joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1401a2bed
Capabilities:
Parse pe header

Disassembly:
sub r8d, r8d
lea edx, [r8 + 2]
jmp 0x1401f9cf8
jmp 0x1404afd68
mov qword [rsp + 8], rbx
sub bx, sp
shld bx, r13w, 0x16
cmc
mov dword [rsp + 0x18], r8d
rcl bh, 0x84
sal bx, 0x76
neg bx
mov dword [rsp + 0x10], edx
and ebx, 0x5f4e373a
push rbp
movsx rbx, r8w
or ebx, esi
mov rbp, rsp
and bl, 0x61
sal bh, cl
rol bl, 0x12
sub rsp, 0x50
bswap bx
clc
movsx bx, r15b
mov ebx, ecx
stc
test r8d, r8d
jmp 0x1404afdba
jne 0x1404afe54
sub ecx, ecx
jmp 0x1404afdc7
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
jmp 0x1404afdd5
je 0x1404afe54
mov ecx, 0x5a4d
stc
test bpl, 0xeb
cmc
cmp word [rax], cx
jmp 0x1404afdee
jne 0x1404afe54
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
test ebx, r11d
test cl, 0xc5
cmp dword [rcx], 0x4550
jmp 0x1404afe0c
jne 0x1404afe54
mov eax, 0x20b
cmp si, bp
cmp word [rcx + 0x18], ax
jmp 0x1404afe23
jne 0x1404afe54
cmp dword [rcx + 0x84], 0xe
jmp 0x1404afe35
jbe 0x1404afe54
cmp dword [rcx + 0xf8], 0
jmp 0x1404afe47
je 0x1404afe54
mov ecx, ebx
call fcn.1404afc47
lea rax, [rbp + 0x18]
mov byte [rbp + 0x28], 0
xchg dx, r9w
mov qword [rbp - 0x20], rax
cdq
lea r9, [rbp - 0x2c]
lea rax, [rbp + 0x20]
seto ch
mov qword [rbp - 0x18], rax
movsx r8w, bl
movsx edx, r11w
lea r8, [rbp - 0x20]
setno al
lea rax, [rbp + 0x28]
movsx cx, dil
movzx ecx, r15w
jmp 0x1404afe96
mov qword [rbp - 0x10], rax
lea rdx, [rbp - 0x28]
cwde
cmovae rcx, r14
movzx rcx, bp
mov eax, 2
movsx rcx, bp
not ch
lea rcx, [rbp - 0x30]
jmp 0x1404afebb
mov dword [rbp - 0x2c], eax
jmp 0x1404afec3
mov dword [rbp - 0x28], eax
jmp 0x1404afecb
call fcn.1404b0075
cmp dword [rbp + 0x20], 0
jmp 0x1404afed9
je 0x1404afef2
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
mov bpl, r13b
pop rbp
jmp 0x1404afef1
ret
mov ecx, ebx
jmp 0x1404afef9
call fcn.1404afcdb
int3

Function at 0x1401f9d1c
Capabilities:
Encrypt data using speck
Resolve function by parsing pe exports

Disassembly:
jmp 0x140444a8c
mov rcx, qword [rcx]
jmp 0x140132ebd
push rsi
push rdi
sbb si, bp
movsxd rsi, ebx
sub rsp, 0x28
rol al, cl
inc sil
rol al, 0x22
mov rsi, rcx
movsx ax, bpl
sar ax, 0x18
cdqe
mov rcx, qword [rcx + 0x18]
mov ax, 0x28da
neg al
clc
mov rax, qword [rcx]
cmc
test r15b, cl
cmp dl, dil
xor edx, edx
sub r8d, r8d
jmp 0x140444acd
call qword [rax + 0x188]
mov edi, eax
movsx ecx, r14w
lea rcx, [rsi + 0x30]
jmp 0x140444ae2
call fcn.140458943
test edi, edi
jmp 0x140444aee
je 0x140444b18
cmp edi, 0x8899000c
jne 0x140444b34
mov rcx, rsi
add rsp, 0x28
not dil
xchg esi, edi
pop rdi
pop rsi
jmp 0x140444b13
jmp fcn.140444721
nop
shld edi, r12d, 0x83
add rsp, 0x28
movzx di, r8b
xchg dil, sil
movsxd rsi, edx
pop rdi
cmovo rsi, rsp
pop rsi
ret
mov ecx, edi
and dl, r10b
movabs r8, 0xad4a5352d2edebd0
bt r9w, 0x4e
movzx r9, ax
mov dl, 3
cmp r8b, sil
mov r9d, 0x54
