joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1406b50ee
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x20], r9
cmc
clc
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
movzx r8w, r15b
mov qword [rsp + 8], rcx
movzx ecx, sp
sub rsp, 0x78
movzx r8d, di
cmovle dx, r12w
cdq
mov dword [rsp + 0x38], 1
mov dword [rsp + 0x3c], 0
movzx r8w, bl
xorps xmm0, xmm0
cdq
mov ch, 0xb7
movss dword [rsp + 0x40], xmm0
movzx rdx, r12w
mov cl, bh
movsx edx, sp
xorps xmm0, xmm0
setne dh
not r8d
movss dword [rsp + 0x44], xmm0
cdq
movzx r8, r10w
xorps xmm0, xmm0
setno cl
mov dl, dl
cwd
movss dword [rsp + 0x48], xmm0
movsx r8w, r11b
movzx edx, r10w
jmp 0x1406b5176
xorps xmm0, xmm0
bswap r8
cmovbe dx, bx
mov rdx, 0xffffffffbc83bd87
movss dword [rsp + 0x4c], xmm0
seta r8b
movzx cx, r9b
mov cx, 0x3b25
mov dword [rsp + 0x50], 0
cwd
mov dword [rsp + 0x54], 0
mov dword [rsp + 0x58], 0
cwd
sets r8b
mov dword [rsp + 0x5c], 0
mov dl, 0xb8
mov qword [rsp + 0x60], 0
mov dl, r9b
mov dword [rsp + 0x68], 0
not cl
bswap r8w
lea r8, [rsp + 0x38]
movsx edx, cx
mov edx, dword [rsp + 0x88]
cmovbe ecx, edi
mov rcx, qword [rsp + 0x80]
jmp 0x1406b51fd
call fcn.1406b2b70
mov dword [rsp + 0x20], eax
test r10b, r12b
cmp qword [rsp + 0x90], 0
je 0x1406b5260
cmp dword [rsp + 0x20], 0
je 0x1406b523a
mov eax, dword [rsp + 0x50]
jmp 0x1406b522c
mov dword [rsp + 0x24], eax
jmp 0x1406b5235
jmp 0x1406b5247
mov dword [rsp + 0x24], 0
btr rcx, 7
mov rax, qword [rsp + 0x90]
or cl, r14b
mov ecx, dword [rsp + 0x24]
test r14b, 0x1c
mov dword [rax], ecx
test r9b, 0x2f
cmp qword [rsp + 0x98], 0
je 0x1406b52bf
cmp dword [rsp + 0x20], 0
jmp 0x1406b5279
je 0x1406b5296
mov eax, dword [rsp + 0x58]
jmp 0x1406b5288
mov dword [rsp + 0x28], eax
jmp 0x1406b5291
jmp 0x1406b52a5
mov dword [rsp + 0x28], 0
adc ax, 0x1f26
test bl, 0x38
mov rax, qword [rsp + 0x98]
mov ecx, dword [rsp + 0x28]
clc
stc
mov dword [rax], ecx
cmp spl, dl
test r10b, r13b
cmp r13b, 0xa4
cmp qword [rsp + 0xa0], 0
jmp 0x1406b52cd
je 0x1406b5318
cmp dword [rsp + 0x20], 0
jmp 0x1406b52dd
je 0x1406b52f5
mov eax, dword [rsp + 0x54]
mov dword [rsp + 0x2c], eax
jmp 0x1406b52f0
jmp 0x1406b52fe
mov dword [rsp + 0x2c], 0
stc
mov rax, qword [rsp + 0xa0]
movzx cx, bl
movzx rcx, cx
mov ecx, dword [rsp + 0x2c]
cmp sil, bpl
clc
mov dword [rax], ecx
cmp qword [rsp + 0xa8], 0
jmp 0x1406b5326
je 0x1406b5381
cmp dword [rsp + 0x20], 0
jmp 0x1406b5336
je 0x1406b5353
mov eax, dword [rsp + 0x5c]
jmp 0x1406b5345
mov dword [rsp + 0x30], eax
jmp 0x1406b534e
jmp 0x1406b5365
mov dword [rsp + 0x30], 0
bt eax, esi
and ah, 0xf
movsx eax, r13w
mov rax, qword [rsp + 0xa8]
shrd ecx, eax, 0x9c
mov ecx, dword [rsp + 0x30]
mov dword [rax], ecx
cmp r14d, r14d
test ax, sp
