joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1401c8d69
Capabilities:
Encrypt data using rc4 prga

Disassembly:
ucomisd xmm1, xmm0
jp 0x1401df808
jne 0x1401df808
sub ecx, ecx
jmp 0x14027e034
test r8b, 0x10
jmp 0x1401e89b6
movzx ecx, word [rsp + 0xe]
cmp r13b, 0x2d
mov edx, 0xbfef
cmp r11b, 0x3b
add ax, r14w
shr ecx, 4
bsf ax, si
movsx eax, cx
rol al, cl
movsd qword [rsp + 0x10], xmm1
movzx rax, si
movsxd rax, r13d
shl ah, 0x9b
and ecx, 0x7ff
movsd qword [rsp + 0x18], xmm1
mov rax, qword [rsp + 0x18]
cmp r13b, r9b
shr rax, 0x30
and ax, dx
cqo
sal dx, 0x5a
mov edx, 0x3fe0
or ax, dx
stc
clc
test bpl, 0xca
mov word [rsp + 0x16], ax
cmc
jmp 0x140251062
je 0x1401e89c0
mov dword [rsp + 8], edx
xor ah, 0x91
jmp 0x14021e776
jne 0x14021e7b6
test edx, edx
jmp 0x14021e7b0
movsd qword [rsp + 8], xmm0
jmp 0x1402747cf
jns 0x1401230a0
or eax, 1
clc
mov dword [rsp + 0xc], eax
test r15b, spl
add edx, edx
dec ecx
test r8b, spl
cmp cl, 0xcb
jmp 0x1401d61ef
mov dword [rsp + 0xc], eax
cmc
test ecx, 0x4f400575
stc
test edx, edx
jmp 0x14012308f
movaps xmm1, xmm0
jmp 0x14011a4bd
test byte [rsp + 0xe], 0x10
jmp 0x1400f84b1
movsd xmm0, qword [rsp + 0x10]
jmp 0x14027e034
mov rax, qword [rsp + 8]
mov cx, 0x59ee
bsf r8w, cx
bts r8w, r10w
mov ecx, 0x7ff0
mov r8, rax
cmp ebp, 0x2db012f
test r14b, al
jmp 0x1401f2bc5
jne 0x14021e776
mov eax, dword [rsp + 0xc]
add eax, eax
jmp 0x1401aabe0
shr r8, 0x30
test r10, r10
clc
test cx, r8w
jmp 0x1402815d0
movsd xmm0, qword [rsp + 8]
jmp 0x14021dc04
jmp 0x14027e034
movzx eax, word [rsp + 0xe]
dec dl
rcr dx, 0xf9
mov edx, 0xffef
test al, r10b
jmp 0x140275e10
je 0x1400f7945
sub r9d, r9d
movsx cx, bpl
movzx rcx, dx
movzx cx, r15b
mov ecx, 0xfffffc03
comisd xmm0, xmm1
seta r9b
cmp r8b, dl
test rbp, r10
jmp 0x1400f06d4
ret
sub ecx, 0x3fe
jmp 0x1401de0fc
xorps xmm0, xmm0
mov r10, rdx
jmp 0x1400e0238
and ax, dx
clc
test bl, 0x71
mov word [rsp + 0xe], ax
cmp cx, r13w
stc
test r9d, r9d
jmp 0x1402875d4
mov dword [r10], ecx
jmp 0x14023d03b
jne 0x1400f7945
mov edx, dword [rsp + 8]
shr rax, 0x20
cmc
test r11d, r11d
clc
test eax, 0xfffff
jmp 0x1400fabf4
je 0x1402875f3
mov edx, 0x8000
test r12b, r8b
clc
or ax, dx
add dx, di
mov word [rsp + 0xe], ax
shl dl, 0x73
add dl, ah
movsd xmm0, qword [rsp + 8]
rol ah, cl
bsr edx, r9d
cwd
mov edx, 0xbfef
movsd qword [rsp + 0x10], xmm0
neg ah
ror ah, 0xec
mov rax, qword [rsp + 0x10]
shr rax, 0x30
cmp cl, 0x13
and ax, dx
sbb dh, 0x13
movsxd rdx, ecx
rol dx, 0x4e
movsd qword [rsp + 8], xmm0
mov edx, 0x3fe0
or ax, dx
mov word [rsp + 0xe], ax
jmp 0x140204600

Function at 0x1401f1dc6
Capabilities:
Parse pe header

Disassembly:
jne 0x1401e39b4
xor eax, eax
inc al
mov ecx, 0x20b
shr al, cl
cmp word [rdx + 0x18], cx
xchg al, al
mov al, r12b
sete al
jmp 0x1401cdf39
ret
sub eax, eax
jmp 0x140238d80
mov eax, 0x5a4d
cmp word [rcx], ax
jmp 0x14024e29a
ret
jne 0x1401e39b4
movsxd rdx, dword [rcx + 0x3c]
lea rdx, [rdx + rcx]
clc
cmp dword [rdx], 0x4550
jmp 0x14010bab4
Function at 0x140236da6
Capabilities:
Encrypt data using speck
Resolve function by parsing pe exports