add si, 0x19d7
xchg edi, esi
bt esi, r15d
add rsp, 0x28
setg dil
pop rdi
not sil
xchg si, si
pop rsi
jmp fcn.1403ae3a8
Function at 0x1402152bd
Capabilities:
Parse pe header

Disassembly:
xor edx, edx
sub r8, 0x3e01082c
rcr r8b, 0x4f
sub ecx, ecx
movsx r8w, r8b
movzx r8, sp
bswap r8d
lea r8d, [rdx + 1]
jmp 0x1404afd68

Function at 0x14021ae27
Capabilities:
Parse pe header

Disassembly:
jmp 0x1404afd68
xor r8d, r8d
xor edx, edx
jmp 0x1401fb428
Function at 0x14024f60d
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov rax, qword [rsp + 8]
add r8w, r11w
shld r8w, dx, 0x8c
sub r8, r15
mov ecx, 0x7ff0
clc
mov r8, rax
cmp ebp, 0x25b87103
shr r8, 0x30
clc
test sil, 0x6d
test cx, r8w
jmp 0x14025ca90
jmp 0x1401c28fb
movsd xmm0, qword [rsp + 8]
jmp 0x1401db553
jne 0x1401e6ee8
mov eax, dword [rsp + 0xc]
add eax, eax
mov dword [rsp + 0xc], eax
test r13d, ecx
test edx, edx
jmp 0x1401e6ec1
movsd qword [rsp + 8], xmm0
jmp 0x14022399d
comisd xmm0, xmm1
seta r9b
cmp r10b, 0xa4
test r8b, 0x10
jmp 0x140105d15
mov word [rsp + 0xe], ax
jmp 0x1401029c0
mov dword [r10], ecx
jmp 0x140253515
jmp 0x1401c28fb
jns 0x1401e6ecf
or eax, 1
mov dword [rsp + 0xc], eax
cmc
add edx, edx
dec ecx
test byte [rsp + 0xe], 0x10
je 0x140105d1f
mov dword [rsp + 8], edx
shld ax, r14w, 0xbc
movzx eax, word [rsp + 0xe]
adc dh, 0x96
shr dx, 0x54
not dh
mov edx, 0xffef
clc
cmc
and ax, dx
test cx, r12w
cmp rbp, rbx
mov word [rsp + 0xe], ax
cmc
test r9d, r9d
jmp 0x14020a904
jne 0x1401ffb3a
test edx, edx
je 0x14020fb3f
sub r9d, r9d
mov cx, bx
mov ecx, 0xfffffc03
jmp 0x1401201ca
je 0x14020a91f
mov edx, 0x8000
or ax, dx
mov word [rsp + 0xe], ax
bsf rdx, r14
bts rax, r14
movsd xmm0, qword [rsp + 8]
rcr rax, cl
mov edx, 0xbfef
sal rax, 0xea
rcr ah, cl
rcl al, cl
movsd qword [rsp + 0x10], xmm0
mov rax, qword [rsp + 0x10]
shr rax, 0x30
and ax, dx
add dx, cx
rcr dx, cl
movsd qword [rsp + 8], xmm0
cwd
or dx, 0x6fe3
mov edx, 0x3fe0
stc
test dil, sil
cmc
or ax, dx
jmp 0x1401be2ec
movzx ecx, word [rsp + 0xe]
mov edx, 0xbfef
and eax, eax
add ah, 0x3b
shr ecx, 4
shld eax, r13d, 0xd5
movsd qword [rsp + 0x10], xmm1
xor al, spl
bsr ax, cx
btc ax, 0xbc
and ecx, 0x7ff
movzx ax, r13b
add al, spl
movsd qword [rsp + 0x18], xmm1
bsf rax, r15
movzx rax, sp
movsx rax, r14w
mov rax, qword [rsp + 0x18]
clc
shr rax, 0x30
and ax, dx
mov edx, 0x3fe0
test r9w, si
clc
or ax, dx
mov word [rsp + 0x16], ax
cmp r14b, al
sub ecx, 0x3fe
jmp 0x140231632
xorps xmm0, xmm0
mov r10, rdx
jmp 0x140265626
movsd xmm0, qword [rsp + 0x10]
jmp 0x1401c28fb
movaps xmm1, xmm0
jmp 0x14010a3b4
ret
jne 0x14020fb3f
mov edx, dword [rsp + 8]
cmp r9b, 0xec
cmp r12w, r12w
shr rax, 0x20
clc
test eax, 0xfffff
jmp 0x1401ffb2c
ucomisd xmm1, xmm0
jp 0x1400e0238
jne 0x1400e0238
xor ecx, ecx
jmp 0x1400f2bbe
Function at 0x140274d21
Capabilities:
Encrypt data using rc4 prga

Disassembly:
dec rcx
cmc
test r11w, r8w
