joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1404449ee
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
movzx ax, sil
push r14
push rsi
cbw
push rdi
inc eax
push rbp
rcl r14b, cl
rcr al, cl
push rbx
sub al, dil
sub rsp, 0x38
mov edi, r8d
bsr si, r10w
mov r14, rdx
mov rsi, rcx
mov rax, qword [rdx]
cmp dword [rax + 0x10], r8d
jne 0x140444a91
test r9d, r9d
jmp 0x140444a2e
je 0x140444c12
lea rcx, [rsp + 0x20]
mov rdx, r14
cmp r12b, r15b
xor r8d, r8d
jmp 0x140444a47
call fcn.14044398e
mov dword [rsi + 4], 0
jmp 0x140444a58
mov dword [rsi + 0xc], 0
mov dword [rsi + 0x10], edi
movss xmm0, dword [rsp + 0x30]
jmp 0x140444a6d
subss xmm0, dword [rsp + 0x2c]
movss dword [rsi + 8], xmm0
movss xmm0, dword [rsp + 0x24]
jmp 0x140444a83
movss dword [rsi], xmm0
jmp 0x140444a8c
jmp 0x140444cb2
mov dword [rsi + 4], 0
lea rcx, [rsp + 0x20]
btr rdx, 0xc2
sbb rdx, 0xb767b8b
sub ebx, ebx
rcr dh, cl
xor dh, 0xa5
bswap rdx
mov rdx, r14
cmc
xor r8d, r8d
call fcn.14044398e
mov eax, dword [rsp + 0x34]
stc
cmp r11b, 0xd5
cmp eax, edi
jmp 0x140444acf
jle 0x140444ae9
xor ebp, ebp
not cl
movsx rcx, r11w
mov ecx, eax
jmp 0x140444ae4
jmp 0x140444b64
sub ebx, ebx
not r15b
movsx r15w, r11b
mov r15b, cl
lea r15, [rsp + 0x20]
nop word cs:[rax + rax]
bswap bp
mov ebp, ebx
mov ebx, eax
movss xmm0, dword [rsp + 0x28]
jmp 0x140444b17
addss xmm0, dword [rsi + 4]
movss dword [rsi + 4], xmm0
movsxd r8, esi
jmp 0x140444b29
mov rcx, r15
bswap r8w
cdq
mov rdx, r14
mov r8w, r13w
mov r8d, eax
jmp 0x140444b40
call fcn.14044398e
mov ecx, dword [rsp + 0x34]
btr eax, esi
bsr ax, sp
lea eax, [rcx + rbx]
cmp r14w, dx
cmp eax, edi
jmp 0x140444b5e
jle 0x140444b08
mov dword [rsi + 0xc], ebx
mov dword [rsi + 0x10], ecx
jmp 0x140444b6f
movss xmm0, dword [rsp + 0x30]
jmp 0x140444b7a
subss xmm0, dword [rsp + 0x2c]
movss dword [rsi + 8], xmm0
jmp 0x140444b90
mov dword [rsi + 0x14], ebp
cmc
clc
cmp ebx, 0x20b261d0
movss xmm0, dword [rsp + 0x20]
test bpl, 0xe6
stc
cmp ch, 0x6b
movss dword [rsi], xmm0
jmp 0x140444bb2
cmp ebx, edi
jmp 0x140444bb9
jge 0x140444cb2
sub edi, ebx
movsx r8, r11w
xor ebp, ebp
not dl
nop dword [rax]
mov rcx, r14
cdq
movsx r8w, bl
mov edx, ebx
mov r8d, ebp
jmp 0x140444be3
call fcn.140444227
addss xmm0, dword [rsi]
movss dword [rsi], xmm0
jmp 0x140444bf5
inc ebp
cmp r9d, esi
clc
jmp 0x140444c00
cmp edi, ebp
jmp 0x140444c07
jne 0x140444bd0
jmp 0x140444cb2
xorps xmm0, xmm0
movlps qword [rsi], xmm0
mov dword [rsi + 8], 0x3f800000
test r11b, 0x6a
sub eax, eax
cmc
jmp 0x140444c2b
test edi, edi
jmp 0x140444c32
jle 0x140444c97
lea rbp, [rsp + 0x20]
cqo
cwd
nop word cs:[rax + rax]
mov cx, 0x6751
cmovbe dx, ax
mov ebx, eax
movzx r8w, r9b
movsxd rdx, r10d
mov rcx, rbp
movzx dx, spl
mov rdx, r14
not r8b
movsx r8w, dil
mov r8d, eax
jmp 0x140444c79
call fcn.14044398e
mov eax, dword [rsp + 0x34]
clc
add eax, ebx
cmp eax, edi
jmp 0x140444c8c
jl 0x140444c54
jmp 0x140444c99
xor ebx, ebx
mov dword [rsi + 0xc], eax
clc
and r14b, r12b
