joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400072b0
Capabilities:
Access peb ldr_data
Encode data using base64
Encode data using xor
Encrypt data using speck
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x2e8
movaps xmmword [rsp + 0x2d0], xmm6
movabs r12, 0xcbf29ce484222325
movabs r14, 0x1d12a89b9e723ff5
lea rcx, [0x1400ce915]
jmp 0x1403af920

Function at 0x140008210
Capabilities:
Access peb ldr_data
Encrypt data using speck
Get kernel32 base address
Parse pe header

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x38
movabs r14, 0xcbf29ce484222325
lea rcx, [0x1400ce987]
jmp 0x1403b1472

Function at 0x14017389a
Capabilities:
Parse pe header

Disassembly:
sub r8d, r8d
sub edx, edx
jmp 0x14028971e
jmp 0x1404b3234

Function at 0x14019cbde
Capabilities:
Encrypt data using speck
Resolve function by parsing pe exports

Disassembly:
mov rcx, qword [rcx]
jmp 0x1401fe0e8
jmp 0x1404484de
push rsi
bt eax, esi
and rax, rdx
mov ax, 0x4642
push rdi
bt si, 0x99
cwde
sub sil, r14b
sub rsp, 0x28
bswap si
bt ax, 0x2c
neg si
mov rsi, rcx
add eax, r8d
clc
mov rcx, qword [rcx + 0x18]
or eax, 0x79f23f88
sub al, 0xba
mov rax, qword [rcx]
xor edx, edx
sub r8d, r8d
jmp 0x140448521
call qword [rax + 0x188]
mov edi, eax
lea rcx, [rsi + 0x30]
call fcn.14045bf64
test edi, edi
je 0x140448577
cmp edi, 0x8899000c
jmp 0x140448545
jne 0x140448594
mov rcx, rsi
btr edi, edx
stc
dec dil
add rsp, 0x28
movzx rdi, bx
xchg sil, sil
pop rdi
bswap si
movsx esi, r8w
setg sil
pop rsi
jmp 0x140448572
jmp fcn.140448184
nop
clc
or di, 0x4ab8
add rsp, 0x28
pop rdi
mov si, r10w
bswap si
xchg rsi, rsi
pop rsi
jmp 0x140448593
ret
mov ecx, edi
movabs r8, 0xad4a5352d2edebd0
ror di, 0xc7
mov dl, 3
shr edi, cl
inc esi
mov r9d, 0x54
add rsp, 0x28
movzx di, r8b
jmp 0x1404485be
pop rdi
xchg sil, sil
movsxd rsi, r13d
setnp sil
pop rsi
jmp 0x1404485cf
jmp fcn.1403b1aa9
Function at 0x1401c727f
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
movsxd rdx, edx
cdq
setg dl
lea edx, [r8 + 2]
jmp 0x1402468d0
jmp 0x1404b3234
mov qword [rsp + 8], rbx
clc
shld ebx, r15d, 0xbb
mov dword [rsp + 0x18], r8d
movsx bx, r11b
movsx rbx, r11w
mov dword [rsp + 0x10], edx
and bx, di
xadd bl, bh
seto bl
push rbp
rcl bh, cl
movsx rbp, sp
mov rbp, rsp
ror bx, 5
sub rsp, 0x50
mov ebx, ecx
cmp r12w, cx
cmp r10b, 0x7e
test r8d, r8d
jmp 0x1404b327e
jne 0x1404b3317
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
jmp 0x1404b3294
je 0x1404b3317
mov ecx, 0x5a4d
cmc
cmp dx, 0x2dc3
cmp word [rax], cx
jmp 0x1404b32ad
jne 0x1404b3317
movsxd rcx, dword [rax + 0x3c]
test r15w, 0x4f00
lea rcx, [rcx + rax]
clc
stc
cmp dword [rcx], 0x4550
jmp 0x1404b32ce
jne 0x1404b3317
mov eax, 0x20b
test di, r13w
cmp word [rcx + 0x18], ax
jmp 0x1404b32e6
jne 0x1404b3317
cmp dword [rcx + 0x84], 0xe
jmp 0x1404b32f8
jbe 0x1404b3317
cmp dword [rcx + 0xf8], 0
je 0x1404b3317
mov ecx, ebx
jmp 0x1404b3312