clc
cmp al, 0x30
je 0x140166fc6
cmp al, r9b
movsx edx, ax
movsx dx, spl
lea rdx, [rcx - 1]
bswap eax
setle al
movzx eax, di
cmovne rdx, rcx
xor ax, r8w
shl eax, cl
nop dword [rax]
movzx eax, byte [r8]
cmp bp, 0x5fe2
jmp 0x140184d10
jne 0x14010bf81
inc rcx
test al, al
jmp 0x14028c8b8
je 0x140105d0b
movzx edx, al
inc eax
nop dword [rax + rax]
movzx eax, dl
stc
cmp dl, r9b
jmp 0x14015d54c
jne 0x1400e72fd
ret
je 0x140105d0b
movzx eax, byte [rcx + 1]
dec dh
bswap edx
setae dh
inc rcx
sets dl
movzx edx, al
test al, al
jmp 0x140105d05
jne 0x1400e72d5
movzx eax, byte [rcx - 1]
jmp 0x1400e72c4
lea rdx, [rdx + 1]
test ebx, ecx
stc
mov byte [rdx], al
lea r8, [r8 + 1]
test al, al
jmp 0x140126741
jne 0x14028c8cb
movzx eax, byte [rcx - 1]
movsx r8w, r10b
setle r8b
mov r8, rcx
jmp 0x14020f2e4
je 0x1401a7737
movzx eax, byte [rcx + 1]
inc rcx
cmc
test bpl, dil
test al, al
jmp 0x1401a7731
dec rcx
cmc
cmp al, 0x30
jmp 0x140166fc0
mov rax, qword [rdx]
sbb dl, r13b
mov rdx, qword [rax + 0xf8]
btc ax, r9w
mov rax, qword [rdx]
movzx r9d, byte [rax]
movsx ax, bpl
rol ah, 0xf6
movzx eax, byte [rcx]
test rbx, r11
cmc
test al, al
jmp 0x14010bf71
je 0x140126747
movzx eax, byte [rcx]
clc
stc
test al, al
je 0x1401a7737
sub al, 0x45
cmp r10b, r13b
cmp rsp, 0x4a107009
test esi, 0x540a5999
test al, 0xdf
jmp 0x1401cde3b

Function at 0x14028e8d0
Capabilities:
Parse pe header

Disassembly:
jne 0x1401e95d0
movsxd rdx, dword [rcx + 0x3c]
lea rdx, [rdx + rcx]
cmc
cmp dword [rdx], 0x4550
jmp 0x140120ccc
jne 0x1401e95d0
sub eax, eax
adc ch, 0x93
sal al, cl
sar al, cl
mov ecx, 0x20b
rcl al, 0xe
cmp word [rdx + 0x18], cx
sete al
jmp 0x1401ba249
ret
xor eax, eax
ret
mov eax, 0x5a4d
cmp r8b, 0xb
cmp word [rcx], ax
jmp 0x1400f1ce4
Function at 0x14039c0a2
Capabilities:
Execute anti-debugging instructions

Disassembly:
push rdi
push rsi
mov sil, 0x19
cmovs rdi, r15
cwd
push r14
rdtsc
cbw
movzx ax, r13b
push rbp
cwde
push r12
pushfq
rol dl, cl
bsr bp, r11w
push r11
adc sil, sil
push rbx
mov r10w, 0x4b94
sar ax, cl
movabs rdx, 0
rcl bpl, cl
xor sil, 0x17
push rdx
mov rsi, qword [rsp + 0x90]
rol edi, cl
xor esi, 0x4179067f
cdqe
ror esi, 1
neg ax
sub r10b, r14b
sbb bl, r12b
xor esi, 0x218e387c
jmp 0x1403312d1
dec eax
cmp esi, 0x4965619a
bswap eax
cmp dh, 0x36
add eax, 0x1d2a162b
jmp 0x14031bd65
jmp r10
push rax
movzx eax, r9w
push r10
push rdx
push r9
not dx
cqo
movzx r10d, bp
push rcx
movsx ax, ah
rdtsc
push r13
cmove dx, bx
jmp 0x1402af3e3
push rbx
add bl, 0x30
btc ebx, edx
stc
xor dword [rsp], eax
ror bx, 0x80
pop rbx
cmp bx, 0x605c
test ecx, 0x344e2807
movsxd rax, eax
add r10, rax
jmp 0x1402d1f0e
dec esi
shr r11w, 0x8e
sar dil, cl
xor esi, 0x20c06096
dec bp
movzx r11w, r13b
dec esi
lea rsi, [rsi + rdx]
rcl r10b, cl
movsx rax, r15w
movabs r11, 0x100000000
cbw
add rsi, r11
mov rdi, rsp
btr ax, 0xd
movsx r10d, r14w
ror ebp, cl
sub rsp, 0x180
