joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180066110
Capabilities:
Receive data
Receive data on socket

Disassembly:
push rbx
push rdi
push r14
sub rsp, 0xd0
mov rax, qword [0x18009f2c0]
xor rax, rsp
mov qword [rsp + 0xc0], rax
mov rbx, qword [rcx + 0xa00]
lea rax, [rsp + 0x30]
mov rdi, qword [rcx]
mov r14, rcx
mov dword [rsp + 0x30], 0x80
xor r9d, r9d
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x40]
mov r8d, dword [rbx + 0x15c]
mov rdx, qword [rbx + 0x168]
add r8d, 4
mov rcx, qword [rbx + 0x18]
mov qword [rsp + 0x20], rax
call qword [sym.imp.WS2_32.dll_recvfrom]
cmp dword [rbx + 0x150], 0
mov dword [rbx + 0x154], eax
jne 0x1800661a5
movsxd r8, dword [rsp + 0x30]
lea rcx, [rbx + 0xd0]
lea rdx, [rsp + 0x40]
call sub.VCRUNTIME140.dll_memcpy
mov eax, dword [rsp + 0x30]
mov dword [rbx + 0x150], eax
mov r8d, dword [rbx + 0x154]
mov qword [rsp + 0xf8], rbp
mov qword [rsp + 0x100], rsi
cmp r8d, 4
jge 0x180066206
lea rdx, str.Received_too_short_packet
mov rcx, rdi
call fcn.180040910
mov dword [rbx + 0xc], 7
xor eax, eax
mov rsi, qword [rsp + 0x100]
mov rbp, qword [rsp + 0xf8]
mov rcx, qword [rsp + 0xc0]
xor rcx, rsp
call fcn.180079240
add rsp, 0xd0
pop r14
pop rdi
pop rbx
ret
mov rdx, qword [rbx + 0x168]
movzx eax, byte [rdx]
movzx ecx, byte [rdx + 1]
shl eax, 8
or ecx, eax
mov dword [rbx + 0xc], ecx
sub ecx, 3
je 0x1800662c1
sub ecx, 1
je 0x180066334
sub ecx, 1
je 0x180066270
cmp ecx, 1
je 0x180066253
lea r8, str.Internal_error:_Unexpected_packet
mov rcx, rdi
lea rdx, [0x18008d8f0]
call fcn.180040910
jmp 0x180066334
add r8d, 0xfffffffe
add rdx, 2
mov rcx, rbx
call fcn.180065e40
test eax, eax
je 0x180066334
jmp 0x1800661da
movzx ecx, byte [rdx + 2]
lea eax, [r8 - 4]
movsxd rbp, eax
lea rsi, [rdx + 4]
movzx eax, byte [rdx + 3]
mov r8, rbp
shl ecx, 8
xor edx, edx
or ecx, eax
mov dword [rbx + 8], ecx
mov rcx, rsi
call sub.VCRUNTIME140.dll_memchr
test rax, rax
je 0x180066334
sub rax, rsi
cmp rax, rbp
jae 0x180066334
mov r8, rsi
lea rdx, str.TFTP_error:__s_n
mov rcx, rdi
call fcn.180040a90
jmp 0x180066334
cmp r8d, 4
jle 0x180066334
movzx eax, byte [rdx + 3]
movzx ecx, byte [rdx + 2]
shl ecx, 8
or ecx, eax
movzx eax, word [rbx + 0x48]
inc eax
movzx eax, ax
cmp eax, ecx
jne 0x180066334
lea eax, [r8 - 4]
mov rcx, r14
lea r8, [rdx + 4]
movsxd r9, eax
mov edx, 1
call fcn.180040830
mov esi, eax
test eax, eax
je 0x180066313
mov edx, 5
mov rcx, rbx
call fcn.180066e00
mov eax, esi
jmp 0x1800661da
mov eax, dword [rbx + 0x154]
mov rcx, rdi
sub eax, 4
cdqe
add qword [rdi + 0xf8], rax
mov rdx, qword [rdi + 0xf8]
call fcn.18004f230
mov rcx, r14
call fcn.18004f510
test eax, eax
je 0x1800661d8
mov edx, 5
mov rcx, rbx
call fcn.180066e00
mov eax, Ordinal_45
jmp 0x1800661da
Function at 0x1800790d0
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rdi
push r14
sub rsp, 0x20
