joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140238833
Capabilities:
Access peb ldr_data

Disassembly:
je 0x1401da50f
mov word [r10], r11w
sub r11d, 0x58c81c67
add r10, 2
movsx r11w, spl
movzx r11d, word [r9 + rax*2 + 2]
add rax, 1
test r11w, r11w
jmp 0x14023f8e1
je 0x140130783
mov word [rcx], 0
ret
je 0x14023f8ea
sub eax, eax
nop word [rax + rax]
cmc
cmp r8, rax
jmp 0x14011557f
cmovb r8, rdx
jmp 0x140211e18
nop dword [rax + rax]
cmp r8, rdx
jmp 0x140207ae4
cmovae r8, rdx
movsx r9, si
mov r9, qword [rax + 0x60]
movzx r11d, word [r9]
bsr r10w, r13w
btr r10, 0x1b
lea r10, [0x1400b5f50]
stc
clc
test r11w, r11w
jmp 0x1401360b8
je 0x1401da515
mov word [r10], 0
movzx eax, word [0x1400b5f50]
shl r8w, 0x1d
sar r8b, 0xfa
cmp rdx, 0x104
movsx r8d, di
mov r8d, 0x104
jmp 0x140205008
je 0x14022cb9b
xor edx, edx
lea r9, [0x1400b5f50]
clc
nop word cs:[rax + rax]
cmp rdx, rcx
jmp 0x14014fbfc
cmovb r8, rdx
cmc
cmp r9b, 0xa9
test ax, ax
jmp 0x1401de802
je 0x14013077e
mov word [rcx], ax
shrd ax, r8w, 0x41
add rcx, 2
bswap eax
movzx eax, word [r9 + rdx*2 + 2]
test r12, 0x70374aa4
add rdx, 1
cmp r14w, r13w
cmp r10w, 0x7446
test ax, ax
jmp 0x14022cb8c
mov rax, qword gs:[0x30]
btc r10w, 0xb9
mov r9, r13
shrd r9w, r13w, 0x8d
mov rax, qword [rax + 0x60]
sub r11w, r14w
dec r9
mov rax, qword [rax + 0x18]
sal r9b, cl
mov rax, qword [rax + 0x10]
mov r9, 0x74d04647
movzx r8d, word [rax + 0x58]
rcr r10b, cl
cmp r8, rdx
mov r9, rbp
jmp 0x14018c121
jmp 0x1401de808
jne 0x14014fc01
sub r8, rdx
test r8w, 0x3d79
test r8, r8
jmp 0x140130778
movzx eax, word [0x1400b5f50]
cmp r12b, r14b
cmc
stc
test ax, ax
je 0x14020cc6c
cmp rdx, 0x104
mov r8w, r15w
movzx r8w, r13b
mov r8d, 0x104
jmp 0x14014244c
jne 0x1401360c7
sub r8, rax
test r8, r8
jmp 0x1401da509
Function at 0x14037678f
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
cmc
push r14
push rsi
sar r14b, cl
ror r14w, cl
cmp esp, 0x25812d42
push rdi
movsx r14w, bl
push rbx
sub rsp, 0x20
or sil, bl
mov r15, r8
add r14w, di
neg r14
shrd rsi, r10, 0x26
mov rsi, rdx
bsf r14, rsp
rcr dh, 0xaa
and dh, 0x7e
mov r14, rcx
xor rax, 0x2cc21857
mov rdx, r8
cmovns eax, r14d
sub rdx, rsi
shr r8w, 0x8d
shl al, cl
bts eax, r8d
sar rdx, 5
add eax, 0x1be4448
movzx r8d, di
movabs rax, 0xaaaaaaaaaaaaaaab
imul rdx, rax
mov r8, qword [rcx]
jmp 0x14037680e
mov rcx, qword [rcx + 0x10]
jmp 0x140376818
sub rcx, r8
clc
cmp sp, 0x3405
stc
sar rcx, 5
cmp r11, 0x44057f15
test r9w, r9w
test r10b, 0x55
imul rcx, rax
cmp rdx, rcx
jmp 0x140376841
jbe 0x1403768af
mov rcx, r14
call fcn.140376a04
mov rbx, qword [r14]
cmp rsi, r15
je 0x1403769dc
nop word [rax + rax]
cqo
movzx cx, r8b
mov dx, r9w
mov rcx, rbx
movzx rdx, r12w
movzx edx, si
mov rdx, rsi
call fcn.14037593f
add rbx, 0x60
test dil, r14b
test r11w, 0x3c3e
cmp r8b, al
add rsi, 0x60
test r11w, 0x7d98
cmc
cmp rsi, r15
jmp 0x1403768a4
jne 0x14037686f
jmp 0x1403769dc
mov rcx, qword [r14 + 8]
sub rcx, r8
sar rcx, 5
test r8d, r12d
clc
imul rcx, rax
test bpl, sil