add r15b, sil
mov dword [rsi + 0x10], 0
mov dword [rsi + 0x14], ebx
movzx r14w, r14b
add rsp, 0x38
mov r14w, cx
cmovbe r15w, r8w
pop rbx
pop rbp
pop rdi
xchg r14b, r14b
sets sil
pop rsi
setp r15b
pop r14
pop r15
jmp 0x140444cd7
ret
Function at 0x140448e24
Capabilities:
Log keystrokes via polling

Disassembly:
sub rsp, 0x28
jmp 0x140448e2d
movzx ecx, cx
call qword [sym.imp.USER32.dll_GetKeyState]
movzx eax, ax
cmp bl, 0xdc
cmp eax, 0x100
xchg al, al
setae al
add rsp, 0x28
ret

Function at 0x14044a59b
Capabilities:
Access peb ldr_data
Encrypt data using speck

Disassembly:
sub rsp, 0x28
cdqe
movsx rax, r9w
mov rcx, qword [rcx]
setne al
mov rax, qword [rcx]
jmp 0x14044a5b3
call qword [rax + 0x28]
test eax, eax
jmp 0x14044a5bd
je 0x14044a601
mov ecx, eax
adc dl, spl
movabs r8, 0xcafa59766d7f94e
stc
rol dl, 0x86
mov dl, 3
bt r9, rdx
adc r9b, 0x9b
mov r9d, 0x2a
test rsi, 0x2bf37cc6
stc
jmp 0x14044a5f3
add rsp, 0x28
jmp 0x14044a5fc
jmp fcn.1403b3ff8
nop
stc
add rsp, 0x28
jmp 0x14044a60c
ret

Function at 0x14044b9fc
Capabilities:
Execute anti-debugging instructions

Disassembly:
push rsi
dec sil
stc
push rdi
sbb rax, 0x152b70da
movzx rsi, r10w
sub rsp, 0xa8
mov si, r13w
sets ah
movaps xmmword [rsp + 0x90], xmm10
jmp 0x14044ba2d
movaps xmmword [rsp + 0x80], xmm9
movaps xmmword [rsp + 0x70], xmm8
movsx rdi, sp
movsxd rsi, eax
not esi
movaps xmmword [rsp + 0x60], xmm7
movsx rsi, sp
movsx ax, r12b
cdqe
movaps xmmword [rsp + 0x50], xmm6
bswap ax
xchg al, dil
movsx edi, cx
movaps xmm9, xmm3
xchg rsi, rax
cwde
mov rdi, rdx
mov rsi, rcx
bswap rax
movzx ax, r11b
movss xmm8, dword [rsp + 0xe0]
cdqe
mov rcx, qword [rcx + 0x20]
movups xmm0, xmmword [r8]
movsx rax, si
movsx ax, spl
movaps xmmword [rsp + 0x30], xmm0
cdq
mov al, r11b
rdtsc
mov rax, qword [rcx]
jmp 0x14044baab
lea rdx, [rsp + 0x30]
jmp 0x14044bab5
call qword [rax + 0x40]
movsd xmm7, qword [rdi]
movaps xmm0, xmm7
jmp 0x14044bac4
call fcn.1404bd10b
movaps xmm10, xmm0
jmp 0x14044bad2
shufps xmm7, xmm7, 0x55
movaps xmm0, xmm7
jmp 0x14044bade
call fcn.1404bd10b
unpcklps xmm10, xmm0
addps xmm10, xmmword [0x1400bd4e0]
movlps qword [rdi], xmm10
movlps qword [rsp + 0x30], xmm10
movsd xmm7, qword [rdi + 8]
jmp 0x14044bb03
movaps xmm0, xmm7
jmp 0x14044bb0b
call fcn.1404bd10b
movaps xmm6, xmm0
jmp 0x14044bb18
shufps xmm7, xmm7, 0x55
movaps xmm0, xmm7
call fcn.1404bd10b
movss dword [rdi + 8], xmm6
jmp 0x14044bb2e
unpcklps xmm6, xmm0
movss dword [rdi + 0xc], xmm0
addps xmm6, xmm10
movlps qword [rsp + 0x38], xmm6
movss dword [rsp + 0x40], xmm9
movss dword [rsp + 0x44], xmm9
movsx rcx, cx
mov rcx, qword [rsi + 0x18]
rdtsc
cwd
mov al, sil
mov r8, qword [rsi + 0x20]
bswap dx
movzx rax, bp
mov rax, qword [rcx]
not edx
mov dx, 0x532f
cmovge dx, dx
mov qword [rsp + 0x20], 0
movzx rdx, r14w
lea rdx, [rsp + 0x30]
jmp 0x14044bb8b
movaps xmm3, xmm8
jmp 0x14044bb94
call qword [rax + 0x90]
movaps xmm6, xmmword [rsp + 0x50]
bts edi, r12d
movsx si, r10b
