joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14039cb0d
Capabilities:
Packed with generic packer

Disassembly:
add qword [rsp], 0x68d2c
movabs rax, 0x9500600caf08bba6
cmp ebx, 0x34b72586
not bl
jbe 0x140091c4c
or bl, 0x13
sub ax, 0xfa0a
mov rax, qword [rsp]

Function at 0x1403bad6a
Capabilities:
Encode data using xor

Disassembly:
bswap rbx
xchg qword [rsp + 0x58], rdi
mov r14, qword [rsp + 0x48]
shl rbx, 0xd7
shr rbx, 0xc
lea rbp, [r15*2 - 0x4d661800]
shr r15b, 0x57
add r15b, 0xa3
shr bl, 0x10
je 0x1404c6ee9
mov r15, qword [rsp + rbp + 0x3945f650]
xor bpl, 0xbb
call fcn.14008b2fa
add qword [rsp + 8], 0xffffffffffc69048
movabs rbx, 0xc2085822a934872e
push r13
movabs rbx, 0x899b9d92d88ee8ae
call fcn.14001d881
xor dl, byte [rdx + 0x33e09e50]
invalid

Function at 0x14042d8b7
Capabilities:
Encode data using base64

Disassembly:
test byte [rsp + 0x38], 0xb6
js 0x14008eaf1
mov r10, qword [rsp + 0x28]
sets r12b
push rdx
lea rdx, [rdx + r10*2 + 0x5204d23d]
jb fcn.1404593d1
mov qword [rsp], r9
add qword [rsp + r10 - 0x1207ffb4], 0xffffffffbfc73803
call fcn.140028b14

Function at 0x14044cb05
Capabilities:
Encode data using base64

Disassembly:
not qword [rsp + r14 - 0xd11982c]
add qword [rsp + 0x48], 0x20e67
neg rdx
neg word [rsp + 0x20]
movsx rdx, r10w
push rdi
shr r12, cl
test r12d, 0xba2a9e0b
mov r12, qword [rsp + r15 - 0xff49]
jne 0x1403477ee
movzx r15, cl
test r15d, 0x1c3e1433
mov qword [rsp + r15 - 0x75], rcx
call fcn.140061989
setge byte [rsp + 0x58]
shr word [rsp + 0x58], 0x84
test byte [rsp + 0x38], 0x22
jb 0x1403de6eb
shl word [rsp + 0x58], 0xf5
and word [rsp + 0x38], 0x4633
push qword [rsp + 0x50]
popfq
lea rsp, [rsp + 0x60]
ret
cmp ebp, 0x6a16692
jb 0x140046451
shl r8, 0x27
neg r8d
cmp r12, 0x3b0d0aa3
mov rdx, qword [rsp + r8*4 + 0x18]
not r12b
mov ebp, 0x7abb70d
ja 0x1404a4997
lea rsi, [rsi*4 - 0x31ead965]
jl 0x1400595fb
mov rsi, qword [rsp + rsi + 0x31ead82d]
jge 0x140360794
je 0x14044cb3c
outsd dx, dword [rsi]
in eax, dx
push rsp
invalid
add sil, byte [rcx]
insd dword [rdi], dx
mov ah, 0xbf
xor al, 0x6d
shr dword [rsi - 0x39cec1c1], 0x5e
fdiv st(1)
mov dh, 0x5a
rol dl, 0xa9
invalid

Function at 0x1404727de
Capabilities:
Packed with generic packer

Disassembly:
cmp word [rsp + 0x18], 0xfb8
js 0x1403eb398
invalid
cmovs r11, qword [rsp + 0x38]
bswap r11d
call fcn.14003ac69
lea rbp, [r13 + r11*8 + 0x5486e232]
jg 0x140054104
mov qword [rsp + 0x18], r11
or word [rsp + 0x38], 0xc088
lea rax, [rax - 0x3270f177]
neg ebp
jne 0x14037fb81

Function at 0x14047f3b6
Capabilities:
Encode data using xor

Disassembly:
sub r9b, byte [rsp + 5]
call fcn.140091644
sbb al, 0x40
mov dword [rax + rbp*4], eax
cli
mov bh, 0x2a
add qword [rsp], 0x3e27d
movabs rsi, 0xa1892c98c0aadaa0
movabs r9, 0x160bee9fb0078e25
movabs rbp, 0x4f370d16d73c682a
xor sil, r10b
cmp r10w, 0xd418
jo fcn.140422f36
mov rbp, qword [rsp]
mov rbp, qword [rbp + riz]
js fcn.140381f7d
movzx r10w, r9b
not r10
neg esi
mov qword [rsp], r9
bswap r10
lea rbp, [rbp + 0x701d82ac]
jbe 0x1400bc744
xor qword [rsp + 0x68], 0x2605c28e
push qword [rsp + 0x48]
popfq
lea rsp, [rsp + 0x70]
ret
Function at 0x1404b59b9
Capabilities:
Packed with generic packer