cmp dil, 0x74
cmp rdx, rcx
jmp 0x1403768d1
jbe 0x14037695e
lea rdi, [rcx + rcx*2]
cmc
cmp r10b, r9b
test bpl, 0x94
shl rdi, 5
shr ecx, 0x8a
dec ecx
add rdi, rsi
movsx edx, cx
cmovae cx, r14w
setp ch
mov rcx, rsi
cmovle dx, ax
not dx
mov rdx, rdi
jmp 0x14037690c
call fcn.140376c93
mov rbx, qword [r14 + 8]
cmp di, 0x3d5c
stc
cmc
nop dword [rax + rax]
cmc
cmp rdi, r15
jmp 0x14037692a
je 0x1403769dc
mov rcx, rbx
movsx dx, spl
mov dx, r10w
cdq
mov rdx, rdi
jmp 0x140376945
call fcn.14037593f
add rbx, 0x60
stc
cmc
add rdi, 0x60
jmp 0x140376959
jmp 0x140376922
lea rbx, [rdx + rdx*2]
or cl, r13b
movzx rcx, r8w
shl rbx, 5
add rbx, r8
mov ecx, 0x730624f7
movsx ecx, dx
mov rcx, rsi
cmovbe dx, ax
movsx dx, r12b
cdq
mov rdx, r15
call fcn.140376c93
mov rdi, qword [r14 + 8]
cmp rbx, rdi
jmp 0x140376999
je 0x1403769dc
mov rsi, rbx
movsx cx, al
mov rcx, r13
cmovl cx, r11w
nop dword [rax]
mov cl, bl
movzx cx, dil
movzx ecx, r12w
mov rcx, rsi
jmp 0x1403769c5
call fcn.140374017
add rsi, 0x60
cmp rsi, rdi
jmp 0x1403769d6
jne 0x1403769bd
mov qword [r14 + 8], rbx
add rsp, 0x20
mov r15b, 0x40
xchg rbx, r14
pop rbx
pop rdi
movzx si, bl
pop rsi
pop r14
movzx r15w, r15b
movsx r15d, r13w
pop r15
jmp 0x140376a03
ret
Function at 0x1403930e2
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r14
push rsi
xor r14b, 0xf9
push rdi
push rbx
rcl bh, 0x6d
movzx r14d, r11w
inc bl
sub rsp, 0x28
mov rdi, r8
mov rbx, rdx
lahf
ror r14b, 0x72
sbb rax, r8
mov r14, rcx
mov rdx, r8
btc eax, r9d
sub rdx, rbx
btr ax, r12w
sar rdx, 5
shr ax, cl
mov rcx, qword [rcx]
movsxd rax, r12d
stc
mov rax, qword [r14 + 0x10]
cmc
clc
sub rax, rcx
test r14w, 0x2896
test edx, edi
sar rax, 5
cmp rdx, rax
jbe 0x1403931e0
mov rcx, r14
jmp 0x14039314c
call fcn.1403933e1
mov rax, qword [r14]
cmp rbx, rdi
jmp 0x14039315c
je 0x1403933a9
lea rcx, [0x1400bba50]
mov dx, 0x4667
nop word [rax + rax]
cqo
jmp 0x14039317f
mov qword [rax], rcx
mov dword [rax + 8], 0
not dx
movzx edx, sp
mov edx, dword [rbx + 8]
mov dword [rax + 8], edx
cmc
mov rdx, qword [rbx + 0x10]
stc
mov qword [rax + 0x10], rdx
shl dx, 0xc
btc edx, r9d
mov rdx, qword [rbx + 0x18]
jmp 0x1403931b4
mov qword [rax + 0x18], rdx
add rax, 0x20
jmp 0x1403931c9
add rbx, 0x20
cmp rbx, rdi
jmp 0x1403931d5
jne 0x14039317f
jmp 0x1403933a9
mov rax, qword [r14 + 8]
shr r8w, 0x1f
setnp r9b
test r11b, 0xdb
mov r8, rax
jmp 0x140393201
sub r8, rcx
mov r9b, 0x81
and r9b, al
bt r9w, sp
mov r9, r8
clc
stc
sar r9, 5
stc
cmp r9b, 0x61
cmp rdx, r9
jmp 0x140393225
jbe 0x14039332d
shl r9, 5
stc
lea rdx, [rbx + r9]
test r8, r8
jmp 0x14039323c
je 0x1403932a0
add rbx, 8
inc si
setne sil
add rcx, 8
bsr esi, edi
xor eax, eax
xchg si, si
nop
adc si, bx
adc si, 0x39cc
mov rsi, qword [rbx + rax + 0x10]
mov qword [rcx + rax + 0x10], rsi
movups xmm0, xmmword [rbx + rax]
cmp rcx, 0x71b46d0f
cmc
movups xmmword [rcx + rax], xmm0
test r15d, esp
add rax, 0x20
clc
test r10d, 0x5de2675d
cmp r9, rax
jmp 0x140393293
jne 0x140393262
mov rax, qword [r14 + 8]