call fcn.1404b30ea
lea rax, [rbp + 0x18]
cqo
mov byte [rbp + 0x28], 0
movsxd rdx, r12d
movzx r8, sp
mov qword [rbp - 0x20], rax
lea r9, [rbp - 0x2c]
cwd
lahf
lea rax, [rbp + 0x20]
mov rcx, r9
mov qword [rbp - 0x18], rax
mov cl, 0x57
lea r8, [rbp - 0x20]
movsx eax, dx
lea rax, [rbp + 0x28]
movzx edx, r8w
mov qword [rbp - 0x10], rax
jmp 0x1404b335b
lea rdx, [rbp - 0x28]
movzx rcx, r15w
mov eax, 2
lea rcx, [rbp - 0x30]
jmp 0x1404b3371
mov dword [rbp - 0x2c], eax
jmp 0x1404b3379
mov dword [rbp - 0x28], eax
jmp 0x1404b3381
call fcn.1404b3524
cmp dword [rbp + 0x20], 0
je 0x1404b33a3
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
xchg bpl, bpl
pop rbp
jmp 0x1404b33a2
ret
mov ecx, ebx
jmp 0x1404b33aa
call fcn.1404b31b5
int3

Function at 0x1401fd029
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov rdx, rcx
xchg cl, ch
lea rcx, [0x1400ba2a8]
jmp fcn.1404b6e67

Function at 0x1401febe8
Capabilities:
Parse pe header

Disassembly:
ret
jne 0x140102c70
sub eax, eax
movzx ecx, di
mov ecx, 0x20b
shr al, cl
cmp word [rdx + 0x18], cx
mov al, 0x29
sete al
jmp 0x1400e0284
xor eax, eax
jmp 0x1401ae632
ret
lea rdx, [rdx + rcx]
jmp 0x14024d36b
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x140102c70
movsxd rdx, dword [rcx + 0x3c]
jmp 0x1401e9215
cmp dword [rdx], 0x4550
jmp 0x1400e4860
Function at 0x14020ae60
Capabilities:
Access peb ldr_data

Disassembly:
je 0x1401e5d13
sub edx, edx
lea r9, [0x1400b8f10]
cmp sil, dl
cmp r8, rdx
jmp 0x140216ab9
jmp 0x1400e630d
jne 0x1401223e0
sub r8, rax
test r8, r8
jmp 0x1401722f1
je 0x140114039
sub eax, eax
cmp r9w, r12w
test dl, ah
nop word [rax + rax]
cmp r8, rax
je 0x1401722f7
mov word [r10], r11w
xor r11w, 0x7535
cmp esi, r13d
add r10, 2
mov r11b, dil
movsx r11w, r9b
movsx r11d, bp
movzx r11d, word [r9 + rax*2 + 2]
jmp 0x140138652
inc rax
test r12w, 0x5edc
test r11w, r11w
jmp 0x140114030
je 0x1401dc194
mov word [r10], 0
xor eax, 0x58ca79c0
rcr r8b, 0x61
jmp 0x1401dc194
cmovb r8, rdx
jmp 0x140210368
jne 0x1400e6319
sub r8, rdx
test r12d, 0x234e2122
jmp 0x1401e5d13
movzx eax, word [0x1400b8f10]
ror r8d, cl
cmp rdx, 0x104
mov r8d, 0x104
jmp 0x1401773f3
test r8, r8
je 0x1401e5d21
mov word [rcx], 0
ret
cmovb r8, rdx
jmp 0x1401078d5
mov rax, qword gs:[0x30]
sub r11, 0x664c3e3f
mov rax, qword [rax + 0x60]
shr r11b, 0xf8
movzx r10, r11w
sar r9w, 0x96
mov rax, qword [rax + 0x18]
cmc
xadd r8b, r9b
rcr r10b, cl
mov rax, qword [rax + 0x10]
movzx r10, si
movzx r8d, word [rax + 0x58]
rol r9b, 0x79
setle r10b
cmp r8, rdx
mov r9w, 0x4e34
cmovae r8, rdx
sal r10b, cl
sbb r10b, r12b
ror r11w, cl
mov r9, qword [rax + 0x60]
bts r10w, r14w
movsx r10, si
shl r11b, 0x95
movzx r11d, word [r9]
sal r10b, cl
lea r10, [0x1400b8f10]
test r11w, r11w
jmp 0x1401223cc
inc rdx
stc
test ax, ax
jmp 0x1401b319d
movzx eax, word [0x1400b8f10]
cmp r15d, 0x7b868c5
test ax, ax
jmp 0x140241ebc
test ax, ax
jmp 0x1400e6307
je 0x1401e5d1c