Disassembly:
test qword [rsp + 0x40], 0x310a8b3e
ja 0x1403e9cfc
setge byte [rsp + 0x28]
test dword [rsp + 0x48], r15d
call fcn.140002a9e
not qword [rsp + rdi - 0x2ecb63d3]
mov r12, qword [rsp + 0x38]
je 0x1400469d4
shr r15w, 0x48
add qword [rsp + 8], 0xffffffffbfc853c8
mov rcx, qword [rsp + 0x50]
neg di
shr di, 0xa3
mov byte [rsp + 0x40], 0x93
shl dword [rsp + rdi*2 - 0x5d9626b8], 0xa4
xor r15d, dword [rsp + 0x28]
xor qword [rsp + 0x28], r15
mov rdi, qword [rsp + 0x68]
jne 0x14039b385
xchg edi, eax
cmp bh, al
invalid
add qword [rsp + 0x10], 0xffffffffbffdd15f
neg rdi
neg word [rsp + 0x40]
shl byte [rsp + rdi - 0x2ecb63db], cl
je 0x14039b48e
pop rsp
add dword [rsi], eax
add al, byte [rax]
invalid

Function at 0x1404c82ec
Capabilities:
Packed with generic packer
Resolve function by parsing pe exports

Disassembly:
jns 0x140422fca
or dword [rsp + 8], edi
cmp rdi, 0xffffffffdd80871d
mov rdi, qword [rsp + 0x50]
mov qword [rsp + 8], 0x6c99e233
jb 0x14045cca3
jns 0x14002f59c
not word [rsp + 8]
shr qword [rsp + 0x10], 0x27
mov r10, qword [rsp + 0x28]
test byte [rsp + 8], dil
jg 0x14045a3c5

Function at 0x1404d892d
Capabilities:
Packed with generic packer

Disassembly:
add qword [rsp], 0xffffffffffeea26d
cmp rcx, 0x739828b8
not qword [rsp + 8]
push rdx
mov ecx, dword [rsp + 0x14]
movzx ebp, cl
movabs rdi, 0x40962023f8007321
push rsi
mov rdx, qword [rsp + rbp*2 - 0x1e6]
mov rdi, qword [rsp + 0x10]
mov rdi, qword [rdi]
jbe 0x14002349a
cmove edx, ebp
je 0x14008826e
lea rbp, [rcx + rdx*4 + 0x7d064904]
js 0x140023466