add ax, 0x1c91
and rsp, 0xfffffffffffffff0
cwde
and bl, r8b
xadd r10w, bp
mov rbx, rsi
cdqe
btc bp, r9w
movabs rbp, 0
test dil, bl
sub rbx, rbp
lea r10, [0x140331348]
sub rsi, 4
mov eax, dword [rsi]
xor eax, ebx
xor eax, 0x6aa83e03
jmp 0x1402c4085
push r8
jmp 0x1402d2fc2
push r15
jmp 0x14034023a
Function at 0x1403b8ddb
Capabilities:
Encrypt data using speck

Disassembly:
push r15
sbb r15w, r14w
xor r10b, spl
neg r15b
push r14
or r15b, cl
movzx r15, ax
push r13
cmp bh, 0x1a
rcr r10d, cl
push r12
movzx r15, r12w
movzx r10w, sil
inc r12b
push rsi
btc r12w, r15w
test ch, 0xda
movsx r15d, r10w
push rdi
sar r10w, cl
push rbp
bswap r10w
push rbx
or r10b, r15b
sub rsp, 0x78
shl r12b, cl
or r15, rdx
movaps xmmword [rsp + 0x60], xmm6
test bpl, r14b
movsx r10w, r10b
mov r12, r8
cmc
bswap r8
shr r15w, 0xc8
mov rbx, rdx
btc r10w, si
mov r15, rcx
bt r10w, sp
sal r8, cl
btc r10w, 0xa7
add r12, rdx
sal r8b, 0xe4
mov dword [rcx + 8], 0
or r8b, r11b
ror r10b, 0xe0
xchg r8d, r8d
lea r10, [rcx + 0x30]
ror r8b, cl
adc r8, 0x236d4294
lea r8, [rcx + 0x10]
jmp 0x1403b8e8d
sub eax, eax
jmp 0x1403b8e94
xorps xmm6, xmm6
lea r9, [rsp + 0x30]
movzx r14d, di
mov r13d, 0x16
and r14, r13
rol r14b, 0xf9
adc r14b, al
Function at 0x1403c9b64
Capabilities:
Encode data using base64
Encrypt data using rc4 prga

Disassembly:
push r14
bsf ax, ax
sbb ax, bx
rcl al, cl
push rsi
adc sil, r10b
clc
rol ax, 0xd
push rdi
rcl sil, cl
shrd si, r8w, 0x5a
movzx rax, r12w
push rbx
bt si, 0xee
cmovne si, r11w
seto sil
sub rsp, 0x28
rcr ah, cl
ror si, 0xe7
dec rsi
mov rsi, rcx
lea rax, [0x1400be400]
mov qword [rcx], rax
test r12b, 0x2a
cmp di, 0x534
mov rcx, qword [rcx + 0xa8]
cmp r11w, 0x123b
test sp, bx
test rcx, rcx
jmp 0x1403c9bd0
je 0x1403c9c12
lea rax, [rsi + 0x70]
cmp dil, 0x26
cmp rcx, rax
cwde
jmp 0x1403c9be9
setne dl
movsx eax, di
movzx rax, bx
lahf
mov rax, qword [rcx]
jmp 0x1403c9bfc
call qword [rax + 0x20]
mov qword [rsi + 0xa8], 0
sub di, 0x3d7
sub rdi, rcx
mov rdi, qword [rsi + 0x58]
stc
test rdi, rdi
jmp 0x1403c9c1f
je 0x1403c9cef
lea r14, [rsi + 0x58]
sal bh, cl
shl bl, 0xe2
cmp rax, 0x51dc56ba
mov rbx, qword [rsi + 0x60]
test r10w, 0x74c0
clc
cmp rdi, rbx
jmp 0x1403c9c48
je 0x1403c9c7f
nop word cs:[rax + rax]
movzx ecx, bx
mov rcx, rdi
jmp 0x1403c9c66
call fcn.1403c9e6a
add rdi, 0x60
cmc
cmp rdi, rbx
jne 0x1403c9c5e
mov rdi, qword [r14]
rcr dl, 0xdc
mov rdx, qword [rsi + 0x68]
cmp r12b, 0x3f
cmc
sub rdx, rdi
jmp 0x1403c9c97
cmp rdx, 0x1000
jmp 0x1403c9ca3
jb 0x1403c9ccc
mov rax, qword [rdi - 8]
add rdi, 0xfffffffffffffff8
cmc
jmp 0x1403c9cb7
sub rdi, rax
stc
cmp rdi, 0x20
jae 0x1403c9e5f
add rdx, 0x27
mov rdi, rax
mov rcx, rdi
jmp 0x1403c9cd4
call fcn.140197518
xorps xmm0, xmm0
movups xmmword [r14], xmm0
mov qword [r14 + 0x10], 0
movsx rdi, bp
shl edi, 0x3d
lea rax, [0x1400bdb70]
clc
bsr di, dx
mov qword [rsi], rax
test sil, 0x2d