mov word [rcx], ax
shld ax, bp, 0xd4
bts ax, r11w
add rcx, 2
movzx eax, di
mov rax, 0x261b525a
movsx ax, r9b
movzx eax, word [r9 + rdx*2 + 2]
jmp 0x1401f4246
je 0x1401efda3
cmp rdx, 0x104
movsx r8d, di
mov r8d, 0x104
jmp 0x1401efd9a

Function at 0x14025534d
Capabilities:
Enumerate pe sections

Disassembly:
movzx eax, word [r8 + 0x14]
inc r11w
adc r11b, 0x3e
movsx r11w, r12b
movzx r11d, word [r8 + 6]
add rax, 0x18
test sil, r10b
stc
lea rax, [rax + r8]
cmp r14b, sil
cmc
test rdx, r12
test r11d, r11d
jmp 0x14028e795
jb 0x1401a2afc
mov ecx, dword [rax + 8]
test bpl, 0xf0
add ecx, edx
cmp r10, rcx
jmp 0x1401a2af6
jb 0x140213c6f
inc r9d
cmp r10, r8
test bp, dx
jmp 0x1402853b1
ret
movsxd r8, dword [rcx + 0x3c]
bt r11, rdi
xor r9d, r9d
lea r8, [r8 + rcx]
cmp bpl, r13b
mov r10, rdx
jmp 0x1400ef500
add rax, 0x28
clc
cmp r9d, r11d
jmp 0x1402998a1
je 0x1402998a7
mov edx, dword [rax + 0xc]
clc
cmp r10, rdx
jmp 0x14011b987
jb 0x14028e79b
sub eax, eax
jmp 0x140213c6f
Function at 0x140272ea0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
dec rcx
cmp al, 0x30
jmp 0x14020620b
je 0x140229587
movzx eax, byte [rcx]
test al, al
je 0x1402724b2
sub al, 0x45
test al, 0xdf
jmp 0x140272982
je 0x1401c44c7
movzx eax, byte [rcx + 1]
inc rcx
jmp 0x1401c544e
dec rcx
cmp spl, 0xda
stc
cmp al, 0x30
jmp 0x14019e7c9
je 0x140206211
cmp al, r9b
mov rdx, 0x66f71b84
rdtsc
cmovl eax, r8d
lea rdx, [rcx - 1]
movzx eax, dx
cmovne rdx, rcx
mov al, 0x3e
bts rax, rbp
nop dword [rax]
sar rax, cl
bsf eax, r15d
btc ax, r15w
movzx eax, byte [r8]
cmp spl, al
lea rdx, [rdx + 1]
cmp r8b, r12b
mov byte [rdx], al
lea r8, [r8 + 1]
test al, al
jmp 0x140229581
jne 0x1402063b4
inc rcx
cmc
clc
test al, al
jmp 0x1400fda78
movzx edx, al
cmp ch, 0x62
test al, al
jmp 0x1401c44c1
inc rcx
stc
cmc
cmp ax, 0x6f36
test al, al
jmp 0x1402724ac
jne 0x14019e7cf
movzx eax, byte [rcx - 1]
jmp 0x1401833fc
mov rax, qword [rdx]
add r9w, 0x6972
movzx r9d, byte [rax]
add al, r8b
shr rax, cl
movzx eax, byte [rcx]
test al, al
je 0x1401c44c7
movzx edx, al
nop dword [rax + rax]
mov al, spl
not ax
movzx eax, dl
cmp ax, sp
stc
jmp 0x14028a588
jne 0x14019e803
ret
jne 0x1400fda89
movzx eax, byte [rcx - 1]
jmp 0x14027f454
je 0x1402724b2
movzx eax, byte [rcx + 1]
jmp 0x1401deddc
mov rax, qword [rdx]
xor dl, 0xe9
mov rdx, qword [rax + 0xf8]
xadd r9w, ax
jmp 0x140206388
mov r8, rcx
jmp 0x1400e2879
cmp dl, r9b
jmp 0x14011ea0f
Function at 0x1403bf70b
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
test r13w, si
push r14
cmp al, r14b
push r12
movzx r12, r14w
push rsi
sal r12b, 0x89
adc r12b, 0xea
not r12b
push rdi
push rbx
sub rsp, 0x28
mov r12, r8
cmp bl, r15b
test r14b, 0x91
clc
test rdx, rdx
je 0x1403bf939
mov r15, rdx
rol bh, cl
movzx rbx, r10w
mov rbx, rcx
cmp r11d, 0xc257571
sub esi, esi
jmp 0x1403bf79b
mov rcx, rdi
movzx rdx, di
movsxd rdx, r14d
cdq
mov rdx, r14
call fcn.1403bd46c
mov eax, dword [rbx + rsi + 0x58]