movaps xmm7, xmmword [rsp + 0x60]
movaps xmm8, xmmword [rsp + 0x70]
rol dil, cl
rcr edi, cl
clc
movaps xmm9, xmmword [rsp + 0x80]
movaps xmm10, xmmword [rsp + 0x90]
add rsp, 0xa8
mov dil, al
movzx edi, bp
movsx esi, r10w
pop rdi
setg sil
xchg sil, sil
pop rsi
jmp 0x14044bbea
ret
Function at 0x14044d5e5
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
sub rsp, 0x18
neg eax
mov r8, rcx
btc ax, r14w
mov eax, 0x5a4d
cmc
cmp r8w, r11w
cmp word [0x140000000], ax
jmp 0x14044d609
jne 0x14044d71c
movsxd rcx, dword [0x14000003c]
cmp sp, r13w
or dh, 0xf
sbb dl, dh
lea rdx, [0x140000000]
lea rcx, [rcx + rdx]
cmp dword [rcx], 0x4550
jne 0x14044d71c
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jmp 0x14044d644
jne 0x14044d71c
sub r8, rdx
bt eax, r10d
mov dl, 0x48
cdq
movzx edx, word [rcx + 0x14]
mov r9b, 0x9b
add rdx, 0x18
movzx r9w, r13b
movzx eax, bp
lea rdx, [rdx + rcx]
movzx eax, word [rcx + 6]
lea rcx, [rax + rax*4]
stc
cmovb r9w, si
lea r9, [rdx + rcx*8]
jmp 0x14044d686
mov qword [rsp], rdx
cmp rdx, r9
je 0x14044d6d5
mov ecx, dword [rdx + 0xc]
jmp 0x14044d69c
cmp r8, rcx
jmp 0x14044d6a4
jb 0x14044d6cc
mov eax, dword [rdx + 8]
cmp r13b, 0x6d
clc
jmp 0x14044d6b7
add eax, ecx
clc
test r9b, 0xcc
cmp r8, rax
jmp 0x14044d6c6
jb 0x14044d6e0
add rdx, 0x28
jmp 0x14044d686
xor edx, edx
jmp 0x14044d6e0
test rdx, rdx
jmp 0x14044d6e8
jne 0x14044d6f5
sub al, al
jmp 0x14044d72b
cmp dword [rdx + 0x24], 0
jmp 0x14044d6fe
jge 0x14044d710
xor al, al
jmp 0x14044d70b
jmp 0x14044d72b
mov al, 1
jmp 0x14044d717
jmp 0x14044d72b
xor al, al
jmp 0x14044d72b
add rsp, 0x18
jmp 0x14044d734
ret
Function at 0x14045f079
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
mov qword [rsp + 0x20], rbx
add al, 0x98
push rbp
xor al, r12b
xchg rbp, rax
inc bpl
mov rbp, rsp
sub rax, 0x6d27227b
sub rsp, 0x20
sar ah, 0xc4
mov rax, qword [0x1400b7288]
bsr rbx, r10
and bh, 0x6c
movabs rbx, 0x2b992ddfa232
cmp rax, rbx
jmp 0x14045f0ba
jne 0x14045f17c
and qword [rbp + 0x18], 0
xchg ch, cl
bswap ecx
lea rcx, [rbp + 0x18]
jmp 0x14045f0d2
call qword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
mov rax, qword [rbp + 0x18]
jmp 0x14045f0e1
mov qword [rbp + 0x10], rax
jmp 0x14045f0ea
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov eax, eax
xor qword [rbp + 0x10], rax
jmp 0x14045f0fb
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov eax, eax
lea rcx, [rbp + 0x20]
xor qword [rbp + 0x10], rax
jmp 0x14045f110
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov eax, dword [rbp + 0x20]
sub ecx, 0x77b622d6
stc
bts cx, bx
lea rcx, [rbp + 0x10]
shl rax, 0x20
clc
xor rax, qword [rbp + 0x20]
stc
xor rax, qword [rbp + 0x10]
stc
xor rax, rcx
cmovns bp, r12w
sal ch, cl
movabs rcx, 0xffffffffffff
and rax, rcx
sal ecx, 0x49
movabs rcx, 0x2b992ddfa233
sar bpl, 0xd3
bsr bp, r11w
cmp rax, rbx
movsxd rbp, r12d
movzx ebx, ax
cmove rax, rcx
mov qword [0x1400b7288], rax
rcr bpl, 0x86
mov rbx, qword [rsp + 0x48]
not rax
rcl bpl, cl
