joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1401057b5
Capabilities:
Encrypt data using speck
Resolve function by parsing pe exports

Disassembly:
mov rcx, qword [rcx]
jmp 0x140207989
jmp 0x14043d0b5
push rsi
push rdi
rol ah, cl
sub rsp, 0x28
mov sil, 0xf4
btc rax, r8
mov rsi, rcx
rcl al, 0x4f
mov rcx, qword [rcx + 0x18]
mov rax, qword [rcx]
xor edx, edx
cmc
cmp edi, ebx
sub r8d, r8d
call qword [rax + 0x188]
mov edi, eax
lea rcx, [rsi + 0x30]
jmp 0x14043d0ea
call fcn.140450ce5
test edi, edi
jmp 0x14043d0f6
je 0x14043d128
cmp edi, 0x8899000c
jne 0x14043d13a
mov rcx, rsi
add rsp, 0x28
bswap rdi
xchg dil, dil
not dil
pop rdi
movzx rsi, bp
pop rsi
jmp 0x14043d123
jmp fcn.14043cd7b
nop
stc
jmp 0x14043d12f
add rsp, 0x28
movsx edi, r14w
pop rdi
pop rsi
ret
mov ecx, edi
mov dil, dil
xchg sil, dl
inc r8b
movabs r8, 0xad4a5352d2edebd0
mov dl, 3
shr r9b, 0x33
bt rdi, r12
shld r9d, r15d, 0xd5
mov r9d, 0x54
sub sil, 0x65
add rsp, 0x28
movzx di, r12b
pop rdi
pop rsi
jmp 0x14043d178
jmp fcn.1403a6a1c

Function at 0x1401c8c30
Capabilities:
Access peb ldr_data

Disassembly:
cmovb r8, rdx
cmp r9b, 0x31
test ax, ax
jmp 0x140112f0d
je 0x1402043dd
sub edx, edx
movzx r9, dx
bsf r9d, r12d
movzx r9d, r10w
lea r9, [0x1400b8f10]
test r15b, 0xe
cmp spl, 0x32
cmp r8, rdx
jmp 0x14022856a
ret
mov rax, qword gs:[0x30]
or r9d, eax
movsx r8d, r10w
mov rax, qword [rax + 0x60]
mov r9w, 0x6dec
movsx r9d, r12w
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
movzx r8d, word [rax + 0x58]
xchg r9w, r9w
rcl r9w, 0x6d
cmp r8, rdx
movzx r10d, r8w
movsx r9w, dil
cmovae r8, rdx
bt r9w, 0x81
adc r10d, 0x7727f83
mov r9, qword [rax + 0x60]
movzx r11d, word [r9]
lea r10, [0x1400b8f10]
test r10d, esi
cmp dil, spl
cmp r10b, 0x6e
test r11w, r11w
je 0x1401a7c58
sub eax, eax
clc
nop word [rax + rax]
cmp r8, rax
je 0x1401a20a5
mov word [r10], r11w
rcl r11w, 0x40
sar r11w, cl
add r10, 2
movzx r11d, word [r9 + rax*2 + 2]
inc rax
test r11w, r11w
jmp 0x1401a7c4f
je 0x1401a20ae
mov word [r10], 0
or r8b, dil
movzx eax, word [0x1400b8f10]
shr r8w, cl
btr r8w, 0xa1
cmp rdx, 0x104
movsx r8d, di
movsx r8w, r9b
mov r8d, 0x104
jmp 0x140104c84
jne 0x14019dc84
sub r8, rax
test r8, r8
jmp 0x1401a209f
movzx eax, word [0x1400b8f10]
test ax, ax
je 0x14019dc08
cmp rdx, 0x104
movsx r8w, bpl
movzx r8d, dx
mov r8d, 0x104
jmp 0x14028b4e0
jne 0x140112f30
sub r8, rdx
stc
test r8, r8
jmp 0x14023cbac
je 0x14023cbb2
mov word [rcx], ax
sar al, 0x2f
bts eax, ecx
and al, r11b
add rcx, 2
jmp 0x14024dcd2
jmp 0x140112f13
je 0x14012b134
mov word [rcx], 0
jmp 0x14012b134
movzx eax, word [r9 + rdx*2 + 2]
inc rdx
test ax, ax
jmp 0x1402043d3
cmovb r8, rdx
jmp 0x14022a32c
Function at 0x1401edbd8
Capabilities:
Parse pe header

Disassembly:
sub r8d, r8d
movsx dx, r8b
lea edx, [r8 + 2]
jmp 0x140258184
jmp 0x1404a8371
mov qword [rsp + 8], rbx
movzx rbx, r8w
xadd bx, bx
