh, dh
add rax, 0x29
jmp 0x1403c566d
mov rdx, rax
mov rcx, rbx
call fcn.14026e02c
movaps xmm0, xmmword [0x1400bd3f0]
shl edi, cl
stc
movups xmmword [rsi + 0x68], xmm0
mov dil, 0x1b
mov word [rsi + 0x58], 0
lahf
xadd ah, al
lea rax, [0x1400bdb70]
xor dil, 0xa6
mov qword [rsi], rax
mov rdi, qword [rsi + 0x40]
sal bh, cl
mov rbx, qword [rsi + 0x48]
test r13, 0x96f2354
stc
cmp rdi, rbx
jne 0x1403c56cf
jmp 0x1403c5713
add rdi, 8
cmc
cmp rdi, rbx
je 0x1403c56fc
mov rcx, qword [rdi]
clc
test spl, 0xd9
test rcx, rcx
je 0x1403c56c1
mov rax, qword [rcx]
mov dx, 0x30e6
mov edx, 1
jmp 0x1403c56f1
call qword [rax + 0xb8]
jmp 0x1403c56c1
mov rdi, qword [rsi + 0x40]
cmp rdi, qword [rsi + 0x48]
jmp 0x1403c5709
je 0x1403c5713
mov qword [rsi + 0x48], rdi
test rdi, rdi
jmp 0x1403c571b
je 0x1403c579e
mov rdx, qword [rsi + 0x50]
test r9w, r10w
cmp sil, al
sub rdx, rdi
cmp rdx, 0x1000
jmp 0x1403c573b
jb 0x1403c5778
mov rax, qword [rdi - 8]
test r11d, 0x43230d15
add rdi, 0xfffffffffffffff8
cmp cl, r13b
clc
sub rdi, rax
test r13b, 0x16
clc
cmp rdi, 0x20
jae 0x1403c57c5
add rdx, 0x27
rcl ecx, cl
mov rdi, rax
bts cx, r13w
ror ch, cl
and ch, ch
add rsi, 0x40
movzx ecx, bp
mov rcx, rdi
call fcn.14026e02c
xorps xmm0, xmm0
movups xmmword [rsi], xmm0
mov qword [rsi + 0x10], 0
sete bh
shrd bx, r9w, 0x55
add rsp, 0x20
cmovae di, r12w
movzx ebx, cx
pop rbx
bswap rdi
movsx esi, bx
pop rdi
movzx rsi, sp
movzx esi, bx
movzx si, spl
pop rsi
jmp 0x1403c57c4
ret
call fcn.1404b5e2e
int3
Function at 0x1403ca9c9
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r14
shrd ax, r13w, 0x2b
neg al
sbb ax, 0x4513
push rsi
push rdi
bts si, r15w
sub rsi, 0x2d7073c6
push rbx
sub rsp, 0x28
sar al, cl
sub esi, edi
mov rsi, rcx
lea rax, [0x1400be400]
mov qword [rcx], rax
cmp rdx, r8
mov rcx, qword [rcx + 0xa8]
cmp di, 0x211b
test rcx, rcx
jmp 0x1403caa12
je 0x1403caa4d
lea rax, [rsi + 0x70]
rcl dl, cl
cmp rcx, rax
movzx rax, ax
setne dl
movsx ax, r15b
cmovb eax, ecx
cwde
mov rax, qword [rcx]
jmp 0x1403caa39
call qword [rax + 0x20]
mov qword [rsi + 0xa8], 0
sal di, cl
or dil, r15b
mov rdi, qword [rsi + 0x58]
test rdi, rdi
jmp 0x1403caa59
je 0x1403cab50
lea r14, [rsi + 0x58]
or bh, ch
adc bx, 0x6222
bsr rbx, r9
mov rbx, qword [rsi + 0x60]
clc
jmp 0x1403caa78
cmp rdi, rbx
jmp 0x1403caa80
