joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140197ed8
Capabilities:
Check for software breakpoints

Disassembly:
cmp rdx, rax
jmp 0x140275bbf
je 0x140122473
add rdx, 2
jmp 0x14025f88a
je 0x1401a2f87
sub ecx, ecx
cmp rbp, 0x44fa6a39
cmp bx, r10w
cmp word [rdx], cx
jmp 0x1400f48d5
je 0x140122473
add rdx, 2
jmp 0x1400ea836
xorps xmm1, xmm1
movdqu xmm0, xmmword [rdx]
jmp 0x14023aa92
and ecx, 0x1f
mov eax, 0x20
cmp cl, bpl
stc
sub rax, rcx
cmp bl, 0xaf
jmp 0x1401ff74c
je 0x140122473
add rdx, 2
jmp 0x140122efc
sub rdx, r8
sar rdx, 1
setg al
mov rax, rdx
jmp 0x14024369f
jmp 0x14018b8ee
jmp 0x1401c6316
vpxor xmm1, xmm1, xmm1
vpcmpeqw ymm1, ymm1, ymmword [rdx]
vpmovmskb eax, ymm1
test eax, eax
vzeroupper
jne 0x1401e6a79
add rdx, 0x20
jmp 0x140186431
sub ecx, ecx
stc
cmp word [rdx], cx
jmp 0x140120354
mov eax, dword [reloc.d2d1.dll_Ordinal_1]
movsx dx, bpl
mov dl, r10b
mov r8, rcx
rol dx, cl
mov rdx, rcx
test eax, 0x17996d7a
cmp eax, 5
jmp 0x1401c3469
and ecx, 0xf
neg rax
mov eax, 0x10
sub rax, rcx
test bpl, bl
cmc
neg rcx
jmp 0x140263cea
je 0x14028fa8d
cmp word [rdx], cx
jmp 0x14028fa7a
sbb r9, r9
xor ecx, ecx
cmp r8b, 0x6e
and r9, rax
shr r9, 1
bswap ax
lea rax, [r8 + r9*2]
test al, r9b
cmp r8, rax
jmp 0x1401a6620
jl 0x140239e54
test r8b, 1
jmp 0x14028c017
cmp word [rdx], cx
jmp 0x140249a22
jmp 0x14028c023
cmp word [rdx], cx
jmp 0x1400e1710
jl 0x14018b8eb
test r8b, 1
jmp 0x1400ea823
neg rcx
jmp 0x1401c28ba
je 0x140122473
add rdx, 2
jmp 0x1401d1264
cmp eax, 1
jmp 0x1401f2f40
pcmpeqw xmm0, xmm1
pmovmskb eax, xmm0
test eax, eax
jne 0x1401c6316
add rdx, 0x10
jmp 0x14028c194
ret
je 0x140122473
add rdx, 2
jmp 0x14012d32e
je 0x140275bc5
cmp word [rdx], cx
je 0x140275bc5
add rdx, 2
jmp 0x1400e0150
jmp 0x1401e6a79
sbb r9, r9
cmc
stc
xor ecx, ecx
test dil, 0x42
and r9, rax
shr r9, 1
rcl al, cl
shr ah, cl
not eax
lea rax, [r8 + r9*2]
cmp r8, rax
jmp 0x1402502da
jne 0x1402502e0
sub rdx, r8
cmp r11b, 0xcc
clc
sar rdx, 1
clc
cmp r13w, dx
cmp rdx, r9
jne 0x14012247c
lea rdx, [r8 + rdx*2]
jmp 0x1400fe5e0
je 0x14010c3e7
xor ecx, ecx
test bpl, 0xfe
cmp word [rdx], cx
jmp 0x14020d538
jmp 0x1400fe5e3
je 0x14028fa8d
add rdx, 2
cmp rdx, rax
jne 0x1401a6626
sub rdx, r8
sar rdx, 1
cmp rdx, r9
jne 0x14012247c
lea rdx, [r8 + rdx*2]
jmp 0x140186431

Function at 0x1401a1f4c
Capabilities:
Enumerate pe sections

Disassembly:
cmp r10, rdx
jmp 0x14018ecb8
jb 0x1401a1fa1
sub eax, eax
jmp 0x1402182dd
jb 0x1402182dd
inc r9d
add rax, 0x28
cmp r13b, cl
cmp bpl, 0x4d
cmp r9d, r11d
jmp 0x14011abe4
jb 0x14011c3da
mov ecx, dword [rax + 8]
clc
jmp 0x14026c7ac
movsxd r8, dword [rcx + 0x3c]
cmp r13b, 0x56
xor r9d, r9d
movzx rax, cx
movzx ax, r10b
shr r11d, 0xab
lea r8, [r8 + rcx]
cwde
adc rax, rbx
mov r10, rdx
clc
sub r11, 0x48d97667
movzx eax, word [r8 + 0x14]
and r11b, bpl
movzx r11d, word [r8 + 6]
cmp r9b, 0xbd
test r14d, r15d
stc
add rax, 0x18
test cl, dl
lea rax, [rax + r8]
cmp edi, edi
test r11d, r11d
je 0x14011abea