test rbp, rcx
cmp rdx, rdi
jmp 0x1403932a8
je 0x1403933a9
lea rcx, [0x1400bba50]
btc bx, r13w
sal bx, cl
xchg bl, bh
nop dword [rax + rax]
mov qword [rax], rcx
bsr bx, r13w
mov bh, 0x4d
mov dword [rax + 8], 0
rcl bl, 0xa5
bt bx, sp
btr ebx, 0x12
mov ebx, dword [rdx + 8]
stc
mov dword [rax + 8], ebx
shl bh, 0xc1
dec bl
xadd bh, bh
mov rbx, qword [rdx + 0x10]
test bpl, 0xbe
jmp 0x1403932fd
mov qword [rax + 0x10], rbx
mov rbx, qword [rdx + 0x18]
jmp 0x14039330b
mov qword [rax + 0x18], rbx
add rax, 0x20
cmp al, sil
add rdx, 0x20
cmp rdx, rdi
jmp 0x140393322
jne 0x1403932c4
jmp 0x1403933a9
shl rdx, 5
btr rax, r11
not ax
mov rax, rdx
stc
clc
add rax, rcx
cmp r12b, 0xe
cmp rbx, rdi
je 0x1403933a9
add rcx, 8
nop word cs:[rax + rax]
not dh
sal dx, cl
xor dh, 0xe5
nop dword [rax]
btr rdx, 0xd
mov rdx, qword [rbx + 0x18]
stc
test r9b, r11b
jmp 0x140393379
mov qword [rcx + 0x10], rdx
cmc
movups xmm0, xmmword [rbx + 8]
cmp ch, al
movups xmmword [rcx], xmm0
clc
jmp 0x14039338d
add rbx, 0x20
add rcx, 0x20
cmp r13w, 0x7c61
cmp r13w, cx
stc
cmp rbx, rdi
jne 0x14039336c
mov qword [r14 + 8], rax
inc si
xchg sil, bl
add rsp, 0x28
movsxd rbx, ebx
movzx di, r13b
pop rbx
bswap di
pop rdi
xchg rsi, r14
movsx rsi, sp
pop rsi
movzx r14d, r13w
jmp 0x1403933d9
pop r14
jmp 0x1403933e0
ret
Function at 0x14039cbce
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
push r14
bt r14d, 0x87
cmc
push r13
movzx r14w, sil
movzx r13d, r8w
test r11b, 0xad
push r12
push rsi
test r9b, cl
movzx r12, r9w
push rdi
cmovnp r15d, r10d
not r13d
movsx r15w, r15b
push rbp
stc
btc r13d, 0x8a
push rbx
xadd bl, r15b
btr r14, r11
or r12d, edx
sub rsp, 0x38
setge r14b
bswap r12d
shld r12, r14, 0x3f
movaps xmmword [rsp + 0x20], xmm6
mov r14, r9
mov r15, r8
mov r12, rdx
inc bl
mov r13, rcx
btr ebx, r8d
jmp 0x14039cc3d
mov rbx, qword [rcx]
cmp bpl, 0xa2
test rbx, rbx
jmp 0x14039cc4c
je 0x14039cd98
mov rdi, qword [r13 + 8]
cmp rbx, rdi
je 0x14039cd35
add rbx, 0x10
xchg bpl, bpl
lea rbp, [0x1400bbc30]
jmp 0x14039cc72
movaps xmm6, xmmword [0x1400ba520]
jmp 0x14039ccbf
call fcn.140239321
lea rax, [rbx - 0x10]
cmc
jmp 0x14039cc90
movups xmmword [rbx + 0x10], xmm6
cmp esp, 0x26b2680d
stc
mov byte [rbx], 0
clc
jmp 0x14039cca4
add rbx, 0x38
jmp 0x14039ccae
add rax, 0x38
stc
cmp r11d, r8d
cmp rax, rdi
je 0x14039cd2f
mov qword [rbx - 0x10], rbp
shl ax, cl
and al, dl
mov rax, qword [rbx + 0x18]
cmp rax, 0x10
jmp 0x14039ccd5
jb 0x14039cc83
mov rcx, qword [rbx]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jmp 0x14039ccee
jb 0x14039cc7e
mov rsi, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rsi
stc
cmp rcx, 0x20
jmp 0x14039cd09
jae 0x14039ce2a
add rax, 0x28
not dh
movsx rcx, bp
mov rdx, rax
cmovb cx, ax
not cl
mov rcx, rsi
jmp 0x14039cd2a
jmp 0x14039cc7e
mov rbx, qword [r13]
cwd
mov rdx, qword [r13 + 0x10]
cmp ecx, 0x3be31308
sub rdx, rbx
cmp rdx, 0x1000
jmp 0x14039cd4e
jb 0x14039cd8b
mov rax, qword [rbx - 8]
sub rbx, rax
cmp r8b, 0xe8
test ch, 0x8c
