joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1404005ec
Capabilities:
Access peb ldr_data

Disassembly:
sub rsp, 0x28
test r12w, dx
test r8, r8
jmp 0x1404005fc
je 0x140400664
movzx r9d, word [r8]
cmc
test esi, ecx
test r9w, r9w
jmp 0x140400612
je 0x1404006a0
xor eax, eax
bsr r10w, si
mov r10, rcx
nop dword [rax + rax]
cmp rdx, rax
jmp 0x140400632
je 0x140400874
mov word [r10], r9w
add r10, 2
bswap r9w
movzx r9d, word [r8 + rax*2 + 2]
inc rax
test r9w, r9w
jne 0x14040062a
sub rdx, rax
jmp 0x14040065f
jmp 0x1404006a3
movzx r9d, word [0x1400b8f10]
cmp r11b, 0xf6
stc
cmc
test r9w, r9w
jmp 0x14040067b
je 0x1404006b6
cmp rdx, 0x104
setle r8b
mov r8d, 0x104
cmovb r8, rdx
jmp 0x14040069b
jmp 0x140400805
mov r10, rcx
test rdx, rdx
jmp 0x1404006ab
jne 0x140400874
jmp 0x14040087a
mov rax, qword gs:[0x30]
not r9w
sbb r10w, 0x3044
shr r11b, 0xb1
mov rax, qword [rax + 0x60]
mov rax, qword [rax + 0x18]
bt r11w, 0x6e
mov rax, qword [rax + 0x10]
bt r10, 0x88
adc r9b, r13b
shrd r9w, dx, 0x2c
movzx r8d, word [rax + 0x58]
bsr r11w, r12w
bsf r9, r15
mov r10w, r8w
cmp r8, rdx
movzx r9, cx
cmovae r8, rdx
mov r9, qword [rax + 0x60]
ror r11b, 0x5c
movzx r11d, word [r9]
add r10d, edi
sal r10w, cl
lea r10, [0x1400b8f10]
test al, r11b
cmc
test r11w, r11w
jmp 0x140400731
je 0x140400795
sub eax, eax
test bl, r12b
cmp al, 0x53
nop word cs:[rax + rax]
cmp r8, rax
je 0x1404007a3
mov word [r10], r11w
sbb r11d, ecx
bt r11d, 0x60
and r11b, dil
add r10, 2
mov r11, 0x21502125
movzx r11d, word [r9 + rax*2 + 2]
jmp 0x14040077a
inc rax
clc
cmc
cmp r8b, 0xb2
test r11w, r11w
jmp 0x14040078c
jne 0x14040074c
sub r8, rax
test r8, r8
jmp 0x14040079d
je 0x1404007b7
mov word [r10], 0
rol r9, 0xd
sar r9w, 0x17
bsr r8w, r11w
movzx r9d, word [0x1400b8f10]
stc
mov r10, 0x78be0c72
cmp rdx, 0x104
movsx r8w, r12b
setae r10b
mov r8d, 0x104
not r10b
sete r10b
mov r10, 0x80c077d
cmovb r8, rdx
mov r10, rcx
cmp r8d, eax
stc
test r9w, r9w
jmp 0x1404007ff
je 0x140400866
sub edx, edx
shl ax, cl
lea rax, [0x1400b8f10]
sub r10b, r9b
mov r10, rcx
cmc
cmp r11b, 0x30
nop dword [rax + rax]
jmp 0x140400829
cmp r8, rdx
jmp 0x140400831
je 0x140400874
mov word [r10], r9w
rcl r9b, cl
add r10, 2
movzx r9d, word [rax + rdx*2 + 2]
jmp 0x14040084d
inc rdx
cmp r8b, 0xe4
test r9w, r9w
jmp 0x14040085d
jne 0x140400829
sub r8, rdx
test r8, r8
jmp 0x14040086e
je 0x14040087a
mov word [r10], 0
movabs rax, 0xe039ec0d24fefd13
movzx dx, r9b
mov dx, 0x51b9
cdq
mov qword [rsp], rax
mov eax, 0x17996053
movsx edx, r8w
movabs rax, 0x2247bce40ef3a5e6
cdq
mov qword [rsp + 8], rax
movabs rdx, 0xe05dec612491fd3d
jmp 0x1404008ba
mov qword [rsp + 0x10], rdx
jmp 0x1404008c4
mov qword [rsp + 0x18], rax
movzx eax, bx
lea rax, [rsp + 0x10]
movdqa xmm0, xmmword [rsp]
pxor xmm0, xmmword [rax]
movdqa xmmword [rsp], xmm0
movd eax, xmm0