je 0x1403caabf
nop word cs:[rax + rax]
mov rcx, rdi
jmp 0x1403caa9b
call fcn.1403cac8b
add rdi, 0x60
jmp 0x1403caaa9
cmp rdi, rbx
jmp 0x1403caab1
jne 0x1403caa93
mov rdi, qword [r14]
movzx dx, r10b
mov rdx, qword [rsi + 0x68]
sub rdx, rdi
test r10, 0x68ce68c6
cmp rdx, 0x1000
jb 0x1403cab1e
mov rax, qword [rdi - 8]
cmp dx, 0x4dee
add rdi, 0xfffffffffffffff8
test r13, 0x71472ffa
test si, si
sub rdi, rax
test ebx, 0x50360408
clc
cmp rdi, 0x20
jmp 0x1403cab04
jae 0x1403cac80
add rdx, 0x27
mov rdi, rax
setge cl
mov ecx, 0x289a129c
movzx cx, r13b
mov rcx, rdi
jmp 0x1403cab26
call fcn.14026e02c
xorps xmm0, xmm0
movups xmmword [r14], xmm0
neg dil
xor bh, ah
btr ax, 0xba
mov qword [r14 + 0x10], 0
lahf
rcr di, 0xdd
mov rdi, 0x71b74252
lea rax, [0x1400bdb70]
movsxd rbx, r11d
test sil, r14b
mov qword [rsi], rax
shr ebx, cl
btr di, 0x3e
mov rdi, qword [rsi + 0x40]
clc
mov bl, r9b
cmp bl, r11b
mov rbx, qword [rsi + 0x48]
cmp rdi, rbx
jmp 0x1403cab7e
jne 0x1403cab9c
jmp 0x1403cabeb
add rdi, 8
clc
cmp rdi, rbx
jmp 0x1403cab96
je 0x1403cabd4
mov rcx, qword [rdi]
clc
cmp cl, bl
jmp 0x1403caba7
test rcx, rcx
jmp 0x1403cabaf
je 0x1403cab89
mov rax, qword [rcx]
bswap dx
movsx rdx, r12w
movzx dx, r13b
mov edx, 1
call qword [rax + 0xb8]
jmp 0x1403cab89
mov rdi, qword [rsi + 0x40]
cmc
cmp r14w, di
cmp rdi, qword [rsi + 0x48]
je 0x1403cabeb
mov qword [rsi + 0x48], rdi
test rdi, rdi
je 0x1403cac60
mov rdx, qword [rsi + 0x50]
sub rdx, rdi
cmp rdx, 0x1000
jb 0x1403cac38
mov rax, qword [rdi - 8]
cmp r8b, r13b
add rdi, 0xfffffffffffffff8
stc
cmp bx, 0x190
sub rdi, rax
stc
cmp rdi, 0x20
jmp 0x1403cac26
jae 0x1403cac80
add rdx, 0x27
mov rdi, rax
or ch, 0x35
dec ch
add rsi, 0x40
sets ch
mov rcx, rdi
jmp 0x1403cac47
call fcn.14026e02c
xorps xmm0, xmm0
movups xmmword [rsi], xmm0
mov qword [rsi + 0x10], 0
cmc
bsr r14w, r15w
add rsp, 0x28
movsx esi, dx
movzx r14, r9w
cmovp r14w, r15w
pop rbx
pop rdi
cmovle r14w, r9w
pop rsi
pop r14
jmp 0x1403cac7f
ret
call fcn.1404b5e2e
int3
Function at 0x1403dba2c
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
bt r15d, 0xe1
rol r15d, 0xd
cmovge r15w, bx
push r14
sbb r15w, 0x22dc
xchg r14, r14
push r13
btr r14w, r14w
shl r14b, cl
push r12
btc r14w, r9w
push rsi
bt r14, 0xe
test r13, rcx
push rdi
push rbp
bts r14, rbp