add rbx, 0xfffffffffffffff8
cmp rbx, 0x20
jae 0x14039ce2a
add rdx, 0x27
movzx ecx, r8w
movsx bx, r12b
mov ch, 0xd8
mov rbx, rax
movsx rcx, sp
movsx cx, bh
mov rcx, rbx
jmp 0x14039cd93
call fcn.140239321
mov qword [r13], r12
movzx eax, r15w
inc bp
rol di, cl
imul rax, r15, 0x38
cmp r9b, 0xae
lea rax, [rax + r12]
mov qword [r13 + 8], rax
sbb sil, 1
btr bx, r9w
imul rax, r14, 0x38
bts bp, dx
shrd r14, r13, 0xc8
add rax, r12
shrd r12w, r10w, 0xd3
movsx r14d, r11w
xor r14w, r8w
mov qword [r13 + 0x10], rax
movaps xmm6, xmmword [rsp + 0x20]
btr r15w, 0xd9
dec edi
add rsp, 0x38
cmovno r15w, di
not sil
pop rbx
pop rbp
pop rdi
pop rsi
jmp 0x14039ce0b
pop r12
mov r14b, 0x23
pop r13
bswap r15
mov r15w, r12w
not r14b
pop r14
movzx r15d, r10w
pop r15
jmp 0x14039ce29
ret
call fcn.14046a291
int3
Function at 0x14039e4a7
Capabilities:
Check for software breakpoints

Disassembly:
push r15
sal r15b, cl
shrd r15, r14, 0xe3
push r14
sub r15w, r12w
push r13
shrd r13d, esi, 0x61
rcr r13w, cl
bts r15d, r12d
push r12
add r13b, spl
rcl r15w, cl
push rsi
or r13b, al
cmove r13, rsi
xor r12b, 0xb5
push rdi
movsx r15d, r15w
bsr r13w, di
push rbp
sar r13d, 0x4b
push rbx
sbb bh, 0x8e
setne bl
sub rsp, 0x48
rcr r13b, 0x9d
btr bx, 0xf1
movaps xmmword [rsp + 0x30], xmm6
mov rdi, r9
ror r12b, cl
mov r15, r8
bts r12w, bx
sbb r12, r14
test r10b, cl
mov r12, rdx
mov r13, rcx
mov rbx, qword [rcx]
test rbx, rbx
jmp 0x14039e529
je 0x14039e69e
mov rsi, qword [r13 + 8]
stc
cmp rbx, rsi
jmp 0x14039e53c
je 0x14039e637
mov qword [rsp + 0x28], rdi
add rbx, 0x10
cmovs r14d, ebp
mov r14b, bl
lea r14, [0x1400bbc10]
jmp 0x14039e55e
movaps xmm6, xmmword [0x1400ba520]
jmp 0x14039e599
call fcn.140239321
movups xmmword [rbx + 0x10], xmm6
mov byte [rbx], 0
cmp esi, edi
jmp 0x14039e57d
add rbx, 0x50
add rdi, 0x18
clc
jmp 0x14039e58b
cmp rdi, rsi
jmp 0x14039e593
je 0x14039e621
mov qword [rbx - 0x10], r14
not cl
lea rdi, [rbx + 0x28]
mov cl, sil
xchg ch, ch
mov rcx, rdi
jmp 0x14039e5b0
call fcn.14039b771
mov rax, qword [rbx + 0x18]
test dx, r11w
clc
cmp rax, 0x10
jb 0x14039e56f
mov rcx, qword [rbx]
stc
lea rdx, [rax + 1]
clc
test r9b, bl
cmp rdx, 0x1000
jmp 0x14039e5e0
jb 0x14039e56a
mov rbp, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
clc
cmp rdx, r9
sub rcx, rbp
test r15d, r14d
cmp r9b, 0xfd
cmp rcx, 0x20
jae 0x14039e72b
add rax, 0x28
mov rdx, rax
mov cx, 0x2345
mov cl, r12b
mov rcx, rbp
jmp 0x14039e61c
jmp 0x14039e56a
mov rbx, qword [r13]
shrd edx, esi, 0x22
mov rdi, qword [rsp + 0x28]
bts rdx, r9
bts dx, r12w
mov rdx, qword [r13 + 0x10]
jmp 0x14039e642
sub rdx, rbx
jmp 0x14039e64a
cmp rdx, 0x1000
jmp 0x14039e656
jb 0x14039e691
mov rax, qword [rbx - 8]
test sil, 0xec
sub rbx, rax
jmp 0x14039e66c
add rbx, 0xfffffffffffffff8
jmp 0x14039e675
cmp rbx, 0x20
jae 0x14039e72b
add rdx, 0x27
xchg bx, bx
movzx ecx, r13w
movsx rbx, r11w
mov rbx, rax
mov rcx, rbx
jmp 0x14039e699
call fcn.140239321
mov qword [r13], r12
and r14w, di
bsf esi, r14d