mov edx, dword [rax + 0xc]
jmp 0x1400e0240
ret
add ecx, edx
cmp r10, rcx
jmp 0x14011c3d4
Function at 0x1401ae66a
Capabilities:
Parse pe header

Disassembly:
sub eax, eax
ret
ret
mov eax, 0x5a4d
cmp word [rcx], ax
jmp 0x14027ebcc
jne 0x14011c3d1
sub eax, eax
rol cx, 0x1d
mov ecx, 0x20b
shr al, 0x46
cmp word [rdx + 0x18], cx
sete al
jmp 0x1401a4458
jne 0x14011c3d1
movsxd rdx, dword [rcx + 0x3c]
cmp ebx, edi
add rdx, rcx
cmp r10w, 0xb38
test edi, 0x13d44402
cmp dword [rdx], 0x4550
jmp 0x140276338

Function at 0x1401d51d8
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp byte [rax + rdx], 0x78
jne 0x140178732
movzx r8d, byte [rcx + 2]
cwde
mov rax, qword [r9 + 0xf8]
cwd
lea rdx, [rcx + 2]
jmp 0x1401a1693
jne 0x1401e463c
movzx eax, r8b
jmp 0x140178722
cmovne rdx, rcx
mov rcx, qword [rax]
movzx eax, byte [rcx]
test spl, bl
btc rcx, r13
adc ch, 0xb2
mov byte [rdx], al
bt rcx, 0xfb
lea rax, [rdx + 1]
shr cx, 0xa6
bswap rcx
xor rcx, r15
nop dword [rax]
xchg ch, dl
xadd dl, dl
setl cl
movzx ecx, byte [rax]
sub dl, spl
rcl dx, cl
cwd
movzx edx, r8b
mov byte [rax], r8b
shrd r8w, r12w, 0x10
rcl r8b, 0x5c
cmp r10b, 0x53
lea rax, [rax + 1]
movsxd r8, esi
or r8b, r8b
bt r8d, 0x3c
movzx r8d, cl
cmc
test r10b, 0xd4
test dl, dl
jmp 0x14023a87d
je 0x14017974a
mov rax, qword [r9]
jmp 0x1401e462a
mov r9, qword [rdx]
cdq
movzx r8, r13w
not rdx
movzx r8d, byte [rcx]
cdq
sal rdx, 0x7e
shl edx, cl
mov rdx, qword [r9 + 0x110]
cmp bpl, 0xe6
cmp byte [r8 + rdx], 0x65
jmp 0x1401a5610
nop dword [rax + rax]
movsx r8w, r9b
cmovns r8w, r10w
movzx r8d, byte [rcx + 1]
jmp 0x140289571
jne 0x1401a16cb
ret
inc rcx
test bh, bl
cmp dil, bl
stc
test byte [rax + r8*2], 4
jmp 0x140179744
Function at 0x1401f85d4
Capabilities:
Parse pe header

Disassembly:
sub r8d, r8d
xor edx, edx
jmp 0x1404aba10

Function at 0x140217842
Capabilities:
Parse pe header

Disassembly:
jmp 0x1404aba10
lea edx, [r8 + 2]
jmp 0x14010dfc8
sub r8d, r8d
movsxd rdx, edx
jmp 0x14011721e
mov qword [rsp + 8], rbx
cmp r9w, r10w
mov dword [rsp + 0x18], r8d
movsx rbx, r10w
test r14w, r14w
shl bl, cl
mov dword [rsp + 0x10], edx
movsxd rbx, ecx
push rbp
btr rbp, 0x78
xor bpl, r13b
and bp, 0x559c
mov rbp, rsp
shl rbx, 0x3f
rcl bh, cl
sal ebx, 0x7b
sub rsp, 0x50
test r15d, r14d
mov ebx, ecx
cmp ecx, r14d
stc
test r8d, r8d
jne 0x1404abaf9
xor ecx, ecx
jmp 0x1404aba66
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
jmp 0x1404aba74
je 0x1404abaf9
mov ecx, 0x5a4d
cmp word [rax], cx
jmp 0x1404aba87
jne 0x1404abaf9
movsxd rcx, dword [rax + 0x3c]
cmp al, 0xf5
test al, r13b
test di, 0x6357
lea rcx, [rcx + rax]
cmp dword [rcx], 0x4550
jmp 0x1404abaaa
jne 0x1404abaf9
mov eax, 0x20b
jmp 0x1404ababa
cmp word [rcx + 0x18], ax
jmp 0x1404abac3
jne 0x1404abaf9
cmp dword [rcx + 0x84], 0xe
jmp 0x1404abad5
jbe 0x1404abaf9
cmp dword [rcx + 0xf8], 0
jmp 0x1404abae7
je 0x1404abaf9
mov ecx, ebx
jmp 0x1404abaf4
call fcn.1404ab8e3
lea rax, [rbp + 0x18]
cmovl r9w, dx
mov dh, 0x87
not dx
mov byte [rbp + 0x28], 0