Disassembly:
jmp 0x1404469ae
mov rcx, qword [rcx]
jmp 0x14010f3c4
push rsi
push rdi
sub rsp, 0x28
not sil
setl al
mov rax, rbp
mov rsi, rcx
mov rcx, qword [rcx + 0x18]
mov rax, qword [rcx]
test ax, 0x4c55
jmp 0x1404469d0
sub edx, edx
sub r8d, r8d
jmp 0x1404469da
call qword [rax + 0x188]
mov edi, eax
movzx ecx, r8w
movzx rcx, r9w
movsx ecx, r11w
lea rcx, [rsi + 0x30]
jmp 0x1404469f7
call fcn.14045a67a
test edi, edi
jmp 0x140446a03
je 0x140446a37
cmp edi, 0x8899000c
jne 0x140446a60
mov rcx, rsi
add rsp, 0x28
bswap di
pop rdi
jmp 0x140446a2c
pop rsi
jmp 0x140446a32
jmp fcn.14044668f
nop
and di, 0x2270
add rsp, 0x28
setp dil
movsx rsi, r9w
xchg di, si
pop rdi
movsx si, r9b
mov si, cx
seto sil
pop rsi
jmp 0x140446a5f
ret
mov ecx, edi
ror esi, 0x55
movabs r8, 0xad4a5352d2edebd0
mov dl, 3
shr r9b, cl
rcr r9d, cl
mov r9d, 0x54
cmc
add rsp, 0x28
bswap si
movzx rdi, cx
pop rdi
jmp 0x140446a8f
pop rsi
jmp 0x140446a95
jmp fcn.1403aff88

Function at 0x140238886
Capabilities:
Access peb ldr_data
Encrypt data using rc4 prga

Disassembly:
je 0x140145947
xor eax, eax
test r15w, 0x6d6c
test bpl, r14b
nop word [rax + rax]
cmp r8, rax
jmp 0x14028e15d
je 0x140142c3e
xor edx, edx
bt r9d, esi
stc
lea r9, [0x1400b8f10]
test r12w, 0x6b96
cmp r8, rdx
je 0x14022f330
mov word [rcx], ax
rcr al, cl
bsf rax, rdx
and eax, r10d
add rcx, 2
movzx eax, word [r9 + rdx*2 + 2]
jmp 0x140246bd7
inc rax
cmp spl, r12b
cmp r9b, 0xa4
test r11w, r11w
jmp 0x14014593d
mov rax, qword gs:[0x30]
mov rax, qword [rax + 0x60]
shl r11w, 0x27
and r9b, 0x4a
mov rax, qword [rax + 0x18]
not r10w
btr r10, 8
movsx r8w, dil
mov rax, qword [rax + 0x10]
movzx r11w, dl
movzx r8d, word [rax + 0x58]
or r10w, bx
cmp r8, rdx
sete r10b
cmovae r8, rdx
btr r10, rax
clc
mov r9, qword [rax + 0x60]
btc r11d, esp
movzx r11d, word [r9]
neg r10w
lea r10, [0x1400b8f10]
jmp 0x1401f3780
jne 0x140102f64
sub r8, rdx
cmp dl, r8b
test r8, r8
jmp 0x14022f32a
jne 0x1400fa8d5
sub r8, rax
cmc
test r8, r8
jmp 0x14024d71c
je 0x14013c73f
cmp rdx, 0x104
movsx r8w, r15b
movsx r8d, ax
cmovns r8, r12
mov r8d, 0x104
jmp 0x1402761ee
jmp 0x140102f50
test r11w, r11w
jmp 0x1400fa8be
cmovb r8, rdx
test rax, 0x560b54b9
test ax, ax
jmp 0x140102f4a
test ax, ax
jmp 0x1401dad99
je 0x14022f335
mov word [rcx], 0
ret
movzx eax, word [0x1400b8f10]
jmp 0x140221dfa
inc rdx
cmp r10w, r14w
cmc
test ax, ax
jmp 0x140142c32
je 0x14024d730
mov word [r10], 0
xor r8, rbx
adc ah, dl
dec r8b
movzx eax, word [0x1400b8f10]
or r8d, 0x5b9033ac
bt r8, rsp
ror r8w, cl
cmp rdx, 0x104
xchg r8b, r8b
movsx r8, r12w
mov r8b, 0xba
mov r8d, 0x104
jmp 0x14021b392
cmovb r8, rdx
jmp 0x1401e5019
je 0x14024d722
mov word [r10], r11w
sbb r11w, bx
or r11b, bl
add r10, 2
sete r11b
movsx r11d, r8w
movzx r11d, bx
movzx r11d, word [r9 + rax*2 + 2]
jmp 0x14012b7c6
Function at 0x1402451f9
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov eax, 0x47
jmp 0x1400fd9ff
mov byte [rcx], al
movzx ax, r11b
movzx rax, r10w
movsx rax, r10w
mov rax, r10
jmp 0x1401986ea
lea r8d, [rax - 2]
jmp 0x14010089a
mov eax, 0x67