push rbx
movzx r14, r8w
sub rsp, 0x38
movzx r14d, r15w
movaps xmmword [rsp + 0x20], xmm6
sar r12, cl
stc
sbb r15w, r15w
mov r14, r9
mov r15, r8
mov r12, rdx
mov r13, rcx
bts ebx, ebp
mov rbx, qword [rcx]
cmp spl, r10b
test rbx, rbx
jmp 0x1403dba9e
je 0x1403dbbde
mov rdi, qword [r13 + 8]
cmc
jmp 0x1403dbaae
cmp rbx, rdi
jmp 0x1403dbab6
je 0x1403dbb82
lea rsi, [0x1400beb30]
xorps xmm6, xmm6
jmp 0x1403dbb04
lea rbp, [rbx + 0x18]
jmp 0x1403dbad4
call fcn.14026e02c
movups xmmword [rbp], xmm6
test rdi, r8
cmc
mov qword [rbp + 0x10], 0
clc
stc
cmp r15b, bpl
add rbx, 0x30
stc
test spl, al
cmp rbx, rdi
jmp 0x1403dbafe
je 0x1403dbb7a
mov qword [rbx], rsi
mov rcx, qword [rbx + 0x18]
test rcx, rcx
jmp 0x1403dbb13
je 0x1403dbaee
mov rdx, qword [rbx + 0x28]
clc
test sil, 0xff
sub rdx, rcx
cmp dil, r15b
test spl, 0xe6
jmp 0x1403dbb31
cmp rdx, 0x1000
jmp 0x1403dbb3d
jb 0x1403dbacb
mov rax, qword [rcx - 8]
test sp, r9w
cmc
add rcx, 0xfffffffffffffff8
cmc
sub rcx, rax
cmc
clc
cmp r15b, 0xbe
cmp rcx, 0x20
jmp 0x1403dbb63
jae 0x1403dbc9e
add rdx, 0x27
mov rcx, rax
jmp 0x1403dbb75
jmp 0x1403dbacb
mov rbx, qword [r13]
inc dl
sal dh, cl
mov rdx, qword [r13 + 0x10]
test r14b, 0x76
sub rdx, rbx
stc
cmp rdx, 0x1000
jmp 0x1403dbb9a
jb 0x1403dbbd6
mov rax, qword [rbx - 8]
add rbx, 0xfffffffffffffff8
jmp 0x1403dbbad
sub rbx, rax
jmp 0x1403dbbb5
cmp rbx, 0x20
jmp 0x1403dbbbe
jae 0x1403dbc9e
add rdx, 0x27
movzx cx, spl
mov rbx, rax
movzx rcx, si
mov cl, 0xbb
mov rcx, rbx
call fcn.14026e02c
mov qword [r13], r12
mov sil, 0x55
shr bp, 0xde
lea rax, [r15 + r15*2]
movsx rsi, r12w
rcr rsi, cl
or bpl, 0xa6
shl rax, 4
stc
movzx rsi, r8w
add rax, r12
sal rbp, cl
xor di, 0x392d
shr dil, 0xdd
mov qword [r13 + 8], rax
bt r15, 0x4b
stc
setne sil
lea rax, [r14 + r14*2]
bsr r14w, si
btr bx, 0x6f
shl rax, 4
lea rax, [rax + r12]
and rbx, 0x5f690b0f
adc r12b, sil
ror rsi, 0x6e
mov qword [r13 + 0x10], rax
movsx r14, r8w
movaps xmm6, xmmword [rsp + 0x20]
add rsp, 0x38
movsx r15w, r14b
pop rbx
not r13b
xchg r13b, sil
pop rbp
movzx r14w, r13b
xchg di, r12w
mov r15b, dl
pop rdi
mov sil, 0xde
movsx r13, ax
movsx si, spl
pop rsi
pop r12
cmovo r14w, ax
pop r13
xchg r15b, r15b
movsx r14d, r9w
pop r14
cmovo r15w, r12w
movsx r15w, sil
pop r15
jmp 0x1403dbc9d
ret
call fcn.1404b5e2e
int3