mov qword [rbp - 0x20], rax
cdqe
lea r9, [rbp - 0x2c]
movsxd rcx, edi
lea rax, [rbp + 0x20]
movzx rdx, bp
mov rcx, 0x3ed830ba
not r8b
mov qword [rbp - 0x18], rax
lahf
lea r8, [rbp - 0x20]
cdqe
cbw
movzx edx, bp
lea rax, [rbp + 0x28]
mov qword [rbp - 0x10], rax
setle dh
lea rdx, [rbp - 0x28]
jmp 0x1404abb4f
mov eax, 2
movzx rcx, si
lea rcx, [rbp - 0x30]
jmp 0x1404abb61
mov dword [rbp - 0x2c], eax
jmp 0x1404abb69
mov dword [rbp - 0x28], eax
call fcn.1404abd1f
cmp dword [rbp + 0x20], 0
jmp 0x1404abb7a
je 0x1404abb9c
mov rbx, qword [rsp + 0x60]
clc
cmp bx, 0x471a
add rsp, 0x50
xchg bp, bp
movsxd rbp, r11d
pop rbp
jmp 0x1404abb9b
ret
mov ecx, ebx
jmp 0x1404abba3
call fcn.1404ab98c
int3
Function at 0x1403b61f1
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
rcl al, cl
cdqe
push r14
push r13
push r12
cmp edi, 0x66462bdb
bt rax, 0x10
push rsi
mov ah, 0x93
push rdi
not sil
movzx rax, bx
rcr r14b, cl
push rbx
rcr ax, cl
cbw
sbb dil, 0x65
sub rsp, 0x20
jmp 0x1403b622a
mov rsi, r8
and r14b, bpl
movsx edi, r10w
setb dil
mov rdi, rdx
jmp 0x1403b6244
mov r14, rcx
shrd ebx, eax, 0xc2
sub bh, 0xa7
cbw
mov rbx, qword [rcx]
mov rcx, qword [rcx + 0x10]
cbw
cmp r14, 0x606b4cc0
sub rcx, rbx
rcr ah, 0xa
sar rcx, 4
bts eax, esi
inc ax
rol al, cl
movabs rax, 0xf0f0f0f0f0f0f0f1
cmp r14b, 0xb7
stc
imul rcx, rax
test r8w, 0x1369
test r14, rsi
cmp rcx, r8
jae 0x1403b6300
mov rcx, r14
xchg dx, dx
mov rdx, rsi
jmp 0x1403b62a5
call fcn.1403b6503
mov rbx, qword [r14]
nop word [rax + rax]
mov rcx, rdi
movsx edx, r8w
mov rcx, rbx
xchg dl, dl
setle dh
movzx edx, r14w
mov rdx, rdi
jmp 0x1403b62d1
call fcn.1403b6cf0
add rbx, 0x110
test dil, dl
clc
add rdi, 0x110
jmp 0x1403b62ed
dec rsi
jmp 0x1403b62f5
jne 0x1403b62bd
jmp 0x1403b64af
mov r13, qword [r14 + 8]
mov r12, r13
btc r15, r12
sub r12, rbx
sar r12, 4
shl r15d, 0xc6
xadd r15b, r15b
xor r15, 0x58191361
imul r12, rax
and r15w, r8w
mov r15, r12
cmc
sub r15, rsi
jmp 0x1403b6335
jae 0x1403b63ea
cmp rbx, r13
jmp 0x1403b6343
je 0x1403b6397
nop word cs:[rax + rax]
movsx rcx, r10w
mov rcx, rbx
cmovl dx, bp
cdq
bswap dx
mov rdx, rdi
jmp 0x1403b636e
call fcn.1403b6794
add rbx, 0x110
clc
add rdi, 0x110
stc
jmp 0x1403b6388
cmp rbx, qword [r14 + 8]
jmp 0x1403b6391
jne 0x1403b635b
cmp rsi, r12
jmp 0x1403b639f
je 0x1403b64af
nop dword [rax + rax]
mov rcx, rbx
movsx rdx, si
setp dl
mov rdx, rdi
call fcn.1403b6cf0
add rbx, 0x110
cmp r11b, 0x78
clc
add rdi, 0x110
jmp 0x1403b63d7
inc r15
jmp 0x1403b63df
jne 0x1403b63ad
jmp 0x1403b64af
imul r15, rsi, 0x110
cmp r12w, sp
clc
test bx, r14w
lea r15, [r15 + rbx]
cmp rax, r13
jmp 0x1403b6406
test rsi, rsi
je 0x1403b645f
nop
setb dl
not dl
mov rcx, rbx
cwd
mov dx, bp
mov rdx, rdi
jmp 0x1403b6425
call fcn.1403b6794
add rbx, 0x110
cmp al, bpl
cmp bx, 0x4d0b
add rdi, 0x110
jmp 0x1403b6445
dec rsi
jmp 0x1403b644d
jne 0x1403b6415
mov r13, qword [r14 + 8]
test r9b, dil
test bpl, 0x10
cmc
cmp r15, r13
jmp 0x1403b6467
je 0x1403b64a5
mov rsi, r15