adc r8b, sil
or r8w, di
sal r8b, cl
lea r8d, [rax - 2]
cmp edx, 0x1000
jmp 0x1401139c5
cmove eax, r8d
jmp 0x1400fc541
je 0x14011a0ed
mov byte [rcx], r8b
inc dx
rdtsc
inc rcx
sbb al, 0x9a
rdtsc
mov edx, r9d
movzx rax, di
bswap eax
mov eax, 0x3000
test r13b, 0x4d
test cl, r9b
and edx, eax
cmp r12b, 0xce
test r14b, bpl
test r9b, 4
jmp 0x1401441a8
test r9b, 0x10
jmp 0x14028fe26
cmp edx, 0x2000
jmp 0x1401e76ed
jne 0x140100887
mov al, 0x61
jmp 0x14020cc1c
je 0x140126700
cmp edx, 0x2000
je 0x1401e76f3
cmp edx, eax
jne 0x1400f10a0
mov al, 0x41
jmp 0x1400fc541
inc rcx
cmp rdx, 0x576d091d
jmp 0x1401217a8
mov byte [rcx + 1], 0
jmp 0x14020935a
mov word [rcx], 0x2a2e
test bh, 0xc2
jmp 0x1401d5319
add rcx, 2
cmp esp, 0x48b5466d
cmp r9b, r9b
test r8b, r8b
jmp 0x14011a0d8
jne 0x140212d08
mov al, 0x66
jmp 0x14022781a
ret
jmp 0x1400fc541
cmp edx, eax
jmp 0x140141cb3
je 0x1401217a8
mov byte [rcx], 0x2b
jmp 0x14016f7e6
jmp 0x1400fc541
mov byte [rdx], 0x25
sbb ecx, ebx
mov r10, rdx
movzx rcx, si
add cx, r11w
shr ch, 0xa1
lea rcx, [rdx + 1]
test r9b, 0x20
jmp 0x140227807
je 0x1401afc1c
mov byte [rcx], 0x23
inc rcx
jmp 0x1401afc1c

Function at 0x14026efd8
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
not dh
cdq
mov dl, 0xe9
lea edx, [r8 + 2]
jmp 0x14028628d
jmp 0x1404b1ea5
mov qword [rsp + 8], rbx
rcr rbx, cl
mov dword [rsp + 0x18], r8d
movzx ebx, bp
mov dword [rsp + 0x10], edx
adc bl, 0xee
btr rbx, rdx
movzx rbx, r15w
push rbp
neg bp
bts bp, si
mov rbp, rsp
sub rsp, 0x50
rol bl, cl
mov ebx, ecx
cmp dil, bl
cmp cl, 0xc9
clc
test r8d, r8d
jne 0x1404b1f83
sub ecx, ecx
jmp 0x1404b1eee
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
jmp 0x1404b1efc
je 0x1404b1f83
mov ecx, 0x5a4d
jmp 0x1404b1f0c
cmp word [rax], cx
jmp 0x1404b1f14
jne 0x1404b1f83
movsxd rcx, dword [rax + 0x3c]
cmp r13w, 0x468
test edx, r14d
add rcx, rax
cmp sil, bpl
clc
cmp dword [rcx], 0x4550
jne 0x1404b1f83
mov eax, 0x20b
stc
test eax, 0x53ff3ffc
cmp r8w, cx
cmp word [rcx + 0x18], ax
jmp 0x1404b1f52
jne 0x1404b1f83
cmp dword [rcx + 0x84], 0xe
jmp 0x1404b1f64
jbe 0x1404b1f83
cmp dword [rcx + 0xf8], 0
jmp 0x1404b1f76
je 0x1404b1f83
mov ecx, ebx
call fcn.1404b1d7f
lea rax, [rbp + 0x18]
movzx r8d, cx
mov byte [rbp + 0x28], 0
setl r8b
mov qword [rbp - 0x20], rax
cbw
setbe r9b
lea r9, [rbp - 0x2c]
cmovo cx, cx
cqo
lea rax, [rbp + 0x20]
mov dx, r8w
cdq
cmovo r8d, r12d
mov qword [rbp - 0x18], rax
lea r8, [rbp - 0x20]
cwd
not dx
setle ah
lea rax, [rbp + 0x28]
cqo
mov qword [rbp - 0x10], rax
movsxd rdx, edi
lea rdx, [rbp - 0x28]
mov eax, 2
lea rcx, [rbp - 0x30]
jmp 0x1404b1fe3
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
jmp 0x1404b1fee
call fcn.1404b2194
cmp dword [rbp + 0x20], 0
jmp 0x1404b1ffc
je 0x1404b2025
mov rbx, qword [rsp + 0x60]
btr bp, dx
xor bpl, 0x49
shld bp, si, 0xf2
add rsp, 0x50
movsxd rbp, r9d
not bpl
pop rbp
jmp 0x1404b2024
ret
mov ecx, ebx
call fcn.1404b1e2f
int3
Function at 0x14027f7b8
Capabilities:
Parse pe header

Disassembly:
jmp 0x1404b1ea5
sub r8d, r8d
xor edx, edx
jmp 0x140203f2c
Function at 0x1403cdacd