mov eax, dword [rcx + 0x18]
mov rbx, rcx
mov ebp, r8d
mov r14, rdx
lea ecx, [rax + rax]
mov eax, dword [rbx + 0x20]
add rax, 0x18
add rcx, rax
call qword [sub.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rdi, rax
test rax, rax
jne 0x180079112
mov rbx, qword [rsp + 0x50]
add rsp, 0x20
pop r14
pop rdi
pop rbp
ret
lea rcx, [rax + 0x18]
mov qword [rax], rbx
mov qword [rax + 8], rcx
mov eax, dword [rbx + 0x18]
add rax, rcx
mov qword [rsp + 0x48], rsi
mov qword [rdi + 0x10], rax
cmp ebp, dword [rbx + 0x1c]
jbe 0x180079159
call qword [rbx]
mov rcx, qword [rdi + 8]
mov r8d, ebp
mov rdx, r14
call qword [rbx + reloc.WS2_32.dll_htonl]
mov r14d, dword [rbx + 0x18]
add r14, qword [rdi + 0x10]
mov rdx, qword [rdi + 8]
mov rcx, r14
call qword [rbx + reloc.WS2_32.dll_recv]
mov rcx, qword [rdi + 8]
mov ebp, dword [rbx + 0x20]
call qword [rbx]
mov rcx, qword [rdi + 0x10]
call qword [rbx]
xor esi, esi
test rbp, rbp
je 0x1800791b2
mov rsi, rbp
nop dword [rax + rax]
movzx eax, byte [r14]
lea rdx, [rsp + 0x40]
xor al, 0x36
mov r8d, 1
mov byte [rsp + 0x40], al
mov rcx, qword [rdi + 8]
call qword [rbx + reloc.WS2_32.dll_htonl]
movzx eax, byte [r14]
lea rdx, [rsp + 0x40]
xor al, 0x5c
lea r14, [r14 + 1]
mov byte [rsp + 0x40], al
mov r8d, 1
mov rcx, qword [rdi + 0x10]
call qword [rbx + reloc.WS2_32.dll_htonl]
sub rbp, 1
jne 0x180079170
mov eax, dword [rbx + 0x1c]
cmp rsi, rax
jae 0x1800791f3
nop word [rax + rax]
mov rcx, qword [rdi + 8]
lea rdx, [0x18008d4e2]
mov r8d, 1
call qword [rbx + reloc.WS2_32.dll_htonl]
mov rcx, qword [rdi + 0x10]
lea rdx, [0x18008d4e3]
mov r8d, 1
call qword [rbx + reloc.WS2_32.dll_htonl]
mov eax, dword [rbx + 0x1c]
inc rsi
cmp rsi, rax
jb 0x1800791c0
mov rsi, qword [rsp + 0x48]
mov rax, rdi
mov rbx, qword [rsp + 0x50]
add rsp, 0x20
pop r14
pop rdi
pop rbp
ret

Function at 0x18007a428
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rbx, rdx
lea r8, [rsp + 0x60]
mov edi, ecx
mov edx, 0x20000001
lea rcx, str._x_sys_default_locale
mov r9d, 2
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
test eax, eax
jne 0x18007a462
xor r9d, r9d
mov dword [rsp + 0x60], r9d
jmp 0x18007a467
mov r9d, dword [rsp + 0x60]
and qword [rsp + 0x30], 0
mov r8d, edi
and dword [rsp + 0x28], 0
xor edx, edx
mov ecx, 0x1300
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_FormatMessageA]
mov edx, eax
test eax, eax
je 0x18007a4b0
mov r8, qword [rbx]
dec r8
add r8, rdx
movzx ecx, byte [r8]
lea rax, reloc.WS2_32.dll_accept
cmp byte [rcx + rax], 0
je 0x18007a4b0
dec r8
sub rdx, 1
jne 0x18007a496
mov rbx, qword [rsp + 0x50]
mov rax, rdx
add rsp, 0x40
pop rdi
ret
Function at 0x1400072b0
Capabilities:
Access peb ldr_data
Encrypt data using speck
Get number of processors
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x2e8
movaps xmmword [rsp + 0x2d0], xmm6
movabs r12, 0xcbf29ce484222325