setae cl
mov cx, sp
nop word [rax + rax]
cmovl ecx, esi
movzx ecx, r12w
mov rcx, rsi
jmp 0x1403b648b
call fcn.1403b0d16
add rsi, 0x110
cmp rsi, r13
jmp 0x1403b649f
jne 0x1403b6483
mov rbx, r15
test r13, 0x61c77f8
mov qword [r14 + 8], rbx
jmp 0x1403b64bc
add rsp, 0x20
pop rbx
movsx r15, r15w
bswap r13w
movsx si, r10b
pop rdi
pop rsi
xchg r13b, r12b
setbe r14b
not r13b
pop r12
movzx r15w, dl
mov r13, rbp
not r15b
pop r13
movzx r15w, r15b
pop r14
mov r15b, r9b
movsx r15w, spl
movsxd r15, r12d
pop r15
jmp 0x1403b6502
ret
Function at 0x1403bbabb
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rsi
bswap si
test r9w, r14w
sar esi, cl
push rdi
cmp r10w, 0x54d6
sbb ax, r12w
push rbx
sar sil, cl
sub rsp, 0x20
shr sil, 0x12
movsx rsi, di
lahf
mov rsi, rcx
movzx ax, r15b
sbb eax, 0x5b376136
lea rax, [0x1400bdab0]
cmp esp, 0x7d211860
mov qword [rcx], rax
sar al, cl
mov rax, qword [rcx + 0x88]
cmp r9, rax
cmp rax, 8
jb 0x1403bbb9f
mov rcx, qword [rsi + 0x70]
sal dl, cl
stc
adc edx, 0x26c81041
lea rdx, [rax + rax]
test dx, r8w
cmc
cmp r14, r12
add rdx, 2
jmp 0x1403bbb3c
cmp rdx, 0x1000
jmp 0x1403bbb48
jb 0x1403bbb9a
mov rbx, qword [rcx - 8]
cmc
add rcx, 0xfffffffffffffff8
test r13d, 0x40e14f12
stc
sub rcx, rbx
test r8b, bl
cmp rcx, 0x20
jae 0x1403bbd38
lea rax, [rax + rax]
jmp 0x1403bbb78
add rax, 0x29
bswap rdx
movsx dx, r9b
cdq
mov rdx, rax
movsx rcx, bx
setne cl
xchg cx, cx
mov rcx, rbx
jmp 0x1403bbb9a
call fcn.1401216d4
movaps xmm0, xmmword [0x1400bd3f0]
shl ax, 0x20
shr eax, cl
sbb rax, 0x66275d6f
movups xmmword [rsi + 0x80], xmm0
xchg bx, di
shld ebx, r13d, 0xdc
mov word [rsi + 0x70], 0
lahf
shld edi, r15d, 0x72
inc bx
lea rax, [0x1400bdb70]
movzx ebx, dx
rcr bh, 0xe9
mov qword [rsi], rax
not rbx
bsr edi, r10d
cmp dx, 0x651a
mov rdi, qword [rsi + 0x40]
add bl, r15b
btc ebx, r8d
mov rbx, qword [rsi + 0x48]
cmc
jmp 0x1403bbc02
cmp rdi, rbx
jmp 0x1403bbc0a
jne 0x1403bbc2c
jmp 0x1403bbc7a
add rdi, 8
jmp 0x1403bbc23
cmp rdi, rbx
je 0x1403bbc63
mov rcx, qword [rdi]
test r14b, r8b
test rcx, rcx
jmp 0x1403bbc3a
je 0x1403bbc15
mov rax, qword [rcx]
movzx dx, r12b
movsxd rdx, edx
bswap rdx
mov edx, 1
jmp 0x1403bbc58
call qword [rax + 0xb8]
jmp 0x1403bbc15
mov rdi, qword [rsi + 0x40]
test dil, 0xf8
cmp rdi, qword [rsi + 0x48]
je 0x1403bbc7a
mov qword [rsi + 0x48], rdi
stc
test rdi, rdi
je 0x1403bbd0f
mov rdx, qword [rsi + 0x50]
test edx, ebx
jmp 0x1403bbc8e
sub rdx, rdi
cmp dil, al
cmp rdx, 0x1000
jmp 0x1403bbca0
jb 0x1403bbcd4
mov rax, qword [rdi - 8]
cmc
stc
add rdi, 0xfffffffffffffff8
cmp r8w, 0xa54
sub rdi, rax
cmp bp, r8w
cmp rdi, 0x20
jae 0x1403bbd38
add rdx, 0x27
sar rdi, 0xc
sub edi, eax
mov rdi, rax
add rsi, 0x40
mov cx, si
xchg cl, ch
mov rcx, rdi
jmp 0x1403bbce5
call fcn.1401216d4
xorps xmm0, xmm0
movups xmmword [rsi], xmm0
not bl
xor di, 0x442e
sar rdi, 0x86
mov qword [rsi + 0x10], 0
btr si, 0x71
and bh, 0x8c
movzx esi, r14w
add rsp, 0x20
xchg bl, dil
movsx rbx, dx
bswap edi
pop rbx
movsx si, bl