clc
mov dword [r12 + rsi + 0x58], eax
mov rax, qword [rbx + rsi + 0x50]
cmc
mov qword [r12 + rsi + 0x50], rax
add rsi, 0x60
jmp 0x1403bf78d
dec r15
jmp 0x1403bf795
je 0x1403bf92a
mov eax, dword [rbx + rsi + 8]
cmc
mov dword [r12 + rsi + 8], eax
stc
clc
cmp r12, rbx
je 0x1403bf76f
cmp qword [rbx + rsi + 0x28], 0x10
jmp 0x1403bf7bb
jb 0x1403bf7d0
mov r9, qword [rbx + rsi + 0x10]
jmp 0x1403bf7cb
jmp 0x1403bf7e6
lea r9, [rbx + rsi]
add r9, 0x10
shld di, r11w, 0xd3
bt edi, 0x39
btc rdi, rdx
lea r14, [r12 + rsi]
jmp 0x1403bf7ef
add r14, 0x10
stc
mov rdi, qword [rbx + rsi + 0x20]
mov rax, qword [r12 + rsi + 0x28]
test r12d, 0x262551a4
cmp rax, rdi
jmp 0x1403bf80d
jae 0x1403bf833
mov rcx, r14
mov dl, r15b
cmova dx, cx
movzx edx, r15w
mov rdx, rdi
jmp 0x1403bf829
call fcn.1403bd46c
jmp 0x1403bf874
cmp rax, 0x10
jmp 0x1403bf83c
jb 0x1403bf84c
mov r14, qword [r12 + rsi + 0x10]
sete ch
cwd
mov qword [r12 + rsi + 0x20], rdi
movsx edx, sp
cwd
mov rcx, r14
movsxd r8, eax
mov rdx, r9
mov r8, rdi
jmp 0x1403bf867
call fcn.1404a58cd
mov byte [r14 + rdi], 0
add r14b, dl
mov r14, qword [rbx + rsi + 0x40]
cmp qword [rbx + rsi + 0x48], 0x10
jmp 0x1403bf884
jb 0x1403bf894
mov r9, qword [rbx + rsi + 0x30]
jmp 0x1403bf8a9
lea r9, [rbx + rsi]
movsx ax, r14b
xor rax, rsi
bts di, r13w
add r9, 0x30
lea rdi, [r12 + rsi]
shl ax, cl
add rdi, 0x30
lahf
sal rax, 0x54
bt ax, 0x6f
mov rax, qword [r12 + rsi + 0x48]
test r11b, 0xd2
cmp rax, r14
jb 0x1403bf75c
cmp rax, 0x10
jmp 0x1403bf8d9
jb 0x1403bf8f2
mov rdi, qword [r12 + rsi + 0x30]
movsx r8w, bpl
movzx rdx, r11w
jmp 0x1403bf8f2
mov qword [r12 + rsi + 0x40], r14
movsx cx, r11b
mov rcx, rdi
mov rdx, r9
cmovo r8w, cx
movzx r8, ax
bswap r8
mov r8, r14
jmp 0x1403bf916
call fcn.1404a58cd
mov byte [rdi + r14], 0
jmp 0x1403bf925
jmp 0x1403bf76f
lea r12, [r12 + rsi]
sub dil, bpl
bts r14d, r12d
btr rsi, rbp
mov rax, r12
add rsp, 0x28
setnp r12b
pop rbx
mov r12b, 0xa3
bswap r14
pop rdi
movsxd r14, ebp
jmp 0x1403bf954
pop rsi
xchg r15b, r14b
movzx r14, r15w
movsx r14, dx
pop r12
mov r14w, 0x461a
bswap r14w
jmp 0x1403bf970
pop r14
movzx r15d, si
pop r15
jmp 0x1403bf97d
ret
Function at 0x1403cf636
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
stc
push r14
btc r14, r9
clc
push r13
push r12
and r14b, r9b
push rsi
rcr r12b, 0xd6
xor sil, r13b
push rdi
and r15b, sil
rol r12d, 0x56
shl r12b, cl
push rbx
shl r15, cl
rcl sil, 0x13
and esi, 0x63a33d20
sub rsp, 0x30
add r14b, 0x96
movsx si, bl
movaps xmmword [rsp + 0x20], xmm6
adc r14b, 0x4d
mov r15, r9
xadd r12d, r14d
btc r14w, si
movsx r13, r14w
mov r12, r8
movzx r14d, r13w
dec esi
mov r14, rdx
shr r13b, cl
btc r13, 0xb1
movzx r13d, sp
mov r13, rcx
bts rsi, rdx
add sil, 8
mov rsi, qword [rcx]
cmp rdi, r11
test bpl, 0x8c
test rsi, rsi
jmp 0x1403cf6c2
je 0x1403cf7fb
mov rbx, qword [r13 + 8]
cmp r10b, dil
clc
cmp rsi, rbx
jmp 0x1403cf6d8
je 0x1403cf79f