cmp r12b, 0x95
cmp dword [rsp + 0x20], 0
jmp 0x1406b538b
je 0x1406b53a8
mov eax, dword [rsp + 0x68]
jmp 0x1406b539a
mov dword [rsp + 0x34], eax
jmp 0x1406b53a3
jmp 0x1406b53ba
mov dword [rsp + 0x34], 0
movsx ax, sil
jmp 0x1406b53ba
mov eax, dword [rsp + 0x34]
cmc
add rsp, 0x78
jmp 0x1406b53c8
ret
Function at 0x1406c6436
Capabilities:
Resolve function by parsing pe exports

Disassembly:
movss dword [rsp + 0x20], xmm3
test ebx, edi
movss dword [rsp + 0x18], xmm2
stc
mov qword [rsp + 0x10], rdx
cmp r14w, bp
test sil, 0x24
mov qword [rsp + 8], rcx
test r8w, r8w
sub rsp, 0x68
jmp 0x1406c6464
movss xmm0, dword [rsp + 0x80]
jmp 0x1406c6472
ucomiss xmm0, dword [0x1400a8dfc]
jne 0x1406c64b5
mov rax, qword [rsp + 0x70]
cwd
sal dx, cl
add rax, 0x80
cqo
mov qword [rsp + 0x40], rax
cmovnp edx, r13d
cqo
mov rdx, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x40]
jmp 0x1406c64ab
call fcn.1406a8dd5
jmp 0x1406c668d
mov rax, qword [rsp + 0x70]
add rax, 0x80
cdq
movzx rcx, r11w
jmp 0x1406c64ca
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x70]
mov cl, bpl
movsx dx, dh
movzx cx, r15b
mov eax, dword [rax + 0x80]
not dx
mov ecx, 0xe089fa3a
mov ecx, dword [rsp + 0x98]
movzx rdx, bx
cqo
cdq
lea eax, [rcx + rax + 1]
movsx dx, r13b
mov edx, eax
jmp 0x1406c650f
mov rcx, qword [rsp + 0x48]
call fcn.1406a8f66
mov dword [rsp + 0x20], 0
jmp 0x1406c6526
jmp 0x1406c653b
mov eax, dword [rsp + 0x20]
inc eax
mov dword [rsp + 0x20], eax
rcl al, 0x84
xor rax, r14
mov eax, dword [rsp + 0x98]
cmp r10w, cx
cmp dword [rsp + 0x20], eax
jmp 0x1406c654f
jg 0x1406c668d
cvtsi2ss xmm0, dword [rsp + 0x20]
cvtsi2ss xmm1, dword [rsp + 0x98]
divss xmm0, xmm1
movss xmm1, dword [rsp + 0x90]
subss xmm1, dword [rsp + 0x88]
mulss xmm0, xmm1
movss xmm1, dword [rsp + 0x88]
adc rax, rcx
cmovl rax, rax
or ax, 0x819e
addss xmm1, xmm0
movsx ax, ah
cbw
movaps xmm0, xmm1
xor al, 0x38
xchg ah, al
btc ax, 0x1b
movss dword [rsp + 0x24], xmm0
bswap ax
mov rax, qword [rsp + 0x70]
clc
stc
add rax, 0x80
mov qword [rsp + 0x50], rax
jmp 0x1406c65c8
movss xmm0, dword [rsp + 0x24]
jmp 0x1406c65d3
call fcn.140097df0
mulss xmm0, dword [rsp + 0x80]
mov rax, qword [rsp + 0x78]
jmp 0x1406c65eb
movss xmm1, dword [rax + 4]
addss xmm1, xmm0
movaps xmm0, xmm1
movss dword [rsp + 0x30], xmm0
jmp 0x1406c6602
movss xmm0, dword [rsp + 0x24]
jmp 0x1406c660d
call fcn.140097630
mulss xmm0, dword [rsp + 0x80]
mov rax, qword [rsp + 0x78]
movss xmm1, dword [rax]
movzx dx, r8b
setb ch
addss xmm1, xmm0
movaps xmm0, xmm1
mov ch, 0x36
cwd
movss dword [rsp + 0x28], xmm0
mov cl, 0x18
cqo
movsx rcx, r14w
movss xmm0, dword [rsp + 0x28]
cwd
movss dword [rsp + 0x38], xmm0
cwd
movss xmm0, dword [rsp + 0x30]
bswap cx
cqo
movsx edx, di