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
push r14
movzx r14, r8w
and r15d, r13d
push r13
mov r14b, 0x47
ror r15d, 0xc
push r12
bsf r15, r15
push rsi
neg r14d
bt r15w, 0x52
push rdi
btc r15, 0xc2
dec r12d
or r14, 0x104f2707
push rbx
sub rsp, 0x30
movaps xmmword [rsp + 0x20], xmm6
ror sil, 0x13
rcr r13b, 0xda
mov r15, r9
shld rsi, rbx, 0xa9
shr r14b, 0x91
and r13, r13
mov r12, r8
bts si, r15w
test r10w, 0x6321
mov r14, rdx
movsx r13d, r14w
mov r13, rcx
mov rsi, qword [rcx]
cmp al, r15b
cmc
test rsi, rsi
jmp 0x1403cdb49
je 0x1403cdc8b
mov rbx, qword [r13 + 8]
cmc
cmp rsi, rbx
je 0x1403cdc2e
movaps xmm6, xmmword [0x1400bd3f0]
jmp 0x1403cdb69
jmp 0x1403cdb98
call fcn.14011c520
movups xmmword [rsi + 0x10], xmm6
jmp 0x1403cdb7e
mov word [rsi], 0
test al, 0xcb
clc
add rsi, 0x20
cmp rsi, rbx
jmp 0x1403cdb92
je 0x1403cdc22
mov rax, qword [rsi + 0x18]
cmp rax, 8
jmp 0x1403cdba5
jb 0x1403cdb73
mov rcx, qword [rsi]
ror edx, 0x2a
lea rdx, [rax + rax]
stc
cmp dx, r10w
test bpl, bl
add rdx, 2
test dh, 0x2d
stc
test bpl, r9b
cmp rdx, 0x1000
jmp 0x1403cdbd4
jb 0x1403cdb6e
mov rdi, qword [rcx - 8]
test r8w, 0x5263
stc
add rcx, 0xfffffffffffffff8
test edi, esi
test r8b, 0x3e
sub rcx, rdi
cmp rcx, 0x20
jae 0x1403cdd11
add rax, rax
sar cx, cl
movzx edx, r11w
add rax, 0x29
movsx cx, dil
mov ch, 0xbb
mov rdx, rax
mov rcx, rdi
jmp 0x1403cdc1d
jmp 0x1403cdb6e
mov rsi, qword [r13]
rcl dh, 0x79
movsx dx, r14b
mov rdx, qword [r13 + 0x10]
jmp 0x1403cdc38
sub rdx, rsi
test di, 0x72ef
cmc
cmp rdx, 0x1000
jmp 0x1403cdc4d
jb 0x1403cdc7e
mov rax, qword [rsi - 8]
add rsi, 0xfffffffffffffff8
sub rsi, rax
stc
cmc
cmp rsi, 0x20
jmp 0x1403cdc69
jae 0x1403cdd11
add rdx, 0x27
mov esi, 0x17bf5144
mov sil, r11b
mov rsi, rax
mov rcx, rsi
jmp 0x1403cdc86
call fcn.14011c520
mov qword [r13], r14
movsx ebx, cx
shl r12, 5
sub di, 0x4f28
shl dil, 0xf0
dec edi
add r12, r14
bt esi, ebp
mov qword [r13 + 8], r12
sets dil
movsx rbx, r14w
shl r15, 5
ror bh, 0x88
add r15, r14
movsx r14d, r12w
shl bx, 0xbc
mov qword [r13 + 0x10], r15
xor r15w, 0x2d8
movaps xmm6, xmmword [rsp + 0x20]
rol r13d, cl
add rsp, 0x30
movsxd rbx, r11d
mov r15b, 0xa8
pop rbx
movzx r14, r15w
movzx di, al
pop rdi
movsx esi, sp
mov r13b, 0x10
not sil
pop rsi
not r12w
pop r12
pop r13
bswap r14d
not r14b
pop r14
movzx r15w, dil
movzx r15, r11w
pop r15
ret
call fcn.1404b6f1c
int3
Function at 0x1403d2b4b
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rsi
sbb esi, 0x20b7682e
sar ah, cl
push rdi
bsf ax, sp
jmp 0x1403d2b60
push rbx
shr ah, cl
xor si, 0x1f26
sub rsp, 0x20
neg rax
sal sil, 0xa5
mov rsi, rcx
movzx rax, di
add al, 0x18
lea rax, [0x1400be340]
cmp r15b, 0x82
clc
mov qword [rcx], rax
mov rcx, qword [rcx + 0x90]
test rcx, rcx
je 0x1403d2bb3
mov rax, qword [rcx]
call qword [rax + 0x10]
mov qword [rsi + 0x90], 0
rol cx, cl
cmp r12w, cx
mov rcx, qword [rsi + 0x88]
test r10b, r14b
stc
cmc
test rcx, rcx
je 0x1403d2be4
mov rax, qword [rcx]
jmp 0x1403d2bd0
call qword [rax + 0x10]
mov qword [rsi + 0x88], 0
shl cl, cl
btc ecx, 0x87
mov rcx, qword [rsi + 0x80]