add rcx, 0xfffffffffffffffe
jmp 0x1404008ec
nop word cs:[rax + rax]
cmp word [rcx + 2], 0
jmp 0x140400900
lea rcx, [rcx + 2]
jmp 0x140400909
jne 0x1404008f6
test ax, ax
je 0x140400954
lea rdx, [rsp + 2]
stc
test r10b, bpl
nop word cs:[rax + rax]
jmp 0x140400936
mov word [rcx], ax
add rcx, 2
mov ah, 0xc4
movzx eax, word [rdx]
stc
add rdx, 2
cmp r14b, sil
test ax, ax
jne 0x140400936
mov word [rcx], 0
jmp 0x14040095e
add rsp, 0x28
ret
Function at 0x140446633
Capabilities:
Log keystrokes via polling

Disassembly:
sub rsp, 0x28
jmp 0x14044663c
movzx ecx, cx
call qword [sym.imp.USER32.dll_GetKeyState]
movzx eax, ax
cmp eax, 0x100
setae al
cmp bl, spl
test r14b, 0xb7
add rsp, 0x28
ret

Function at 0x140447dfe
Capabilities:
Access peb ldr_data
Encrypt data using speck

Disassembly:
sub rsp, 0x28
mov rcx, qword [rcx]
movzx rax, ax
cbw
mov rax, qword [rcx]
jmp 0x140447e13
call qword [rax + 0x28]
test eax, eax
jmp 0x140447e1d
je 0x140447e62
mov ecx, eax
bt r8w, 0x42
cmc
movabs r8, 0xcafa59766d7f94e
xadd dl, r9b
neg r9b
mov dl, 3
bts r9w, si
test r11b, r13b
mov r9d, 0x2a
cmp rdx, 0x67075049
add rsp, 0x28
jmp 0x140447e5d
jmp fcn.1403b1aa9
nop
test r13b, r10b
add rsp, 0x28
jmp 0x140447e6f
ret

Function at 0x140447f00
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rsi
bts ax, bp
and al, 0xd5
inc si
push rdi
btr ax, bp
rol sil, cl
cwde
push rbp
sal ax, cl
dec si
shld ax, r11w, 0x55
push rbx
test ax, r8w
test r11w, 0x65b3
sub rsp, 0x48
or bx, 0x2694
setne al
mov rax, r9
cmp r14w, si
bt bx, r15w
sbb r9b, bpl
mov rsi, rdx
movzx ebx, r13w
mov rdx, rcx
btc r9, r8
mov ebx, dword [rsp + 0xa0]
mov qword [rsp + 0x40], 0
xor cx, dx
shl r9w, cl
mov rcx, qword [0x1400b9300]
or r9w, 0x576f
movzx r9, r13w
movss xmm0, dword [r8]
rcl r9w, cl
sar r9b, cl
movss xmm1, dword [r8 + 4]
btr r9w, 0x1b
bts r9w, r9w
mov r9, qword [rdx]
test bh, 0x20
cmc
cmp ebx, 0xffffffff
jmp 0x140447fa8
je 0x140447fb6
mov r8d, ebx
jmp 0x140447fed
mov rdx, 0xffffffffffffffff
nop word [rax + rax]
movsx r8, r9w
movsx r8d, bx
lea r8, [rdx + 1]
jmp 0x140447fd7
cmp word [rax + rdx*2 + 2], 0
cwd
mov rdx, r8
jmp 0x140447fe7
jne 0x140447fce
mov ebp, dword [rsp + 0x98]
movsx edi, sp
movzx ebx, ax
bswap bx
mov ebx, dword [rsp + 0x90]
mov dh, 0xd0
not dil
mov rdi, qword [rcx]
movsx edx, dx
mov dx, bx
bswap dx
lea rdx, [rsp + 0x40]
jmp 0x140448020
mov qword [rsp + 0x30], rdx
cmovs edx, r8d
movss dword [rsp + 0x28], xmm1
movsx rdx, r14w
seta dl
movss dword [rsp + 0x20], xmm0
mov rdx, rax
jmp 0x140448044
call qword [rdi + 0x90]
test eax, eax
jmp 0x140448051
je 0x140448087
mov ecx, eax
not dl
mov dl, cl
movabs r8, 0xcafa59766d7f94e
mov dl, 0x5d
mov dl, 3
movsx r9d, r14w
bswap r9w
movzx r9d, r14w
mov r9d, 0x41
jmp 0x140448082
call fcn.1403b1aa9
mov rcx, qword [rsp + 0x40]
mov rax, qword [rcx]
mov edx, ebx
jmp 0x140448096