lea rax, [r15 + r15*4]
setno bpl
btr rbx, rbp
shl rax, 4
xor r15w, r14w
test r11w, dx
bswap rbp
lea rax, [rax + r12]
mov qword [r13 + 8], rax
movsx bx, dil
cmp r10b, 0xcc
rol esi, 0x4e
lea rax, [rdi + rdi*4]
shl rax, 4
seta r15b
add rax, r12
mov qword [r13 + 0x10], rax
movaps xmm6, xmmword [rsp + 0x30]
or sil, 0x62
add rsp, 0x48
xchg rbx, rdi
mov si, r12w
pop rbx
movzx r12w, al
movsx r13, r14w
pop rbp
pop rdi
pop rsi
pop r12
pop r13
movsxd r15, r15d
jmp 0x14039e71d
pop r14
movsx r15d, r12w
pop r15
jmp 0x14039e72a
ret
call fcn.14046a291
int3
Function at 0x14039f838
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r14
clc
mov r14w, r9w
push rsi
and r14, r12
or r14w, sp
push rdi
sal r14b, 0xa2
push rbx
sub rsp, 0x98
sar edi, 0x89
btr rbx, 0x1f
movaps xmmword [rsp + 0x80], xmm6
sar di, cl
btc r14, 0x5d
mov r14, rcx
sal di, cl
shl dil, 0xac
neg bx
mov dword [rcx + 8], 0
bts edi, esp
mov qword [rcx + 0x10], 0
sbb bx, 0x1746
shr edi, 0xf1
and di, 0x42fa
mov rdi, qword [rcx + 0x18]
sar bh, 0xbb
mov rbx, qword [rcx + 0x20]
clc
test r8b, 0
cmp rdi, rbx
jmp 0x14039f8b1
je 0x14039f99a
add rdi, 0x28
movsx esi, r13w
jmp 0x14039f8c6
lea rsi, [0x1400bba30]
jmp 0x14039f8d2
xorps xmm6, xmm6
jmp 0x14039f911
call fcn.140239321
movups xmmword [rdi - 0x10], xmm6
mov qword [rdi], 0
movzx ax, r15b
lea rax, [rdi - 0x28]
cmc
add rdi, 0x30
stc
add rax, 0x30
cmp bpl, 0xc7
clc
cmc
cmp rax, rbx
jmp 0x14039f90b
je 0x14039f98c
mov qword [rdi - 0x28], rsi
test r13b, 0xd2
xor cl, r12b
bsr cx, r10w
mov rcx, qword [rdi - 0x10]
clc
test r15b, r12b
test rcx, rcx
je 0x14039f8ef
mov rdx, qword [rdi]
test al, dil
sub rdx, rcx
cmp cx, ax
cmp rdx, 0x1000
jmp 0x14039f94a
jb 0x14039f8da
mov rax, qword [rcx - 8]
cmc
sub rcx, rax
add rcx, 0xfffffffffffffff8
jmp 0x14039f961
cmp rcx, 0x20
jmp 0x14039f96a
jae 0x14039fac8
add rdx, 0x27
jmp 0x14039f97f
mov rcx, rax
jmp 0x14039f987
jmp 0x14039f8da
mov rax, qword [r14 + 0x18]
jmp 0x14039f995
mov qword [r14 + 0x20], rax
cwde
mov qword [r14 + 0x30], 0
movsx ax, r9b
movzx eax, r13w
lea rax, [0x1400bbc70]
jmp 0x14039f9b7
mov qword [rsp + 0x28], rax
jmp 0x14039f9c1
xorps xmm0, xmm0
movups xmmword [rsp + 0x38], xmm0
cmp dl, 0x96
shl rax, 0x64
movups xmmword [rsp + 0x48], xmm0
movups xmmword [rsp + 0x58], xmm0
not ah
rol ch, 0x22
or ah, 9
movups xmmword [rsp + 0x68], xmm0
setbe ah
mov qword [rsp + 0x78], 0
sbb ax, r14w
btc cx, bp
bt cx, 0x15
mov dword [rsp + 0x30], 0
btc ecx, ebx
lea rax, [r14 + 0x38]
mov dword [r14 + 0x40], 0
xchg ch, ch
shl ch, 0x5c
movsx rcx, r11w
lea rcx, [rsp + 0x28]
jmp 0x14039fa2a
cmp rcx, rax
jmp 0x14039fa32
je 0x14039fa8a
lea rcx, [r14 + 0x48]
sub edx, edx
test r15b, 0xd2
cmp r9b, spl
sub r8d, r8d
jmp 0x14039fa4d
call fcn.1403a17d3
lea rcx, [r14 + 0x60]
movzx dx, r11b
mov rdx, qword [rsp + 0x50]
mov r8, qword [rsp + 0x58]
call fcn.1403a17d3
add r14, 0x78
xchg cl, r8b
mov rdx, qword [rsp + 0x68]
xchg cx, cx
movzx rcx, r13w
mov r8, qword [rsp + 0x70]
mov rcx, r14
call fcn.1403a17d3