movaps xmm6, xmmword [0x1400bd3f0]
jmp 0x1403cf6ea
jmp 0x1403cf718
call fcn.140238558
movups xmmword [rsi + 0x10], xmm6
cmp r8, r9
mov word [rsi], 0
test r10b, 0x9e
test bl, spl
add rsi, 0x20
clc
test r14b, bpl
cmp rsi, rbx
je 0x1403cf79b
mov rax, qword [rsi + 0x18]
cmc
stc
cmp rax, 8
jmp 0x1403cf727
jb 0x1403cf6f4
mov rcx, qword [rsi]
movzx dx, r14b
add dl, ch
lea rdx, [rax + rax]
add rdx, 2
clc
cmp r15b, 0x63
cmp r10b, r14b
cmp rdx, 0x1000
jmp 0x1403cf753
jb 0x1403cf6ef
mov rdi, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
test bp, r14w
stc
sub rcx, rdi
cmp rcx, 0x20
jmp 0x1403cf772
jae 0x1403cf86f
add rax, rax
add rax, 0x29
mov rdx, rax
movzx rcx, r14w
movzx ecx, bp
jmp 0x1403cf78e
mov rcx, rdi
jmp 0x1403cf796
jmp 0x1403cf6ef
mov rsi, qword [r13]
mov rdx, qword [r13 + 0x10]
test r9b, 0x90
cmp bh, 0x91
sub rdx, rsi
test r15b, 0xb3
test di, di
cmp rdx, 0x1000
jb 0x1403cf7f3
mov rax, qword [rsi - 8]
add rsi, 0xfffffffffffffff8
sub rsi, rax
cmp esi, ebp
cmc
clc
cmp rsi, 0x20
jmp 0x1403cf7d9
jae 0x1403cf86f
add rdx, 0x27
bswap rcx
mov cl, 0x6f
mov sil, r14b
mov rsi, rax
movsxd rcx, eax
xchg ch, cl
mov rcx, rsi
call fcn.140238558
mov qword [r13], r14
shl r12, 5
sub edi, 0x26da1150
movsx bx, r10b
lea r12, [r12 + r14]
clc
rol sil, cl
ror rbx, cl
mov qword [r13 + 8], r12
shl r15, 5
cmp dl, r12b
rcr rbx, 7
lea r15, [r15 + r14]
mov qword [r13 + 0x10], r15
movzx r12, bp
movaps xmm6, xmmword [rsp + 0x20]
movsx r13d, r15w
add rsp, 0x30
movsxd rbx, r10d
pop rbx
sets r12b
movsx r15, r11w
pop rdi
pop rsi
movsx r15, dx
jmp 0x1403cf858
pop r12
pop r13
movzx r15w, dil
movsx r15w, dl
movsx r14d, r11w
pop r14
pop r15
ret
call fcn.1404b833f
int3
Function at 0x1403de0a9
Capabilities:
Check for software breakpoints

Disassembly:
push r15
test dl, cl
btr r15, rcx
bt r15d, 0x8d
push r14
shr r15d, 0xc4
push r13
sub r15b, spl
sub r13, 0x6dad3ed5
push r12
push rsi
btc r13d, 0x2b
shld r14, rsp, 0x37
push rdi
bsf r14d, r15d
or r12w, 0x9ae
push rbp
push rbx
sub rsp, 0x38
not r14b
movaps xmmword [rsp + 0x20], xmm6
movsx r12w, spl
mov r14, r9
sbb r15w, r14w
mov r15, r8
mov r12, rdx
shrd ebx, r8d, 0x18
mov r13, rcx
sar ebx, 0x54
shld bx, bx, 0x8d
mov rbx, qword [rcx]
cmp r8b, 0xcc
test rbx, rbx
jmp 0x1403de11f
je 0x1403de245
mov rdi, qword [r13 + 8]
cmp rbx, rdi
je 0x1403de1df
lea rsi, [0x1400beb30]
xorps xmm6, xmm6
jmp 0x1403de16a
lea rbp, [rbx + 0x18]
jmp 0x1403de14a
call fcn.140238558
movups xmmword [rbp], xmm6
cmc
mov qword [rbp + 0x10], 0
add rbx, 0x30
cmc
cmp rbx, rdi
je 0x1403de1d8
mov qword [rbx], rsi
movsxd rcx, r14d
mov rcx, qword [rbx + 0x18]
test rcx, rcx
je 0x1403de15c
mov rdx, qword [rbx + 0x28]
clc
sub rdx, rcx
cmc
cmp cl, r10b
cmp rdx, 0x1000
jb 0x1403de141
mov rax, qword [rcx - 8]
jmp 0x1403de1a6
add rcx, 0xfffffffffffffff8
cmp dl, 0xd4
cmp r10, r13
sub rcx, rax
test bl, r15b
cmp rcx, 0x20
jae 0x1403de304
add rdx, 0x27
movzx rcx, dx
mov rcx, rdi