Function at 0x1404e59fc
Capabilities:
Packed with generic packer

Disassembly:
setg byte [rsp + 0x48]
jl 0x14004096f
push qword [rsp + 0x40]
popfq
lea rsp, [rsp + 0x58]
ret
neg r15b
mov rdx, qword [rsp + rdx - 0x5652b3b0]
call fcn.140441275
jg fcn.1400c8339
jbe 0x140095c62
Function at 0x140657d5c
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
sub rsp, 0x78
mov byte [rsp + 0x34], 0xe9
mov dh, 0xb5
movsx edx, bp
setnp al
mov byte [rsp + 0x35], 0x50
cwde
jmp 0x140657d82
mov byte [rsp + 0x36], 0xf0
movsx rcx, di
mov byte [rsp + 0x37], 0x29
mov byte [rsp + 0x38], 4
not dh
mov byte [rsp + 0x39], 0x90
movsx dx, r11b
cwd
movzx rcx, r10w
mov byte [rsp + 0x3c], 0x89
lahf
mov edx, r8d
bswap cx
mov byte [rsp + 0x3d], 0x87
lahf
movsx eax, cx
movzx rax, r10w
mov byte [rsp + 0x3e], 0x78
movzx edx, r10w
mov cx, r15w
mov byte [rsp + 0x3f], 6
mov byte [rsp + 0x40], 0
cqo
movzx rax, r11w
cwde
mov byte [rsp + 0x41], 0
cdqe
movzx rax, r14w
mov byte [rsp + 0x50], 0xc6
movzx dx, spl
rdtsc
cqo
mov byte [rsp + 0x51], 0x87
sets ch
cmovs ecx, edi
mov byte [rsp + 0x52], 0x7c
cdqe
xchg ah, dh
mov byte [rsp + 0x53], 6
lahf
movzx ecx, r12w
movsxd rcx, ecx
mov byte [rsp + 0x54], 0
cwde
cdqe
mov byte [rsp + 0x55], 0
rdtsc
xchg ch, cl
cbw
mov byte [rsp + 0x56], 4
mov byte [rsp + 0x57], 0xc6
mov byte [rsp + 0x58], 0x87
mov cx, r12w
mov byte [rsp + 0x59], 0xda
mov byte [rsp + 0x5a], 5
movsx rax, cx
bswap rdx
lahf
mov byte [rsp + 0x5b], 0
mov byte [rsp + 0x5c], 0
cbw
cmovbe cx, r12w
mov byte [rsp + 0x5d], 5
mov byte [rsp + 0x5e], 0xe9
mov byte [rsp + 0x5f], 0x9e
mov byte [rsp + 0x60], 0xf
xchg cx, dx
movzx rcx, r14w
jmp 0x140657e81
mov byte [rsp + 0x61], 0xd6
mov byte [rsp + 0x62], 0xfb
mov rax, qword [rsp + 0x80]
xchg edx, edx
mov cl, r15b
mov eax, dword [rax + 0xc]
xchg ch, ch
mov dword [rsp + 0x30], eax
movsx cx, sil
cwd
mov dx, 0xa0a8
mov edx, dword [rsp + 0x30]
xchg cl, ch
mov rcx, qword [rsp + 0x80]
jmp 0x140657ebf
call fcn.1406f6a27
mov qword [rsp + 0x48], rax
cmp qword [rsp + 0x48], 0
jmp 0x140657ed4
jne 0x140657ee6
sub eax, eax
jmp 0x140657ee1
jmp 0x14065802d
mov r9d, 0x20
cmovne r8w, r11w
setp r8b
mov r8, qword [0x1400aab00]
movzx edx, r11w
mov edx, dword [rsp + 0x30]
movzx cx, r13b
movzx ecx, r11w
mov rcx, qword [rsp + 0x80]
jmp 0x140657f1a
call fcn.1406f703d
mov r9d, 0x20
movsx r8, cx
mov r8, qword [0x1400aabc8]
cqo
mov edx, dword [rsp + 0x30]
movsx cx, r8b
xchg cl, cl
bswap rcx
mov rcx, qword [rsp + 0x80]
jmp 0x140657f4d
call fcn.1406f703d
cmp dword [rsp + 0x88], 0
jmp 0x140657f5f
je 0x140657fdb
mov qword [rsp + 0x20], 6
cmovp r9, rax
not dh
cqo
lea r9, [rsp + 0x34]
mov r8, qword [0x1400aab00]
mov edx, dword [rsp + 0x30]
movzx cx, dl
movzx rcx, sp
mov rcx, qword [rsp + 0x80]
jmp 0x140657f9b
call fcn.1406f6ee1
mov qword [rsp + 0x20], 0x13
lea r9, [rsp + 0x50]
cwd
movsx edx, di
mov r8, qword [0x1400aabc8]
movzx dx, dil
mov dl, spl
movsxd rdx, r10d
mov edx, dword [rsp + 0x30]
mov rcx, qword [rsp + 0x80]
call fcn.1406f6ee1
jmp 0x140658024
mov qword [rsp + 0x20], 6
movsx r9d, r15w
cmovnp r9w, r15w
lea r9, [rsp + 0x3c]
movzx dx, dil
mov r8, qword [0x1400aab00]
bswap dx
cqo
xchg edx, edx
mov edx, dword [rsp + 0x30]
movsx cx, r12b
jmp 0x140658017