adc bx, 0x142b
mov rdi, qword [rsi + 0x40]
sal bh, cl
inc bh
mov rbx, qword [rsi + 0x48]
test r10b, r15b
cmc
cmp rdi, rbx
jmp 0x1403c9d1f
jne 0x1403c9d46
jmp 0x1403c9d93
add rdi, 8
cmp r9w, 0x5d47
clc
test r13b, al
cmp rdi, rbx
jmp 0x1403c9d40
je 0x1403c9d76
mov rcx, qword [rdi]
stc
test rcx, rcx
jmp 0x1403c9d52
je 0x1403c9d2a
mov rax, qword [rcx]
movzx dx, r8b
movzx rdx, bx
cwd
mov edx, 1
call qword [rax + 0xb8]
jmp 0x1403c9d2a
mov rdi, qword [rsi + 0x40]
cmc
jmp 0x1403c9d80
cmp rdi, qword [rsi + 0x48]
jmp 0x1403c9d89
je 0x1403c9d93
mov qword [rsi + 0x48], rdi
test rdi, rdi
jmp 0x1403c9d9b
je 0x1403c9e47
mov rdx, qword [rsi + 0x50]
test rsp, r11
clc
sub rdx, rdi
test bl, r10b
jmp 0x1403c9db4
cmp rdx, 0x1000
jmp 0x1403c9dc0
jb 0x1403c9e05
mov rax, qword [rdi - 8]
cmp r13w, r8w
add rdi, 0xfffffffffffffff8
cmc
jmp 0x1403c9ddb
sub rdi, rax
jmp 0x1403c9de3
cmp rdi, 0x20
jae 0x1403c9e5f
add rdx, 0x27
shl rcx, 0x46
bt edi, r15d
bsr cx, r14w
mov rdi, rax
btc cx, dx
add rsi, 0x40
movzx cx, r11b
movzx ecx, r9w
movsx cx, r9b
mov rcx, rdi
jmp 0x1403c9e1f
call fcn.140197518
xorps xmm0, xmm0
movups xmmword [rsi], xmm0
xor bx, 0x481a
ror bx, 0xe6
setp r14b
mov qword [rsi + 0x10], 0
shr r14w, 0x5e
sal rdi, cl
add rsp, 0x28
cmovns si, r13w
xchg di, r14w
pop rbx
pop rdi
pop rsi
cmovnp r14w, r13w
pop r14
ret
call fcn.1404b4f8e
int3
Function at 0x1403cc0d3
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
xor r15w, r8w
xor r15w, 0x2912
push r14
sar r14b, cl
push r13
inc r15
push r12
test r10, 0x658d15f8
push rsi
neg r14b
push rdi
shl r13w, 0x4f
push rbx
sub rsp, 0x30
cmp di, r14w
movsx si, bpl
movaps xmmword [rsp + 0x20], xmm6
rcl r14b, 0xf6
rcr r15b, cl
btr r15w, 0x5f
mov r15, r9
sal sil, cl
inc sil
mov r12, r8
jmp 0x1403cc131
mov r14, rdx
mov r13, rcx
mov rsi, qword [rcx]
test bpl, 0x37
test rsi, rsi
jmp 0x1403cc146
je 0x1403cc289
mov rbx, qword [r13 + 8]
cmp r15w, r10w
cmp rsi, rbx
jmp 0x1403cc15c
je 0x1403cc21e
movaps xmm6, xmmword [0x1400bd3f0]
jmp 0x1403cc199
call fcn.140197518
movups xmmword [rsi + 0x10], xmm6
test edi, r15d
cmc
mov word [rsi], 0
cmc
stc
test si, 0x173a
add rsi, 0x20
cmp rsi, rbx
jmp 0x1403cc193
je 0x1403cc21a
mov rax, qword [rsi + 0x18]
cmp sil, 0x7f
cmp rax, 8
jmp 0x1403cc1aa
jb 0x1403cc173
mov rcx, qword [rsi]
lea rdx, [rax + rax]
cmp rcx, r10
add rdx, 2
stc
cmp rdx, 0x1000
jmp 0x1403cc1cb
jb 0x1403cc16e
mov rdi, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
test r8b, 0x7a
clc
sub rcx, rdi
jmp 0x1403cc1e6
cmp rcx, 0x20
jmp 0x1403cc1ef
jae 0x1403cc314
lea rax, [rax + rax]
ror ch, cl
sbb dh, al
rcr edx, cl
add rax, 0x29
mov rdx, rax
movsx rcx, sp
movzx rcx, dx
mov cx, 0x6e2c
mov rcx, rdi
jmp 0x1403cc16e
mov rsi, qword [r13]
mov rdx, qword [r13 + 0x10]
test r13b, r11b
clc
sub rdx, rsi
test r8b, 0x56
cmp rdx, 0x1000
jmp 0x1403cc239
jb 0x1403cc281
mov rax, qword [rsi - 8]
jmp 0x1403cc248