movabs r14, 0x1d12a89b9e723ff5
lea rcx, [0x1400ce915]
jmp 0x1403adc26

Function at 0x140008210
Capabilities:
Encode data using xor
Encrypt data using speck
Parse pe header

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x38
movabs r14, 0xcbf29ce484222325
lea rcx, [0x1400ce987]
jmp 0x1403af793

Function at 0x1400e0353
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
clc
cmp word [rcx], ax
jmp 0x1401b6bcf
sub eax, eax
ret
jne 0x1400f2fce
movsxd rdx, dword [rcx + 0x3c]
test r12b, r11b
lea rdx, [rdx + rcx]
cmp r15d, r10d
cmp dword [rdx], 0x4550
jne 0x1400f2fce
xor eax, eax
bts ecx, r10d
rol cl, 0x7f
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
mov al, r14b
mov al, 0x8f
sete al
jmp 0x1401ce286
ret

Function at 0x14010d26e
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
test dl, r12b
sub edx, edx
jmp 0x140190c3d
jmp 0x1404b1a25
Function at 0x140137707
Capabilities:
Encrypt data using speck
Resolve function by parsing pe exports

Disassembly:
mov rcx, qword [rcx]
jmp 0x14022b23c
jmp 0x1404464bf
push rsi
rol esi, cl
ror eax, 0x63
push rdi
setb al
sub rsp, 0x28
neg al
movzx rax, dx
mov rsi, rcx
mov rcx, qword [rcx + 0x18]
or ax, 0x3c85
bts ax, cx
mov rax, qword [rcx]
clc
xor edx, edx
clc
xor r8d, r8d
jmp 0x1404464f1
call qword [rax + 0x188]
mov edi, eax
bswap cx
movsx cx, r14b
movsx ecx, bx
lea rcx, [rsi + 0x30]
jmp 0x14044650d
call fcn.14045a230
test edi, edi
jmp 0x140446519
je 0x140446551
cmp edi, 0x8899000c
jne 0x140446562
mov rcx, rsi
adc edi, r10d
rcr edi, 0x59
add esi, 0xf0c65cb
add rsp, 0x28
movzx edi, bx
movsx rsi, r9w
pop rdi
pop rsi
jmp 0x14044654c
jmp fcn.140446174
nop
cmc
add rsp, 0x28
not di
pop rdi
pop rsi
jmp 0x140446561
ret
mov ecx, edi
shr r9w, 0xb9
add r8w, 0x425d
cmp r11b, r13b
movabs r8, 0xad4a5352d2edebd0
mov dl, 3
movsx r9, ax
cmc
mov r9d, 0x54
add rsp, 0x28
movsx rdi, r10w
jmp 0x140446599
pop rdi
bswap rsi
jmp 0x1404465a9
pop rsi
jmp 0x1404465af
jmp fcn.1403afd79

Function at 0x14014a30c
Capabilities:
Access peb ldr_data

Disassembly:
je 0x14019a304
mov word [rcx], ax
ror al, 0x51
sar al, 0xb4
mov ah, 0x9a
add rcx, 2
movsx ax, bl
lahf
movzx eax, word [r9 + rdx*2 + 2]
jmp 0x14010a075
inc rdx
test ax, ax
jmp 0x1401e9649
ret
movzx eax, word [0x1400b8f10]
test spl, bl
cmp esi, 0x63837417
test ax, ax
jmp 0x1402739f1
cmp r8, rax
jmp 0x14022796c
cmovb r8, rdx
jmp 0x140260d4a
je 0x14013f3f5
mov word [rcx], 0
jmp 0x14013f3f5
inc rax
test r11w, r11w
jne 0x14014f191
sub r8, rax
test bl, r8b
cmp rbx, rdi
test r8, r8
je 0x1401ce77f
mov word [r10], 0
and r8w, 0x2eba
movzx eax, word [0x1400b8f10]
shr r8, 0x43
cmp rdx, 0x104
movsx r8d, r10w
movsxd r8, r13d
movsx r8, r14w
mov r8d, 0x104
jmp 0x140252e6d
jne 0x140260d62
sub r8, rdx
cmc
test r8, r8
jmp 0x14019a2fe
mov rax, qword gs:[0x30]
bsf r9w, r11w
mov rax, qword [rax + 0x60]