mov rcx, qword [rsp + 0x80]
call fcn.1406f6ee1
mov eax, 1
test r12b, 0x1c
add rsp, 0x78
jmp 0x140658036
ret
Function at 0x140658924
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dword [rsp + 0x10], edx
adc rax, r15
mov dh, 0xe
mov qword [rsp + 8], rcx
cdqe
cmp spl, spl
lahf
sub rsp, 0x78
mov byte [rsp + 0x34], 0xe9
movsx rcx, r14w
lahf
mov byte [rsp + 0x35], 0xc9
setl dl
mov byte [rsp + 0x36], 0x77
cwde
mov byte [rsp + 0x37], 1
cbw
mov byte [rsp + 0x38], 4
bswap cx
cdq
cmovo dx, bx
mov byte [rsp + 0x39], 0x90
cmovge ax, r14w
cwde
mov byte [rsp + 0x50], 0xc7
movsx eax, di
mov byte [rsp + 0x51], 0x87
xchg al, al
cdqe
movsx dx, r12b
mov byte [rsp + 0x52], 0xc8
mov byte [rsp + 0x53], 0
movzx ax, r14b
mov byte [rsp + 0x54], 0
rdtsc
mov byte [rsp + 0x55], 0
cdq
mov byte [rsp + 0x56], 0
nop
mov byte [rsp + 0x57], 0
movsxd rcx, edi
movzx ecx, r10w
mov byte [rsp + 0x58], 0
cmova rax, rcx
mov dl, dh
mov byte [rsp + 0x59], 0
mov byte [rsp + 0x5a], 0x89
mov byte [rsp + 0x5b], 0x87
rdtsc
mov byte [rsp + 0x5c], 0xc8
cdqe
movsxd rcx, r13d
cmovbe eax, r8d
mov byte [rsp + 0x5d], 0
setae cl
bswap ax
movzx ax, cl
mov byte [rsp + 0x5e], 0
cwde
mov byte [rsp + 0x5f], 0
mov byte [rsp + 0x60], 0xe9
not cx
mov byte [rsp + 0x61], 0x23
movzx rax, bp
mov byte [rsp + 0x62], 0x88
movzx ecx, r9w
lahf
mov byte [rsp + 0x63], 0xfe
jmp 0x140658a26
mov byte [rsp + 0x64], 0xfb
cwd
mov byte [rsp + 0x3c], 0x89
mov byte [rsp + 0x3d], 0x87
movsx ax, r8b
mov byte [rsp + 0x3e], 0xc8
not ax
movzx dx, dl
mov byte [rsp + 0x3f], 0
cmova cx, r8w
mov rax, 0x3b1aa335
mov byte [rsp + 0x40], 0
movsx cx, ah
mov byte [rsp + 0x41], 0
movzx cx, r14b
cqo
mov dl, spl
mov rax, qword [rsp + 0x80]
movsxd rdx, r15d
sets cl
mov eax, dword [rax + 0xc]
cqo
mov dword [rsp + 0x30], eax
xchg ecx, edx
mov edx, dword [rsp + 0x30]
movzx ecx, r13w
xchg ch, cl
mov rcx, qword [rsp + 0x80]
call fcn.1406f6a27
mov qword [rsp + 0x48], rax
clc
stc
cmp qword [rsp + 0x48], 0
jmp 0x140658ab3
jne 0x140658ac5
xor eax, eax
jmp 0x140658ac0
jmp 0x140658be6
mov r9d, 0x20
mov r8, r14
mov r8, qword [0x1400aaba0]
mov dx, r10w
mov edx, dword [rsp + 0x30]
mov rcx, qword [rsp + 0x80]
jmp 0x140658aea
call fcn.1406f703d
mov r9d, 0x20
mov r8, qword [0x1400aabe8]
cwd
cdq
mov edx, dword [rsp + 0x30]
mov cl, r13b
mov rcx, qword [rsp + 0x80]
jmp 0x140658b13
call fcn.1406f703d
cmp dword [rsp + 0x88], 0
jmp 0x140658b25
je 0x140658ba4
mov qword [rsp + 0x20], 6
lea r9, [rsp + 0x34]
cdq
not r8w
mov r8, qword [0x1400aaba0]
not dh
movzx edx, r9w
cqo
mov edx, dword [rsp + 0x30]
mov rcx, qword [rsp + 0x80]
jmp 0x140658b5e
call fcn.1406f6ee1
mov qword [rsp + 0x20], 0x15
lea r9, [rsp + 0x50]
movzx edx, r8w
movzx rcx, cx
cdq
mov r8, qword [0x1400aabe8]
mov edx, dword [rsp + 0x30]
bswap rcx
not cx
mov ch, al
mov rcx, qword [rsp + 0x80]
jmp 0x140658b9a
call fcn.1406f6ee1
jmp 0x140658be1
mov qword [rsp + 0x20], 6
cdq
xchg r9d, r8d
lea r9, [rsp + 0x3c]
mov r8, qword [0x1400aaba0]
movsxd rcx, ebp
bswap cx
mov edx, dword [rsp + 0x30]
movsxd rcx, eax
mov cl, 0x33
xchg cx, cx
mov rcx, qword [rsp + 0x80]
jmp 0x140658bdc
call fcn.1406f6ee1
mov eax, 1
add rsp, 0x78
ret
Function at 0x140682f56
Capabilities:
Hash data with crc32