add rsi, 0xfffffffffffffff8
test bp, 0x65df
stc
clc
sub rsi, rax
test ch, 0x2f
cmp rsi, 0x20
jmp 0x1403cc262
jae 0x1403cc314
add rdx, 0x27
movsx rsi, cx
mov si, 0x1f53
movsx esi, dx
mov rsi, rax
movsx cx, r12b
not ch
mov rcx, rsi
call fcn.140197518
mov qword [r13], r14
stc
shl r12, 5
inc bx
lea r12, [r12 + r14]
btr ebx, 0x56
bswap ebx
sub rbx, r9
mov qword [r13 + 8], r12
sete dil
bsr di, r11w
shl r15, 5
cmova ebx, r8d
movzx r12d, bp
add si, 0x76e8
lea r15, [r15 + r14]
mov qword [r13 + 0x10], r15
and esi, edx
rcl r14b, cl
sub di, di
movaps xmm6, xmmword [rsp + 0x20]
add rsp, 0x30
movzx r15w, r14b
movsx rbx, r12w
movsx bx, r15b
pop rbx
movzx r15d, r12w
cmovno r15d, r14d
pop rdi
not sil
movsx r13d, r15w
pop rsi
pop r12
movsxd r15, ebp
pop r13
pop r14
movsxd r15, r10d
movsx r15, sp
mov r15b, 0x14
pop r15
jmp 0x1403cc313
ret
call fcn.1404b4f8e
int3
Function at 0x1403e5940
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
cmp cx, 0xcc5
bt r15w, di
push r14
movzx r15, sp
jmp 0x1403e5957
push r13
push r12
movsx r12d, r8w
push rsi
push rdi
push rbp
xadd r15b, r15b
bt r12w, cx
push rbx
sbb bl, spl
xchg r12, rbx
sub rsp, 0x38
movaps xmmword [rsp + 0x20], xmm6
mov r14, r9
btr ebx, 0x4e
rol r13b, 0x5d
cmp sil, al
mov r15, r8
not ebx
mov r12, rdx
xor r13w, dx
clc
mov r13, rcx
stc
mov rbx, qword [rcx]
stc
cmp r9, 0x1c26419
test rbx, rbx
je 0x1403e5b27
mov rdi, qword [r13 + 8]
cmp r15, r13
cmc
cmp dil, 0xa6
cmp rbx, rdi
jmp 0x1403e59c2
je 0x1403e5ac6
lea rbp, [0x1400bed10]
jmp 0x1403e59d4
movaps xmm6, xmmword [0x1400bd400]
jmp 0x1403e59e0
jmp 0x1403e5a1d
call fcn.140197518
movups xmmword [rbx + 0x20], xmm6
test r11, rbx
cmp si, 0x109c
mov byte [rbx + 0x10], 0
cmp r8w, ax
stc
add rbx, 0x50
stc
test r11, 0x733c0a14
cmp r14w, cx
cmp rbx, rdi
jmp 0x1403e5a17
je 0x1403e5ab7
mov qword [rbx], rbp
movsxd rcx, ebx
lea rcx, [rbx + 0x38]
jmp 0x1403e5a2c
call fcn.1403e2dd2
mov rax, qword [rbx + 0x28]
cmc
cmp rax, 0x10
jmp 0x1403e5a3f
jb 0x1403e59ea
mov rcx, qword [rbx + 0x10]
shl dh, 0x71
or rdx, r12
test bh, 0xa4
lea rdx, [rax + 1]
stc
cmp rdx, 0x1000
jmp 0x1403e5a63
jb 0x1403e59e5
mov rsi, qword [rcx - 8]
jmp 0x1403e5a73
add rcx, 0xfffffffffffffff8
cmp r11d, 0x6986384f
test rbx, 0x1872603f
sub rcx, rsi
test r12b, r14b
cmp rcx, 0x20
jmp 0x1403e5a94
jae 0x1403e5bb1
add rax, 0x28
not dh
mov rdx, rax
movsx ecx, ax
movzx rcx, r9w
mov rcx, rsi
jmp 0x1403e5ab2
jmp 0x1403e59e5
mov rbx, qword [r13]
sub edx, r12d
setle dl
btc dx, 0xa9
mov rdx, qword [r13 + 0x10]
test si, r12w
sub rdx, rbx
cmp rdx, 0x1000
jmp 0x1403e5add
jb 0x1403e5b1a
mov rax, qword [rbx - 8]
cmp rax, 0x531c278c
clc
stc
add rbx, 0xfffffffffffffff8
test r8b, 0x56
sub rbx, rax
cmp r10b, bl
cmp rbx, 0x20
jae 0x1403e5bb1
add rdx, 0x27
mov rbx, rax
movzx rcx, r9w
movzx cx, dh
not cx
mov rcx, rbx
jmp 0x1403e5b22
call fcn.140197518
mov qword [r13], r12
cdqe
shl bh, 0x47