mov rcx, rax
jmp 0x1403de1d3
jmp 0x1403de141
mov rbx, qword [r13]
ror dx, cl
mov rdx, qword [r13 + 0x10]
cmp rbx, 0x3dc62182
clc
cmp r9, rdi
sub rdx, rbx
jmp 0x1403de1f6
cmp rdx, 0x1000
jmp 0x1403de202
jb 0x1403de238
mov rax, qword [rbx - 8]
cmc
add rbx, 0xfffffffffffffff8
clc
test ax, ax
sub rbx, rax
cmp bl, 0x3e
test sil, 0x4c
cmp rbx, 0x20
jmp 0x1403de228
jae 0x1403de304
add rdx, 0x27
movsxd rbx, ebp
mov rbx, rax
mov rcx, rbx
jmp 0x1403de240
call fcn.140238558
mov qword [r13], r12
dec al
lea rax, [r15 + r15*2]
btr bx, 0xf9
cmp dl, r15b
shl rax, 4
lea rax, [rax + r12]
add r15w, 0x2fe3
movsx r15d, bx
mov qword [r13 + 8], rax
and sil, 0x29
lea rax, [r14 + r14*2]
xor bpl, r11b
add r14w, di
shr bp, cl
shl rax, 4
cmovl r15w, r12w
btr r14, rsp
or sil, 0x96
lea rax, [rax + r12]
bts r15, r11
shrd ebp, eax, 0x6f
mov qword [r13 + 0x10], rax
sar r14w, cl
movaps xmm6, xmmword [rsp + 0x20]
adc r13b, spl
inc r12
mov r12d, 0x3ff03bf6
add rsp, 0x38
pop rbx
movsx di, dil
bswap r15w
pop rbp
mov edi, 0x8a3565c
xchg r14d, r14d
seto r14b
pop rdi
movsx r14d, r13w
jmp 0x1403de2df
pop rsi
pop r12
pop r13
movsx r15d, bp
cmovp r14w, si
movsx r15w, spl
pop r14
cmovle r15d, r13d
movzx r15d, r11w
pop r15
jmp 0x1403de303
ret
call fcn.1404b833f
int3
Function at 0x1403e9019
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
btc r15, rax
or r15b, r15b
mov r15b, 6
push r14
stc
add r14w, r8w
movsxd r14, r13d
push r13
add r15b, dl
dec r15w
push r12
cmovo r15w, r11w
sub r13b, r11b
push rsi
add r14b, r10b
sub r15d, 0x61b4555c
push rdi
btr r13w, dx
rol r13w, cl
shl r13b, 0xe0
push rbp
rcl r14d, cl
cmp si, r15w
push rbx
sar r14d, cl
cmc
shl bx, 0x49
sub rsp, 0x38
not r14
rol bx, cl
bsr r14d, ecx
movaps xmmword [rsp + 0x20], xmm6
rcr r12, 0x86
mov r14, r9
shld r13w, r14w, 0x3b
adc r15d, r12d
stc
mov r15, r8
inc r13b
mov r12, rdx
mov r13b, 0xfc
bts ebx, r9d
rcr bl, 0x90
mov r13, rcx
mov bx, sp
xchg bx, bx
mov rbx, qword [rcx]
test ebx, edx
cmp spl, 0x4a
jmp 0x1403e90ba
test rbx, rbx
je 0x1403e922a
mov rdi, qword [r13 + 8]
cmp spl, 0xc1
cmp al, bpl
cmp rbx, rdi
jmp 0x1403e90d6
je 0x1403e91c9
lea rbp, [0x1400bed10]
jmp 0x1403e90e8
movaps xmm6, xmmword [0x1400bd400]
jmp 0x1403e90f4
jmp 0x1403e911f
call fcn.140238558
movups xmmword [rbx + 0x20], xmm6
test r9b, 0x51
mov byte [rbx + 0x10], 0
cmc
add rbx, 0x50
test edi, r12d
stc
cmp dh, 0x7d
cmp rbx, rdi
je 0x1403e91b9
mov qword [rbx], rbp
jmp 0x1403e912d
lea rcx, [rbx + 0x38]
jmp 0x1403e9136
call fcn.1403e6483
mov rax, qword [rbx + 0x28]
cmc
cmp al, bl
cmp rax, 0x10
jmp 0x1403e914b
jb 0x1403e90fe
mov rcx, qword [rbx + 0x10]
mov dl, r11b
neg dx
lea rdx, [rax + 1]
clc
jmp 0x1403e9165
cmp rdx, 0x1000
jmp 0x1403e9171
jb 0x1403e90f9
mov rsi, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
cmp dx, cx
clc
sub rcx, rsi
cmp r9, r9
cmp rsi, 0xcad51c6
test rcx, rcx
cmp rcx, 0x20
jmp 0x1403e919c
jae 0x1403e92ec
add rax, 0x28