mov rax, qword [rax + 0x18]
rcr r8b, 0x50
rol r8w, cl
and r11b, 9
mov rax, qword [rax + 0x10]
movzx r8d, word [rax + 0x58]
btc r10d, 0x9b
cmp r8, rdx
cmovae r8, rdx
mov r9, qword [rax + 0x60]
movzx r11, r14w
movzx r11d, word [r9]
adc r10b, sil
rcl r10b, cl
lea r10, [0x1400b8f10]
test r11w, r11w
je 0x1401ce76a
xor eax, eax
cmp bp, 0x4cf5
nop word [rax + rax]
cmc
jmp 0x14014f191
je 0x1401ce773
mov word [r10], r11w
shrd r11w, r14w, 0x10
add r10, 2
movsxd r11, r9d
movzx r11d, word [r9 + rax*2 + 2]
jmp 0x1401ce754
cmovb r8, rdx
test r15b, 4
cmp eax, r15d
test ax, ax
jmp 0x140260d44
je 0x1401e9653
sub edx, edx
add r9b, sil
sub r9b, dil
lea r9, [0x1400b8f10]
test r14w, 0x7979
cmp r14b, r9b
cmp r8, rdx
jmp 0x1400e3cf3
je 0x14020d243
cmp rdx, 0x104
bswap r8w
mov r8d, 0x104
jmp 0x14015cdbc
Function at 0x14019154c
Capabilities:
Enumerate pe sections

Disassembly:
je 0x1401a9319
mov edx, dword [rax + 0xc]
test r12b, bl
cmp r11w, bp
jmp 0x140210384
movsxd r8, dword [rcx + 0x3c]
sub r9d, r9d
add r8, rcx
rcl rax, 0x78
sub r11b, r8b
xadd r10w, r10w
mov r10, rdx
sar r11w, 0x2a
movzx eax, word [r8 + 0x14]
rcl r11b, 0x65
bt r11w, r11w
movzx r11d, word [r8 + 6]
test r14d, 0x57ae73aa
cmp r11, 0x6f8a7410
add rax, 0x18
cmc
add rax, r8
cmc
test r11w, 0x76b0
test r11d, r11d
jmp 0x14010cd18
jb 0x1401a931b
inc r9d
add rax, 0x28
cmp r9d, r11d
jb 0x14010cd1e
xor eax, eax
ret
cmp r10, rdx
jmp 0x14029a794
jb 0x1401a9309
mov ecx, dword [rax + 8]
add ecx, edx
cmp r10, rcx
jmp 0x1401a9303

Function at 0x140209fd0
Capabilities:
Parse pe header

Disassembly:
jmp 0x1404b1a25
sub r8d, r8d
bswap edx
movsx dx, r15b
setne dh
lea edx, [r8 + 2]
jmp 0x140121f99
mov qword [rsp + 8], rbx
rcr rbx, cl
mov dword [rsp + 0x18], r8d
rcl bx, 0xc2
add ebx, 0x54487edc
cmp r15b, al
mov dword [rsp + 0x10], edx
push rbp
bsr rbx, r12
mov rbp, rsp
sub rsp, 0x50
shr bh, cl
shrd bx, r10w, 0x9e
not bl
mov ebx, ecx
cmp bp, bp
test r8d, r8d
jmp 0x1404b1a66
jne 0x1404b1af3
xor ecx, ecx
jmp 0x1404b1a73
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
jmp 0x1404b1a81
je 0x1404b1af3
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1404b1af3
movsxd rcx, dword [rax + 0x3c]
test dx, 0x522d
add rcx, rax
cmc
stc
cmp dword [rcx], 0x4550
jmp 0x1404b1aae
jne 0x1404b1af3
mov eax, 0x20b
test r12b, 0x1e
stc
cmp word [rcx + 0x18], ax
jmp 0x1404b1ac7
jne 0x1404b1af3
cmp dword [rcx + 0x84], 0xe
jbe 0x1404b1af3
cmp dword [rcx + 0xf8], 0
je 0x1404b1af3
mov ecx, ebx
jmp 0x1404b1aee
call fcn.1404b18f4
lea rax, [rbp + 0x18]
mov byte [rbp + 0x28], 0
not cx
mov qword [rbp - 0x20], rax
setl r8b
lea r9, [rbp - 0x2c]
lea rax, [rbp + 0x20]
xchg dx, r8w
not dl
mov qword [rbp - 0x18], rax
movzx edx, r12w
lea r8, [rbp - 0x20]
lea rax, [rbp + 0x28]
mov dx, 0x50fb
mov qword [rbp - 0x10], rax
lea rdx, [rbp - 0x28]
cwde
mov eax, 2
jmp 0x1404b1b40
lea rcx, [rbp - 0x30]