setnp dil
movsx edi, r15w
pop rdi
bswap esi
jmp 0x1403bbd31
pop rsi
jmp 0x1403bbd37
ret
call fcn.1404b0b96
int3
Function at 0x1403e1455
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
movzx r15d, r9w
push r14
push r13
shrd r13, rbx, 0x8b
push r12
push rsi
dec r12b
push rdi
xchg r12w, r12w
rol r13, cl
btc r13, rsp
push rbp
movsx r12, bp
sal r15, cl
push rbx
xchg r12, rbx
xor r15w, si
sub rsp, 0x38
cmp r10, 0x7670fd6
cmc
movaps xmmword [rsp + 0x20], xmm6
sal bl, cl
mov r14, r9
mov r15, r8
mov r12, rdx
mov r13b, 0xf5
bt r13d, 0xaf
mov r13, rcx
sub rbx, 0x5df6670d
sal bh, 9
mov rbx, qword [rcx]
test di, di
clc
test rbx, rbx
jmp 0x1403e14c6
je 0x1403e1612
mov rdi, qword [r13 + 8]
jmp 0x1403e14d8
cmp rbx, rdi
je 0x1403e15ba
lea rbp, [0x1400bed10]
jmp 0x1403e14ed
movaps xmm6, xmmword [0x1400bd400]
jmp 0x1403e14f9
jmp 0x1403e1524
call fcn.1401216d4
movups xmmword [rbx + 0x20], xmm6
jmp 0x1403e1513
mov byte [rbx + 0x10], 0
add rbx, 0x50
cmp rbx, rdi
je 0x1403e15a9
mov qword [rbx], rbp
movzx rcx, sp
sets cl
lea rcx, [rbx + 0x38]
call fcn.1403de8af
mov rax, qword [rbx + 0x28]
test r10, r11
cmp rax, 0x10
jb 0x1403e1503
mov rcx, qword [rbx + 0x10]
lea rdx, [rax + 1]
cmp esp, 0x30d67d08
cmp rdx, 0x1000
jmp 0x1403e1562
jb 0x1403e14fe
mov rsi, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
cmc
sub rcx, rsi
clc
jmp 0x1403e157a
cmp rcx, 0x20
jmp 0x1403e1583
jae 0x1403e16c5
add rax, 0x28
movsxd rdx, edi
mov rdx, rax
xchg cx, cx
bswap ecx
movsx ecx, r12w
mov rcx, rsi
jmp 0x1403e15a4
jmp 0x1403e14fe
mov rbx, qword [r13]
and dx, r10w
bts dx, r14w
movsx edx, r13w
mov rdx, qword [r13 + 0x10]
sub rdx, rbx
cmp r15b, 0x3d
cmp rdx, 0x1000
jb 0x1403e1605
mov rax, qword [rbx - 8]
jmp 0x1403e15e0
add rbx, 0xfffffffffffffff8
cmp dh, 0xc8
sub rbx, rax
cmp rbx, 0x20
jmp 0x1403e15f3
jae 0x1403e16c5
add rdx, 0x27
movsxd rbx, r14d
mov rbx, rax
xchg ch, cl
mov rcx, rbx
jmp 0x1403e160d
call fcn.1401216d4
mov qword [r13], r12
ror dil, 0x9a
lea rax, [r15 + r15*4]
cmc
and rdi, r14
shl rax, 4
and r15w, 0x16d9
add rax, r12
bswap bp
movzx bx, r15b
rcl bh, cl
mov qword [r13 + 8], rax
bsr rsi, rcx
test eax, r13d
movzx rdi, bp
lea rax, [r14 + r14*4]
shl rax, 4
adc bl, 0x11
movzx r14w, r12b
movsx rdi, r9w
add rax, r12
mov qword [r13 + 0x10], rax
bt ebx, r8d
movaps xmm6, xmmword [rsp + 0x20]
test edx, 0x42e049d7
add rsp, 0x38
bswap r14w
movsx r14, di
pop rbx
not r14
pop rbp
movsx r13d, sp
pop rdi
jmp 0x1403e1695
pop rsi
movsxd r15, r9d
not r15b
xchg r12b, r13b
pop r12
movzx r13, bx
mov r15w, bx
pop r13
setb r15b
pop r14
bswap r15d
movzx r15w, r8b
setns r15b
pop r15
jmp 0x1403e16c4
ret
call fcn.1404b0b96
int3
Function at 0x1403e4ed5
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
test r15b, r11b
push r14
push rsi
cmc
clc
push rdi
rcr rdi, 0x31
bts di, r8w
push rbx
test r11w, bp
stc
sub rsp, 0x30
cmovs di, r8w
movaps xmmword [rsp + 0x20], xmm6
mov rdi, qword [rcx]
test sp, r12w
test rdi, rdi
jmp 0x1403e4f0c
je 0x1403e509d