lea rcx, [rsp + 0x28]
call fcn.1403a15ca
movaps xmm6, xmmword [rsp + 0x80]
adc ebx, 0x472e255c
movsx esi, bp
add rsp, 0x98
movsx rbx, ax
jmp 0x14039fab5
pop rbx
pop rdi
jmp 0x14039fabf
pop rsi
pop r14
jmp 0x14039fac7
ret
call fcn.14046a291
int3
Function at 0x1403a1ebe
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
add r10b, 0x46
bsr r11d, r9d
push r14
cmovg r10d, edi
btr r10d, 0x48
btr r9w, r12w
push r13
push r12
sal r9b, cl
push rsi
cmp edx, r8d
ror r12b, cl
push rdi
movzx r14, r11w
push rbp
btc r13w, 0xc9
movzx rbp, bp
bts r12, r15
push rbx
bts r12, r15
sub rsp, 0x78
xor bpl, r12b
and r14w, si
movaps xmmword [rsp + 0x60], xmm6
mov r13, r8
or r10b, r8b
rcl r10w, 3
mov rbp, rdx
sal r12, 0xd0
mov r12, rcx
movzx r10d, r9w
lea r13, [r13 + rdx]
adc r10b, sil
mov dword [rcx + 8], 0
test spl, r14b
lea r9, [rsp + 0x50]
ror r14b, cl
cmc
lea r14, [rcx + 0x18]
btr r10w, r11w
not r10
xor edx, edx
lea r10, [0x140029f28]
not r8b
movsx r11d, di
bswap r11w
lea r8, [0x140029f0c]
xchg r11b, r11b
cmovg r11d, edx
bswap r11
lea r11, [0x1400bbcd0]
jmp 0x1403a1f80
xorps xmm6, xmm6
lea r15, [rsp + 0x28]
sub ebx, 0x238f31c5
sub ecx, ecx
rcr bh, 0x4a
mov rbx, rbp
add rbp, 1
jmp 0x1403a1fa3
cmp rbp, r13
jmp 0x1403a1fab
ja 0x1403a26eb
movzx edi, byte [rbx]
lahf
btr rax, r15
mov eax, edi
stc
test r10b, 0x44
jmp 0x1403a1fc5
and eax, 0x7f
test r11d, 0x63343c15
stc
shl rax, cl
add rdx, rax
cmp edi, r12d
add rcx, 7
jmp 0x1403a1fe2
test dil, dil
jmp 0x1403a1fea
js 0x1403a1f93
mov rax, rdx
cmc
cmp di, bp
clc
shr rax, 3
stc
add rax, 0xffffffffffffffff
cmp rax, 6
jmp 0x1403a200a
ja 0x1403a2215
movsxd rax, dword [r8 + rax*4 + 0x3787ec]
cmp ecx, eax
add rax, r8
jmp 0x1403a2022
jmp rax
and edx, 7
sub eax, eax
cmp cx, 0x5059
test r15b, r13b
jmp 0x1403a2227
cmp rdx, 5
jmp 0x1403a2230
ja 0x1403a26a9
movsxd rcx, dword [r10 + rdx*4 + 0x3787ec]
add rcx, r10
jmp 0x1403a2246
push rcx
ret
movaps xmm6, xmmword [rsp + 0x60]
add rsp, 0x78
movsx bp, r10b
pop rbx
pop rbp
movsxd r12, ebx
pop rdi
movsxd r15, edx
setle r14b
movzx r13d, bp
pop rsi
movzx r14d, cx
pop r12
movsxd r14, r10d
bswap r15w
cmovg r14w, r13w
pop r13
movsx r14, r12w
pop r14
pop r15
jmp 0x1403a26ea
ret
mov al, 1
jmp 0x1403a26f2
jmp 0x1403a26a9
Function at 0x1403ac7f1
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
shld r15w, r8w, 0xe5
push r14
dec r14b
mov r15w, r14w
shrd r14w, bp, 0xe0
push r13
btr r15d, 0x77
movzx r14, sp
sub r15b, 0xff
push r12
btc r12d, r9d
add r12b, r8b
push rsi
rol r15d, 0x85
bt r13w, 0xe7
bswap rsi
push rdi
test bpl, r10b
cmovns r12w, r12w
push rbx
sub rsp, 0x30
movaps xmmword [rsp + 0x20], xmm6
mov r15, r9
mov r12, r8
shrd r13, r10, 0xe2
shl r13w, 0xb3
test r14b, r11b
mov r14, rdx
mov r13, rcx
dec sil
btc si, 0xe6
movzx si, spl
mov rsi, qword [rcx]
cmp r11w, 0x7ac
cmp si, si
stc
test rsi, rsi
jmp 0x1403ac87c
je 0x1403ac9b0
mov rbx, qword [r13 + 8]
cmp sil, 0x22
cmp rsi, rbx
je 0x1403ac947
movaps xmm6, xmmword [0x1400ba520]
jmp 0x1403ac8bc
call fcn.140239321