mov rdx, rax
xchg cx, cx
mov rcx, rsi
jmp 0x1403e91b4
jmp 0x1403e90f9
mov rbx, qword [r13]
cmovge dx, ax
rcl edx, 0x80
mov edx, 0x508c609b
mov rdx, qword [r13 + 0x10]
clc
sub rdx, rbx
cmp di, 0x562e
test r12w, 0x31f9
cmp rdx, 0x1000
jmp 0x1403e91e8
jb 0x1403e9222
mov rax, qword [rbx - 8]
cmp dl, r15b
add rbx, 0xfffffffffffffff8
sub rbx, rax
cmp r15w, bx
cmp rbx, 0x20
jae 0x1403e92ec
add rdx, 0x27
movzx ebx, cx
movzx cx, r11b
not cl
mov rbx, rax
bswap cx
cmovl ecx, r11d
mov rcx, rbx
call fcn.140238558
mov qword [r13], r12
or bpl, 0xc1
cmovp ebp, edi
test sp, 0x5857
lea rax, [r15 + r15*4]
sub bl, r13b
shl rax, 4
sub si, bp
lea rax, [rax + r12]
jmp 0x1403e9251
mov qword [r13 + 8], rax
lea rax, [r14 + r14*4]
test r10b, dil
shl rax, 4
xor si, 0x5925
add bh, 0xf7
adc bx, bx
add rax, r12
bswap di
bsf esi, r8d
sbb r12w, ax
mov qword [r13 + 0x10], rax
bsf di, r8w
bswap r13w
movaps xmm6, xmmword [rsp + 0x20]
and ebx, r12d
add rsp, 0x38
mov r12w, r12w
pop rbx
not r12b
movzx si, r15b
movsx rdi, r8w
pop rbp
movsx r14w, bl
movsx esi, r13w
setne r13b
pop rdi
setle r14b
movzx r13w, cl
cmova r15w, bp
pop rsi
bswap r15
movzx r12w, r9b
pop r12
cmovo r15, rdi
movzx r13, sp
pop r13
movzx r14w, r15b
cmovae r15w, r13w
pop r14
movsxd r15, r11d
pop r15
jmp 0x1403e92eb
ret
call fcn.1404b833f
int3
Function at 0x1403ea43f
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
test r10b, 0xd5
push r14
mov r14b, 0xc8
movsx r14d, r15w
push rsi
movzx r14, r11w
push rdi
push rbx
bt ebx, 0xd
sub rsp, 0x90
movaps xmmword [rsp + 0x80], xmm6
movsx edi, r11w
xchg bl, r14b
mov r14, rcx
mov dword [rcx + 8], 0
mov qword [rcx + 0x10], 0
bsf ebx, eax
rol dil, 0xde
movzx bx, r14b
mov rdi, qword [rcx + 0x18]
mov rbx, qword [rcx + 0x20]
clc
jmp 0x1403ea49c
cmp rdi, rbx
jmp 0x1403ea4a4
je 0x1403ea581
lea r15, [0x1400beb30]
jmp 0x1403ea4b6
xorps xmm6, xmm6
jmp 0x1403ea4f2
lea rsi, [rdi + 0x18]
jmp 0x1403ea4c7
call fcn.140238558
movups xmmword [rsi], xmm6
cmp ch, 0xba
mov qword [rsi + 0x10], 0
cmc
cmp bl, r14b
test ah, dh
add rdi, 0x30
cmc
cmp r13b, 0x5e
cmp rdi, rbx
je 0x1403ea570
mov qword [rdi], r15
movsxd rcx, esp
neg cl
mov rcx, qword [rdi + 0x18]
test rsp, rdx
test rcx, rcx
jmp 0x1403ea509
je 0x1403ea4e0
mov rdx, qword [rdi + 0x28]
sub rdx, rcx
stc
cmp rdx, 0x1000
jmp 0x1403ea523
jb 0x1403ea4be
mov rax, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
stc
test r8d, 0x17ef53aa
sub rcx, rax
jmp 0x1403ea546
cmp rcx, 0x20
jmp 0x1403ea54f
jae 0x1403ea6df
add rdx, 0x27
movsx ecx, r11w
not ecx
movzx cx, ah
mov rcx, rax
jmp 0x1403ea56b
jmp 0x1403ea4be
mov rax, qword [r14 + 0x18]
jmp 0x1403ea579
mov qword [r14 + 0x20], rax
movzx rax, r10w
mov qword [r14 + 0x30], 0
jmp 0x1403ea595
lea rax, [0x1400bed70]
jmp 0x1403ea5a1
mov qword [rsp + 0x28], rax
jmp 0x1403ea5ab
xorps xmm0, xmm0
movups xmmword [rsp + 0x38], xmm0
shl ax, cl
movups xmmword [rsp + 0x48], xmm0
btc ax, r8w