Disassembly:
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sar eax, 0x1c
sub rsp, 0x28
mov eax, dword [rsp + 0x40]
not eax
jmp 0x140682f77
mov dword [rsp], eax
movsx rax, bp
mov rax, qword [rsp + 0x30]
jmp 0x140682f88
mov qword [rsp + 8], rax
cwde
lea rax, [0x1400a0870]
jmp 0x140682f9a
mov qword [rsp + 0x18], rax
mov al, 4
mov rax, qword [rsp + 0x38]
jmp 0x140682fab
mov qword [rsp + 0x10], rax
movsx ax, dil
movzx eax, r11w
mov rax, qword [rsp + 0x38]
dec rax
jmp 0x140682fc6
mov qword [rsp + 0x38], rax
stc
test bpl, 0x15
cmp al, r14b
cmp qword [rsp + 0x10], 0
jmp 0x140682fde
je 0x14068306a
mov eax, dword [rsp]
rcl dh, cl
bts rdx, r15
shr eax, 8
bts dx, r12w
bsr dx, r13w
mov ecx, dword [rsp]
movsxd rdx, ebx
test r15w, 0x85b7
btc edx, 0x8e
and ecx, 0xff
bsf edx, r11d
mov rdx, qword [rsp + 8]
cmc
movzx edx, byte [rdx]
cmp bl, r11b
jmp 0x140683026
xor ecx, edx
mov ecx, ecx
mov rdx, qword [rsp + 0x18]
xor eax, dword [rdx + rcx*4]
jmp 0x140683037
mov dword [rsp + 4], eax
cbw
mov rax, qword [rsp + 8]
jmp 0x140683047
inc rax
jmp 0x14068304f
mov qword [rsp + 8], rax
mov eax, dword [rsp + 4]
jmp 0x14068305d
mov dword [rsp], eax
jmp 0x140683065
jmp 0x140682fa1
mov eax, dword [rsp]
cmp ch, 0x80
not eax
add rsp, 0x28
jmp 0x14068307b
ret
Function at 0x140685448
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov dword [rsp + 8], ecx
rcr eax, cl
movzx eax, sp
or rax, rbx
sub rsp, 0x28
xadd eax, eax
setne al
mov rax, qword [0x1400ac760]
cmp r9b, 0x10
test bpl, dil
mov qword [rsp], rax
cmp dword [rsp + 0x30], 0
jmp 0x14068547a
jle 0x14068556a
mov rax, qword [rsp]
shl dl, cl
mov cx, r11w
add rax, 0x1ba8
mov qword [rsp + 8], rax
dec rdx
cbw
mov rax, qword [rsp + 8]
mov eax, dword [rax]
cmovs cx, si
mov dx, cx
dec eax
and dx, 0x82b4
movzx rdx, di
cdqe
ror cl, 0xb9
sar dl, cl
xor cx, si
imul rax, rax, 0x14
bts ecx, ecx
inc rdx
movzx rcx, r11w
mov rcx, qword [rsp + 8]
rol dx, 0x1a
add rax, qword [rcx + 8]
movzx ecx, r14w
mov qword [rsp + 0x10], rax
add al, ch
adc ch, 0x8b
cdqe
mov rax, qword [rsp + 0x10]
jmp 0x1406854f4
movsxd rax, dword [rax]
imul rax, rax, 0x10
adc ch, 0xbd
btc dx, r8w
cdq
mov rcx, qword [rsp]
mov rdx, qword [rsp + 0x10]
test cl, 0x1a
test si, r13w
movups xmm0, xmmword [rdx + 4]
movdqu xmmword [rcx + rax + 0x1620], xmm0
test rsi, r11
bswap rcx
mov rax, qword [rsp]
stc
cmovg rcx, r12
movzx rcx, cx
add rax, 0x1ba8
bswap ecx
mov qword [rsp + 0x18], rax
mov rax, qword [rsp + 0x18]
mov eax, dword [rax]
dec eax
mov rcx, qword [rsp + 0x18]
mov dword [rcx], eax
mov eax, dword [rsp + 0x30]
jmp 0x14068555a
dec eax
mov dword [rsp + 0x30], eax
jmp 0x140685565
jmp 0x140685470
add rsp, 0x28
jmp 0x140685573
ret
Function at 0x140685723
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov dword [rsp + 8], ecx
not rax