mov qword [0x1400b7280], rax
test si, 0x23f3
neg ebp
add rsp, 0x20
pop rbp
jmp 0x14045f19f
ret
Function at 0x1404a3dfe
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x10], rbx
test r13b, r10b
jmp 0x1404a3e14
mov qword [rsp + 0x18], rbp
dec bp
shr bpl, 0x42
push rsi
push rdi
push r12
movsx bp, r13b
push r14
sal r14b, cl
movsx r14w, bl
bsf edi, ebp
push r15
and si, dx
cmp r14, 0x637a78a9
or bpl, bpl
sub rsp, 0x20
bts bp, ax
test rdx, rdx
xchg rdi, rdi
movzx rdi, bp
lea r14, [rsp + 0x50]
mov bpl, 2
xchg dil, sil
mov rsi, rcx
not r15d
mov rdi, rcx
movzx ecx, byte [rcx]
cmovge rbp, r13
cmovne r14, rdx
jmp 0x1404a3e7b
mov r15, r9
not rbp
movsx rbp, r9w
mov ebp, r8d
jmp 0x1404a3e8d
jmp 0x1404a3e9d
inc rdi
movzx ecx, byte [rdi]
jmp 0x1404a3e9d
call fcn.1404bcbdf
test eax, eax
jmp 0x1404a3ea9
jne 0x1404a3e92
mov bl, byte [rdi]
add al, 0x53
lea eax, [rbx - 0x2b]
cmc
cmp ax, 0x5939
clc
test al, 0xfd
jmp 0x1404a3ec3
je 0x1404a3ed5
mov bl, 0x2b
jmp 0x1404a3ed0
jmp 0x1404a3ee0
inc rdi
not edx
movzx r9, r9w
bswap ecx
mov r9, r15
mov r8d, ebp
cqo
mov rdx, r14
mov rcx, rdi
jmp 0x1404a3ef3
call fcn.1404a4022
mov rcx, rax
clc
or bpl, 0x5f
dec bpl
mov bpl, 0x2d
movabs r12, 0x8000000000000000
cmp rdi, qword [r14]
jne 0x1404a3f26
mov qword [r14], rsi
jmp 0x1404a3f21
jmp 0x1404a3f2f
cmp rsi, qword [r14]
jne 0x1404a3f3d
test rcx, rcx
jmp 0x1404a3f37
jne 0x1404a3f7a
cmp bl, 0x2b
jmp 0x1404a3f45
jne 0x1404a3f63
movabs rax, 0x7fffffffffffffff
cmp rcx, rax
jmp 0x1404a3f5d
ja 0x1404a3f7a
cmp bl, bpl
jmp 0x1404a3f6b
jne 0x1404a3fba
cmp rcx, r12
jbe 0x1404a3fba
call fcn.1404ba009
mov dword [rax], 0x22
cmp rax, 0x20ea5624
clc
cmc
test r15, r15
je 0x1404a3fa5
mov dword [r15], 1
test r15b, 0x33
cmp bl, r11b
sub bl, bpl
neg bl
jmp 0x1404a3faf
sbb rax, rax
add rax, r12
jmp 0x1404a3fde
mov rax, rcx
neg rax
shl r15w, cl
cmp bl, bpl
mov dil, 0x99
cmovnp si, di
cmove rcx, rax
btc rax, rax
xor si, 0x4922
mov rax, rcx
mov rbx, qword [rsp + 0x58]
shr r15b, cl
movsx ebp, r14w
mov rbp, qword [rsp + 0x60]
rcr r12d, cl
rol r14b, cl
add rsp, 0x20
pop r15
mov si, 0x49ad
movsx esi, r15w
pop r14
movzx si, r8b
mov r12b, r13b
pop r12
cmovae di, di
pop rdi
movsx rsi, r12w
mov sil, dl
pop rsi
jmp 0x1404a4021
ret

Function at 0x1404a4f9f
Capabilities:
Get geographical location

Disassembly:
sub rsp, 0x28
test r9b, r9b
and dword [rsp + 0x30], 0
call fcn.1404af2c6
mov r9d, 2
movsx edx, r12w
lea r8, [rsp + 0x30]
movzx ecx, r14w
mov rcx, qword [rax + 0x28]
lea edx, [r9 + 0x20]
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
movzx ecx, word [rsp + 0x30]
jmp 0x1404a4fdb
sub ecx, 0x30
jmp 0x1404a4fe3
je 0x1404a502f
sub ecx, 1
jmp 0x1404a4ff1
je 0x1404a5020
cmp ecx, 1
jmp 0x1404a4fff
je 0x1404a5011
sub eax, eax
jmp 0x1404a500c
jmp 0x1404a5035
mov eax, 3
jmp 0x1404a501b
jmp 0x1404a5035
mov eax, 1
jmp 0x1404a502a
jmp 0x1404a5035
mov eax, 2
clc
add rsp, 0x28
jmp 0x1404a503e
ret
Function at 0x1404a5e70
Capabilities:
Terminate process