call qword [rax + 0x18]
mov rcx, qword [rsp + 0x40]
movsx edx, r10w
movsxd rax, r8d
mov rax, qword [rcx]
movzx dx, dl
movsxd rdx, r13d
bswap rdx
mov edx, ebp
jmp 0x1404480b9
call qword [rax + 0x20]
mov rax, qword [rsp + 0x40]
sbb bpl, 0x59
adc bh, bl
test r14b, r11b
mov qword [rsi], rax
shr bx, cl
test al, ah
mov rax, rsi
rcl bh, 0xce
add rsp, 0x48
movsx rsi, r9w
pop rbx
not bpl
pop rbp
mov dil, r15b
movsx esi, bx
xchg esi, edi
pop rdi
movsxd rsi, r9d
sete sil
not sil
pop rsi
jmp 0x1404480fe
ret
Function at 0x140449475
Capabilities:
Execute anti-debugging instructions

Disassembly:
push rsi
inc rax
cmovo ax, r12w
or esi, 0x652e1cea
push rdi
sar al, 0x76
movsxd rdi, ecx
movsx rax, bp
sub rsp, 0x88
cbw
movaps xmmword [rsp + 0x70], xmm9
movaps xmmword [rsp + 0x60], xmm8
movzx si, dil
xchg sil, dil
movsx eax, r8w
movaps xmmword [rsp + 0x50], xmm7
movaps xmmword [rsp + 0x40], xmm6
bswap edi
mov sil, 0xb5
nop
movaps xmm8, xmm3
mov rdi, rdx
movsx rdx, r13w
mov dh, 0xbd
cdq
mov rsi, rcx
setns ah
cqo
mov rcx, qword [rcx + 0x20]
movsxd rdx, r14d
mov dl, r14b
movups xmm0, xmmword [r8]
cdq
movsx edx, cx
rdtsc
movaps xmmword [rsp + 0x20], xmm0
rdtsc
nop
cqo
mov rax, qword [rcx]
movzx rdx, r9w
lea rdx, [rsp + 0x20]
call qword [rax + 0x40]
movsd xmm6, qword [rdi]
movaps xmm0, xmm6
jmp 0x140449516
call fcn.1404ba68e
movaps xmm9, xmm0
jmp 0x140449524
shufps xmm6, xmm6, 0x55
movaps xmm0, xmm6
jmp 0x140449530
call fcn.1404ba68e
unpcklps xmm9, xmm0
addps xmm9, xmmword [0x1400bd4e0]
movlps qword [rdi], xmm9
movlps qword [rsp + 0x20], xmm9
movsd xmm6, qword [rdi + 8]
jmp 0x140449555
movaps xmm0, xmm6
jmp 0x14044955d
call fcn.1404ba68e
movaps xmm7, xmm0
shufps xmm6, xmm6, 0x55
movaps xmm0, xmm6
jmp 0x140449571
call fcn.1404ba68e
movss dword [rdi + 8], xmm7
jmp 0x140449580
unpcklps xmm7, xmm0
movss dword [rdi + 0xc], xmm0
jmp 0x14044958d
addps xmm7, xmm9
movlps qword [rsp + 0x28], xmm7
movss dword [rsp + 0x30], xmm8
mov r8b, 0x3e
cdq
movss dword [rsp + 0x34], xmm8
setp dl
mov rcx, qword [rsi + 0x18]
movzx r8w, spl
mov dl, dil
not r8b
mov r8, qword [rsi + 0x20]
cwde
mov rax, qword [rcx]
mov dl, spl
cmovle rdx, rsp
lea rdx, [rsp + 0x20]
jmp 0x1404495d3
call qword [rax + 0x98]
movaps xmm6, xmmword [rsp + 0x40]
bt rdi, 0x6e
clc
movaps xmm7, xmmword [rsp + 0x50]
movaps xmm8, xmmword [rsp + 0x60]
movaps xmm9, xmmword [rsp + 0x70]
bsr edi, r12d
add rsp, 0x88
not esi
pop rdi
not sil
xchg si, si
pop rsi
jmp 0x14044960f
ret
Function at 0x140449b50
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
rcl r15, cl
cwde
cmovno r15, r14
push r14
push rsi
push rdi
push rbp
btc r15d, 0x5e
xor bpl, r15b
push rbx
bswap edi
test spl, bpl
sbb bh, 0x99
sub rsp, 0x88
cwde
movaps xmmword [rsp + 0x70], xmm8
mov al, dil
movaps xmmword [rsp + 0x60], xmm7
cwde
movaps xmmword [rsp + 0x50], xmm6
mov eax, 0x341f21af