movups xmmword [rsi + 0x10], xmm6
cmc
stc
mov byte [rsi], 0
add rsi, 0x20
clc
stc
cmp rsi, rbx
je 0x1403ac939
mov rax, qword [rsi + 0x18]
jmp 0x1403ac8cc
cmp rax, 0x10
jb 0x1403ac8a4
mov rcx, qword [rsi]
xor dx, sp
btc dx, 0xd1
lea rdx, [rax + 1]
cmp rdx, 0x1000
jb 0x1403ac89f
mov rdi, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
jmp 0x1403ac902
sub rcx, rdi
clc
stc
cmp spl, sil
cmp rcx, 0x20
jmp 0x1403ac913
jae 0x1403aca35
add rax, 0x28
movsx rdx, r11w
mov rdx, rax
movsx cx, r8b
bswap rcx
mov rcx, rdi
jmp 0x1403ac934
jmp 0x1403ac89f
mov rsi, qword [r13]
movzx edx, ax
adc rdx, rsi
movsx edx, r15w
mov rdx, qword [r13 + 0x10]
cmc
cmp r13w, r13w
sub rdx, rsi
test dil, cl
cmp sil, 0x50
cmp rdx, 0x1000
jmp 0x1403ac966
jb 0x1403ac9a3
mov rax, qword [rsi - 8]
cmc
sub rsi, rax
cmc
add rsi, 0xfffffffffffffff8
cmp spl, 0xa6
cmp rsi, 0x20
jae 0x1403aca35
add rdx, 0x27
movzx rsi, dx
movsx cx, r12b
mov ch, dh
mov rsi, rax
xchg ch, cl
setnp ch
movsx cx, sil
mov rcx, rsi
jmp 0x1403ac9ab
call fcn.140239321
mov qword [r13], r14
stc
bsf si, bx
shl r12, 5
clc
add r12, r14
mov qword [r13 + 8], r12
shl r12, cl
jmp 0x1403ac9cd
shl r15, 5
mov bh, 0x39
lea r15, [r15 + r14]
cmovns r12w, bp
mov r14d, 0x527301bc
mov qword [r13 + 0x10], r15
movaps xmm6, xmmword [rsp + 0x20]
sar r14d, 0xa
movzx di, cl
add sil, 0xdd
add rsp, 0x30
pop rbx
bswap rdi
mov r13, rdx
movzx r15d, r12w
pop rdi
movsx r15, bx
mov r15b, r13b
pop rsi
cmovne r12w, si
xchg r13d, r13d
pop r12
not r13d
pop r13
xchg r15w, r15w
setbe r15b
pop r14
not r15w
pop r15
jmp 0x1403aca34
ret
call fcn.14046a291
int3
Function at 0x1403ae20d
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
clc
stc
cmp r14w, r10w
push r14
push r12
push rsi
test al, 0x1a
add r12w, 0x4187
cmc
push rdi
jmp 0x1403ae229
push rbx
sub rsp, 0x28
movsx r12d, r11w
rol r12w, cl
sar r12d, cl
mov r12, r8
clc
jmp 0x1403ae243
cmp rcx, rdx
jmp 0x1403ae24b
je 0x1403ae42b
mov r14, rdx
mov rbx, rcx
jmp 0x1403ae264
sub esi, esi
jmp 0x1403ae26b
jmp 0x1403ae29c
mov rcx, r15
mov rdx, rdi
jmp 0x1403ae27b
call fcn.140375266
lea rax, [rbx + rsi]
clc
add rax, 0x50
stc
add rsi, 0x50
cmp rax, r14
jmp 0x1403ae296
je 0x1403ae421
mov eax, dword [rbx + rsi + 8]
jmp 0x1403ae2a6
mov dword [r12 + rsi + 8], eax
cmp r12, rbx
jmp 0x1403ae2b3
je 0x1403ae280
cmp qword [rbx + rsi + 0x28], 0x10
jmp 0x1403ae2c4
jb 0x1403ae2d9
mov r9, qword [rbx + rsi + 0x10]
jmp 0x1403ae2d4
jmp 0x1403ae2e4
lea r9, [rbx + rsi]
seta al
add r9, 0x10
lea r15, [r12 + rsi]
rcl eax, 0xe6
add r15, 0x10
mov rdi, qword [rbx + rsi + 0x20]
bt eax, 0x29
nop
setne ah
mov rax, qword [r12 + rsi + 0x28]
cmp dx, sp
cmp rax, rdi
jmp 0x1403ae30d
jae 0x1403ae331
mov rcx, r15
seta dl
movsx edx, r9w
not dh
mov rdx, rdi
jmp 0x1403ae327
call fcn.140375266
jmp 0x1403ae36e
cmp rax, 0x10
jb 0x1403ae344
mov r15, qword [r12 + rsi + 0x10]
movzx rdx, r14w
mov qword [r12 + rsi + 0x20], rdi
movsx r8d, si
mov rcx, r15
mov rdx, r9
movzx r8w, r11b
movsx r8, r15w
jmp 0x1403ae361