mov dword [rsp + 0x18], r8d
bsr ebx, r15d
shl ebx, cl
bts rbx, rsi
mov dword [rsp + 0x10], edx
rcl bh, 0xc6
rol ebx, 5
push rbp
mov rbp, rsp
sbb bh, 0x2c
sub rsp, 0x50
sal bx, cl
mov ebx, ecx
test r8d, r8d
jmp 0x1404a83af
jne 0x1404a843d
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
jmp 0x1404a83c5
je 0x1404a843d
mov ecx, 0x5a4d
clc
jmp 0x1404a83d6
cmp word [rax], cx
jne 0x1404a843d
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp r12d, esi
cmp r15w, 0x264b
stc
cmp dword [rcx], 0x4550
jne 0x1404a843d
mov eax, 0x20b
stc
clc
cmp word [rcx + 0x18], ax
jne 0x1404a843d
cmp dword [rcx + 0x84], 0xe
jmp 0x1404a8419
jbe 0x1404a843d
cmp dword [rcx + 0xf8], 0
jmp 0x1404a842b
je 0x1404a843d
mov ecx, ebx
jmp 0x1404a8438
call fcn.1404a823d
lea rax, [rbp + 0x18]
movsx r9w, r15b
cwd
cdq
mov byte [rbp + 0x28], 0
cwd
cdq
mov cl, r11b
mov qword [rbp - 0x20], rax
movzx r9, dx
lea r9, [rbp - 0x2c]
bswap edx
lea rax, [rbp + 0x20]
mov qword [rbp - 0x18], rax
lea r8, [rbp - 0x20]
cdqe
xchg ecx, eax
cwd
lea rax, [rbp + 0x28]
movzx rdx, sp
mov cl, r12b
cmovns cx, ax
mov qword [rbp - 0x10], rax
movsx edx, r11w
lea rdx, [rbp - 0x28]
movzx ax, ah
mov eax, 2
cmovl cx, dx
movzx rcx, ax
lea rcx, [rbp - 0x30]
jmp 0x1404a84a7
mov dword [rbp - 0x2c], eax
jmp 0x1404a84af
mov dword [rbp - 0x28], eax
jmp 0x1404a84b7
call fcn.1404a866c
cmp dword [rbp + 0x20], 0
jmp 0x1404a84c5
je 0x1404a84e5
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
xchg ebp, ebp
movsx ebp, di
jmp 0x1404a84de
pop rbp
jmp 0x1404a84e4
ret
mov ecx, ebx
jmp 0x1404a84ec
call fcn.1404a82de
int3

Function at 0x1402025b4
Capabilities:
Parse pe header

Disassembly:
jmp 0x1404a8371
xor r8d, r8d
test r12d, edx
xor edx, edx
jmp 0x14017af8c

Function at 0x14025f52f
Capabilities:
Parse pe header

Disassembly:
lea rdx, [rdx + rcx]
cmp r8d, edx
test cl, r15b
cmp rax, 0x70594cf3
cmp dword [rdx], 0x4550
jne 0x140209849
sub eax, eax
mov ecx, 0x20b
cmp r11, rax
cmp word [rdx + 0x18], cx
jmp 0x14027e518
ret
jne 0x140209849
movsxd rdx, dword [rcx + 0x3c]
clc
jmp 0x1400ed9ee
sub eax, eax
jmp 0x14018bd39
mov eax, 0x5a4d
cmp r8w, 0x2978
cmp word [rcx], ax
jmp 0x1401d7a55
sete al
ret
Function at 0x140275b9d
Capabilities:
Encrypt data using rc4 prga

Disassembly:
dec rcx
cmp r10b, r13b
jmp 0x1401ef5bb
je 0x1401ef5c3
cmp al, r9b
movzx eax, r10w
movsx rdx, cx
movsxd rdx, r15d
lea rdx, [rcx - 1]
movsx eax, r14w
mov ah, 0x31
lahf
cmovne rdx, rcx
ror ah, cl
xor eax, r15d
movsx rax, di
nop dword [rax]
bt ax, dx
rcr ah, cl
bts rax, rcx
movzx eax, byte [r8]
cmp r13d, esi
test r11w, 0x7c40
lea rdx, [rdx + 1]
mov byte [rdx], al
stc
jmp 0x14021dbbc
test al, al
jne 0x1401df2be
movzx eax, byte [rcx - 1]
jmp 0x1401d0a27
je 0x14018c49e
movzx eax, byte [rcx + 1]
inc rcx
sar dx, cl
movzx edx, al
cmp r14d, ebx
test r8w, dx
test al, al
jmp 0x14018c498
jne 0x1402645ba
inc rcx
test al, al
je 0x14021dbc9