Disassembly:
push rbx
movsx bx, ah
movzx ebx, r12w
sub rsp, 0x20
bts bx, r13w
sub bl, spl
add bl, 0x7d
mov rbx, rcx
cmp sil, cl
cmp r8w, 0xde8
xor ecx, ecx
jmp 0x1404a5e9c
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, rbx
jmp 0x1404a5eaa
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov edx, 0xc0000409
add rsp, 0x20
bswap rbx
not bh
movsx rbx, r12w
pop rbx
jmp 0x1404a5ed1
jmp qword [sym.imp.KERNEL32.dll_TerminateProcess]
Function at 0x1404a6400
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov rax, rsp
movsxd r10, edi
add r10, rbp
xadd r10, r11
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
adc bp, 0xb98
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
shl di, cl
mov bl, byte [rcx]
or r14w, di
bts esi, edi
lea r10, [rcx + 1]
stc
mov byte [rdx], bl
bsr di, ax
btc r14w, 0x66
mov esi, r9d
xchg bpl, r14b
jmp 0x1404a644c
lea r14, [0x140000000]
shl bpl, cl
not r11b
xor r11b, 0x41
mov rbp, r8
cmovnp r11w, bp
mov r11, rdx
rcr rdi, cl
mov rdi, rcx
cmp bpl, r11b
jmp 0x1404a6477
test bl, 4
jmp 0x1404a647f
je 0x1404a64c7
movzx ecx, byte [r10]
rcl eax, 0xb3
sar ax, cl
and ecx, 0xf
movsx rax, byte [rcx + r14 + 0xc1a30]
cmc
test esp, 0x12d336e0
mov cl, byte [rcx + r14 + 0xc1a40]
test bx, 0x2cb8
stc
test r9b, r8b
sub r10, rax
mov eax, dword [r10 - 4]
cmc
cmp rsi, rdx
shr eax, cl
mov dword [rdx + 4], eax
test r15b, dil
cmc
test bl, 8
jmp 0x1404a64cf
je 0x1404a64e3
mov eax, dword [r10]
add r10, 4
mov dword [rdx + 8], eax
test r13b, 0x28
test bl, 0x10
jmp 0x1404a64eb
je 0x1404a6510
mov eax, dword [r10]
btc r8w, 0xe2
bsf r8d, r12d
add r10, 4
mov dword [rdx + 0xc], eax
add r8w, 0x790e
adc r8d, r15d
cdqe
movsxd rax, dword [r10]
sal r8b, 0x87
lea r8, [r10 + 4]
stc
clc
xor r9d, r9d
jmp 0x1404a6526
cmp byte [rsp + 0x30], r9b
jne 0x1404a65d0
test bl, 2
jmp 0x1404a6539
je 0x1404a65d0
lea rdx, [rax + rbp]
xchg ah, ah
movzx ecx, byte [rdx]
jmp 0x1404a6555
and ecx, 0xf
movsx rax, byte [rcx + r14 + 0xc1a30]
mov cl, byte [rcx + r14 + 0xc1a40]
sub rdx, rax
mov r10d, dword [rdx - 4]
stc
test r8w, ax
shr r10d, cl
mov dword [r11 + 0x10], r9d
test r10d, r10d
jmp 0x1404a6584
je 0x1404a65d3
mov eax, dword [rdx]
bsf cx, r9w
mov ecx, dword [rdx + 4]
lea rdx, [rdx + 8]
cmc
cmp al, 0xd3
clc
cmp eax, esi
jmp 0x1404a65a3
je 0x1404a65c2
inc r9d
cmp r8d, r12d
cmp r9d, r10d
jmp 0x1404a65b7
jb 0x1404a658a
jmp 0x1404a65d3
mov dword [r11 + 0x10], ecx
jmp 0x1404a65cb
jmp 0x1404a65d3
mov dword [rdx + 0x10], eax
test bl, 1
je 0x1404a6632
movzx ecx, byte [r8]
and ecx, 0xf
sub dh, 0xe4
btc rbx, r15
movsx rdx, byte [rcx + r14 + 0xc1a30]
bt rsi, r10
mov cl, byte [rcx + r14 + 0xc1a40]
test r13w, 0x2cfb
ror ah, 0xea
sub r8, rdx
clc
mov edx, dword [r8 - 4]
movzx r14w, r11b
shr r14w, cl
shr edx, cl
shrd rax, rsp, 0x47
sal ax, 0xe6
sar esi, cl
mov dword [r11 + 0x14], edx
or ax, r10w
cmovle rax, r9
mov rbx, qword [rsp + 0x10]
cmovb si, r15w
shl al, cl
sub r8, rdi
mov rbp, qword [rsp + 0x18]
movsxd rsi, r14d