mov r14, r8
mov rbx, rdx
mov r15, rcx
movsx edx, sp
setb dil
cqo
mov rsi, qword [rsp + 0xe0]
setae dil
cdqe
cwde
mov ebp, dword [rsp + 0xf0]
bswap ecx
mov edx, dword [rsp + 0xe8]
movsx di, r10b
jmp 0x140449bd0
mov rdi, qword [r9]
mov rax, qword [rdi]
mov rcx, rdi
jmp 0x140449bde
call qword [rax + 0x18]
mov rax, qword [rdi]
movsx dx, r9b
cmovle cx, bx
cqo
mov rcx, rdi
cmovg dx, cx
movsxd rdx, r11d
mov edx, ebp
call qword [rax + 0x20]
mov rcx, qword [r15 + 0x20]
movzx dx, r15b
movups xmm0, xmmword [r14]
setne dh
movzx ax, r10b
movaps xmmword [rsp + 0x40], xmm0
mov rax, qword [rcx]
lea r14, [rsp + 0x40]
movzx dx, dh
mov rdx, r14
jmp 0x140449c2c
call qword [rax + 0x40]
movsd xmm7, qword [rbx]
jmp 0x140449c38
movaps xmm0, xmm7
call fcn.1404ba68e
movaps xmm8, xmm0
shufps xmm7, xmm7, 0x55
movaps xmm0, xmm7
call fcn.1404ba68e
unpcklps xmm8, xmm0
addps xmm8, xmmword [0x1400bd4e0]
movlps qword [rbx], xmm8
movlps qword [rsp + 0x40], xmm8
movsd xmm7, qword [rbx + 8]
movaps xmm0, xmm7
jmp 0x140449c73
call fcn.1404ba68e
movaps xmm6, xmm0
shufps xmm7, xmm7, 0x55
movaps xmm0, xmm7
call fcn.1404ba68e
movss dword [rbx + 8], xmm6
unpcklps xmm6, xmm0
movss dword [rbx + 0xc], xmm0
cdqe
movzx ecx, r8w
xchg cl, ah
mov rcx, qword [r15 + 0x18]
jmp 0x140449cac
mov rax, qword [r15 + 0x20]
jmp 0x140449cb5
addps xmm6, xmm8
movlps qword [rsp + 0x48], xmm6
xor r8d, r8d
test dx, r12w
nop
cmp word [rsi + r8*2], 0
jmp 0x140449cd1
lea r8, [r8 + 1]
jmp 0x140449cda
jne 0x140449cc6
dec r8d
movsx bp, r13b
mov rbp, qword [rcx]
xchg dl, r9b
movzx r9w, r9b
jmp 0x140449cf8
mov qword [rsp + 0x28], rax
movsx r9w, spl
mov r9b, r10b
movzx rdx, r13w
mov qword [rsp + 0x20], r14
sete r9b
mov dword [rsp + 0x38], 0
movsx dx, spl
movzx edx, r9w
movsx r9d, r11w
mov dword [rsp + 0x30], 2
mov rdx, rsi
mov r9w, bx
mov r9, rdi
jmp 0x140449d3e
call qword [rbp + 0xd8]
movaps xmm6, xmmword [rsp + 0x50]
movsx r14d, cx
add bpl, spl
setbe dil
movaps xmm7, xmmword [rsp + 0x60]
movsxd r14, ecx
btc edi, 0x4c
sets dil
movaps xmm8, xmmword [rsp + 0x70]
cmovg ebx, r11d
add rsp, 0x88
movsx rbx, r11w
pop rbx
xchg r15d, esi
pop rbp
pop rdi
pop rsi
not r14
mov r15b, 0xb
movsx r14, ax
pop r14
pop r15
ret
Function at 0x14044addd
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
sub rsp, 0x18
mov r8, rcx
sal al, 0xa6
mov eax, esi
sar ah, 0xb7
mov eax, 0x5a4d
clc
cmp cl, r14b
cmp cl, 0xca
cmp word [0x140000000], ax
jmp 0x14044ae04
jne 0x14044af22
movsxd rcx, dword [0x14000003c]
movzx rdx, r9w
lea rdx, [0x140000000]
jmp 0x14044ae21
add rcx, rdx
cmp dword [rcx], 0x4550
jne 0x14044af22
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14044af22
sub r8, rdx
ror rdx, 0xec
movzx edx, word [rcx + 0x14]
sbb r9b, 0x9d
adc r9b, r9b
add rdx, 0x18
add rdx, rcx
ror ax, cl
adc r9w, 0xcd1
cmp ax, r12w
movzx eax, word [rcx + 6]