mov r14, rcx
shl bx, 0x16
sub ebx, r10d
mov rbx, qword [rcx + 8]
cmp rdi, rbx
jmp 0x1403e4f28
je 0x1403e5014
lea r15, [0x1400bed10]
jmp 0x1403e4f3a
movaps xmm6, xmmword [0x1400bd400]
jmp 0x1403e4f46
jmp 0x1403e4f6c
call fcn.1401216d4
movups xmmword [rdi + 0x20], xmm6
jmp 0x1403e4f59
mov byte [rdi + 0x10], 0
clc
add rdi, 0x50
clc
cmp rdi, rbx
je 0x1403e5007
mov qword [rdi], r15
movsxd rcx, ecx
xchg ch, ch
movsx rcx, di
lea rcx, [rdi + 0x38]
jmp 0x1403e4f81
call fcn.1403de8af
mov rax, qword [rdi + 0x28]
cmc
cmp r11b, 9
cmp rax, 0x10
jmp 0x1403e4f98
jb 0x1403e4f50
mov rcx, qword [rdi + 0x10]
adc edx, esp
dec dx
btc dx, 0xe7
lea rdx, [rax + 1]
cmp rdx, 0x1000
jmp 0x1403e4fbc
jb 0x1403e4f4b
mov rsi, qword [rcx - 8]
stc
cmc
add rcx, 0xfffffffffffffff8
sub rcx, rsi
jmp 0x1403e4fd4
cmp rcx, 0x20
jmp 0x1403e4fdd
jae 0x1403e50df
add rax, 0x28
movsx rdx, si
movzx edx, r9w
mov rdx, rax
mov cl, dil
xchg ch, ch
movsxd rcx, r13d
mov rcx, rsi
jmp 0x1403e5002
jmp 0x1403e4f4b
mov rdi, qword [r14]
mov dl, r11b
adc rdx, r13
test r15b, 0x41
mov rdx, qword [r14 + 0x10]
test bpl, bpl
cmp spl, r12b
cmc
sub rdx, rdi
test r11w, 0x62bf
cmp rdx, 0x1000
jb 0x1403e5078
mov rax, qword [rdi - 8]
cmp r14, 0x322b20e2
add rdi, 0xfffffffffffffff8
cmp ebx, 0x422502a2
test r15w, r12w
sub rdi, rax
cmp rdi, 0x20
jmp 0x1403e505a
jae 0x1403e50df
add rdx, 0x27
xchg cx, di
movzx rdi, r15w
mov rdi, rax
movsx cx, r9b
movzx cx, r9b
mov rcx, rdi
jmp 0x1403e5080
call fcn.1401216d4
xorps xmm0, xmm0
movups xmmword [r14], xmm0
mov qword [r14 + 0x10], 0
btc si, 0x5b
xor r14w, r8w
movaps xmm6, xmmword [rsp + 0x20]
dec di
add rsp, 0x30
movsx di, r8b
movzx si, cl
xchg r14b, dil
pop rbx
movsx esi, di
cmovle r15d, ebp
movsx r15, ax
pop rdi
mov r15w, cx
movsx r15d, sp
not sil
pop rsi
pop r14
movsxd r15, r14d
movzx r15, r10w
pop r15
jmp 0x1403e50de
ret
call fcn.1404b0b96
int3
Function at 0x1403ee9e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
rol r15b, 0x7e
or r15b, r12b
push r14
or r15b, r12b
bswap r15
bsr r15w, sp
push r13
bt r13d, ebx
push r12
cmc
rol r15w, cl
push rsi
movzx r13, bx
push rdi
btr r14w, 0x19
rol sil, 0x15
movzx r12d, r14w
push rbx
sub rsp, 0x30
btr r14d, ecx
movaps xmmword [rsp + 0x20], xmm6
cmp r11w, 0x6336
btc r14w, 0xca
mov r15, r9
shr si, 0xc
xor r12d, edx
mov r12, r8
mov r14, rdx
mov r13, rcx
bts rsi, rbp
movzx rsi, r11w
mov rsi, qword [rcx]
test r13w, 0x108a
test rsi, rsi
je 0x1403eeb7f
mov rbx, qword [r13 + 8]
jmp 0x1403eea68
cmp rsi, rbx
jmp 0x1403eea70
je 0x1403eeb1b
movaps xmm6, xmmword [0x1400bd400]
jmp 0x1403eeaa2
call fcn.1401216d4
movups xmmword [rsi + 0x10], xmm6
test esi, eax
mov byte [rsi], 0
add rsi, 0x20
cmp rsi, rbx
jmp 0x1403eea9c
je 0x1403eeb17
mov rax, qword [rsi + 0x18]
cmc
stc
cmp rax, 0x10
jb 0x1403eea87
mov rcx, qword [rsi]
rcr dl, 0xbe
cqo
lea rdx, [rax + 1]
stc
cmp sp, 0x48a9
cmc
cmp rdx, 0x1000
jmp 0x1403eead1
jb 0x1403eea82
mov rdi, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
jmp 0x1403eeae4