mov rax, r8
xchg r14, rsi
movsx si, bpl
movzx r14d, r10w
mov rsi, qword [rsp + 0x20]
mov rdi, qword [rsp + 0x28]
movsx r14, r12w
not r14b
pop r14
jmp 0x1404a6670
ret
Function at 0x1404a6877
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x10], rbx
clc
test sp, 0x6a3e
mov qword [rsp + 0x18], rbp
push rsi
movzx esi, di
rol rsi, 0x1e
xor si, 0x7e0c
push rdi
stc
xor rsi, 0x572b4752
rol di, cl
push r12
shr r12b, 0xa5
push r14
btc r12, r13
push r15
bts r14d, ebp
cmc
sar r15b, 0x7b
sub rsp, 0x20
movsxd rdi, r15d
bswap di
mov esi, dword [r8 + 0xc]
bswap r14d
movzx r14d, r10w
jmp 0x1404a68d1
mov r12, rcx
bswap rdi
mov rcx, r8
mov r15b, 0x37
mov rdi, r9
mov r14, r8
mov r15, rdx
jmp 0x1404a68eb
call fcn.14011404e
mov r10, qword [r12]
cmp r13b, 0xe6
bsf ebp, eax
mov ebp, eax
test dil, 0xa3
stc
mov qword [rdi], r10
clc
test esi, esi
jmp 0x1404a690d
je 0x1404a6a3c
movsxd rax, dword [r14 + 0x10]
xchg bx, bx
shl rbx, cl
lea ecx, [rsi - 1]
dec si
mov bx, 0x8cd
mov esi, ecx
lea rcx, [rcx + rcx*4]
bt bx, ax
lea rbx, [rax + rcx*4]
add rbx, qword [r15 + 8]
test dl, r10b
cmp ebp, dword [rbx + 4]
jmp 0x1404a6944
jle 0x1404a6906
cmp ebp, dword [rbx + 8]
jmp 0x1404a6952
jg 0x1404a6906
mov rcx, qword [r15]
add dx, 0x3f45
shl dh, 0xe2
lea rdx, [rsp + 0x50]
sub r8d, r8d
jmp 0x1404a6970
call qword [sym.imp.KERNEL32.dll_RtlLookupFunctionEntry]
movsxd r8, dword [rbx + 0x10]
xor r9d, 0x2cd90932
bts r9d, edx
xor ecx, ecx
movsxd r10, r13d
bts r10w, bp
add r8, qword [rsp + 0x50]
sub r9b, 9
sal r9b, cl
mov r9d, dword [rbx + 0xc]
test r14w, 0x55e3
mov r10d, dword [rax]
stc
cmc
test r9d, r9d
jmp 0x1404a69b2
je 0x1404a69fe
lea rdx, [r8 + 0xc]
movsx rax, r10w
movzx ax, r13b
or ax, 0x1f53
movsxd rax, dword [rdx]
cmp r8w, si
test sp, 0x271c
cmp rax, r10
jmp 0x1404a69dd
je 0x1404a69fe
inc ecx
add rdx, 0x14
cmp r8d, 0xcc75ebb
cmp ecx, r9d
jmp 0x1404a69f8
jb 0x1404a69c9
cmp ecx, r9d
jmp 0x1404a6a06
jae 0x1404a6906
mov rax, qword [r12]
movzx r14w, al
lea rcx, [rcx + rcx*4]
movsxd rcx, dword [r8 + rcx*4 + 0x10]
rcr bp, 0x9e
shr bp, cl
ror r15w, 0xc7
mov rcx, qword [rcx + rax]
bsf r14, rbp
mov qword [rdi], rcx
shl al, 0x87
xadd bx, si
mov rbx, qword [rsp + 0x58]
stc
sub al, 0xa6
mov rax, rdi
sbb r14w, r10w
mov rbp, qword [rsp + 0x60]
bt r12, 0x80
btc rdi, 0xce
or sil, 0x43
add rsp, 0x20
pop r15
movsx rsi, di
pop r14
pop r12
movsx di, r10b
pop rdi
cmovo si, r13w
movzx esi, r15w
pop rsi
jmp 0x1404a6a81
ret
Function at 0x1404a6c50
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
sal ebx, 0x6e
shl rbx, cl
push rdi
bsf rbx, r8
push r12
push r13
push r14
adc r12, 0x56be585e
rcl r12, 0x1f
push r15
and r15d, r8d
sub rsp, 0x40
mov rbx, qword [rsp + 0x90]
cmovno r12, r8
movsx rbp, r13w
mov r12w, 0x50c3
mov r12, rdx
not r15w
mov rbp, rcx
movsx cx, r15b
not r14w
bswap r15d
mov rdx, r9
movzx rdi, r8w
seto r15b
movsx r15d, r14w
mov rcx, rbx
setbe r15b
mov rdi, r9
not r14b
mov r15d, r8d
movzx r14w, spl
movsx r14, r15w
mov r14d, dword [rbx + 0xc]