cmp rcx, 0x2da7689b
test rsp, 0x30be1132
test rcx, rcx
jmp 0x1403d2c01
je 0x1403d2c27
mov rax, qword [rcx]
jmp 0x1403d2c0f
call qword [rax + 0x10]
mov qword [rsi + 0x80], 0
xadd edi, ebx
rol ah, cl
bsr ax, r10w
lea rax, [0x1400bdb70]
stc
adc bx, r12w
movzx ebx, r8w
mov qword [rsi], rax
mov rdi, qword [rsi + 0x40]
mov rbx, qword [rsi + 0x48]
jmp 0x1403d2c47
cmp rdi, rbx
jmp 0x1403d2c4f
jne 0x1403d2c67
jmp 0x1403d2cb0
add rdi, 8
cmp rdi, rbx
je 0x1403d2c91
mov rcx, qword [rdi]
test rcx, rcx
je 0x1403d2c5a
mov rax, qword [rcx]
bswap rdx
movsxd rdx, r13d
mov edx, 1
jmp 0x1403d2c86
call qword [rax + 0xb8]
jmp 0x1403d2c5a
mov rdi, qword [rsi + 0x40]
cmp cx, sp
test r12, 0x349b5e34
cmp rdi, qword [rsi + 0x48]
je 0x1403d2cb0
mov qword [rsi + 0x48], rdi
test bx, ax
test rdi, rdi
je 0x1403d2d49
mov rdx, qword [rsi + 0x50]
cmp spl, 0xef
sub rdx, rdi
cmp rdx, 0x1000
jmp 0x1403d2cd0
jb 0x1403d2d17
mov rax, qword [rdi - 8]
cmp r8d, 0x42726cb6
add rdi, 0xfffffffffffffff8
sub rdi, rax
test spl, r14b
cmp rdi, 0x20
jmp 0x1403d2cf4
jae 0x1403d2d5e
add rdx, 0x27
rcl cx, 0xb1
sbb cl, sil
shld edi, ecx, 0xd1
mov rdi, rax
sal rcx, cl
bsf cx, dx
movsx rcx, ax
add rsi, 0x40
movzx cx, dil
movzx ecx, cx
movzx rcx, r12w
mov rcx, rdi
jmp 0x1403d2d2f
call fcn.14011c520
xorps xmm0, xmm0
movups xmmword [rsi], xmm0
bts ebx, edi
mov qword [rsi + 0x10], 0
movsx rbx, r15w
add rsp, 0x20
movsx ebx, di
movzx edi, r11w
mov sil, al
pop rbx
movsxd rsi, edx
pop rdi
pop rsi
ret
call fcn.1404b6f1c
int3
Function at 0x1403d6bd3
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r14
push rsi
push rdi
or rsi, 0x684f0f8c
push rbx
ror rsi, cl
btr ax, cx
movzx si, bpl
sub rsp, 0x28
movsxd rax, ebp
bts eax, edx
and sil, 0xe8
mov rsi, rcx
and ah, 0xa1
lea rax, fcn.140010f00
mov qword [rcx], rax
movzx rax, r15w
jmp 0x1403d6c12
lea rax, fcn.140010f00
clc
jmp 0x1403d6c1f
mov qword [rcx + 0x50], rax
stc
test r15b, cl
mov rcx, qword [rcx + 0xa0]
test rcx, rcx
je 0x1403d6cb1
mov rdx, qword [rsi + 0xb0]
cmc
test dil, 0xc1
sub rdx, rcx
cmp rdx, 0x1000
jb 0x1403d6c88
mov rax, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
test bl, r14b
cmp r10b, sil
sub rcx, rax
jmp 0x1403d6c6c
cmp rcx, 0x20
jmp 0x1403d6c75
jae 0x1403d6dd3
add rdx, 0x27
mov rcx, rax
mov dil, spl
movzx edi, dx
lea rdi, [rsi + 0xa0]
jmp 0x1403d6c94
call fcn.14011c520
xorps xmm0, xmm0
movups xmmword [rdi], xmm0
test bx, 0x4434
mov qword [rdi + 0x10], 0
bts di, r13w
mov rdi, qword [rsi + 0x60]
test cl, r12b
test rdi, rdi
jmp 0x1403d6cc0
je 0x1403d6da7
lea r14, [rsi + 0x60]
shr bl, 0x15
neg bl
mov rbx, qword [rsi + 0x68]
jmp 0x1403d6cd8
cmp rdi, rbx
je 0x1403d6d17
nop dword [rax]
mov ecx, r14d
mov rcx, rdi
jmp 0x1403d6cf0
call fcn.1403b6ce0
add rdi, 0x110
cmc
cmp r13b, bpl
test r15w, 0x3909
cmp rdi, rbx
jmp 0x1403d6d0e
jne 0x1403d6ce8
mov rdi, qword [r14]
mov rdx, qword [rsi + 0x70]
sub rdx, rdi
test sil, 0x6d
clc
cmp rdx, 0x1000
jmp 0x1403d6d2f
jb 0x1403d6d79
mov rax, qword [rdi - 8]
jmp 0x1403d6d42
add rdi, 0xfffffffffffffff8
jmp 0x1403d6d4f
sub rdi, rax
cmp r8w, r15w