sub rcx, rdi
cmp rcx, 0x20
jmp 0x1403eeaf0
jae 0x1403eec16
add rax, 0x28
mov rdx, rax
movsx cx, bpl
movsxd rcx, r14d
movzx cx, r14b
mov rcx, rdi
jmp 0x1403eeb12
jmp 0x1403eea82
mov rsi, qword [r13]
mov rdx, qword [r13 + 0x10]
cmp r10b, 0x9d
sub rdx, rsi
cmp rdx, 0x1000
jmp 0x1403eeb32
jb 0x1403eeb72
mov rax, qword [rsi - 8]
test rbp, 0x77967b70
stc
add rsi, 0xfffffffffffffff8
cmc
sub rsi, rax
cmc
clc
stc
cmp rsi, 0x20
jmp 0x1403eeb58
jae 0x1403eec16
add rdx, 0x27
sete sil
mov rsi, rax
movsx cx, r15b
movsx ecx, r15w
mov rcx, rsi
jmp 0x1403eeb7a
call fcn.1401216d4
mov qword [r13], r14
not di
jmp 0x1403eeb8b
shl r12, 5
or edi, 0x31a92d7a
sub bl, 0x3c
inc bh
add r12, r14
rol si, 0xaf
adc dil, al
movsx edi, r13w
mov qword [r13 + 8], r12
xchg dil, r12b
shl r15, 5
ror r12w, 0x1f
and r12w, sp
lea r15, [r15 + r14]
movzx esi, r11w
neg esi
test bpl, 0x7d
mov qword [r13 + 0x10], r15
movaps xmm6, xmmword [rsp + 0x20]
cmp r12b, dl
add rsp, 0x30
pop rbx
xchg sil, dil
movsx r15, r9w
pop rdi
movsxd r14, edi
mov r12b, r12b
movzx r14w, sil
pop rsi
cmove r12, rbp
movsx r13w, cl
pop r12
movzx r15w, r14b
movsx r14w, r11b
mov r14b, bl
pop r13
xchg r14b, r14b
pop r14
pop r15
jmp 0x1403eec15
ret
call fcn.1404b0b96
int3
Function at 0x1403f05c5
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
push r14
push r12
btr r14, rbx
jmp 0x1403f05d8
push rsi
stc
push rdi
push rbx
inc r14d
sub rsp, 0x28
neg r14b
bsr r14w, bx
clc
mov r14, r8
clc
cmc
test rdx, rdx
jmp 0x1403f05f9
je 0x1403f07d7
mov rdi, rdx
adc r12w, 0x96f
movsx r12, dx
bts r12w, bp
mov r12, rcx
jmp 0x1403f061a
xor ebx, ebx
jmp 0x1403f0621
jmp 0x1403f064c
mov rcx, r15
movsx rdx, r9w
mov rdx, rsi
jmp 0x1403f0635
call fcn.1403b58d5
add rbx, 0x50
jmp 0x1403f0643
dec rdi
je 0x1403f07c8
mov eax, dword [r12 + rbx + 8]
clc
mov dword [r14 + rbx + 8], eax
jmp 0x1403f065d
cmp r14, r12
jmp 0x1403f0665
je 0x1403f063a
cmp qword [r12 + rbx + 0x28], 0x10
jmp 0x1403f0676
jb 0x1403f068b
mov r9, qword [r12 + rbx + 0x10]
jmp 0x1403f0686
jmp 0x1403f0697
lea r9, [r12 + rbx]
xor r15w, ax
add r9, 0x10
lea r15, [r14 + rbx]
add r15, 0x10
bsr ax, r13w
mov rsi, qword [r12 + rbx + 0x20]
mov rax, qword [r14 + rbx + 0x28]
cmc
cmp rax, rsi
jae 0x1403f06d6
mov rcx, r15
mov edx, r15d
cdq
movzx dx, sil
mov rdx, rsi
jmp 0x1403f06cc
call fcn.1403b58d5
jmp 0x1403f0732
cmp rax, 0x10
jmp 0x1403f06df
jb 0x1403f06f4
mov r15, qword [r14 + rbx + 0x10]
xchg r8, r8
movsx ecx, sp
movsx rcx, r10w
mov qword [r14 + rbx + 0x20], rsi
cwd
movsx edx, r13w
mov rcx, r15
movzx rdx, di
movzx dx, r8b
mov rdx, r9
movzx r8, r9w
setbe r8b
movsx r8d, r13w
mov r8, rsi
call fcn.14049decb
mov byte [r15 + rsi], 0
bt esi, 0xb6
sbb sil, r9b
rcr rsi, 0x8e
mov rsi, qword [r12 + rbx + 0x40]
cmp qword [r12 + rbx + 0x48], 0x10
jmp 0x1403f0742
jb 0x1403f0757
mov r9, qword [r12 + rbx + 0x30]
jmp 0x1403f0752
jmp 0x1403f0762
lea r9, [r12 + rbx]
add r9, 0x30
shr r15, cl
lea r15, [r14 + rbx]
ror al, cl
add r15, 0x30
mov rax, qword [r14 + rbx + 0x48]