lea rcx, [rax + rax*4]
shld r9w, dx, 0x7c
cmp r11, rbx
lea r9, [rdx + rcx*8]
clc
cmp dil, bpl
test si, r15w
mov qword [rsp], rdx
cmp spl, 0xd4
cmp rdx, r9
jmp 0x14044ae92
je 0x14044aed6
mov ecx, dword [rdx + 0xc]
cmp al, r10b
test edx, ebp
cmp rdi, 0x1fd912b7
cmp r8, rcx
jmp 0x14044aeaf
jb 0x14044aecd
mov eax, dword [rdx + 8]
stc
add eax, ecx
cmp r14d, r9d
cmc
cmp r8, rax
jmp 0x14044aec7
jb 0x14044aee1
add rdx, 0x28
jmp 0x14044ae82
sub edx, edx
cmp bp, 0x2d9c
test r13w, ax
test rdx, rdx
jmp 0x14044aee9
jne 0x14044aefb
sub al, al
jmp 0x14044aef6
jmp 0x14044af37
cmp dword [rdx + 0x24], 0
jmp 0x14044af04
jge 0x14044af16
xor al, al
jmp 0x14044af11
jmp 0x14044af37
mov al, 1
jmp 0x14044af1d
jmp 0x14044af37
sub al, al
jmp 0x14044af29
jmp 0x14044af37
add rsp, 0x18
ret
Function at 0x14045c64f
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
sub rsp, 0x28
movsx cx, bh
lea rcx, [rsp + 0x30]
jmp 0x14045c661
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rax, qword [rsp + 0x30]
clc
stc
jmp 0x14045c673
add rsp, 0x28
ret

Function at 0x1404610e8
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x10], rdx
push rbp
sar ah, cl
sar bx, 0x89
mov rbp, rsp
rcl rbx, 0x48
stc
sub rsp, 0x80
and rax, r13
bt ebx, 0xed
mov rax, qword [0x1400b7288]
xor rax, rsp
movzx rbx, bp
mov qword [rbp - 0x10], rax
mov rax, qword [rcx + 8]
add bx, r15w
add rbx, 0x73cf34de
mov rbx, rdx
mov qword [rbp - 0x58], rdx
cmc
test rax, rax
jmp 0x140461145
je 0x1404611ce
mov rdx, qword [rax + 0x28]
stc
test rdx, rdx
jmp 0x140461158
jne 0x140461162
lea rdx, [rax + 0x30]
xorps xmm0, xmm0
xorps xmm1, xmm1
movups xmmword [rbp - 0x30], xmm0
or r8, 0xffffffffffffffff
movdqu xmmword [rbp - 0x20], xmm1
inc r8
cmc
cmp byte [rdx + r8], 0
jne 0x140461175
lea rcx, [rbp - 0x30]
jmp 0x14046118d
call fcn.14045973f
sub r8d, r8d
sets ah
movzx di, dl
cwd
lea rax, [rbp - 0x30]
cdq
xchg rcx, rdx
lea rcx, [rbp - 0x20]
movzx dx, r13b
jmp 0x1404611b9
lea rdx, [rbp - 0x18]
movsxd rdi, esi
lea edi, [r8 + 1]
jmp 0x1404611c9
jmp 0x140461223
movdqa xmm1, xmmword [0x1400bd400]
lea rax, [rbp - 0x50]
shrd ecx, r11d, 0xc3
stc
movsx cx, sil
sub edi, edi
movsx ecx, si
mov cl, 0xfc
lea rcx, [rbp - 0x40]
xorps xmm0, xmm0
lea rdx, [rbp - 0x38]
sar r8w, cl
movzx r8w, r13b
movups xmmword [rbp - 0x50], xmm0
mov byte [rbp - 0x50], 0
not r8d
setns r8b
mov r8b, r9b
lea r8d, [rdi + 2]
cmp r10b, r12b
clc
movdqu xmmword [rbp - 0x40], xmm1
clc
cmp r8b, bpl
movups xmm0, xmmword [rax]
movups xmm1, xmmword [rax + 0x10]
clc
movups xmmword [rbx], xmm0
cmp sil, 0xf2
clc
cmc
movups xmmword [rbx + 0x10], xmm1
stc
and qword [rcx], 0
cmc
test r13w, 0x21a
mov qword [rdx], 0xf
mov byte [rax], 0
test r8d, r8d
je 0x1404612b2
mov rdx, qword [rbp - 0x38]
cmc
cmp rdx, 0x10
jb 0x1404612b2
mov rcx, qword [rbp - 0x50]
inc rdx
movsx rax, r14w
mov rax, rcx