movss dword [rsp + 0x3c], xmm0
seto dh
lea rdx, [rsp + 0x38]
setl ch
xchg cl, cl
not ch
mov rcx, qword [rsp + 0x50]
jmp 0x1406c6683
call fcn.1406a8dd5
jmp 0x1406c652b
add rsp, 0x68
ret
Function at 0x1406ca66a
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x10], rdx
dec rax
setg ah
clc
mov qword [rsp + 8], rcx
rol al, cl
adc eax, ecx
shld rax, r15, 0x92
sub rsp, 0x48
sal al, 0x8b
sar ah, 0xb
sub al, r11b
mov rax, qword [rsp + 0x50]
cmp si, r12w
movzx eax, byte [rax]
test eax, eax
jmp 0x1406ca6a4
je 0x1406ca929
mov eax, 1
shrd rcx, rbx, 9
btc rcx, 0x11
imul rax, rax, 0
movsx cx, bl
mov ch, 0x2b
mov rcx, qword [rsp + 0x50]
jmp 0x1406ca6ce
mov cl, byte [rcx + rax]
jmp 0x1406ca6d6
call fcn.1406ca5fd
mov dword [rsp + 0x30], eax
mov ecx, 1
movsx rdx, r11w
imul rcx, rcx, 1
movsxd rdx, r15d
sete dl
movsx dx, dh
mov rdx, qword [rsp + 0x50]
jmp 0x1406ca700
mov cl, byte [rdx + rcx]
jmp 0x1406ca708
call fcn.1406ca5fd
mov dword [rsp + 0x2c], eax
sar edx, cl
mov ecx, 1
movzx dx, bpl
movsx edx, bp
sub dx, r14w
imul rcx, rcx, 2
mov rdx, qword [rsp + 0x50]
mov cl, byte [rdx + rcx]
call fcn.1406ca5fd
mov dword [rsp + 0x28], eax
mov ecx, 1
xadd edx, edx
bsr dx, r15w
imul rcx, rcx, 3
xchg rdx, rdx
movsx rdx, r13w
mov rdx, qword [rsp + 0x50]
jmp 0x1406ca75b
mov cl, byte [rdx + rcx]
jmp 0x1406ca763
call fcn.1406ca5fd
mov dword [rsp + 0x24], eax
mov ecx, 1
adc rdx, 0xffffffffab162e83
movzx rdx, r8w
imul rcx, rcx, 4
movsx dx, r9b
movzx dx, bl
mov rdx, qword [rsp + 0x50]
jmp 0x1406ca793
mov cl, byte [rdx + rcx]
jmp 0x1406ca79b
call fcn.1406ca5fd
imul eax, eax, 0x55
mov ecx, dword [rsp + 0x24]
add ecx, eax
movzx ax, cl
mov eax, ecx
neg cl
ror cl, 0x81
imul eax, eax, 0x55
rol dh, 7
sbb ecx, 0xb2c94b2
mov ecx, dword [rsp + 0x28]
btr rdx, 0xa5
add ecx, eax
mov eax, ecx
rcl edx, 0x9e
imul eax, eax, 0x55
mov ecx, dword [rsp + 0x2c]
sub dl, sil
mov dx, 0x390c
movzx rdx, bp
add ecx, eax
mov eax, ecx
rcr cl, 0x19
mov dh, 2
imul eax, eax, 0x55
mov edx, ebp
mov ecx, dword [rsp + 0x30]
btr edx, ebx
rol dx, cl
stc
add ecx, eax
mov eax, ecx
cmp cx, cx
xadd cl, dl
not cx
mov dword [rsp + 0x20], eax
movsx dx, r14b
rcl al, cl
shrd ax, r13w, 0xba
mov eax, dword [rsp + 0x20]
rcl dh, 0xb5
sal dh, 0xb0
and eax, 0xff
mov ecx, 1
imul rcx, rcx, 0
jmp 0x1406ca83d
mov rdx, qword [rsp + 0x58]
mov byte [rdx + rcx], al
mov eax, dword [rsp + 0x20]
shr eax, 8
and eax, 0xff
mov ecx, 1
imul rcx, rcx, 1
sub edx, 0xf3547b1
sal dx, 0x1b
bts dx, di
mov rdx, qword [rsp + 0x58]
test al, 0xa5
mov byte [rdx + rcx], al
mov eax, dword [rsp + 0x20]
shr eax, 0x10
xor dl, r13b
test cx, 0x8ab9
and eax, 0xff
cmovo dx, r15w
mov ecx, 1
btc rdx, 5
shl dx, 0xaa
imul rcx, rcx, 2
adc dl, 2
dec dh
sub dl, r11b
mov rdx, qword [rsp + 0x58]