jmp 0x1404a6ce0
call fcn.14011404e
xor r10d, r10d
ror sil, cl
rcr si, cl
mov esi, eax
test r14d, r14d
je 0x1404a6f40
mov r11, qword [rdi + 8]
or eax, 0xffffffff
movsxd rbx, dword [rbx + 0x10]
sub r8b, 0x62
clc
sar r13b, 0xb8
mov r9d, eax
movsx rdx, r10w
rcl r13b, 0xb9
mov r13d, eax
mov edx, r14d
movzx ax, bpl
lea r8d, [rdx - 1]
rol eax, 0xb3
xor al, r9b
movsx ax, r9b
lea rcx, [r8 + r8*4]
lea rax, [r11 + rcx*4]
cmp esi, dword [rax + rbx + 4]
jle 0x1404a6d53
cmp esi, dword [rax + rbx + 8]
jmp 0x1404a6d4d
jle 0x1404a6d6a
mov edx, r8d
test r14d, eax
cmp sil, cl
test r8d, r8d
jmp 0x1404a6d64
jne 0x1404a6d23
mov r8d, r10d
cmc
stc
test edx, edx
jmp 0x1404a6d76
je 0x1404a6d99
lea eax, [rdx - 1]
cqo
lea rax, [rax + rax*4]
ror dx, cl
lea rdx, [rbx + rax*4]
jmp 0x1404a6d91
add rdx, r11
jmp 0x1404a6da4
mov rdx, r10
shl cx, cl
sbb cx, 0x6366
lea rcx, [r11 + rbx]
test bp, 0x4c89
cmp r12w, r15w
or r11d, 0xffffffff
test rdx, rdx
jmp 0x1404a6dbd
je 0x1404a6dee
mov eax, dword [rdx + 4]
cmp bp, 0x7efa
test r9b, 0xf5
stc
cmp dword [rcx], eax
jmp 0x1404a6dd7
jle 0x1404a6e2c
mov eax, dword [rdx + 8]
cmp dword [rcx + 4], eax
jmp 0x1404a6de8
jg 0x1404a6e2c
cmp r15d, dword [rcx]
jmp 0x1404a6df6
jl 0x1404a6e2c
cmp r15d, dword [rcx + 4]
jg 0x1404a6e2c
cmp r9d, r11d
movsx r13w, r11b
sete r13b
not r13b
mov eax, r8d
mov r13d, r8d
jmp 0x1404a6e20
cmovne eax, r9d
mov r9d, eax
jmp 0x1404a6e2c
inc r8d
add rcx, 0x14
clc
test rbp, r14
cmp r10b, r13b
cmp r8d, r14d
jb 0x1404a6db5
cmp r9d, r11d
mov qword [rsp + 0x20], r12
movsx rdi, r12w
mov eax, r10d
jmp 0x1404a6e57
mov qword [rsp + 0x30], r12
movsx si, r15b
mov r12w, cx
cmovne eax, r9d
lea r11, [rsp + 0x40]
xchg dil, bl
movsxd r12, r12d
mov rbx, qword [r11 + 0x30]
mov si, 0x4d1
movsxd rsi, ecx
movsx r14, r11w
mov rsi, qword [r11 + 0x40]
not di
mov dword [rsp + 0x28], eax
cwde
movzx di, r14b
movsxd rax, esi
lea eax, [r13 + 1]
movzx r14w, sil
mov dil, bl
movups xmm0, xmmword [rsp + 0x20]
cmovge r15d, eax
xchg r12w, r15w
cmovne r10d, eax
movzx r15, cx
movzx di, cl
sete r14b
mov rax, rbp
mov dil, dl
movsx r12d, ax
mov dword [rsp + 0x38], r10d
movsx r12w, sil
movsxd rdi, esi
cmovg di, bp
movups xmm1, xmmword [rsp + 0x30]
mov r12w, r9w
setle r12b
movdqu xmmword [rbp], xmm0
jmp 0x1404a6ef2
movdqu xmmword [rbp + 0x10], xmm1
mov rbp, qword [r11 + 0x38]
movsx rdi, sp
xchg r14b, r13b
mov rsp, r11
setae r13b
pop r15
movzx di, dl
movzx r13, si
mov edi, r14d
pop r14
movsx r13w, cl
movzx r13d, sp
movsx r12, di
pop r13
bswap rdi
movsx r12d, r8w
jmp 0x1404a6f33
pop r12
setle dil
pop rdi
jmp 0x1404a6f3f
ret
call fcn.1404bbefa
int3
Function at 0x1404a7c95
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
clc
mov qword [rsp + 0x18], rdi
movsx rsi, r11w
movsx si, r14b
add sil, r14b
push r14
test bpl, bl
sub rsp, 0x20
rcr sil, cl
cmp byte [rcx + 8], 0
seta r14b
not rsi
movsx si, r14b
mov r14, rdx
movzx rsi, r15w
movsx rsi, dx
movzx si, r15b
mov rsi, rcx
jmp 0x1404a7ce5