bsf rcx, rsi
movsx ax, bpl
movups xmmword [rsp + 0x58], xmm0
xor cx, r8w
movups xmmword [rsp + 0x68], xmm0
mov qword [rsp + 0x78], 0
lahf
jmp 0x1403ea5e6
mov dword [rsp + 0x30], 0
cmp r13b, r12b
lea rax, [r14 + 0x38]
mov dword [r14 + 0x40], 0
movzx cx, sil
shr ecx, 0x33
lea rcx, [rsp + 0x28]
cmp rax, rcx
jmp 0x1403ea612
je 0x1403ea68d
lea rcx, [r14 + 0x48]
stc
clc
sub edx, edx
clc
test r15w, r9w
sub r8d, r8d
call fcn.1403ec3c3
lea rcx, [r14 + 0x60]
mov rdx, qword [rsp + 0x50]
mov r8, qword [rsp + 0x58]
stc
sub r8, rdx
cmc
jmp 0x1403ea645
sar r8, 5
jmp 0x1403ea64e
call fcn.1403ec3c3
add r14, 0x78
mov rdx, qword [rsp + 0x68]
bsr cx, cx
mov r8, qword [rsp + 0x70]
shr ch, 0xca
rcr ch, cl
sub r8, rdx
sar ch, cl
movsx cx, dil
sar r8, 5
xchg rcx, rcx
jmp 0x1403ea680
mov rcx, r14
jmp 0x1403ea688
call fcn.1403ec3c3
lea rcx, [rsp + 0x28]
jmp 0x1403ea697
call fcn.1403ec182
movaps xmm6, xmmword [rsp + 0x80]
movsxd rsi, esi
add rsp, 0x90
xchg bl, bh
pop rbx
mov r14b, 0xc4
movsx r15, cx
movsx di, r9b
pop rdi
xchg si, si
movzx r14, sp
not r14b
pop rsi
movsx r15w, dil
xchg r14b, r14b
pop r14
setae r15b
pop r15
jmp 0x1403ea6de
ret
call fcn.1404b833f
int3
Function at 0x1403ec963
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
push r14
cmp spl, r8b
jmp 0x1403ec973
push rsi
push rdi
ror dil, cl
shrd rdi, rbp, 0xcb
bsr edi, r10d
push rbx
jmp 0x1403ec987
sub rsp, 0x30
movaps xmmword [rsp + 0x20], xmm6
mov edi, ecx
shrd di, ax, 0x10
mov rdi, qword [rcx]
test rdi, rdi
jmp 0x1403ec9a2
je 0x1403ecad3
mov r14, rcx
btc ebx, edi
mov rbx, qword [rcx + 8]
cmp rdi, rbx
je 0x1403eca63
lea r15, [0x1400beb30]
jmp 0x1403ec9c7
xorps xmm6, xmm6
jmp 0x1403ec9f7
lea rsi, [rdi + 0x18]
call fcn.140238558
movups xmmword [rsi], xmm6
test r9b, r12b
mov qword [rsi + 0x10], 0
test r11b, 0x59
add rdi, 0x30
cmp rdi, rbx
je 0x1403eca60
mov qword [rdi], r15
shld cx, di, 0x3f
bt rcx, rax
mov rcx, qword [rdi + 0x18]
test rcx, rcx
jmp 0x1403eca0f
je 0x1403ec9ea
mov rdx, qword [rdi + 0x28]
stc
test bh, 0xc4
sub rdx, rcx
cmp r15b, r10b
cmc
cmp rdx, 0x1000
jb 0x1403ec9cf
mov rax, qword [rcx - 8]
test r10d, ecx
cmc
add rcx, 0xfffffffffffffff8
sub rcx, rax
cmp ah, ch
cmp rcx, 0x20
jae 0x1403ecaf5
add rdx, 0x27
setae cl
mov rcx, rax
jmp 0x1403eca5b
jmp 0x1403ec9cf
mov rdi, qword [r14]
mov rdx, qword [r14 + 0x10]
sub rdx, rdi
cmp rdx, 0x1000
jmp 0x1403eca76
jb 0x1403ecaae
mov rax, qword [rdi - 8]
add rdi, 0xfffffffffffffff8
cmc
clc
sub rdi, rax
stc
cmp rdi, 0x20
jmp 0x1403eca93
jae 0x1403ecaf5
add rdx, 0x27
movzx cx, al
not edi
movsx di, cl
mov rdi, rax
movzx rcx, ax
mov rcx, rdi
jmp 0x1403ecab6
call fcn.140238558
xorps xmm0, xmm0
movups xmmword [r14], xmm0
mov qword [r14 + 0x10], 0
xor r15w, 0x4638
rol r14d, cl
movaps xmm6, xmmword [rsp + 0x20]
xadd bl, bh
add rsp, 0x30
pop rbx
movzx r14, sp
pop rdi
pop rsi
movzx r14w, r15b
pop r14
pop r15
jmp 0x1403ecaf4
ret
call fcn.1404b833f
int3