cmp r13b, 0x23
jmp 0x1406ca8b3
mov byte [rdx + rcx], al
mov eax, dword [rsp + 0x20]
shr eax, 0x18
shld rcx, r15, 0xaa
and eax, 0xff
neg dl
sar rcx, 0xc
mov ecx, 1
adc edx, esp
dec dl
movsx rdx, dx
imul rcx, rcx, 3
sar dl, 0xd
cwd
rol dh, 0xa4
mov rdx, qword [rsp + 0x58]
mov byte [rdx + rcx], al
ror rax, 0xba
mov rax, qword [rsp + 0x50]
cmp r11b, 0xb4
stc
add rax, 5
mov qword [rsp + 0x50], rax
dec al
sar ax, 4
mov rax, qword [rsp + 0x58]
stc
jmp 0x1406ca916
add rax, 4
jmp 0x1406ca91f
mov qword [rsp + 0x58], rax
jmp 0x1406ca691
add rsp, 0x48
jmp 0x1406ca932
ret
Function at 0x1406cbfa6
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov dword [rsp + 0x20], r9d
rcl rax, 0x93
sub al, r10b
rol eax, cl
mov dword [rsp + 0x18], r8d
clc
inc ax
mov qword [rsp + 0x10], rdx
not rax
mov qword [rsp + 8], rcx
movzx rax, r10w
bts cx, ax
sub rsp, 0x18
add al, 0xc
movsxd rax, dword [rsp + 0x30]
btr ecx, 0xaf
mov cx, 0x76bb
bts ecx, r14d
mov rcx, qword [rsp + 0x28]
cmp esi, 0x1da0103e
add rcx, rax
mov rax, rcx
movsx cx, dl
mov ecx, dword [rsp + 0x38]
clc
cmp sil, spl
imul ecx, dword [rsp + 0x50]
test r11b, sil
movsxd rcx, ecx
clc
jmp 0x1406cc018
add rax, rcx
jmp 0x1406cc020
mov qword [rsp + 8], rax
cbw
movsxd rax, r11d
mov eax, dword [rsp + 0x48]
jmp 0x1406cc033
mov dword [rsp + 4], eax
jmp 0x1406cc03c
jmp 0x1406cc08f
mov eax, dword [rsp + 4]
movzx ecx, r9w
movzx cx, r10b
dec eax
xor ch, 0x34
bsr rcx, r10
mov dword [rsp + 4], eax
movzx rcx, ax
movsx ax, r12b
movsxd rax, dword [rsp + 0x50]
shl cl, 0x2d
mov rcx, qword [rsp + 8]
lea rcx, [rcx + rax]
mov ax, si
movsxd rax, r9d
mov rax, rcx
cmp r12, 0xffffffffa297d4a7
mov qword [rsp + 8], rax
cmp bp, r14w
clc
cmp dword [rsp + 4], 0
jmp 0x1406cc099
jle 0x1406cc13f
mov dword [rsp], 0
jmp 0x1406cc0ab
jmp 0x1406cc0c7
mov eax, dword [rsp]
jmp 0x1406cc0b8
inc eax
test r12b, 0x25
cmp r10b, cl
mov dword [rsp], eax
shr ax, cl
mov eax, dword [rsp + 0x40]
cmp dword [rsp], eax
jmp 0x1406cc0d3
jge 0x1406cc13a
movsxd rax, dword [rsp]
xchg cl, r8b
cmovo dx, si
mov rcx, r10
mov rcx, qword [rsp + 8]
mov dl, 0xaa
cmovs r8d, edi
movzx dx, dh
movzx eax, byte [rcx + rax]
movzx dx, r14b
movsxd rcx, dword [rsp]
movzx rdx, r14w
setne r8b
bswap edx
mov rdx, qword [rsp + 8]
movzx r8, r8w
movsx r8, r12w
movzx r8w, r8b
mov r8, qword [rsp + 0x20]
jmp 0x1406cc129
mov al, byte [r8 + rax]
mov byte [rdx + rcx], al
jmp 0x1406cc135
jmp 0x1406cc0b0
jmp 0x1406cc041
add rsp, 0x18
jmp 0x1406cc148
ret
Function at 0x1406d7ea4
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov qword [rsp + 0x10], rdx
cdqe
add ax, si
inc r8w
mov qword [rsp + 8], rcx
sub rsp, 0x38
rdtsc
bsr edx, edx
shrd dx, r14w, 0xa1
mov rax, qword [rsp + 0x40]
movsx dx, r10b
mov rax, qword [rax + 8]