movzx eax, byte [rcx]
cmp al, 0xef
test al, al
jmp 0x1401df2b8
je 0x14016406d
movzx eax, byte [rcx + 1]
inc rcx
jmp 0x140164065
mov r8, rcx
jmp 0x140116c61
je 0x14016406d
sub al, 0x45
test al, 0xdf
jmp 0x1401aa006
cmp al, 0x30
jne 0x14011a2b9
movzx eax, byte [rcx - 1]
jmp 0x140267c77
lea r8, [r8 + 1]
cmc
test al, al
jne 0x14011a2f1
ret
je 0x14018c49e
movzx edx, al
or ax, bx
nop dword [rax + rax]
add al, ah
movsxd rax, edx
movzx eax, dl
cmp dl, r9b
jmp 0x14017fd3c
dec rcx
cmp al, 0x30
jmp 0x14011a2b3
mov rax, qword [rdx]
rcr dx, 7
mov rdx, qword [rax + 0xf8]
mov rax, qword [rdx]
movsxd r9, esi
bsr r9, r12
movzx r9d, byte [rax]
movzx eax, byte [rcx]
stc
test r11b, 0xa4
test al, al
jmp 0x1402645a4
Function at 0x1403b2d1c
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
push r14
push r13
shl al, 0x94
push r12
movsx rax, dx
push rsi
movsx eax, si
push rdi
sbb al, r8b
not eax
push rbx
inc si
movzx rdi, r15w
sub rsp, 0x20
movzx rsi, r14w
mov rsi, r8
mov rdi, rdx
mov r14, rcx
bts ebx, eax
mov rbx, qword [rcx]
mov rcx, qword [rcx + 0x10]
sub rcx, rbx
sbb ah, bl
adc ah, bh
cmc
sar rcx, 4
sub al, r10b
add al, spl
shl ax, 0xd3
movabs rax, 0xf0f0f0f0f0f0f0f1
jmp 0x1403b2d7d
imul rcx, rax
cmp rcx, r8
jmp 0x1403b2d89
jae 0x1403b2df4
mov rcx, r14
movzx rdx, r14w
cdq
cmovb dx, r11w
mov rdx, rsi
jmp 0x1403b2da4
call fcn.1403b2ffc
mov rbx, qword [r14]
movsx edx, r14w
nop word [rax + rax]
mov rcx, rbx
movsx dx, al
mov rdx, rdi
jmp 0x1403b2dc8
call fcn.1403b37e0
add rbx, 0x110
cmc
add rdi, 0x110
jmp 0x1403b2de1
dec rsi
jmp 0x1403b2de9
jne 0x1403b2db9
jmp 0x1403b2fae
mov r13, qword [r14 + 8]
btr r15w, r8w
cmp r10w, cx
movsx r15d, r9w
mov r12, r13
shr r15w, 0xb7
sub r12, rbx
cmc
btc r15w, 0xc0
xor r15w, r9w
sar r12, 4
btr r15w, 0x79
imul r12, rax
mov r15, r12
jmp 0x1403b2e31
sub r15, rsi
jmp 0x1403b2e39
jae 0x1403b2ef2
cmp rbx, r13
jmp 0x1403b2e47
je 0x1403b2e98
nop word cs:[rax + rax]
mov rcx, rbx
movzx edx, r9w
mov rdx, rdi
call fcn.1403b3277
add rbx, 0x110
test r11w, 0x1082
cmc
add rdi, 0x110
cmp cx, 0x5951
jmp 0x1403b2e89
cmp rbx, qword [r14 + 8]
jmp 0x1403b2e92
jne 0x1403b2e5b
cmp rsi, r12
jmp 0x1403b2ea0
je 0x1403b2fae
nop dword [rax + rax]
xchg rdx, rdx
mov rcx, rbx
bswap rdx
mov dl, ah
cqo
mov rdx, rdi
jmp 0x1403b2ec3
call fcn.1403b37e0
add rbx, 0x110
clc
test bh, 0x30
add rdi, 0x110
jmp 0x1403b2edf
inc r15
jmp 0x1403b2ee7
jne 0x1403b2eb1
jmp 0x1403b2fae
imul r15, rsi, 0x110
cmp r13b, 0x42
stc
jmp 0x1403b2f03
add r15, rbx
clc
test bx, r9w
test rsi, rsi
je 0x1403b2f58
nop
movsx rdx, bp
mov rcx, rbx
movsxd rdx, ebx
bswap dx
mov rdx, rdi
jmp 0x1403b2f2a
call fcn.1403b3277
add rbx, 0x110
cmp dl, r14b
clc
add rdi, 0x110
jmp 0x1403b2f46
dec rsi
jmp 0x1403b2f4e
jne 0x1403b2f19
mov r13, qword [r14 + 8]
cmp r15, r13
jmp 0x1403b2f60
je 0x1403b2fa7
mov rsi, r15
jmp 0x1403b2f75
nop word [rax + rax]
setnp ch
not rcx