cmp rdi, 0x20
jae 0x1403d6dd3
add rdx, 0x27
movsxd rdi, r15d
mov di, r11w
movsx rdi, di
mov rdi, rax
mov cl, 0x3d
jmp 0x1403d6d79
mov rcx, rdi
call fcn.14011c520
xorps xmm0, xmm0
movups xmmword [r14], xmm0
adc bx, 0x2024
movzx cx, bpl
rcl edi, 0xcb
mov qword [r14 + 0x10], 0
mov r14w, 0x2711
btr r14, 0x64
mov rcx, rsi
shld r14d, r8d, 0x78
shl r14b, cl
add rsp, 0x28
xchg dil, r14b
movzx r14d, r9w
pop rbx
xchg sil, dil
pop rdi
mov sil, 0xc1
pop rsi
bswap r14
xchg r14, r14
pop r14
jmp fcn.140441787
call fcn.1404b6f1c
int3
Function at 0x1403e5e05
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
sete r15b
cmp r10w, dx
btc r15w, r11w
push r14
clc
push r13
stc
push r12
push rsi
push rdi
sub r15b, dil
shr r15w, 0xe6
btr r13w, dx
push rbp
btr r12w, di
push rbx
sub r13w, sp
sub rsp, 0x38
xor r14b, r9b
movzx r12d, r14w
movaps xmmword [rsp + 0x20], xmm6
cmovne r13, r11
dec r15w
mov r14, r9
bts r15w, di
mov r15, r8
mov r12, rdx
shld r13d, r15d, 0xc8
mov r13, rcx
movsxd rbx, r8d
not bl
mov rbx, qword [rcx]
cmc
cmp sp, r12w
test rbx, rbx
je 0x1403e5fc2
mov rdi, qword [r13 + 8]
cmp rbx, rdi
jmp 0x1403e5e86
je 0x1403e5f5b
lea rbp, [0x1400bed30]
jmp 0x1403e5e98
movaps xmm6, xmmword [0x1400bd400]
jmp 0x1403e5ea4
jmp 0x1403e5ed1
call fcn.14011c520
movups xmmword [rbx + 0x20], xmm6
mov byte [rbx + 0x10], 0
add rbx, 0x38
cmp edi, 0x3b002349
stc
cmp bl, bl
cmp rbx, rdi
jmp 0x1403e5ecb
je 0x1403e5f4c
mov qword [rbx], rbp
bsr ax, bx
sar ax, cl
lahf
mov rax, qword [rbx + 0x28]
cmp rax, 0x10
jmp 0x1403e5ee9
jb 0x1403e5eae
mov rcx, qword [rbx + 0x10]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jmp 0x1403e5f03
jb 0x1403e5ea9
mov rsi, qword [rcx - 8]
cmp r8d, r9d
jmp 0x1403e5f16
add rcx, 0xfffffffffffffff8
clc
cmc
sub rcx, rsi
cmp rcx, 0x20
jae 0x1403e6054
add rax, 0x28
movsx edx, r12w
xchg cl, ch
mov rdx, rax
not ch
mov cl, sil
movsx rcx, r12w
mov rcx, rsi
jmp 0x1403e5f47
jmp 0x1403e5ea9
mov rbx, qword [r13]
xadd dx, dx
bt dx, dx
add dl, sil
mov rdx, qword [r13 + 0x10]
cmp cx, cx
cmc
sub rdx, rbx
clc
cmp rdx, 0x1000
jb 0x1403e5fb5
mov rax, qword [rbx - 8]
test r12d, 0x3f0001de
add rbx, 0xfffffffffffffff8
sub rbx, rax
test r13b, r11b
cmc
cmp r8w, dx
cmp rbx, 0x20
jmp 0x1403e5f97
jae 0x1403e6054
add rdx, 0x27
movzx bx, sil
movzx rcx, r11w
mov rbx, rax
movzx rcx, r11w
movsx ecx, r10w
mov rcx, rbx
jmp 0x1403e5fbd
call fcn.14011c520
mov qword [r13], r12
shr bp, 0x27
inc ax
stc
imul rax, r15, 0x38
cmc
sal r15w, 0x41
add rax, r12
rol rdi, 0x30
mov qword [r13 + 8], rax
or r15, 0x45841938
btr rbx, rdi
movzx edi, bp
imul rax, r14, 0x38
add rax, r12
btc rsi, 0x53
cmc
adc sil, 0x84
mov qword [r13 + 0x10], rax
bt r12d, 0xb9
ror dil, cl
movaps xmm6, xmmword [rsp + 0x20]
mov bl, r8b
add rsp, 0x38
pop rbx
jmp 0x1403e6020
pop rbp
setnp sil
mov r14b, r15b
movsx r12d, r15w
pop rdi
pop rsi
jmp 0x1403e6037
pop r12
bswap r15
setne r15b
not r15d
pop r13
pop r14
not r15d
bswap r15d
movzx r15, r10w
pop r15
ret
call fcn.1404b6f1c
int3
Function at 0x1403e9b43
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
movsxd rax, r15d