mov dword [rbp - 0x2c], eax
jmp 0x1404b1b4c
mov dword [rbp - 0x28], eax
jmp 0x1404b1b54
call fcn.1404b1cf5
cmp dword [rbp + 0x20], 0
je 0x1404b1b73
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
jmp 0x1404b1b72
ret
mov ecx, ebx
jmp 0x1404b1b7a
call fcn.1404b199e
int3
Function at 0x140275e3d
Capabilities:
Encrypt data using rc4 prga

Disassembly:
dec rcx
stc
test r9b, dl
cmc
cmp al, 0x30
jmp 0x14025735e
je 0x140180482
movzx edx, al
sal eax, cl
btr ax, sp
sbb al, spl
nop dword [rax + rax]
cmove rax, r12
movzx eax, dl
cmc
clc
cmp dl, r9b
jmp 0x14029650d
test al, al
jne 0x140171cfb
inc rcx
jmp 0x1401a42b9
test al, al
je 0x140249266
movzx eax, byte [rcx]
test r15b, 0xb1
test r13b, r13b
test al, al
je 0x14026f7d7
sub al, 0x45
test al, 0xdf
je 0x14026f7d7
movzx eax, byte [rcx + 1]
inc rcx
test ebp, edi
test al, al
jmp 0x14026f7d1
dec rcx
cmp rdi, 0x2c5242fb
cmp al, 0x30
jne 0x140257364
movzx eax, byte [rcx - 1]
jmp 0x140167f21
lea r8, [r8 + 1]
test al, al
jmp 0x140249260
jne 0x140257384
ret
je 0x14021d276
cmp al, r9b
mov rax, rsi
lea rdx, [rcx - 1]
cmovne rdx, rcx
xor al, r9b
movzx eax, bp
sar ah, cl
nop dword [rax]
nop
add ah, bl
movzx eax, byte [r8]
test r8b, r8b
cmc
lea rdx, [rdx + 1]
cmc
cmp si, r13w
mov byte [rdx], al
cmp rsp, rsp
jmp 0x140238c57
jne 0x1401a42d3
movzx eax, byte [rcx - 1]
mov r8, rcx
jmp 0x14021d264
mov rax, qword [rdx]
sub r9d, 0x55435f96
bt edx, 0xad
mov rdx, qword [rax + 0xf8]
movsx r9, si
mov rax, qword [rdx]
movzx r9d, byte [rax]
movzx eax, byte [rcx]
cmp dl, 0x2d
cmc
test al, al
jmp 0x140171ce0
movzx edx, al
clc
jmp 0x14018047a
je 0x140180482
movzx eax, byte [rcx + 1]
not rdx
inc rcx
inc dh
jmp 0x14028cda8
Function at 0x1403bc0c3
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
and al, r10b
push r14
rol ax, 0xf1
test bp, r14w
sub r14w, sp
push r13
push r12
lahf
mov ax, dx
and r14d, ebp
push rsi
rcl r14b, cl
and al, sil
xchg sil, sil
push rdi
push rbx
rcl ax, cl
cdqe
shl si, cl
sub rsp, 0x20
xor eax, r11d
ror r14b, 0xdb
mov rsi, r8
movzx ax, dh
shl bl, 0xc
ror al, cl
mov rdi, rdx
bsr r14w, si
mov r14, rcx
bsr ax, r11w
add bl, 0x49
mov rbx, qword [rcx]
rcr ax, 0xe5
mov rcx, qword [rcx + 0x10]
rcr ax, 0x86
sub rcx, rbx
sar rcx, 4
bts ax, r8w
cmp r15b, 0x57
btc ax, 0xbe
movabs rax, 0xf0f0f0f0f0f0f0f1
cmp bl, r14b
imul rcx, rax
test rdx, rdi
cmp rcx, r8
jmp 0x1403bc15f
jae 0x1403bc1c2
mov rcx, r14
xchg edx, edx
mov rdx, rsi
jmp 0x1403bc172
call fcn.1403bc3a0
mov rbx, qword [r14]
nop word [rax + rax]
mov cx, r14w
cwd
mov rcx, rbx
movzx dx, r12b
not dh
movzx edx, bp
mov rdx, rdi
call fcn.1403bcc07
add rbx, 0x110
cmp r15b, spl
add rdi, 0x110
dec rsi
jmp 0x1403bc1b7
jne 0x1403bc189
jmp 0x1403bc35f
mov r13, qword [r14 + 8]
not r15d
sal r15b, 0xa3
mov r12, r13
cmc
rol r15d, 0x71
movsx r15d, r11w
sub r12, rbx
sbb r15b, bl
sar r12, 4
bts r15w, r12w