movzx ecx, si
mov rcx, rsi
jmp 0x1403b2f8c
call fcn.1403ad70b
add rsi, 0x110
cmc
cmp rsi, r13
jmp 0x1403b2fa1
jne 0x1403b2f84
mov rbx, r15
ror sil, 0x35
mov qword [r14 + 8], rbx
add rsp, 0x20
movzx r15w, r14b
pop rbx
bswap di
movzx r12d, ax
movsx rdi, r14w
pop rdi
setg sil
xchg r14w, r15w
pop rsi
movsx r12d, sp
movzx r14d, r12w
bswap r14d
pop r12
movzx r14, r14w
movzx r15w, al
pop r13
movsxd r15, r13d
mov r15d, r15d
xchg r14b, r15b
pop r14
movsx r15w, dl
pop r15
ret
Function at 0x1403d737e
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rsi
push rdi
push rbx
mov r9, rcx
movsx r10, r13w
add r8, rdx
bswap r10w
or r10d, r14d
mov dword [rcx + 8], 0
movsxd r10, r9d
movzx r10w, dil
sub eax, eax
rol r10w, 0x29
movsxd r10, edx
sub ecx, ecx
shrd r10, r13, 0x70
nop word cs:[rax + rax]
movsxd r10, r10d
lea r10, [rdx + 1]
jmp 0x1403d73ca
cmp r10, r8
jmp 0x1403d73d2
ja 0x1403d7636
movzx edi, byte [rdx]
mov edx, edi
cmc
and edx, 0x7f
jmp 0x1403d73e6
shl rdx, cl
test sil, 0xf2
test r12d, r9d
lea rax, [rax + rdx]
rol rdx, 0xae
and dh, 0x86
add rcx, 7
mov rdx, r10
test sil, sil
cmc
cmp bpl, 0xf7
test dil, dil
jmp 0x1403d7412
js 0x1403d73c1
mov rcx, rax
and rcx, 0xfffffffffffffff8
jmp 0x1403d742c
and eax, 7
clc
jmp 0x1403d743b
cmp rcx, 8
jmp 0x1403d7444
je 0x1403d7591
cmp rax, 1
jg 0x1403d7479
test rax, rax
jmp 0x1403d745c
je 0x1403d7549
cmp eax, 1
jne 0x1403d7636
lea rdx, [r10 + 8]
jmp 0x1403d7474
jmp 0x1403d7580
cmp eax, 5
jmp 0x1403d7481
je 0x1403d757c
cmp eax, 2
jmp 0x1403d748f
jne 0x1403d7636
mov rsi, r10
stc
xor edi, edi
shl ax, 0xf0
test r8d, r13d
not ax
sub ecx, ecx
nop word cs:[rax + rax]
lea rax, [rsi + 1]
cmp r12b, spl
cmp rax, r8
jmp 0x1403d74c1
ja 0x1403d7636
mov r11, rdi
cqo
movsxd rbx, edi
cmovb bx, bx
movzx ebx, byte [rsi]
shrd rdx, rax, 0x4b
sub sil, 0x57
bt dx, 0x65
mov edx, ebx
rol esi, 0xdb
mov sil, dil
and edx, 0x7f
dec sil
and sil, dl
btr esi, r11d
shl rdx, cl
and sil, 0x84
sar sil, 0xa9
bswap si
add rdi, rdx
add rcx, 7
shld si, ax, 0x22
mov rsi, rax
test bl, bl
jmp 0x1403d751d
js 0x1403d74b2
add rdx, r11
test sp, si
lea rdx, [rdx + rax]
cmp sp, 0x5c74
cmc
cmp rdx, r8
jmp 0x1403d753b
cmova rdx, rax
jmp 0x1403d7544
jmp 0x1403d73a1
mov rax, r10
nop
rol edx, cl
sar dh, cl
lea rdx, [rax + 1]
clc
cmp rdx, r8
jmp 0x1403d755f
ja 0x1403d7636
cmp byte [rax], 0
lahf
mov rax, rdx
jmp 0x1403d7571
js 0x1403d7552
jmp 0x1403d73a1
lea rdx, [r10 + 4]
cmp rdx, r8
cmova rdx, r10
jmp 0x1403d758c
jmp 0x1403d73a1
cmp eax, 2
jmp 0x1403d7599
jne 0x1403d7636
mov dword [r9 + 8], 2
sal sil, cl
btr si, 0x1f
mov rsi, r10
xchg dh, dh
sub eax, eax
movzx dx, r8b
mov dh, 0x4b
ror dx, cl
xor ecx, ecx
nop word [rax + rax]
cdq
lea rdx, [rsi + 1]
test r15b, 0x84
cmc
clc
cmp rdx, r8
jmp 0x1403d75dc
ja 0x1403d7636
movzx r11d, byte [rsi]
test r15b, bl
mov edi, r11d
not sil
movzx rsi, dx
dec si
and edi, 0x7f
shl rdi, cl
stc