cmp r12b, 0x41
cmp rax, rsi
jmp 0x1403f077d
jb 0x1403f0626
cmp rax, 0x10
jmp 0x1403f078c
jb 0x1403f079c
mov r15, qword [r14 + rbx + 0x30]
movzx cx, dil
mov qword [r14 + rbx + 0x40], rsi
not ecx
mov rcx, r15
movsx edx, r12w
mov rdx, r9
bswap r8w
mov r8, rsi
jmp 0x1403f07b9
call fcn.14049decb
mov byte [r15 + rsi], 0
jmp 0x1403f063a
lea r14, [r14 + rbx]
sal sil, 0x66
sbb dil, spl
or r12w, dx
mov rax, r14
bt bx, cx
add rsp, 0x28
movsx r12w, r12b
movzx r14, r13w
jmp 0x1403f07f0
pop rbx
jmp 0x1403f07fe
pop rdi
xchg r14w, r12w
not r12w
mov r14, rax
pop rsi
bswap r14
sete r12b
movsx r15w, cl
pop r12
movzx r14, bx
movsx r15d, r11w
movsx r15w, cl
pop r14
movzx r15w, r14b
movsx r15d, r10w
pop r15
jmp 0x1403f0838
ret
Function at 0x14041cf3c
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rsi
mov r10, qword [rcx]
sal r9b, 0xbe
mov rsi, qword [rcx + 0x18]
mov r9d, dword [r10 + 4]
test cx, bp
imul r9d, dword [r10]
jmp 0x14041cf5c
cmp r8d, 2
jmp 0x14041cf65
jne 0x14041d0d3
test r9d, r9d
jmp 0x14041cf73
je 0x14041d168
lea ecx, [r9 - 1]
cmp ecx, 3
jb 0x14041d06d
mov r11d, r9d
sal r8w, cl
rcl r8b, cl
and r11d, 0xfffffffc
nop word cs:[rax + rax]
xor r10, 0x575b5c2b
movzx r8d, word [rsi]
rol r10b, 0x3c
movzx r10d, word [rsi + 4]
test dl, r8b
cmp dh, 0x65
stc
sub ecx, ecx
or cl, cl
rol cl, cl
cmp r8w, word [rdx]
movzx r8d, ax
setne cl
movzx r8, r8w
sar r8b, cl
xadd r8w, r8w
neg ecx
sal r8b, cl
mov word [rsi + 2], cx
sub ecx, ecx
shr r8b, 0x77
cmp dil, dil
shr cl, cl
cmp r10w, word [rdx]
sete r8b
xchg cl, r8b
setne cl
test dl, r8b
shl r8w, 0x99
bswap r8
neg ecx
mov word [rsi + 6], cx
stc
movzx r8d, word [rsi + 8]
cmc
xor ecx, ecx
xadd cl, cl
sub cl, spl
cmp r8w, word [rdx]
movsx r8w, spl
setne cl
neg ecx
or r8, rsp
mov word [rsi + 0xa], cx
movzx r8d, word [rsi + 0xc]
test r9w, bp
jmp 0x14041d03e
sub ecx, ecx
sar cl, cl
inc cl
cmp r8w, word [rdx]
setne cl
stc
neg ecx
mov word [rsi + 0xe], cx
cmp r15b, r8b
add rsi, 0x10
jmp 0x14041d05e
add r11d, 0xfffffffc
jmp 0x14041d067
jne 0x14041cfa8
test r9b, 3
jmp 0x14041d076
je 0x14041d168
and r9d, 3
xor ecx, ecx
btr r8w, 0x23
neg r8w
and r8, 0x347d6514
nop word cs:[rax + rax]
sar r8w, cl
movzx r8d, word [rsi + rcx*4]
sub eax, eax
cmp r8w, word [rdx]
jmp 0x14041d0b2
setne al
cmc
neg eax
mov word [rsi + rcx*4 + 2], ax
jmp 0x14041d0c2
inc rcx
cmp r9d, ecx
jne 0x14041d0a2
jmp 0x14041d168
test r9d, r9d
jmp 0x14041d0db
je 0x14041d168
movzx r10d, word [rdx]
sar r8w, cl
inc r8b
mov r8d, r9d
test bp, ax
xor ecx, ecx
jmp 0x14041d0f9
jmp 0x14041d114
inc rcx
jmp 0x14041d106
cmp r8d, ecx
jmp 0x14041d10e
je 0x14041d168
cmp word [rsi + rcx*8], r10w
jmp 0x14041d11e
jne 0x14041d0fe
movzx eax, word [rsi + rcx*8 + 2]
stc
clc
cmc
cmp ax, word [rdx + 2]
jmp 0x14041d135
jne 0x14041d0fe
movzx eax, word [rsi + rcx*8 + 4]
clc
cmp ax, word [rdx + 4]
jne 0x14041d0fe
mov word [rsi + rcx*8 + 6], 0
movzx r10d, r9w
movzx r10, bp
jmp 0x14041d15f
movzx r10d, word [rdx]
jmp 0x14041d0fe
pop rsi
ret