rol r15, 0x74
sar r15b, cl
imul r12, rax
movzx r15w, bpl
shl r15b, cl
movsx r15, sp
mov r15, r12
sub r15, rsi
jmp 0x1403bc20a
jae 0x1403bc2cc
cmp rbx, r13
je 0x1403bc26a
nop word cs:[rax + rax]
movsx rdx, di
mov rcx, rbx
movsxd rdx, edi
mov dl, r10b
movzx edx, r11w
mov rdx, rdi
jmp 0x1403bc240
call fcn.1403bc685
add rbx, 0x110
test r9w, 0x55bf
clc
add rdi, 0x110
stc
cmp rbx, qword [r14 + 8]
jmp 0x1403bc264
jne 0x1403bc22b
cmp rsi, r12
jmp 0x1403bc272
je 0x1403bc35f
nop dword [rax + rax]
movsx rcx, dx
cqo
movsx ecx, sp
mov rcx, rbx
movzx rdx, r9w
cmovp dx, r12w
mov rdx, rdi
jmp 0x1403bc29d
call fcn.1403bcc07
add rbx, 0x110
test r9b, 0xdc
add rdi, 0x110
jmp 0x1403bc2b9
inc r15
jmp 0x1403bc2c1
jne 0x1403bc289
jmp 0x1403bc35f
imul r15, rsi, 0x110
cmp bpl, bpl
add r15, rbx
cmc
cmp r14w, 0x3c6f
test rsi, rsi
je 0x1403bc31f
nop
mov rcx, rbx
mov rdx, rdi
jmp 0x1403bc2f5
call fcn.1403bc685
add rbx, 0x110
clc
cmp bh, 0x50
add rdi, 0x110
dec rsi
jne 0x1403bc2ea
mov r13, qword [r14 + 8]
cmp rbx, rbx
test r13d, r10d
cmp r15, r13
jmp 0x1403bc327
je 0x1403bc355
mov rsi, r15
movzx rcx, bp
nop word [rax + rax]
xchg rcx, rcx
mov rcx, rsi
call fcn.1403b6ad1
add rsi, 0x110
cmp rsi, r13
jne 0x1403bc33d
mov rbx, r15
rcl si, 0xd3
movsxd rsi, r11d
mov qword [r14 + 8], rbx
or r14w, sp
add rsp, 0x20
jmp 0x1403bc374
pop rbx
pop rdi
movsx r15w, r13b
movzx si, bl
pop rsi
movsx r12, r13w
pop r12
movzx r13, ax
pop r13
movsx r15, ax
xchg r14b, r14b
pop r14
movsxd r15, r9d
pop r15
jmp 0x1403bc39f
ret
Function at 0x1403cda17
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
or r15, rcx
stc
ror r15d, 0xd9
push r14
push r13
btr r14w, 0x85
ror r13d, cl
test bx, r12w
push r12
bt r12d, r11d
inc r14
push rsi
ror esi, 0xb0
push rdi
movzx r15d, bp
push rbx
rcr sil, cl
sub rsp, 0x30
movaps xmmword [rsp + 0x20], xmm6
sar esi, 0xa9
sal sil, 0x24
mov r15, r9
mov r12b, r9b
shr rsi, 0x5a
rcr r12, cl
mov r12, r8
movzx r13d, bp
add r14w, 0x68c2
ror r14b, cl
mov r14, rdx
bt r13w, r9w
cmc
mov r13, rcx
mov rsi, qword [rcx]
test r13, r14
test rsi, rsi
je 0x1403cdbb9
mov rbx, qword [r13 + 8]
test rsp, 0x56172ecb
cmp rsi, rbx
je 0x1403cdb6e
movaps xmm6, xmmword [0x1400bd3f0]
jmp 0x1403cdab0
jmp 0x1403cdadc
call fcn.140267d8d
movups xmmword [rsi + 0x10], xmm6
mov word [rsi], 0
cmp r14w, bp
cmp cl, 0x64
clc
add rsi, 0x20
cmc
test r8b, bpl
cmp rsi, rbx
je 0x1403cdb67
mov rax, qword [rsi + 0x18]
test r11, 0x5f490c9d
cmc
stc
cmp rax, 8
jmp 0x1403cdaf2
jb 0x1403cdaba
mov rcx, qword [rsi]
add rdx, 0x19854d85
mov dl, r8b
cdq
lea rdx, [rax + rax]
test cx, ax
add rdx, 2
cmc
cmp rdx, 0x1000
jmp 0x1403cdb1e
jb 0x1403cdab5
mov rdi, qword [rcx - 8]
stc
jmp 0x1403cdb2e
add rcx, 0xfffffffffffffff8
clc
sub rcx, rdi
cmp rcx, 0x20
jmp 0x1403cdb3f
jae 0x1403cdc41
lea rax, [rax + rax]
movzx rdx, cx
movsx rdx, sp
add rax, 0x29