sar sil, cl
add rax, rdi
add rcx, 7
xor si, 0x50fa
mov rsi, rdx
stc
cmp spl, 0xfe
test r11b, r11b
js 0x1403d75ca
mov qword [r9 + 0x10], rdx
mov qword [r9 + 0x18], rax
add rdx, rax
cmp rdx, r8
jmp 0x1403d7630
jbe 0x1403d73a1
cmp r10, r8
sete bh
seta al
pop rbx
not dil
movsx rsi, bp
pop rdi
movsx si, r14b
movzx rsi, sp
pop rsi
jmp 0x1403d7657
ret
Function at 0x1403ddece
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
neg r15b
or r15b, 0x84
push r14
push r13
xor r15b, 0x20
sbb r15b, r8b
push r12
btc r14d, 0x64
shl r14b, cl
xor r12b, r11b
push rsi
add r14, r12
clc
sbb r14d, ebx
push rdi
push rbp
push rbx
sub rsp, 0x38
movaps xmmword [rsp + 0x20], xmm6
mov bl, dh
movzx r13d, r15w
xchg bl, r14b
mov r14, r9
ror r12b, cl
mov r15, r8
dec r13w
sar ebx, 0x14
mov r12, rdx
mov r13, rcx
sbb bx, 0x139b
mov rbx, qword [rcx]
test dl, dil
clc
test rbx, rbx
jmp 0x1403ddf36
je 0x1403de090
mov rdi, qword [r13 + 8]
cmp rbx, rdi
jmp 0x1403ddf48
je 0x1403de036
lea rbp, [0x1400bed10]
jmp 0x1403ddf5a
movaps xmm6, xmmword [0x1400bd400]
jmp 0x1403ddf66
jmp 0x1403ddf94
call fcn.140109d27
movups xmmword [rbx + 0x20], xmm6
jmp 0x1403ddf7d
mov byte [rbx + 0x10], 0
add rbx, 0x50
test cl, bpl
cmp r14b, al
cmp rbx, rdi
je 0x1403de02d
mov qword [rbx], rbp
movsx rcx, di
not cx
lea rcx, [rbx + 0x38]
jmp 0x1403ddfa7
call fcn.1403db2fa
mov rax, qword [rbx + 0x28]
cmp rax, 0x10
jmp 0x1403ddfb9
jb 0x1403ddf70
mov rcx, qword [rbx + 0x10]
or dx, 0x5d79
lea rdx, [rax + 1]
clc
cmp rdx, 0x1000
jmp 0x1403ddfd9
jb 0x1403ddf6b
mov rsi, qword [rcx - 8]
test r13b, r11b
clc
add rcx, 0xfffffffffffffff8
cmp r8b, r11b
test bl, 0xc6
sub rcx, rsi
clc
test r9d, ebx
cmp rcx, 0x20
jmp 0x1403de001
jae 0x1403de132
add rax, 0x28
mov ecx, 0x11724d0a
bswap dx
not cl
mov rdx, rax
movzx cx, spl
jmp 0x1403de025
mov rcx, rsi
jmp 0x1403ddf6b
mov rbx, qword [r13]
clc
bts rdx, r12
mov rdx, qword [r13 + 0x10]
test rbx, r8
cmp edx, 0x362a67d9
stc
sub rdx, rbx
cmp rdx, 0x1000
jmp 0x1403de053
jb 0x1403de083
mov rax, qword [rbx - 8]
cmp dil, sil
clc
test cx, 0x20d2
add rbx, 0xfffffffffffffff8
sub rbx, rax
cmp rbx, 0x20
jmp 0x1403de076
jae 0x1403de132
add rdx, 0x27
mov rbx, rax
mov rcx, rbx
jmp 0x1403de08b
call fcn.140109d27
mov qword [r13], r12
lea rax, [r15 + r15*4]
shl rax, 4
bts rdi, r12
add rax, r12
mov qword [r13 + 8], rax
sub ebp, ebx
movzx di, r8b
lea rax, [r14 + r14*4]
rol r15w, cl
shl rax, 4
add rax, r12
movzx edi, r9w
rcr rbx, 0x8c
mov qword [r13 + 0x10], rax
movsx si, cl
movsx r12d, r10w
movaps xmm6, xmmword [rsp + 0x20]
xchg r14w, r14w
test r12b, 0x30
add rsp, 0x38
movsx ebp, r14w
bswap di
movzx r12, di
pop rbx
movsx r12w, r10b
setno r14b
pop rbp
movzx r13d, cx
movzx r14, r11w
mov dil, 0xe9
pop rdi
movsx r15w, r14b
movsxd r12, r13d
pop rsi
bswap r15w
jmp 0x1403de11a
pop r12
movzx r15, r11w
pop r13
setnp r15b
movzx r14, r12w
mov r15b, r9b
pop r14
pop r15
ret