shrd r8d, edi, 0x9b
mov rcx, qword [rsp + 0x48]
xchg dl, dl
cdq
sub rcx, rax
sal dl, 0x1f
movsxd rdx, r9d
shld dx, di, 0xb1
mov rax, rcx
cqo
sub r8b, bpl
bt cx, dx
sbb rcx, 0xfffffffff82eca9d
mov ecx, 0x38
seta r8b
idiv rcx
bsr dx, r13w
rol ecx, cl
mov qword [rsp + 0x20], rax
mov ecx, r8d
rdtsc
mov rax, qword [rsp + 0x40]
movsxd rcx, esi
bswap edx
movsxd rax, dword [rax]
bt r8, r11
sub rax, qword [rsp + 0x20]
movzx rcx, bx
dec rax
shr r8d, cl
sar r8, 0x88
imul rax, rax, 0x38
cdq
imul rcx, qword [rsp + 0x20], 0x38
mov rdx, qword [rsp + 0x40]
xchg r8d, r8d
jmp 0x1406d7f5e
mov rdx, qword [rdx + 8]
movsx r8d, dx
shl r8b, cl
lea rcx, [rdx + rcx + 0x38]
imul rdx, qword [rsp + 0x20], 0x38
movzx r8, r15w
mov r8, qword [rsp + 0x40]
stc
cmp ax, r12w
add rdx, qword [r8 + 8]
movzx r8, r9w
mov qword [rsp + 0x28], rdx
mov r8, rax
mov rdx, rcx
mov rax, qword [rsp + 0x28]
xchg cl, ch
movzx cx, spl
mov rcx, rax
jmp 0x1406d7fa9
call fcn.1406ef82c
mov rax, qword [rsp + 0x40]
jmp 0x1406d7fbd
mov eax, dword [rax]
cmovp rcx, r9
bswap cx
movsx rcx, r8w
dec eax
bt ecx, esi
mov rcx, qword [rsp + 0x40]
cmp cl, r10b
test r14b, 0x91
mov dword [rcx], eax
btr cx, r9w
imul rax, qword [rsp + 0x20], 0x38
ror rcx, 0xae
bt ecx, r14d
mov rcx, qword [rsp + 0x40]
test r9b, 0x3c
add rax, qword [rcx + 8]
add rsp, 0x38
jmp 0x1406d8006
ret
Function at 0x1406d82e8
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x18], r8
cmp dl, 0x97
mov dword [rsp + 0x10], edx
test bl, 0xa
mov qword [rsp + 8], rcx
movzx ax, r8b
sub rsp, 0x38
bts rax, r11
add ax, di
mov rax, qword [rsp + 0x40]
test r13b, 0xa
mov eax, dword [rax + 4]
stc
cmp dword [rsp + 0x48], eax
jle 0x1406d83fd
mov rax, qword [rsp + 0x40]
test rbp, rdi
cmp dword [rax + 4], 0
jmp 0x1406d8334
je 0x1406d837b
mov rax, qword [rsp + 0x40]
shr rcx, cl
movzx edx, r13w
xor dx, r9w
mov eax, dword [rax + 4]
shl dl, cl
btr dx, 0xb0
cdq
sub eax, edx
ror cx, cl
sar eax, 1
rcr cl, 0x27
sal cl, cl
mov rcx, qword [rsp + 0x40]
test spl, r11b
cmc
add eax, dword [rcx + 4]
mov dword [rsp + 0x24], eax
jmp 0x1406d8376
jmp 0x1406d8386
mov dword [rsp + 0x24], 8
movsxd rax, r8d
mov eax, dword [rsp + 0x24]
jmp 0x1406d8394
mov dword [rsp + 0x28], eax
movsxd rax, r8d
mov eax, dword [rsp + 0x48]
stc
clc
cmp dword [rsp + 0x28], eax
jmp 0x1406d83aa
jle 0x1406d83c7
mov eax, dword [rsp + 0x28]
jmp 0x1406d83b9
mov dword [rsp + 0x2c], eax
jmp 0x1406d83c2
jmp 0x1406d83de
mov eax, dword [rsp + 0x48]
cmovb cx, r12w
cqo
mov dword [rsp + 0x2c], eax
mov ecx, 0xfbb49c19
setb dh
mov edx, dword [rsp + 0x2c]
cmovne ecx, esi
mov cx, 0xd43a
movzx cx, r14b
mov rcx, qword [rsp + 0x40]
jmp 0x1406d83f8
call fcn.1406a9a8e
mov rax, qword [rsp + 0x40]
clc
cmp r15, rdi
mov eax, dword [rax]