mov r8, rdi
call fcn.140457667
mov byte [r15 + rdi], 0
mov rdi, qword [rbx + rsi + 0x40]
clc
cmp ebp, 0x5cb67bb5
cmp qword [rbx + rsi + 0x48], 0x10
jmp 0x1403ae385
jb 0x1403ae39a
mov r9, qword [rbx + rsi + 0x30]
jmp 0x1403ae395
jmp 0x1403ae3a5
lea r9, [rbx + rsi]
xor ax, bx
add r9, 0x30
lea r15, [r12 + rsi]
shr rax, cl
movsx ax, bpl
inc al
add r15, 0x30
btc ax, 0x21
movsxd rax, r14d
mov rax, qword [r12 + rsi + 0x48]
test cx, ax
test spl, 0x12
cmp rax, rdi
jmp 0x1403ae3d3
jb 0x1403ae270
cmp rax, 0x10
jmp 0x1403ae3e2
jb 0x1403ae3ef
mov r15, qword [r12 + rsi + 0x30]
cqo
mov qword [r12 + rsi + 0x40], rdi
mov rcx, r15
movzx edx, si
movsx r8d, r12w
mov rdx, r9
movsx r8d, r11w
mov r8, rdi
jmp 0x1403ae40d
call fcn.140457667
mov byte [r15 + rdi], 0
jmp 0x1403ae41c
jmp 0x1403ae280
add r12, rsi
shl r14b, 0xcb
movsxd rsi, ebx
mov rax, r12
shl dil, 0xfb
sbb rsi, r10
add rsp, 0x28
pop rbx
pop rdi
bswap r14w
pop rsi
pop r12
movsx r15d, sp
cmovp r14w, r10w
pop r14
setns r15b
movzx r15w, bl
bswap r15d
pop r15
jmp 0x1403ae460
ret
Function at 0x1403af085
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r14
push rsi
test sp, 0x527f
stc
push rdi
push rbx
shl di, cl
btc di, 0x9d
sub rsp, 0x38
btr rdi, 0xb6
sar di, 0xe4
movaps xmmword [rsp + 0x20], xmm6
neg dil
mov rdi, qword [rcx]
cmp dl, dh
test rdi, rdi
jmp 0x1403af0ba
je 0x1403af227
mov r14, rcx
cmc
rcr bh, 0x41
mov rbx, qword [rcx + 8]
cmp rdi, rbx
jmp 0x1403af0d3
je 0x1403af1a5
movaps xmm6, xmmword [0x1400ba520]
jmp 0x1403af0e5
jmp 0x1403af11f
call fcn.140239321
movups xmmword [rdi + 0x10], xmm6
cmp bl, 0x5e
mov byte [rdi], 0
test ah, 0xf
cmp r15d, 0x27a5326e
add rdi, 0x20
jmp 0x1403af111
cmp rdi, rbx
jmp 0x1403af119
je 0x1403af19f
mov rax, qword [rdi + 0x18]
test dil, 0x5a
jmp 0x1403af12c
cmp rax, 0x10
jb 0x1403af0ef
mov rcx, qword [rdi]
xor dl, 5
btr dx, 0x46
cmp dl, sil
lea rdx, [rax + 1]
jmp 0x1403af14e
cmp rdx, 0x1000
jmp 0x1403af15a
jb 0x1403af0ea
mov rsi, qword [rcx - 8]
stc
add rcx, 0xfffffffffffffff8
sub rcx, rsi
test rsi, 0x44a943da
cmp rcx, 0x20
jmp 0x1403af17c
jae 0x1403af260
add rax, 0x28
mov edx, 0x64b42403
mov rdx, rax
movsx ecx, r11w
mov rcx, rsi
jmp 0x1403af19a
jmp 0x1403af0ea
mov rdi, qword [r14]
cmp r14b, r9b
mov rdx, qword [r14 + 0x10]
stc
sub rdx, rdi
clc
test rsi, rdx
cmp r11, rcx
cmp rdx, 0x1000
jmp 0x1403af1c0
jb 0x1403af205
mov rax, qword [rdi - 8]
test rbp, 0x48230e7
cmp bp, r9w
sub rdi, rax
stc
cmp dl, 0x89
add rdi, 0xfffffffffffffff8
cmp rdi, 0x20
jae 0x1403af260
add rdx, 0x27
bswap di
jmp 0x1403af1f6
mov rdi, rax
bswap cx
jmp 0x1403af205
mov rcx, rdi
jmp 0x1403af20d
call fcn.140239321
xorps xmm0, xmm0
movups xmmword [r14], xmm0
dec bl
setg dil
mov qword [r14 + 0x10], 0
movaps xmm6, xmmword [rsp + 0x20]
add rsp, 0x38
movzx r14d, r11w
movzx rsi, si
movsx r14w, r12b
pop rbx
jmp 0x1403af243
pop rdi
movzx r14w, r15b
movsxd r14, edx
movzx esi, sp
pop rsi
movsxd r14, esi
movsx r14w, sil
pop r14
jmp 0x1403af25f
ret
call fcn.14046a291
int3