shr ah, 0x96
lea rax, [r15 + r15*4]
xadd si, si
shl rax, 4
lea rax, [rax + r12]
mov qword [r13 + 8], rax
cmp r9b, 0x9c
lea rax, [r14 + r14*4]
mov r15b, r9b
shl rax, 4
add rax, r12
adc bh, bl
mov qword [r13 + 0x10], rax
and di, 0x4358
not r15
movaps xmm6, xmmword [rsp + 0x20]
cmp r9b, r9b
not r12b
add rsp, 0x38
xchg rdi, r15
mov bpl, sil
pop rbx
movsx r13d, r14w
xchg rbp, rsi
movzx r13d, r13w
pop rbp
movsx esi, si
pop rdi
movsx si, dil
movzx r13d, cx
pop rsi
movsx r15d, cx
movzx r13w, r9b
pop r12
pop r13
pop r14
mov r15b, r14b
pop r15
jmp 0x1403e5bb0
ret
call fcn.1404b4f8e
int3
Function at 0x1403e7e63
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
shld ax, si, 6
push r14
btr r14, r10
push rsi
dec r14w
cmc
test r13b, bl
push rdi
shl r14, 0x9e
test bh, 0x36
push rbx
stc
sbb r14d, 0x61990bd8
add r14, r11
sub rsp, 0x20
mov r14, rcx
mov eax, dword [rcx + 8]
jmp 0x1403e7e9f
test al, 2
jmp 0x1403e7ea6
jne 0x1403e7eb3
sub esi, esi
jmp 0x1403e7f6c
mov rdi, qword [r14 + 0x10]
rcl r15b, cl
mov r15, qword [r14 + 0x18]
cmp edx, 0x413f6f92
mov rsi, r15
cmp r10b, 0x39
test r8, rsi
jmp 0x1403e7ed3
sub rsi, rdi
clc
stc
sar rsi, 5
cmc
cmp r15, rdi
jmp 0x1403e7ee5
je 0x1403e7f6c
mov rax, qword [rdi]
movsx ecx, r9w
movzx ecx, r12w
not ch
mov rcx, rdi
jmp 0x1403e7f00
call qword [rax + 0x10]
or rax, 1
cmp r10w, 0x138c
bsr rax, rax
lea rbx, [rax + rax*8]
add rbx, 0x49
cwde
cbw
add ch, bh
shr rbx, 6
lahf
setns ah
cmovo cx, r12w
mov rax, qword [rdi]
mov cx, r14w
cmovne cx, r13w
movsx rcx, bx
mov rcx, rdi
jmp 0x1403e7f43
call qword [rax + 0x10]
lea rsi, [rsi + rax]
add rsi, rbx
add rdi, 0x20
cmp di, 0x2aaa
cmp rdi, r15
jmp 0x1403e7f5e
jne 0x1403e7eeb
mov eax, dword [r14 + 8]
cmp ax, r15w
test al, 4
jmp 0x1403e7f73
jne 0x1403e7f86
mov rdi, rsi
jmp 0x1403e7f81
jmp 0x1403e8033
mov rbx, qword [r14 + 0x28]
mov r15, qword [r14 + 0x30]
movzx edi, r14w
bts edi, r12d
mov rdi, r15
stc
sub rdi, rbx
test cl, sil
cmp bp, 0x2c29
jmp 0x1403e7faa
sar rdi, 5
stc
jmp 0x1403e7fb4
add rdi, rsi
stc
cmp si, r13w
cmp r15, rbx
jmp 0x1403e7fc4
je 0x1403e8033
nop dword [rax]
mov rax, qword [rbx]
mov rcx, rbx
jmp 0x1403e7fd9
call qword [rax + 0x10]
or rax, 1
test bh, 0x5e
sbb cx, 0x3fa6
bsr rax, rax
lea rsi, [rax + rax*8]
test dx, 0x2dfb
shl eax, cl
cwde
add rsi, 0x49
sar cl, 7
shr rsi, 6
mov rax, qword [rbx]
movsxd rcx, r8d
mov rcx, rbx
jmp 0x1403e8011
call qword [rax + 0x10]
lea rdi, [rdi + rax]
add rdi, rsi
add rbx, 0x20
clc
stc
cmp rbx, r15
jmp 0x1403e8029
jne 0x1403e7fce
mov eax, dword [r14 + 8]
test al, 8
jmp 0x1403e803a
je 0x1403e80f2
mov rbx, qword [r14 + 0x40]
ror r15d, cl
sar r15b, 0x44
mov r14, qword [r14 + 0x48]
mov r15, r14
sub r15, rbx
sar r15, 5
lea r15, [r15 + rdi]
cmc
cmp r14, rbx
je 0x1403e80eb
nop word [rax + rax]
mov rax, qword [rbx]
mov rcx, rbx
jmp 0x1403e807b
call qword [rax + 0x10]
or rax, 1
bsr rax, rax
sub si, 0x7663