push r14
btc rax, 0xb4
cmp r11, 0x4884615b
push rsi
push rdi
sub r14w, 0x26ac
shl r14b, 0x43
clc
push rbx
sar al, cl
shr r14b, 0xe9
ror rax, 0x72
sub rsp, 0x20
add ah, 0xb4
mov r14, rcx
mov rax, 0x7d161d0a
sal ax, 0xe5
mov eax, dword [rcx + 8]
cmp r11b, cl
stc
test al, 2
jmp 0x1403e9b91
jne 0x1403e9ba3
xor esi, esi
jmp 0x1403e9b9e
jmp 0x1403e9c52
mov rdi, qword [r14 + 0x10]
movzx r15d, r15w
movsxd r15, r15d
rcl r15b, cl
mov r15, qword [r14 + 0x18]
mov rsi, r15
cmc
sub rsi, rdi
cmp r10b, r13b
cmc
test r10w, cx
sar rsi, 5
stc
jmp 0x1403e9bd1
cmp r15, rdi
jmp 0x1403e9bd9
je 0x1403e9c52
mov rax, qword [rdi]
cmovg rcx, rax
mov rcx, rdi
call qword [rax + 0x10]
or rax, 1
shr bh, cl
bsr rax, rax
lea rbx, [rax + rax*8]
movzx ax, r11b
add rbx, 0x49
rcl eax, 0x75
sbb cx, bx
shr rbx, 6
mov cx, 0x2155
bswap rax
mov rax, qword [rdi]
mov rcx, rdi
jmp 0x1403e9c1f
call qword [rax + 0x10]
add rsi, rax
test r15b, 0x9e
jmp 0x1403e9c2f
add rsi, rbx
add rdi, 0x20
cmp bx, r12w
jmp 0x1403e9c3f
cmp rdi, r15
jmp 0x1403e9c47
jne 0x1403e9bdf
mov eax, dword [r14 + 8]
stc
test al, 4
jne 0x1403e9c67
mov rdi, rsi
jmp 0x1403e9c62
jmp 0x1403e9d30
mov rbx, qword [r14 + 0x28]
inc dil
mov r15, qword [r14 + 0x30]
mov rdi, r15
jmp 0x1403e9c7a
sub rdi, rbx
test sp, 0x44aa
cmp dil, 0x25
cmp r13, rbp
sar rdi, 5
test r15w, sp
add rdi, rsi
cmp r15, rbx
je 0x1403e9d30
nop dword [rax]
cbw
jmp 0x1403e9caa
mov rax, qword [rbx]
mov rcx, rbx
jmp 0x1403e9cb5
call qword [rax + 0x10]
or rax, 1
bsr rax, rax
bts rcx, rax
btc cx, 0x11
lea rsi, [rax + rax*8]
inc rcx
bt cx, 0x81
mov ch, 0xfd
add rsi, 0x49
sub al, 0xdd
btr rax, r11
sal rax, cl
shr rsi, 6
cdqe
cwde
cbw
mov rax, qword [rbx]
movzx rcx, r10w
mov ch, 0xf1
mov rcx, rbx
jmp 0x1403e9d00
call qword [rax + 0x10]
lea rdi, [rdi + rax]
cmc
cmp rbx, r9
add rdi, rsi
add rbx, 0x20
jmp 0x1403e9d1b
cmp rbx, r15
jmp 0x1403e9d23
jne 0x1403e9caa
mov eax, dword [r14 + 8]
test dh, 0xab
test al, 8
jmp 0x1403e9d37
je 0x1403e9e13
mov rbx, qword [r14 + 0x40]
bt r15, 0xcb
xadd r15d, r15d
sbb r15w, dx
mov r14, qword [r14 + 0x48]
rol r15w, 0x86
xadd r15b, r15b
bswap r15d
mov r15, r14
sub r15, rbx
clc
sar r15, 5
lea r15, [r15 + rdi]
cmp r8w, r9w
clc
stc
cmp r14, rbx
jmp 0x1403e9d7b
je 0x1403e9e05
nop word [rax + rax]
seta al
mov rax, qword [rbx]
movsx cx, r12b
mov rcx, rbx
call qword [rax + 0x10]
or rax, 1
bsr rax, rax
lea rsi, [rax + rax*8]
rcr al, cl
sal ch, cl
lahf
add rsi, 0x49
shld rax, r13, 0x68
shr rsi, 6
mov rax, qword [rbx]
mov rcx, rbx
jmp 0x1403e9dc4
call qword [rax + 0x10]
mov rdi, rax
stc
cmp r13, 0x3c1a72da
add rdi, r15
lea rdi, [rdi + rsi]
bsr r15, r13
mov r15b, 0x8a
add rbx, 0x20
and r15b, r10b
xor r15b, bl
mov r15, rdi
jmp 0x1403e9df2
cmp rbx, r14
jmp 0x1403e9dfa
jne 0x1403e9d8d
jmp 0x1403e9e13
mov rdi, r15
bsf rsi, rcx
setne sil
not r14b
mov rax, rdi
add rsp, 0x20
bswap r14d
cmovo esi, edi
mov r14, rsi
pop rbx
movzx r15, r9w
movsx edi, di
pop rdi
bswap r14d
cmovno r15, rsi
pop rsi
setbe r14b
movzx r15d, cx
movzx r14, sp
pop r14
bswap r15d
pop r15
ret
Function at 0x1403fea76