test r13w, cx
cmc
cmp dword [rsp + 0x48], eax
jmp 0x1406d8416
jle 0x1406d84a2
mov rax, qword [rsp + 0x40]
jmp 0x1406d8426
mov eax, dword [rax]
jmp 0x1406d842d
mov dword [rsp + 0x20], eax
jmp 0x1406d844a
mov eax, dword [rsp + 0x20]
jmp 0x1406d843f
inc eax
mov dword [rsp + 0x20], eax
xchg al, ah
rcr rax, cl
mov eax, dword [rsp + 0x48]
test r8, 0x71384681
test r14, r8
cmc
cmp dword [rsp + 0x20], eax
jmp 0x1406d8462
jge 0x1406d84a2
movsxd rax, dword [rsp + 0x20]
mov rcx, qword [rsp + 0x40]
movsx edx, cx
jmp 0x1406d847e
mov rcx, qword [rcx + 8]
mov rdx, qword [rsp + 0x50]
jmp 0x1406d848c
movzx edx, word [rdx]
jmp 0x1406d8494
mov word [rcx + rax*2], dx
jmp 0x1406d849d
jmp 0x1406d8436
mov rax, qword [rsp + 0x40]
movsx rcx, ax
shld cx, r8w, 0xd
mov ecx, dword [rsp + 0x48]
stc
clc
mov dword [rax], ecx
stc
cmp sil, r12b
add rsp, 0x38
jmp 0x1406d84c6
ret
Function at 0x1406ec4d3
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x18
mov r8, rcx
shld eax, r12d, 0xa4
mov eax, 0x5a4d
cmc
cmp word [0x140000000], ax
jne 0x1406ec5f7
movsxd rcx, dword [0x14000003c]
rol rdx, 0xad
lea rdx, [0x140000000]
clc
add rcx, rdx
cmp dword [rcx], 0x4550
jmp 0x1406ec513
jne 0x1406ec5f7
mov eax, 0x20b
clc
stc
cmp word [rcx + 0x18], ax
jmp 0x1406ec529
jne 0x1406ec5f7
sub r8, rdx
lahf
movzx eax, word [rcx + 0x14]
cqo
rcr r9w, cl
or r9w, bx
lea rdx, [rcx + 0x18]
dec r9
xor r9b, r11b
sbb r9b, 9
lea rdx, [rdx + rax]
bsf r9, rsp
stc
cmc
movzx eax, word [rcx + 6]
lea rcx, [rax + rax*4]
shl r9b, 0x2f
rcr r9b, cl
lea r9, [rdx + rcx*8]
mov qword [rsp], rdx
cmc
test ax, 0x4818
cmp rdx, r9
jmp 0x1406ec57d
je 0x1406ec5b9
mov ecx, dword [rdx + 0xc]
test bp, r10w
cmp r8, rcx
jb 0x1406ec5ab
mov eax, dword [rdx + 8]
test r15b, 0xb2
add eax, ecx
clc
cmp r8, rax
jmp 0x1406ec5a5
jb 0x1406ec5bb
add rdx, 0x28
jmp 0x1406ec5b4
jmp 0x1406ec56c
xor edx, edx
test rdx, rdx
jmp 0x1406ec5c3
jne 0x1406ec5d5
sub al, al
jmp 0x1406ec5d0
jmp 0x1406ec605
cmp dword [rdx + 0x24], 0
jmp 0x1406ec5de
jge 0x1406ec5eb
sub al, al
jmp 0x1406ec605
mov al, 1
jmp 0x1406ec5f2
jmp 0x1406ec605
xor al, al
jmp 0x1406ec5fe
jmp 0x1406ec605
add rsp, 0x18
jmp 0x1406ec60e
ret
Function at 0x1406ee319
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
btr r10, 0x35
mov qword [rax + 0x18], rsi
movzx r11, r11w
test r14d, 0x352a0d2f
mov qword [rax + 0x20], rdi
shl bl, 0x81
rcl dil, cl
push r14
mov bl, byte [rcx]
movsx ebp, si
stc
lea r10, [rcx + 1]
adc bpl, 0x15
mov byte [rdx], bl
movzx di, r14b
xchg si, bp
cmp rbp, r8
mov esi, r9d
lea r14, [0x140000000]
or r11b, 0x81
add bpl, 0x88
mov rbp, r8
not di
mov r11, rdx
ror dil, 0xbc
bt edi, 0x3b
mov rdi, rcx
test bl, 4
jmp 0x1406ee38d
je 0x1406ee3da
movzx ecx, byte [r10]
sub ax, sp
and ecx, 0xf