clc
sub rsp, 0x58
xadd rax, rax
setne ah
add rax, r8
mov rax, qword [0x1400ac760]
cmc
cmp cx, 0xa70c
mov qword [rsp + 0x38], rax
stc
cmp dword [rsp + 0x60], 0
jle 0x1406859c2
mov rax, qword [rsp + 0x38]
add rax, 0x1bb8
movsx rcx, bp
movzx cx, dh
setl cl
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
cmovnp ecx, r11d
seto ch
mov eax, dword [rax]
jmp 0x14068578d
dec eax
cdqe
shr ecx, cl
imul rax, rax, 0xc
add cl, bh
or ch, ah
mov rcx, qword [rsp + 0x40]
jmp 0x1406857a5
add rax, qword [rcx + 8]
cmova cx, r11w
movsx rcx, r11w
mov rcx, r15
mov qword [rsp + 0x28], rax
movzx cx, r15b
mov rax, qword [rsp + 0x28]
jmp 0x1406857cf
mov ecx, dword [rax]
jmp 0x1406857d6
call fcn.1400da300
mov qword [rsp + 0x20], rax
adc cx, bp
shl cx, 0xb0
mov rax, qword [rsp + 0x20]
mov eax, dword [rax + 8]
bts ecx, r14d
or cl, 0x92
btr ecx, 0xf
mov rcx, qword [rsp + 0x38]
lea rax, [rcx + rax + 0x1568]
clc
test r14d, 0x9597fc28
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x20]
cmp dword [rax], 8
jmp 0x140685821
jne 0x14068588b
mov rax, qword [rsp + 0x20]
test r14d, r8d
cmp r13w, sp
cmp dword [rax + 4], 1
jmp 0x14068583c
jne 0x14068588b
mov eax, 4
sub r8b, 0xa8
imul rax, rax, 0
mov ecx, 4
rcl r8w, 0x84
imul rcx, rcx, 0
mov rdx, qword [rsp + 0x30]
movsx r8d, r9w
mov r8, qword [rsp + 0x28]
jmp 0x140685870
movss xmm0, dword [r8 + rax + 4]
jmp 0x14068587c
movss dword [rdx + rcx], xmm0
jmp 0x140685886
jmp 0x140685963
mov rax, qword [rsp + 0x20]
jmp 0x140685895
cmp dword [rax], 8
jmp 0x14068589d
jne 0x140685963
mov rax, qword [rsp + 0x20]
stc
cmp dword [rax + 4], 2
jne 0x140685963
mov eax, 4
ror ecx, 0x8f
imul rax, rax, 0
movzx edx, r13w
ror ch, cl
mov ecx, 4
sal dx, 0xbc
or dx, 0x931b
imul rcx, rcx, 0
mov rdx, qword [rsp + 0x30]
xor r8b, r14b
inc r8b
mov r8, qword [rsp + 0x28]
movss xmm0, dword [r8 + rax + 4]
movzx r8w, r14b
test r11, 0x28208100
movss dword [rdx + rcx], xmm0
sal dx, cl
bts rax, r15
shr al, 0xb3
mov eax, 4
imul rax, rax, 1
btr r8w, r14w
movsx edx, r9w
mov ecx, 4
imul rcx, rcx, 1
bsr rdx, rbp
cmp r11b, r12b
mov rdx, qword [rsp + 0x30]
xchg r8d, r8d
btc r8w, 0x84
mov r8, qword [rsp + 0x28]
test r13, r8
cmp dl, r11b
movss xmm0, dword [r8 + rax + 4]
movsx eax, r10w
bt rax, 0xb9
shr ah, cl
movss dword [rdx + rcx], xmm0
btc cx, 0x27
bswap rax
mov rax, qword [rsp + 0x38]
not cl
add rax, 0x1bb8
movzx cx, r15b
jmp 0x14068597a
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x48]
mov eax, dword [rax]
setbe cl
dec eax
not rcx
mov rcx, qword [rsp + 0x48]
jmp 0x140685998
mov dword [rcx], eax
movzx ax, bh
cwde
jmp 0x1406859a4
mov eax, dword [rsp + 0x60]
jmp 0x1406859ad
dec eax
jmp 0x1406859b4
mov dword [rsp + 0x60], eax
jmp 0x1406859bd
jmp 0x14068574c
add rsp, 0x58
jmp 0x1406859cb
ret
Function at 0x140685ae6