mov rdx, rax
not ch
mov rcx, rdi
jmp 0x1403cdb62
jmp 0x1403cdab5
mov rsi, qword [r13]
xor rdx, r8
mov rdx, qword [r13 + 0x10]
sub rdx, rsi
cmp rdx, 0x1000
jb 0x1403cdbac
mov rax, qword [rsi - 8]
stc
cmp spl, r10b
add rsi, 0xfffffffffffffff8
sub rsi, rax
stc
cmp rsi, 0x20
jae 0x1403cdc41
add rdx, 0x27
mov rsi, rax
bswap rcx
movsxd rcx, r11d
movzx ecx, bx
mov rcx, rsi
jmp 0x1403cdbb4
call fcn.140267d8d
mov qword [r13], r14
cmc
shl r12, 5
add bx, r14w
rol sil, 0xb7
lea r12, [r12 + r14]
xchg esi, ebx
test dh, 0x70
mov qword [r13 + 8], r12
shl r15, 5
shrd bx, r8w, 3
lea r15, [r15 + r14]
movsx r14d, r11w
cmp r11w, 0x5f88
mov qword [r13 + 0x10], r15
cmovno r15d, r15d
btc ebx, 0xa9
movaps xmm6, xmmword [rsp + 0x20]
add rsp, 0x30
movsxd rbx, r11d
not r12b
pop rbx
movsx esi, r15w
movsx rsi, bp
xchg r13b, r14b
pop rdi
movsx esi, r15w
xchg esi, r14d
pop rsi
mov r14b, 0xdf
pop r12
movsx r14w, r13b
jmp 0x1403cdc32
pop r13
movzx r15d, ax
movzx r14, bx
pop r14
pop r15
ret
call fcn.1404b6b98
int3
Function at 0x1403d6bc8
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r14
sal ah, cl
rcr ax, 0x40
bswap rax
push rsi
push rdi
sbb sil, bpl
movsx eax, cx
push rbx
jmp 0x1403d6be1
sub rsp, 0x28
cbw
movzx ax, spl
dec ax
mov rsi, rcx
mov eax, 0x310d676a
neg ax
cmp r9b, dil
lea rax, fcn.140010f00
stc
cmp r12w, cx
mov qword [rcx], rax
bsr rax, r8
lea rax, fcn.140010f00
cmp bl, dh
stc
mov qword [rcx + 0x50], rax
cmp sil, bpl
jmp 0x1403d6c26
mov rcx, qword [rcx + 0xa0]
stc
cmp r12b, 0x7d
test rcx, rcx
jmp 0x1403d6c3a
je 0x1403d6cc9
mov rdx, qword [rsi + 0xb0]
cmc
cmp r12b, 0x9b
sub rdx, rcx
stc
cmp rdx, 0x1000
jmp 0x1403d6c5c
jb 0x1403d6ca4
mov rax, qword [rcx - 8]
test r8d, 0x54e22a72
test cx, r13w
add rcx, 0xfffffffffffffff8
cmc
sub rcx, rax
test edx, 0xd650256
clc
jmp 0x1403d6c85
cmp rcx, 0x20
jmp 0x1403d6c8e
jae 0x1403d6dcd
add rdx, 0x27
not ecx
mov rdi, r12
mov rcx, rax
seto dil
lea rdi, [rsi + 0xa0]
call fcn.140267d8d
xorps xmm0, xmm0
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], 0
cmp spl, bl
bts di, bp
rol dil, 0x59
mov rdi, qword [rsi + 0x60]
test rdi, rdi
jmp 0x1403d6cd5
je 0x1403d6d9e
lea r14, [rsi + 0x60]
xor bx, bx
cmp rsi, 0x77243387
movzx ebx, r15w
mov rbx, qword [rsi + 0x68]
cmp rdi, rbx
je 0x1403d6d28
nop dword [rax]
movzx ecx, r10w
movsxd rcx, r13d
mov rcx, rdi
call fcn.1403b6ad1
add rdi, 0x110
cmp rdi, rbx
jmp 0x1403d6d1c
jne 0x1403d6d05
mov rdi, qword [r14]
movzx edx, bx
mov rdx, qword [rsi + 0x70]
sub rdx, rdi
cmp dh, 0x23
test cl, r11b
cmp rdx, 0x1000
jb 0x1403d6d80
mov rax, qword [rdi - 8]
test r11b, dl
add rdi, 0xfffffffffffffff8
cmp sil, 0x11
test r11b, bpl
sub rdi, rax
test bh, 0x4d
test r13w, bp
cmp rdi, 0x20
jmp 0x1403d6d67
jae 0x1403d6dcd
add rdx, 0x27
movsx rdi, r8w
mov rdi, rax
movzx ecx, r15w
movzx rcx, ax
mov rcx, rdi
call fcn.140267d8d
xorps xmm0, xmm0