btr ax, r13w
jmp 0x1406ee3a7
movsx rax, byte [rcx + r14 + 0x9bb38]
cmp r8b, r11b
mov cl, byte [rcx + r14 + 0x9bb48]
cmc
cmp r12w, 0x1409
sub r10, rax
bts ax, ax
mov eax, dword [r10 - 4]
shr eax, cl
cmp r15b, r8b
mov dword [rdx + 4], eax
cmc
test r12b, 0xbf
test bl, 8
jmp 0x1406ee3e2
je 0x1406ee40b
mov eax, dword [r10]
test r10w, dx
test r9b, 0x8e
cmc
add r10, 4
cmc
jmp 0x1406ee3ff
mov dword [rdx + 8], eax
jmp 0x1406ee40b
test bl, 0x10
jmp 0x1406ee413
je 0x1406ee437
mov eax, dword [r10]
test r13b, r14b
add r10, 4
sal r8d, 2
movzx r8d, di
shld r8w, cx, 5
mov dword [rdx + 0xc], eax
test r12b, r15b
movsxd rax, dword [r10]
lea r8, [r10 + 4]
cmc
clc
xor r9d, r9d
cmp byte [rsp + 0x30], r9b
jmp 0x1406ee44d
jne 0x1406ee4ed
test bl, 2
je 0x1406ee4ed
lea rdx, [rax + rbp]
movzx ecx, byte [rdx]
and ecx, 0xf
bswap r10d
movsx rax, byte [rcx + r14 + 0x9bb38]
rcl r10, cl
mov cl, byte [rcx + r14 + 0x9bb48]
shr r10b, cl
sub rdx, rax
setae r10b
rcr r10b, cl
movsx r10w, r12b
mov r10d, dword [rdx - 4]
test ebp, ebx
stc
shr r10d, cl
mov dword [r11 + 0x10], r9d
test bpl, bpl
test r10d, r10d
je 0x1406ee4f0
mov eax, dword [rdx]
stc
inc cl
mov ecx, dword [rdx + 4]
lea rdx, [rdx + 8]
cmc
cmp eax, esi
jmp 0x1406ee4bd
je 0x1406ee4df
inc r9d
cmp r13w, 0xda95
cmp r9d, r10d
jmp 0x1406ee4d4
jb 0x1406ee4a9
jmp 0x1406ee4f0
mov dword [r11 + 0x10], ecx
jmp 0x1406ee4e8
jmp 0x1406ee4f0
mov dword [rdx + 0x10], eax
test bl, 1
jmp 0x1406ee4f8
je 0x1406ee547
movzx ecx, byte [r8]
xor bh, 0xb9
test dx, r11w
dec rax
and ecx, 0xf
clc
sal bpl, cl
add ebx, 0x279a2a04
movsx rdx, byte [rcx + r14 + 0x9bb38]
cwde
mov cl, byte [rcx + r14 + 0x9bb48]
not ebx
cmp spl, 0x8a
sub r8, rdx
mov edx, dword [r8 - 4]
bt rax, 0x93
shr edx, cl
adc bpl, 0x22
mov dword [r11 + 0x14], edx
mov rbx, qword [rsp + 0x10]
sal bpl, 0xb6
sub r8, rdi
jmp 0x1406ee558
mov rbp, qword [rsp + 0x18]
cmovbe si, cx
mov rax, r8
movsxd rsi, ebx
cmovbe r14, rdi
movsx di, dil
mov rsi, qword [rsp + 0x20]
mov rdi, qword [rsp + 0x28]
pop r14
jmp 0x1406ee581
ret
Function at 0x140712809
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
test sp, 0x9326
test r11w, r10w
mov qword [rsp + 0x10], rbp
cmp r11b, r11b
mov qword [rsp + 0x18], rsi
push rdi
cmc
push r14
push r15
add r14b, sil
bsr r14w, di
sub rsp, 0x20
and r14w, r11w
rol r14b, 8
movzx r14w, bl
mov r14, rcx
cmc
test rcx, rcx
jmp 0x14071284f
je 0x140712944
sub ebx, ebx
shr edx, cl
stc
lea r15, [0x140000000]
cdq
xor r8w, r13w
cmc
mov edi, 0xe3
lea eax, [rdi + rbx]
bts rbp, rsp
mov r8d, 0x55
cwd
stc
cdq
mov rcx, r14
cmp bx, 0x8211
sub eax, edx
setg sil
rcl rsi, 0x1d
sar eax, 1
movsx si, dl
movsxd rbp, eax
mov rdx, rbp
cmc
mov rsi, rbp
cmc
cmp rcx, rcx
add rdx, rdx
jmp 0x1407128ab