jmp 0x14046127b
cmp rdx, 0x1000
jmp 0x140461287
jb 0x1404612ad
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmc
stc
cmp rax, 0x1f
jmp 0x1404612a7
ja 0x140461377
call fcn.140238558
test edi, edi
jmp 0x1404612b9
je 0x14046132b
mov rdx, qword [rbp - 0x18]
cmp rdx, 0x10
jmp 0x1404612cc
jb 0x14046132b
mov rcx, qword [rbp - 0x30]
cbw
inc rdx
shl ax, 0x2c
adc ah, 0x53
mov rax, rcx
cmp bpl, 0xaf
clc
cmp rdx, 0x1000
jmp 0x1404612f6
jb 0x140461326
mov rcx, qword [rcx - 8]
cmp dx, 0x560d
cmp si, di
clc
add rdx, 0x27
stc
sub rax, rcx
stc
add rax, 0xfffffffffffffff8
cmc
cmp rax, 0x1f
jmp 0x140461320
ja 0x140461377
call fcn.140238558
mov rax, rbx
neg ch
add cl, r10b
shl rcx, 0x35
mov rcx, qword [rbp - 0x10]
cmc
xor rcx, rsp
jmp 0x140461344
call fcn.1404a1da3
lea r11, [rsp + 0x80]
not rbx
movsx bx, dil
movsx rbx, r10w
mov rbx, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
movsx rbp, r11w
mov rsp, r11
cmovno rbp, r8
pop rbp
jmp 0x140461376
ret
call fcn.1404b833f
int3
Function at 0x140461382
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov rax, rsp
test dl, cl
mov qword [rax + 0x10], rbx
stc
mov qword [rax + 0x18], rbp
push rsi
jmp 0x14046139a
push rdi
sal ebp, cl
mov ebp, 0x1c3436c1
push r12
test dil, 0xef
xchg bpl, bpl
push r14
rcl bpl, 0xf9
push r15
sub bp, 0x6946
xor r15b, r12b
sub rsp, 0x40
clc
xor r12d, r12d
mov r15, r8
shr bpl, cl
stc
mov qword [rax + 0x20], r12
rol bpl, cl
or rdi, 0xffffffffffffffff
movzx ebp, cx
mov rbp, rcx
inc rdi
test r12b, r11b
cmp byte [rdi + rcx], r12b
jmp 0x1404613ea
jne 0x1404613db
add rdi, 1
movsxd rbx, r11d
mov bl, 0x9f
mov esi, r10d
mov rbx, r12
movsxd r14, edi
setae r14b
not si
mov rsi, rdi
mov r14, rcx
jmp 0x140461414
je 0x140461471
lea r9, [rsp + 0x88]
mov qword [rsp + 0x20], r15
cmovge dx, si
mov r8, rsi
movsxd rcx, edi
lea rcx, [rsp + 0x70]
cmova dx, r11w
cwd
mov rdx, r14
call fcn.14045bbcc
test eax, eax
jle 0x140461471
cdqe
jmp 0x140461454
inc rbx
jmp 0x14046145c
add r14, rax
cmp spl, 0xb2
sub rsi, rax
jmp 0x14046146b
jne 0x14046141a
inc rbx
cmovp rdx, rsi
movsx rcx, r11w
setae dl
mov edx, 2
movsxd rcx, r13d
mov rcx, rbx
jmp 0x14046148f
call fcn.1400f884c
mov r14, rax
test r11d, 0xb1f100a
cmp r10b, 0xe
test rax, rax
jmp 0x1404614aa
je 0x14046157a
mov qword [rsp + 0x30], r12
mov rsi, rax
test bh, 0x73
test rbx, rbx
jmp 0x1404614c3
je 0x140461528
lea r9, [rsp + 0x30]
cwd
movsxd r8, esi
movsx rdx, r14w
mov qword [rsp + 0x20], r15
setno dh
movzx edx, r8w
mov cx, ax
mov r8, rdi
movsx edx, r15w
mov rdx, rbp
movzx rcx, bp
movsxd rcx, r12d
movsx cx, spl
mov rcx, rsi
call fcn.14045bbcc
test eax, eax
jmp 0x14046150b
jle 0x140461528
cdqe
add rsi, 2
stc
cmp dl, r8b
add rbp, rax
sub rbx, 1
jne 0x1404614c9
lea r11, [rsp + 0x40]
movsx rbx, r8w
mov word [rsi], r12w
mov rbx, qword [r11 + 0x38]
movzx r15d, sp
lahf
mov rax, r14