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov byte [rsp + 0x20], r9b
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
adc rax, 0x1c93078c
neg ax
btc rax, 0xb1
mov qword [rsp + 8], rcx
sub rsp, 0x98
mov rax, qword [0x1400ac760]
cmc
test r11b, r8b
mov qword [rsp + 0x58], rax
shr rax, cl
mov rax, qword [rsp + 0x58]
mov rax, qword [rax + 0x1a80]
cmp bpl, r8b
mov qword [rsp + 0x78], rax
add ah, 0x94
movzx eax, byte [rsp + 0xb8]
clc
test sp, 0x90b8
test eax, eax
jmp 0x140685b4f
je 0x140685b87
mov rdx, qword [rsp + 0xb0]
movsx ecx, r9w
jmp 0x140685b66
mov rcx, qword [rsp + 0xa8]
jmp 0x140685b73
call fcn.1406859cc
mov qword [rsp + 0x60], rax
jmp 0x140685b82
jmp 0x140685c2e
cmp qword [rsp + 0xb0], 0
jne 0x140685c20
mov rax, qword [rsp + 0xa8]
movzx ecx, r8w
mov qword [rsp + 0x70], rax
jmp 0x140685baf
mov qword [rsp + 0x50], 0xffffffffffffffff
cwde
inc qword [rsp + 0x50]
ror cx, 0x18
bts cx, r8w
or cx, 0xa5bd
mov rax, qword [rsp + 0x70]
neg cl
btc cx, 0x31
shr ch, 0xa0
mov rcx, qword [rsp + 0x50]
cmp byte [rax + rcx], 0
jmp 0x140685be9
jne 0x140685bb9
mov rax, qword [rsp + 0x50]
bts cx, r11w
bts rcx, r10
not rcx
mov rcx, qword [rsp + 0xa8]
clc
test dx, 0x2ea5
lea rcx, [rcx + rax]
xor al, dil
mov rax, rcx
mov qword [rsp + 0xb0], rax
mov rax, qword [rsp + 0xb0]
stc
mov qword [rsp + 0x60], rax
mov rax, qword [rsp + 0x60]
cmp qword [rsp + 0xa8], rax
jmp 0x140685c40
je 0x140685d85
mov rax, qword [rsp + 0x78]
clc
jmp 0x140685c51
mov rax, qword [rax + 0x2b0]
mov qword [rsp + 0x88], rax
cmp r9w, 0x441e
test r10b, 0x3d
clc
movss xmm1, dword [0x1400a4f0c]
cmc
xor ecx, ecx
jmp 0x140685c7b
call fcn.140685195
mov dword [rsp + 0x68], eax
xchg dh, ch
movsx r9, r15w
mov rax, qword [rsp + 0x58]
movzx cx, r9b
movss xmm0, dword [rax + 0x1928]
movss dword [rsp + 0x6c], xmm0
movsxd rdx, ebp
mov rax, qword [rsp + 0x58]
mov rax, qword [rax + 0x1920]
cdq
mov qword [rsp + 0x80], rax
mov qword [rsp + 0x40], 0
movzx rdx, r11w
movsx ecx, r9w
xorps xmm0, xmm0
rdtsc
cwd
movss dword [rsp + 0x38], xmm0
movsx r9w, bpl
cbw
cwd
mov rax, qword [rsp + 0x60]
xchg edx, r9d
cdq
movsx edx, r13w
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0xa8]
movzx ecx, bx
cmove rcx, rsp
mov r9b, r14b
mov qword [rsp + 0x28], rax
mov eax, dword [rsp + 0x68]
movsx r9w, dil
mov dword [rsp + 0x20], eax
cdq
lea r9, [rsp + 0xa0]
movss xmm2, dword [rsp + 0x6c]
mov dh, 0x36
movzx dx, ch
mov dx, bp
mov rdx, qword [rsp + 0x80]
mov rcx, qword [rsp + 0x88]
jmp 0x140685d45
call fcn.1406d4d32
mov rax, qword [rsp + 0x58]
movzx eax, byte [rax + 0x3048]
test sil, 0x10
test eax, eax
jmp 0x140685d61
je 0x140685d85
mov r8, qword [rsp + 0x60]
mov rdx, qword [rsp + 0xa8]
cmovg cx, ax
lea rcx, [rsp + 0xa0]
call fcn.1406b2db0
add rsp, 0x98
jmp 0x140685d91
ret
Function at 0x14068ffda