je 0x1404a7d98
mov rax, qword [rcx]
test ch, al
test rax, rax
jmp 0x1404a7cf8
je 0x1404a7d98
or rdi, 0xffffffffffffffff
jmp 0x1404a7d07
inc rdi
cmp dh, 0xb6
cmp r12, rdi
clc
cmp byte [rax + rdi], 0
jmp 0x1404a7d1a
jne 0x1404a7d07
lea rcx, [rdi + 1]
jmp 0x1404a7d29
call fcn.1401a0fe4
mov rbx, rax
test r12b, 0xb1
test rax, rax
jmp 0x1404a7d3d
je 0x1404a7d86
mov r8, qword [rsi]
mov cl, r10b
lea rdx, [rdi + 1]
setbe cl
movzx cx, dl
mov rcx, rax
jmp 0x1404a7d5c
call fcn.1404cdea3
mov rax, rbx
and rcx, 0x5f113293
dec cx
mov byte [r14 + 8], 1
mov qword [r14], rax
movsxd rcx, ebp
movsx cx, r14b
xor ebx, ebx
bswap rcx
mov cx, di
mov rcx, rbx
jmp 0x1404a7d8e
call fcn.1400e0209
jmp 0x1404a7db8
mov rax, qword [rcx]
not bh
movzx rdi, r12w
mov qword [rdx], rax
add di, 0x154f
adc rsi, 0x53833808
mov byte [rdx + 8], 0
cmc
bswap r14
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
dec r14b
xor dil, r9b
mov rdi, qword [rsp + 0x40]
add rsp, 0x20
movsx r14w, r13b
mov r14b, r13b
pop r14
jmp 0x1404a7de0
ret
Function at 0x1404b1e13
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x10], rbx
sub bx, 0x78e0
mov qword [rsp + 0x18], rsi
xor ah, 0xd1
or bl, r15b
push rdi
sub rsp, 0x50
movzx eax, r13w
mov rax, qword [0x1400b7288]
add bl, r15b
xor rax, rsp
rol ebx, 0xb3
dec bl
mov qword [rsp + 0x40], rax
cmp byte [rcx + 0x54], 0
cmovle bx, r12w
bswap bx
jmp 0x1404b1e59
mov rbx, rcx
jmp 0x1404b1e61
je 0x1404b1f57
cmp dword [rcx + 0x50], 0
jmp 0x1404b1e70
jle 0x1404b1f57
mov rsi, qword [rcx + 0x48]
cdqe
shld rcx, r14, 0x27
xor edi, edi
mov rax, qword [rbx + 8]
setge r9b
btc rcx, 0x19
lea rdx, [rsp + 0x34]
rol r9b, cl
movzx r9d, word [rsi]
mov r8d, r11d
lea rcx, [rsp + 0x30]
shl r8b, 0xa1
and dword [rsp + 0x30], 0
movsxd r8, r14d
lea rsi, [rsi + 2]
movsxd r8, esp
cmove r8w, bp
mov r8d, 6
jmp 0x1404b1ec7
mov qword [rsp + 0x20], rax
jmp 0x1404b1ed1
call fcn.1404d56b7
test eax, eax
jne 0x1404b1f49
mov r8d, dword [rsp + 0x30]
test rsi, rcx
cmc
stc
test r8d, r8d
jmp 0x1404b1ef0
je 0x1404b1f49
lea rax, [rbx + 0x10]
movzx r9d, r14w
movzx dx, r9b
jmp 0x1404b1f08
lea r9, [rbx + 0x28]
cmovp dx, r13w
mov qword [rsp + 0x20], rax
lea rcx, [rbx + 0x468]
movzx dx, r10b
mov dh, dl
lea rdx, [rsp + 0x34]
jmp 0x1404b1f2e
call fcn.1404b0203
inc edi
clc
cmp edi, dword [rbx + 0x50]
jmp 0x1404b1f3e
jne 0x1404b1e83
jmp 0x1404b1f94
or dword [rbx + 0x28], 0xffffffff
jmp 0x1404b1f52
jmp 0x1404b1f94
mov r8d, dword [rbx + 0x50]
cmovae r9, r10
cmp bpl, al
lea rax, [rcx + 0x10]
neg dx
mov rdx, qword [rbx + 0x48]
mov r9w, 0xca1
shl r9, cl
lea r9, [rcx + 0x28]
clc
cmc
test ch, 0xda
add rcx, 0x468
mov qword [rsp + 0x20], rax
jmp 0x1404b1f8f
call fcn.1404b0203
mov al, 1
mov rcx, qword [rsp + 0x40]
test r13w, 0x7511
xor rcx, rsp
jmp 0x1404b1fa9
call fcn.1404a4670
mov rbx, qword [rsp + 0x68]
or sil, 0x8b
dec sil
rcr dil, cl
mov rsi, qword [rsp + 0x70]
shr edi, 0xdd
add rsp, 0x50
movsx edi, si
movzx edi, bx
movzx rdi, r15w
pop rdi
jmp 0x1404b1fd9
ret