movsx r14d, ax
bswap r14w
mov rbp, qword [r11 + 0x40]
mov r12, 0x453e412a
movzx di, r9b
mov rsp, r11
bswap edi
cmovo r12w, r14w
pop r15
pop r14
pop r12
pop rdi
cmova si, r15w
setno sil
pop rsi
jmp 0x140461579
ret
call fcn.14045b35a
int3
Function at 0x14046e3e6
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov rax, rsp
clc
cmp r13b, 0x2e
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
rcr bpl, 0xde
xor rbp, rdi
mov qword [rax + 0x18], rsi
btc si, bx
mov qword [rax + 0x20], rdi
push r14
shrd rsi, rbx, 0xed
adc r14b, dil
rcl r14b, 0x7d
sub rsp, 0x20
movzx edi, dx
sal sil, cl
sal r14d, 0x61
mov rsi, qword [rsp + 0x50]
movzx r14d, r9w
inc bpl
mov rdi, r8
rol ebp, cl
inc bpl
mov rbp, rdx
test r10b, 0x3d
test rsi, rsi
jmp 0x14046e448
je 0x14046e522
mov rbx, qword [r8 + 8]
test rbx, r8
test rbx, rbx
jmp 0x14046e45d
je 0x14046e509
mov rax, qword [rbx + 0x40]
cmc
cmp r10b, r13b
cmp r13b, 0xb7
cmp qword [rax], 0
jmp 0x14046e478
je 0x14046e4c8
mov rax, qword [rbx + 0x58]
cmp dword [rax], 0
jmp 0x14046e48a
jle 0x14046e4c8
dec dword [rax]
cdq
mov rcx, qword [rbx + 0x40]
movsx rdx, cx
mov rdx, qword [rcx]
mov al, bh
cbw
movsx rax, di
lea rax, [rdx + 2]
jmp 0x14046e4af
mov qword [rcx], rax
movsx rax, si
movzx eax, r14w
mov word [rdx], r14w
jmp 0x14046e4c3
jmp 0x14046e4f1
mov rax, qword [rbx]
movsx edx, di
cqo
movzx dx, r10b
movzx edx, r14w
movsx rcx, r15w
xchg ch, cl
mov rcx, rbx
mov rax, qword [rax + 0x18]
jmp 0x14046e4eb
call qword [case.0x14044ab9b.0]
mov ecx, 0xffff
jmp 0x14046e500
cmp cx, ax
jne 0x14046e513
mov byte [rdi], 1
cmp spl, r9b
test r13d, eax
clc
sub rsi, 1
jmp 0x14046e51c
jne 0x14046e455
movups xmm0, xmmword [rdi]
adc r14d, r8d
rol esi, cl
mov rbx, qword [rsp + 0x30]
cdqe
mov r14b, r12b
mov rax, rbp
adc r14b, 0x12
cmp r8b, 0x6a
ror r14b, cl
mov rsi, qword [rsp + 0x40]
btc r14, 0xd0
sbb di, 0x4e40
cmc
mov rdi, qword [rsp + 0x48]
and r14d, 0x67a70fb0
ror r14w, cl
movdqu xmmword [rbp], xmm0
xchg r14w, bp
setns r14b
movzx r14d, bx
mov rbp, qword [rsp + 0x38]
xchg r14b, r14b
add rsp, 0x20
pop r14
jmp 0x14046e586
ret
Function at 0x1404752f7
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov rax, rsp
clc
mov qword [rax + 8], rbx
xor bx, 0x5cfe
xadd bl, bh
add bx, 0x27a1
mov qword [rax + 0x10], rbp
mov rbp, 0xb0a7bab
mov qword [rax + 0x18], rsi
mov esi, ebp
and bh, 0x54
add sil, 0xc6
mov qword [rax + 0x20], rdi
btr bx, 0xd8
shr bl, 0xd5
push r14
movsx bp, r9b
movsxd r14, eax
bt esi, 0x38
sub rsp, 0x20
xchg r14w, bp
mov rsi, r9
mov rbx, r8
mov r14, rdx
mov rbp, rcx
test r9, r9
jmp 0x14047535a
je 0x140475455
mov rdi, qword [rdx + 8]
test r11w, 0x9d8
test rdi, rdi
jmp 0x140475372
je 0x140475439
mov rax, qword [rdi + 0x40]
adc r8b, bl
xor r8b, spl
add r8, rcx
movzx r8d, word [rbx]
cmp qword [rax], 0
jmp 0x140475392
je 0x1404753e5
mov rax, qword [rdi + 0x58]