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
test r15d, 0x2b2a6ab3
sub rsp, 0x48
call fcn.14008b313
mov qword [rsp + 0x38], rax
cbw
mov rax, qword [rsp + 0x58]
test r11b, r15b
test ecx, 0xd4a892bb
cmc
mov byte [rax], 1
mov rax, qword [rsp + 0x50]
test dil, 0xa
clc
test bl, bpl
cmp dword [rax], 0
jmp 0x140690022
jle 0x140690045
mov rax, qword [rsp + 0x50]
mov rax, qword [rax + 8]
jmp 0x140690036
mov qword [rsp + 0x28], rax
jmp 0x140690040
jmp 0x14069004e
mov qword [rsp + 0x28], 0
mov rax, qword [rsp + 0x58]
movzx ecx, ax
movsx rcx, r13w
movsxd rcx, edi
mov rcx, qword [rsp + 0x28]
mov qword [rax + 8], rcx
cdqe
jmp 0x14069006d
mov rax, qword [rsp + 0x58]
xchg cl, cl
movzx cx, al
mov rcx, qword [rsp + 0x50]
jmp 0x140690082
mov ecx, dword [rcx]
jmp 0x140690089
mov dword [rax + 0x10], ecx
bswap ax
xchg cx, ax
mov rax, qword [rsp + 0x58]
mov dword [rax + 0x14], 0
mov rax, qword [rsp + 0x58]
not rcx
movzx cx, r12b
mov dword [rax + 0x18], 0
movzx ax, ah
movzx eax, r15w
movsx ax, r13b
xorps xmm0, xmm0
movss dword [rsp + 0x30], xmm0
movsx cx, dh
movsx rax, cx
xorps xmm0, xmm0
cdqe
xchg cl, ch
cbw
movss dword [rsp + 0x34], xmm0
mov cx, r10w
movsx ecx, r9w
jmp 0x1406900eb
mov rax, qword [rsp + 0x30]
movsxd rcx, ecx
movsx cx, r11b
bswap ecx
mov rcx, qword [rsp + 0x58]
jmp 0x140690104
mov qword [rcx + 0x1c], rax
mov rax, qword [rsp + 0x38]
mov rax, qword [rax + 8]
mov rcx, qword [rsp + 0x58]
mov qword [rcx + 0x24], rax
bswap cx
movzx eax, sp
mov rax, qword [rsp + 0x38]
xchg cl, cl
mov rcx, 0x41092c81
movzx rcx, r9w
mov rax, qword [rax + 0xb8]
bswap ecx
mov rcx, qword [rsp + 0x58]
mov qword [rcx + 0x2c], rax
mov dword [rsp + 0x20], 0
jmp 0x140690151
jmp 0x140690165
mov eax, dword [rsp + 0x20]
inc eax
stc
mov dword [rsp + 0x20], eax
lahf
cmovl eax, esi
mov rax, qword [rsp + 0x50]
jmp 0x140690172
mov eax, dword [rax]
stc
cmp dword [rsp + 0x20], eax
jmp 0x14069017e
jge 0x140690229
movsxd rax, dword [rsp + 0x20]
mov rcx, qword [rsp + 0x50]
mov rcx, qword [rcx + 8]
mov rax, qword [rcx + rax*8]
mov rcx, qword [rsp + 0x58]
stc
mov ecx, dword [rcx + 0x18]
clc
test dx, 0x7e06
jmp 0x1406901aa
add ecx, dword [rax + 0x20]
shl rax, 0xb
mov eax, ecx
xchg ecx, ecx
sal cl, cl
not ch
mov rcx, qword [rsp + 0x58]
cmp sp, 0xfa3a
cmc
test r9w, r15w
mov dword [rcx + 0x18], eax
inc cl
cmp ax, r13w
setl al
movsxd rax, dword [rsp + 0x20]
xor ecx, 0x7a8c4100
not rcx
add cx, 0x6c99
mov rcx, qword [rsp + 0x50]
test dil, r11b
jmp 0x1406901f4
mov rcx, qword [rcx + 8]
mov rax, qword [rcx + rax*8]
sub ch, 0x36
mov rcx, qword [rsp + 0x58]
stc
mov ecx, dword [rcx + 0x14]
cmp di, dx
cmp sp, 0x939c
add ecx, dword [rax + 0x10]
bswap eax
mov eax, ecx
movzx cx, r9b
mov rcx, qword [rsp + 0x58]
mov dword [rcx + 0x14], eax
jmp 0x140690156
add rsp, 0x48
jmp 0x140690232
ret