call fcn.1404ad355
int3
Function at 0x1403f5432
Capabilities:
Access peb ldr_data

Disassembly:
sub rsp, 0x28
stc
test r8, r8
jmp 0x1403f543f
je 0x1403f54c1
movzx r9d, word [r8]
test r9w, r9w
jmp 0x1403f5452
je 0x1403f54ff
sub eax, eax
inc r10b
ror r10w, cl
mov r10, rcx
nop dword [rax + rax]
test ebx, ebp
cmp rdx, rax
jmp 0x1403f5476
je 0x1403f56a0
mov word [r10], r9w
sar r9b, 0x2f
bswap r9w
shrd r9w, r12w, 0x89
add r10, 2
jmp 0x1403f5497
movzx r9d, word [r8 + rax*2 + 2]
jmp 0x1403f54a2
inc rax
test r9w, r9w
jmp 0x1403f54ae
jne 0x1403f546e
sub rdx, rax
jmp 0x1403f54bc
jmp 0x1403f5502
movzx r9d, word [0x1400b8f10]
test r9w, r9w
jmp 0x1403f54d2
je 0x1403f5515
cmp rdx, 0x104
seta r8b
movzx r8, r8w
movzx r8d, r9w
mov r8d, 0x104
jmp 0x1403f54f6
cmovb r8, rdx
jmp 0x1403f563c
mov r10, rcx
test rdx, rdx
jmp 0x1403f550a
jne 0x1403f56a0
jmp 0x1403f56ae
mov rax, qword gs:[0x30]
cmc
bt r9w, 0x2e
mov rax, qword [rax + 0x60]
shrd r11, rdi, 0x64
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
movzx r8d, word [rax + 0x58]
cmp r8, rdx
cmovae r8, rdx
rcr r11, cl
xor r11d, r10d
sar r10w, 0x5f
mov r9, qword [rax + 0x60]
jmp 0x1403f555f
movzx r11d, word [r9]
lea r10, [0x1400b8f10]
test r11w, r11w
jmp 0x1403f5573
je 0x1403f55da
sub eax, eax
test r10b, 0x93
nop word cs:[rax + rax]
cmp rdi, 0x4e3c7a15
cmc
jmp 0x1403f559a
cmp r8, rax
jmp 0x1403f55a2
je 0x1403f55e8
mov word [r10], r11w
add r10, 2
movzx r11d, word [r9 + rax*2 + 2]
inc rax
jmp 0x1403f55c1
test r11w, r11w
jmp 0x1403f55ca
jne 0x1403f559a
sub r8, rax
clc
test r14w, 0x3a52
test r8, r8
jmp 0x1403f55e2
je 0x1403f55f9
mov word [r10], 0
movzx r10w, r11b
shrd r9w, r8w, 0xbc
movzx r9d, word [0x1400b8f10]
test dx, 0x7905
cmp rdx, 0x104
movzx r10d, bx
mov r8d, 0x104
xchg r10b, r10b
cmovb r8, rdx
mov r10, rcx
cmp esp, 0x3f4e1927
jmp 0x1403f562d
test r9w, r9w
jmp 0x1403f5636
je 0x1403f5692
xor edx, edx
lea rax, [0x1400b8f10]
mov r10, rcx
nop dword [rax + rax]
cmp r8, rdx
jmp 0x1403f5658
je 0x1403f56a0
mov word [r10], r9w
shrd r9w, r12w, 0xd5
adc r9b, 0x1a
add r10, 2
mov r9, 0xe8d0a27
cmovl r9, rbp
movzx r9d, word [rax + rdx*2 + 2]
inc rdx
test r9w, r9w
jne 0x1403f5650
sub r8, rdx
cmc
test r8, r8
jmp 0x1403f569a
je 0x1403f56ae
mov word [r10], 0
movzx eax, r9w
movsx rdx, cx
movabs rax, 0xe039ec0d24fefd13
cwd
not dx
mov qword [rsp], rax
cdq
bswap dx
movabs rax, 0x2247bce40ef3a5e6
mov qword [rsp + 8], rax
mov dx, 0x5e4a
movsx dx, dil
movabs rdx, 0xe05dec612491fd3d
jmp 0x1403f56ec
mov qword [rsp + 0x10], rdx
jmp 0x1403f56f6
mov qword [rsp + 0x18], rax
lea rax, [rsp + 0x10]
jmp 0x1403f5705
movdqa xmm0, xmmword [rsp]
pxor xmm0, xmmword [rax]
movdqa xmmword [rsp], xmm0
movd eax, xmm0
add rcx, 0xfffffffffffffffe
stc
nop word cs:[rax + rax]
stc
cmp bpl, 0x58
cmp word [rcx + 2], 0
jmp 0x1403f5735
lea rcx, [rcx + 2]
jmp 0x1403f573e
jne 0x1403f572b
test ax, ax
jmp 0x1403f574c