mov rdx, qword [r15 + rdx*8 + 0xa0eb0]
call fcn.14007c8a5
test eax, eax
jmp 0x1407128bf
je 0x1407128f8
jns 0x1407128d8
lea edi, [rbp - 1]
jmp 0x1407128d3
jmp 0x1407128de
lea ebx, [rbp + 1]
test al, r12b
cmp ebx, edi
jmp 0x1407128e5
jle 0x14071286c
or eax, 0xffffffff
jmp 0x1407128f3
jmp 0x140712910
lea rsi, [rsi + rsi]
btc ax, 0x1a
bt eax, 0xae
mov eax, dword [r15 + rsi*8 + 0xa0eb8]
test edx, r8d
test eax, eax
jmp 0x140712917
js 0x140712944
cmp eax, 0xe4
jmp 0x140712927
jae 0x140712944
cdqe
add rax, rax
mov eax, dword [r15 + rax*8 + 0x9f450]
jmp 0x14071293f
jmp 0x140712952
xor eax, eax
btc r14w, 0xa
movzx esi, sp
bswap bp
mov rbx, qword [rsp + 0x40]
movzx rdi, sp
sub r14b, 0xb8
mov rbp, qword [rsp + 0x48]
shl dil, cl
adc di, 0xd31f
jmp 0x140712971
mov rsi, qword [rsp + 0x50]
btr r14w, 0x9c
add rsp, 0x20
movsx r15w, r12b
pop r15
movzx edi, r8w
pop r14
movzx di, dl
movsx edi, dx
jmp 0x140712999
pop rdi
jmp 0x14071299f
ret
Function at 0x14171d528
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.14171d6af
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x14171d559
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x14171d53f
add dl, dl
jne 0x14171d566
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x14171d5c6
xor eax, eax
add dl, dl
jne 0x14171d575
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x14171d67d
add dl, dl
jne 0x14171d586
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x14171d593
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x14171d5a0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x14171d5ad
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x14171d5ba
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x14171d54e
mov eax, 1
add dl, dl
jne 0x14171d5d6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x14171d5e3
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x14171d5cb
sub eax, ebx
mov ebx, 1
jne 0x14171d61c
mov ecx, 1
add dl, dl
jne 0x14171d5fe
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x14171d60b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x14171d5f3
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14171d54e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x14171d638
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x14171d645
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x14171d62d
cmp eax, 0x7d00
jae 0x14171d66b
cmp eax, 0x500
jb 0x14171d666
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14171d54e
cmp eax, 0x7f
ja 0x14171d66e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14171d54e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x14171d6a2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x14171d54e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20