movups xmmword [r14], xmm0
mov qword [r14 + 0x10], 0
jmp 0x1403d6d9e
mov rcx, rsi
rcr sil, cl
shr bh, cl
sar bx, cl
add rsp, 0x28
bswap rdi
pop rbx
mov sil, r12b
pop rdi
seto r14b
movzx r14d, cx
xchg sil, sil
pop rsi
pop r14
jmp 0x1403d6dc8
jmp fcn.1404412ad
call fcn.1404b6b98
int3
Function at 0x1403e0902
Capabilities:
Check for software breakpoints

Disassembly:
push rsi
clc
cmp bpl, 0xb5
push rdi
cmovle r9, r9
push rbx
mov r9, rcx
btr r10w, r10w
add r10b, r9b
add r8, rdx
jmp 0x1403e0921
mov dword [rcx + 8], 0
sub eax, eax
sete r10b
xor ecx, ecx
movzx r10, r15w
nop word cs:[rax + rax]
bswap r10w
lea r10, [rdx + 1]
cmp r13b, dl
stc
cmp r10, r8
ja 0x1403e0b78
movzx edi, byte [rdx]
bts edx, r13d
sub dx, bp
mov edx, edi
clc
and edx, 0x7f
shl rdx, cl
cmc
add rax, rdx
movsx edx, r14w
add rcx, 7
bts edx, ecx
mov rdx, r10
test dil, dil
js 0x1403e0944
mov rcx, rax
cmc
cmp r14b, 0x27
and rcx, 0xfffffffffffffff8
and eax, 7
cmc
cmp ax, 0x740e
cmp rcx, 8
jmp 0x1403e09a0
je 0x1403e0aca
cmp rax, 1
jmp 0x1403e09af
jg 0x1403e09da
test rax, rax
je 0x1403e0a7a
cmp eax, 1
jmp 0x1403e09c6
jne 0x1403e0b78
lea rdx, [r10 + 8]
jmp 0x1403e09d5
jmp 0x1403e0ab4
cmp eax, 5
jmp 0x1403e09e2
je 0x1403e0aac
cmp eax, 2
jmp 0x1403e09f0
jne 0x1403e0b78
mov rsi, r10
xor edi, edi
sub ecx, ecx
nop word cs:[rax + rax]
lea rax, [rsi + 1]
cmp rax, r8
ja 0x1403e0b78
mov r11, rdi
and dl, r12b
cmp rcx, r15
movzx ebx, byte [rsi]
shl dx, 0xfa
cmp sp, 0x365d
cmp si, sp
mov edx, ebx
btc rsi, 0x5b
rol sil, cl
and edx, 0x7f
shl rdx, cl
movsxd rsi, r12d
lea rdi, [rdi + rdx]
add rcx, 7
mov rsi, rax
test bl, bl
jmp 0x1403e0a52
js 0x1403e0a08
lea rdx, [rdx + r11]
test r9w, r12w
clc
jmp 0x1403e0a66
add rdx, rax
cmp rdx, r8
cmova rdx, rax
jmp 0x1403e0a75
jmp 0x1403e0928
mov rax, r10
stc
nop
btc dx, r11w
movzx rdx, r11w
lea rdx, [rax + 1]
cmp rdx, r8
ja 0x1403e0b78
cmp byte [rax], 0
mov rax, rdx
jmp 0x1403e0aa1
js 0x1403e0a89
jmp 0x1403e0928
lea rdx, [r10 + 4]
test r8b, 0x4a
cmp rdx, r8
jmp 0x1403e0abc
cmova rdx, r10
jmp 0x1403e0ac5
jmp 0x1403e0928
cmp eax, 2
jne 0x1403e0b78
mov dword [r9 + 8], 2
sar sil, cl
mov rsi, r10
cdq
adc dl, sil
sub eax, eax
setnp dh
sub ecx, ecx
cmp r9d, 0x6a616921
bt dx, 0x6a
nop word [rax + rax]
lea rdx, [rsi + 1]
clc
jmp 0x1403e0b08
cmp rdx, r8
jmp 0x1403e0b10
ja 0x1403e0b78
movzx r11d, byte [rsi]
mov edi, r11d
and edi, 0x7f
rcr si, cl
shl si, cl
and sil, spl
shl rdi, cl
adc si, 0x2b77
rcl sil, 0xc4
add rax, rdi
cmp al, 0xcc
add rcx, 7
rol sil, cl
mov rsi, rdx
test spl, 0xb0
test r11b, r11b
jmp 0x1403e0b50
js 0x1403e0afe
mov qword [r9 + 0x10], rdx
cmc
mov qword [r9 + 0x18], rax
test spl, bl
lea rdx, [rdx + rax]
jmp 0x1403e0b6f
cmp rdx, r8
jbe 0x1403e0928
cmp r10, r8
bswap si
movzx rbx, r13w
seta al
setb sil
movzx di, sil
pop rbx
not dil
pop rdi
seto sil
mov sil, 0xef
movsxd rsi, r8d
pop rsi
ret