je 0x1403f5793
lea rdx, [rsp + 2]
nop word cs:[rax + rax]
cmp dh, 0x80
cmp r10b, dil
mov word [rcx], ax
add rcx, 2
cmovnp ax, r10w
and ax, ax
bts rax, r10
movzx eax, word [rdx]
add rdx, 2
test al, bpl
test ax, ax
jmp 0x1403f578d
jne 0x1403f5768
mov word [rcx], 0
add rsp, 0x28
ret
Function at 0x140419765
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rsi
mov r10, qword [rcx]
shld si, r14w, 0xe7
mov rsi, qword [rcx + 0x18]
mov r9d, dword [r10 + 4]
stc
imul r9d, dword [r10]
cmp bp, 0x6bba
jmp 0x140419786
cmp r8d, 2
jmp 0x14041978f
jne 0x140419917
test r9d, r9d
jmp 0x14041979d
je 0x140419998
lea ecx, [r9 - 1]
cmp ecx, 3
jmp 0x1404197af
jb 0x1404198ab
mov r11d, r9d
mov r8b, 0xd2
bsf r8, rdi
and r11d, 0xfffffffc
btr r8d, r9d
movsx r10w, dl
movzx r8w, sil
nop word cs:[rax + rax]
shld r8, rbp, 0xa3
movzx r8d, word [rsi]
movzx r10d, word [rsi + 4]
clc
xor ecx, ecx
cmp r8w, word [rdx]
cmovb r8, rbp
setne cl
mov r8, 0x4cff269e
mov r8, r15
neg ecx
ror r8b, cl
cmp dh, 0xc2
mov word [rsi + 2], cx
bts r8w, dx
sar r8w, cl
sub r8, 0x4a74510a
sub ecx, ecx
rol r8w, 0xc4
cmp r10w, word [rdx]
mov r8w, 0x14bd
setne cl
neg ecx
jmp 0x14041983b
mov word [rsi + 6], cx
movzx r8d, word [rsi + 8]
cmp r8w, di
sub ecx, ecx
jmp 0x140419851
cmp r8w, word [rdx]
setne cl
movzx r8d, r12w
neg ecx
inc r8b
shr r8, 0xd3
mov word [rsi + 0xa], cx
sar r8b, cl
shld r8, rsi, 0xd8
inc r8b
movzx r8d, word [rsi + 0xc]
jmp 0x14041987e
xor ecx, ecx
clc
cmp r8w, word [rdx]
setne cl
neg ecx
test dx, 0x3959
mov word [rsi + 0xe], cx
test r12b, 0x39
add rsi, 0x10
cmc
add r11d, 0xfffffffc
jmp 0x1404198a5
jne 0x1404197e3
test r9b, 3
jmp 0x1404198b4
je 0x140419998
and r9d, 3
dec r8
sub ecx, ecx
xor r8b, r9b
cmp rsp, rdi
nop word cs:[rax + rax]
movzx r8d, word [rsi + rcx*4]
xor eax, eax
add al, 0x40
cmp r8w, word [rdx]
mov al, cl
setne al
test dx, 0x5639
jmp 0x1404198f0
neg eax
jmp 0x1404198f7
mov word [rsi + rcx*4 + 2], ax
inc rcx
jmp 0x140419904
cmp r9d, ecx
jmp 0x14041990c
jne 0x1404198d4
jmp 0x140419998
test r9d, r9d
jmp 0x14041991f
je 0x140419998
movzx r10d, word [rdx]
mov r8d, r9d
xor ecx, ecx
jmp 0x140419943
inc rcx
clc
cmp bl, 0x58
cmp r8d, ecx
je 0x140419998
cmp word [rsi + rcx*8], r10w
jmp 0x14041994d
jne 0x140419933
movzx eax, word [rsi + rcx*8 + 2]
cmp ax, word [rdx + 2]
jmp 0x140419961
jne 0x140419933
movzx eax, word [rsi + rcx*8 + 4]
cmp ax, word [rdx + 4]
jmp 0x140419975
jne 0x140419933
mov word [rsi + rcx*8 + 6], 0
xchg r10b, r10b
movzx r10w, sil
movzx r10d, word [rdx]
jmp 0x140419993
jmp 0x140419933
pop rsi
ret
Function at 0x140435e0d
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rsi
rol eax, 0xdc
sbb sil, r13b
jmp 0x140435e24
push rdi
bts rdi, rax
movzx eax, r9w
push rbx
stc
test spl, r10b
or ax, 0x22f9
sub rsp, 0x90
movaps xmmword [rsp + 0x80], xmm7
movaps xmmword [rsp + 0x70], xmm6
bts di, di
rol sil, 0x3f
shr ax, 0xc4
mov rdi, rdx