shl esi, 0x24
lea rsi, [rax + rax*8]
add rsi, 0x49
shr rsi, 6
cwde
movzx ax, bpl
movsxd rcx, edi
mov rax, qword [rbx]
mov rcx, rbx
jmp 0x1403e80ae
call qword [rax + 0x10]
mov rdi, rax
jmp 0x1403e80b9
add rdi, r15
stc
sar r15d, cl
xor r15d, 0x65d1741c
add rdi, rsi
add rbx, 0x20
mov r15, rdi
cmp dil, 0xf0
cmp rsp, rdi
cmp rbx, r14
jmp 0x1403e80e0
jne 0x1403e8070
jmp 0x1403e80f2
mov rdi, r15
cmp dil, 0xab
mov rax, rdi
cmp r12, rbp
add rsp, 0x20
cmovne rbx, r11
movzx r15d, r15w
jmp 0x1403e8109
pop rbx
movzx r15, sp
sets r14b
jmp 0x1403e8117
pop rdi
movsx esi, r15w
movzx si, r12b
pop rsi
pop r14
pop r15
jmp 0x1403e812b
ret
Function at 0x1403f2cfb
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
shld r15, r13, 0xbe
push r14
rcl r15d, 0x40
btr r15d, 0xcb
push r13
movsx r14d, r9w
test r12b, bl
btc r14, r8
push r12
movzx r12, di
bsr r13w, r11w
push rsi
push rdi
adc r12b, bl
push rbx
sub rsp, 0x30
adc sil, r10b
ror r14b, 0xd5
cmp ax, r15w
movaps xmmword [rsp + 0x20], xmm6
sar esi, 0x52
mov r15, r9
mov r12, r8
bswap esi
rol r14, cl
mov r14, rdx
xor sil, 0x27
sub r13b, dil
mov r13, rcx
or sil, 0x66
bt si, 0xa0
mov rsi, qword [rcx]
clc
test rsi, rsi
jmp 0x1403f2d6f
je 0x1403f2e90
mov rbx, qword [r13 + 8]
cmp r12b, dil
stc
cmp rsi, rbx
je 0x1403f2e2d
movaps xmm6, xmmword [0x1400bd400]
jmp 0x1403f2d92
jmp 0x1403f2dc5
call fcn.140197518
movups xmmword [rsi + 0x10], xmm6
test ebp, 0x602f4e97
jmp 0x1403f2dab
mov byte [rsi], 0
test cx, 0x4c88
add rsi, 0x20
cmp rsi, rbx
jmp 0x1403f2dbf
je 0x1403f2e26
mov rax, qword [rsi + 0x18]
cmp rax, 0x10
jb 0x1403f2d9c
mov rcx, qword [rsi]
bt dx, 0xfe
lea rdx, [rax + 1]
clc
cmp rdx, 0x1000
jmp 0x1403f2dec
jb 0x1403f2d97
mov rdi, qword [rcx - 8]
cmc
add rcx, 0xfffffffffffffff8
cmp r11, r11
sub rcx, rdi
cmp rcx, 0x20
jmp 0x1403f2e0a
jae 0x1403f2f1e
add rax, 0x28
mov rdx, rax
movsxd rcx, r12d
mov cx, 0x2111
mov rcx, rdi
jmp 0x1403f2d97
mov rsi, qword [r13]
shr dx, cl
mov rdx, qword [r13 + 0x10]
jmp 0x1403f2e37
sub rdx, rsi
test r10b, dil
cmp rdx, 0x1000
jmp 0x1403f2e49
jb 0x1403f2e83
mov rax, qword [rsi - 8]
add rsi, 0xfffffffffffffff8
cmc
sub rsi, rax
stc
cmp rsi, 0x20
jmp 0x1403f2e65
jae 0x1403f2f1e
add rdx, 0x27
movsx rcx, dx
not rcx
mov rsi, rax
bswap ecx
setnp cl
jmp 0x1403f2e83
mov rcx, rsi
jmp 0x1403f2e8b
call fcn.140197518
mov qword [r13], r14
or si, r8w
shl r12, 5
lea r12, [r12 + r14]
bswap rsi
or bl, 0xa7
mov qword [r13 + 8], r12
movzx r12d, r8w
shl r15, 5
and r12b, dl
add r15, r14
mov qword [r13 + 0x10], r15
mov r13, 0x480b2bc9
jmp 0x1403f2ecf
movaps xmm6, xmmword [rsp + 0x20]
and r15w, 0x53fa
add bx, 0x15cf
add rsp, 0x30
movsx rsi, bp
mov bx, r11w
movzx r15d, bx
pop rbx
movsx di, bl
pop rdi
mov r15b, 0x29
jmp 0x1403f2efd
pop rsi
movsx r12d, bx
movsxd r14, ecx
movzx r14, bx
pop r12
pop r13
not r14w
pop r14
movsx r15w, al
movsxd r15, eax
pop r15
ret
call fcn.1404b4f8e
int3