jmp 0x1404753a1
cmp dword [rax], 0
jmp 0x1404753a9
jle 0x1404753e5
dec dword [rax]
cdqe
mov ax, 0x5d30
mov rcx, qword [rdi + 0x40]
cqo
rdtsc
cdqe
mov rdx, qword [rcx]
cdqe
lea rax, [rdx + 2]
jmp 0x1404753cf
mov qword [rcx], rax
jmp 0x1404753d7
mov word [rdx], r8w
jmp 0x1404753e0
jmp 0x140475423
mov rax, qword [rdi]
movzx dx, r12b
cqo
movsx rcx, r8w
movzx edx, r8w
movsx rcx, di
xchg cl, cl
movsx ecx, r15w
mov rcx, rdi
mov rax, qword [rax + 0x18]
jmp 0x14047540d
call qword [case.0x14044ab9b.0]
movzx r8d, ax
shrd ax, di, 0x51
bsf rax, r13
add al, r10b
mov eax, 0xffff
clc
stc
cmp ax, r8w
jmp 0x140475433
jne 0x140475441
mov byte [r14], 1
cmp bh, 0xa9
cmc
add rbx, 2
cmc
sub rsi, 1
jmp 0x14047544f
jne 0x14047536a
movups xmm0, xmmword [r14]
test r14b, 0xaa
shr dil, cl
mov rbx, qword [rsp + 0x30]
rol di, 0xa2
bt edi, r14d
mov rax, rbp
sal rdi, cl
btc rdi, 0x63
btr di, r12w
mov rsi, qword [rsp + 0x40]
jmp 0x14047548b
mov rdi, qword [rsp + 0x48]
rcr r14w, cl
clc
bsr r14, rdi
movdqu xmmword [rbp], xmm0
mov rbp, qword [rsp + 0x38]
btc r14, r9
test r10b, bpl
movsx r14d, bx
add rsp, 0x20
movzx r14, r14w
pop r14
jmp 0x1404754bd
ret
Function at 0x1404754be
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov rax, rsp
clc
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
inc rbp
rcr ebp, 0xd0
mov qword [rax + 0x18], rsi
xor rsi, r8
mov sil, r14b
mov qword [rax + 0x20], rdi
movzx ebp, ax
push r14
sub rsp, 0x20
or di, 0x6aac
test r10d, 0x4533ebe
adc dil, 0x52
mov rsi, r9
rcl dil, cl
shl ebp, 0x62
and di, r11w
movzx r14d, r8w
mov rdi, rdx
cmp r10b, 0x50
mov rbp, rcx
test rbp, 0x76cd7e64
jmp 0x14047551e
test r9, r9
je 0x1404755f0
mov rbx, qword [rdx + 8]
clc
cmp rcx, 0x31606a42
test r8b, 0xa9
test rbx, rbx
jmp 0x14047553f
je 0x1404755db
mov rax, qword [rbx + 0x40]
stc
cmp dx, r10w
cmp r11d, 0x51727d3c
cmp qword [rax], 0
jmp 0x14047555e
je 0x1404755ae
mov rax, qword [rbx + 0x58]
cmp r14b, r8b
cmc
cmp dword [rax], 0
jle 0x1404755ae
dec dword [rax]
mov rax, 0x19a45423
mov rcx, qword [rbx + 0x40]
mov rdx, qword [rcx]
movsx rax, r12w
cwde
lea rax, [rdx + 2]
jmp 0x140475593
mov qword [rcx], rax
movsx rax, r9w
nop
movzx eax, r14w
jmp 0x1404755a5
mov word [rdx], r14w
jmp 0x1404755c5
mov rax, qword [rbx]
movzx edx, r14w
bswap rcx
mov rcx, rbx
mov rax, qword [rax + 0x18]
call qword [case.0x14044ab9b.0]
mov ecx, 0xffff
test sp, di
cmp cx, ax
jmp 0x1404755d5
jne 0x1404755e1
mov byte [rdi], 1
test dil, sil
sub rsi, 1
jmp 0x1404755ea
jne 0x140475537
movups xmm0, xmmword [rdi]
cmp r9b, bpl
rcr r14, cl
mov rbx, qword [rsp + 0x30]
mov rax, rbp
not esi
cmp r10b, spl
sbb edi, r8d
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
btr r14, rcx
shr r14d, 0xcc
movdqu xmmword [rbp], xmm0
mov rbp, qword [rsp + 0x38]
add rsp, 0x20
not r14
movsx r14, bx
movsx r14d, bp
pop r14
ret