Capabilities:
Access peb ldr_data
Encrypt data using rc4 prga

Disassembly:
sub rsp, 0x28
test cl, 0x15
cmp r11w, 0x5e1c
test r8, r8
je 0x1403feaf2
movzx r9d, word [r8]
test r8b, 0x89
test r9w, r9w
je 0x1403feb3b
xor eax, eax
bswap r10w
mov r10, rcx
nop dword [rax + rax]
cmp esp, ebx
stc
cmp rdx, rax
jmp 0x1403feaba
je 0x1403fecc7
mov word [r10], r9w
add r10, 2
movzx r9d, word [r8 + rax*2 + 2]
jmp 0x1403fead3
inc rax
test r9w, r9w
jmp 0x1403feadf
jne 0x1403feab2
sub rdx, rax
jmp 0x1403feaed
jmp 0x1403feb3f
movzx r9d, word [0x1400b8f10]
cmp r8d, 0x44f032c6
test cl, dil
test r9w, r9w
jmp 0x1403feb0d
je 0x1403feb4d
cmp rdx, 0x104
mov r8w, r11w
cmovge r8, r10
jmp 0x1403feb27
mov r8d, 0x104
jmp 0x1403feb32
cmovb r8, rdx
jmp 0x1403fec69
mov r10, rcx
clc
test rdx, rdx
jne 0x1403fecc7
jmp 0x1403feccd
mov rax, qword gs:[0x30]
shld r9w, cx, 0xda
mov rax, qword [rax + 0x60]
mov rax, qword [rax + 0x18]
and r10b, r8b
rcr r11b, cl
movsxd r8, ecx
mov rax, qword [rax + 0x10]
cmc
movzx r8d, word [rax + 0x58]
or r9b, r14b
cmp r8, rdx
movzx r10w, r10b
cmovae r8, rdx
xadd r9b, r11b
bswap r10w
movsx r9w, dil
mov r9, qword [rax + 0x60]
movzx r11d, word [r9]
and r10b, bpl
xadd r10b, r10b
lea r10, [0x1400b8f10]
test r11w, r11w
jmp 0x1403febb2
je 0x1403fec10
xor eax, eax
cmp dh, 0x7e
test r15b, 0xd5
nop word cs:[rax + rax]
cmp r8, rax
je 0x1403fec19
mov word [r10], r11w
movzx r11, r9w
rol r11w, cl
cmp al, 0x27
add r10, 2
movzx r11w, dil
movzx r11d, word [r9 + rax*2 + 2]
inc rax
cmc
test r11w, r11w
jmp 0x1403fec02
jne 0x1403febcf
sub r8, rax
clc
cmp r14b, 0xa9
test r8, r8
je 0x1403fec2a
mov word [r10], 0
test bpl, 0xc6
sbb r10b, bpl
and r10w, bp
movzx r9d, word [0x1400b8f10]
shr r10d, cl
clc
shr r8, 0x56
cmp rdx, 0x104
movsx r8w, dil
cmovae r10d, r15d
movsx r8d, r9w
mov r8d, 0x104
movzx r10, r9w
cmovb r8, rdx
mov r10, rcx
test r9w, r9w
je 0x1403fecbe
xor edx, edx
lea rax, [0x1400b8f10]
mov r10, rcx
cmc
clc
nop dword [rax + rax]
cmp r8, rdx
jmp 0x1403fec87
je 0x1403fecc7
mov word [r10], r9w
btr r9w, bx
add r10, 2
inc r9b
movzx r9d, word [rax + rdx*2 + 2]
jmp 0x1403feca8
inc rdx
jmp 0x1403fecb0
test r9w, r9w
jne 0x1403fec7f
sub r8, rdx
cmc
test r8, r8
je 0x1403feccd
mov word [r10], 0
movabs rax, 0xe039ec0d24fefd13
setno dh
xchg rdx, rdx
mov qword [rsp], rax
movabs rax, 0x2247bce40ef3a5e6
movzx edx, cx
mov qword [rsp + 8], rax
movzx edx, sp
movabs rdx, 0xe05dec612491fd3d
mov qword [rsp + 0x10], rdx
jmp 0x1403fed0a
mov qword [rsp + 0x18], rax
movsx rax, ax
movzx eax, bx
lea rax, [rsp + 0x10]
movdqa xmm0, xmmword [rsp]
pxor xmm0, xmmword [rax]
movdqa xmmword [rsp], xmm0
movd eax, xmm0
add rcx, 0xfffffffffffffffe
cmc
nop word cs:[rax + rax]
jmp 0x1403fed42
cmp word [rcx + 2], 0
lea rcx, [rcx + 2]
jmp 0x1403fed50
jne 0x1403fed42
test ax, ax
jmp 0x1403fed5e
je 0x1403fed99
lea rdx, [rsp + 2]
nop word cs:[rax + rax]
cmp bl, spl
stc
mov word [rcx], ax
add rcx, 2
bsf eax, edx
movzx eax, word [rdx]
test r14b, r10b
add rdx, 2
cmc
test sil, r12b
test ax, ax
jne 0x1403fed78
mov word [rcx], 0
stc
add rsp, 0x28
jmp 0x1403feda8
ret