jmp 0x140435e60
mov rsi, rcx
mov rax, 0x7f161441
mov rax, qword [rdx]
cmc
cmp qword [rax + 0x18], 8
jb 0x140435e83
mov rax, qword [rax]
add ch, 0x1e
adc r9b, 0x6a
movsxd rcx, r8d
lea r9, [rax + rcx*2]
and al, r12b
shl ax, 0x3a
rcl ax, 0x45
xor ebx, ebx
or ax, cx
nop word cs:[rax + rax]
movzx ax, r9b
movzx eax, word [r9 + rbx*2]
jmp 0x140435eb7
cmp eax, 0xa
jmp 0x140435ebf
je 0x140435edf
test eax, eax
jmp 0x140435ecc
je 0x140435edf
inc rbx
jmp 0x140435eda
jmp 0x140435eac
test byte [rdi + 0x1c], 4
jmp 0x140435ee8
jne 0x14043605e
mov rcx, qword [rdi + 0x10]
cqo
rdtsc
mov rax, qword [rdi + 8]
movsd xmm0, qword [rax + 8]
movsx r8d, cx
cdq
movsd qword [rsp + 0x40], xmm0
mov dword [rsp + 0x30], ebx
mov dword [rsp + 0x28], 2
cmovl r8, rbx
movsx r8d, r9w
mov dword [rsp + 0x20], 0
bswap r8d
mov dl, bpl
not r8
lea rdx, [rsp + 0x38]
movzx r8w, dl
lea r8, [rsp + 0x40]
jmp 0x140435f43
call fcn.14043cb32
xorps xmm0, xmm0
movaps xmmword [rsp + 0x50], xmm0
cbw
setg ch
movzx rax, r8w
movaps xmmword [rsp + 0x40], xmm0
cdq
movzx cx, r14b
xchg al, cl
mov dword [rsp + 0x60], 0
cwde
movzx rcx, r11w
mov rcx, qword [rsp + 0x38]
mov rax, qword [rcx]
cqo
lea rdx, [rsp + 0x40]
jmp 0x140435f87
call qword [rax + 0x1e0]
test eax, eax
je 0x140435fb3
mov ecx, eax
movabs r8, 0xe31b45c42a775183
mov dl, 3
mov r9d, 0x4f
jmp 0x140435fae
call fcn.1403a6a1c
movss xmm6, dword [rsp + 0x4c]
or rdx, rax
dec ch
movss xmm7, dword [rsp + 0x50]
shr cx, 0xcd
xor dx, 0x1a39
lea rcx, [rsp + 0x38]
lea rdx, [rsp + 0x40]
xor r8d, r8d
jmp 0x140435fdf
call fcn.140436400
movss xmm0, dword [rdi + 0x18]
jmp 0x140435fee
movss dword [rsi], xmm0
jmp 0x140435ff7
addss xmm6, xmm0
movss dword [rsi + 4], xmm6
btc cx, dx
clc
movss xmm0, dword [rsp + 0x50]
sar rcx, cl
xadd rcx, rcx
movss dword [rsi + 8], xmm0
sub cl, r14b
rcr cl, cl
mov dword [rsi + 0xc], 0
movss dword [rsi + 0x10], xmm7
test r12w, di
mov dword [rsi + 0x14], ebx
not cx
shl cx, 0x39
mov rcx, qword [rsp + 0x38]
jmp 0x140436045
test rcx, rcx
je 0x1404360ce
mov rax, qword [rcx]
jmp 0x140436056
call qword [rax + 0x10]
jmp 0x1404360ce
movss xmm0, dword [rdi + 0x18]
jmp 0x140436068
movss dword [rsi], xmm0
jmp 0x140436071
cvtsi2ss xmm1, ebx
mulss xmm1, dword [0x1400bfc14]
addss xmm1, xmm0
movss dword [rsi + 4], xmm1
movss xmm0, dword [0x1400bfc94]
jmp 0x140436093
movlps qword [rsi + 8], xmm0
mov rax, qword [rdi + 8]
jmp 0x1404360a0
movss xmm0, dword [rax + 0xc]
jmp 0x1404360aa
addss xmm0, dword [0x1400bfbd0]
movss dword [rsi + 0x10], xmm0
rol dil, cl
bt di, 0xf6
sbb dil, r9b
mov dword [rsi + 0x14], ebx
ror bl, cl
movzx rsi, r11w
sar dil, cl
movaps xmm6, xmmword [rsp + 0x70]
ror ebx, cl
clc
xor ebx, 0x73b83f4a
movaps xmm7, xmmword [rsp + 0x80]
sar rdi, 0x38
cmp r14b, 0x2d
add rsp, 0x90
movzx rbx, cx
pop rbx
bswap di
movsx rsi, r12w
mov di, si
pop rdi
movsx si, r14b
mov rsi, r10
movzx rsi, ax
pop rsi
ret