joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400a225d
Capabilities:
Write file on windows

Disassembly:
ror byte [rcx - 9], cl
fiadd dword [rcx + 0x53]
movzx r11d, word [rsp + 0x1b]
lea r11, [r11*8 + 0x8bf7d2e]
call fcn.140435644
add dword [rdx], ecx
add al, 0
or dh, byte [rsi + rax]
add byte [rdx], cl
xor al, byte [rsi]
jo 0x1400a2265
invalid
sbb al, 0xdd
jge 0x1400a2229
or al, ch
invalid
jle 0x1400a2284
add byte [rax], al
stc
inc dword [rbp - 0x33cf4763]
int3

Function at 0x1400a2fc1
Capabilities:
Encode data using xor

Disassembly:
not qword [rsp + r12*2 + 0x40]
jb fcn.1403717aa
mov r12, qword [rsp + r12*8 + 0x28]
setb byte [rsp + 0x40]
mov qword [rsp + 0x40], 0xffffffffb19dc736
jle 0x1403cd8e9
sub byte [rsp + 0x40], 0x3e
add word [rsp + 0x40], 0x9513
je 0x140410a9c
push qword [rsp + 0x48]
popfq
lea rsp, [rsp + 0x58]
ret
call 0x140068841

Function at 0x1400b030f
Capabilities:
Terminate process

Disassembly:
mov rax, qword [rsp]
not word [rsp]
mov rax, qword [rsp + 0x20]
mov rax, qword [rax]
cmp r9b, byte [rsp + 4]
not word [rsp]
mov qword [rsp + 0x20], r9
setae byte [rsp]
lea rax, [rax - 0x7eee5c46]
or qword [rsp], 0x330b22c
or r9d, 0x3b87022
jle 0x1400dcb61
add byte [rax], al
add cl, ch
push rcx
invalid
add r9w, r9w
jbe 0x140024e07
shl r9, 0xa9
setne r9b
xchg qword [rsp + 0x28], rdi
mov r9, qword [rsp + 0x18]
add qword [rsp], 0xffffffffbfc115a4
call fcn.1403d0adc
loope 0x1400b0307

Function at 0x1400d2650
Capabilities:
Terminate process

Disassembly:
setne r13b
mov r13w, word [rsp + 0x24]
sub qword [rsp + 0x20], 0x7e10bb90
xor dword [rsp + 0x20], 0x1f362208
mov r13, qword [rsp + 0x38]
not word [rsp + 0x20]
shr dword [rsp + 0x20], 0xe3
or word [rsp + 0x20], 0x5893
and byte [rsp + 0x20], 0x99
jo 0x140024e88
push qword [rsp + 0x30]
popfq
lea rsp, [rsp + 0x40]
ret

Function at 0x1400eb6bc
Capabilities:
Terminate process

Disassembly:
xchg qword [rsp + rbx - 0x4000006d], rdx
mov rsi, qword [rsp + rbx - 0x400000b5]
jno 0x14038a570
add qword [rsp + rbx - 0x40000095], 0xffffffffbff99d96
neg rbx
not ebx
mov r12, rbx
js 0x140024e80
mov r15, qword [rsp + 8]
call fcn.1404844ec

Function at 0x14033a506
Capabilities:
Encode data using base64
Execute anti-debugging instructions
Resolve function by parsing pe exports

Disassembly:
push qword [rsp + 8]
popfq
lea rsp, [rsp + 0x20]
call fcn.1405e6916
pushfq
add qword [rsp + 0x18], 0xffffffffbf8c79cb
push rcx
mov rcx, rbx
mov qword [rsp + 0x20], 0x4ba30a42
mov rcx, qword [rsp]
sub rbx, 0x1610213e
xor bl, 0x38
not bx
sub rbx, 0x63a0811c
cmp ebx, 0x720df78a
jns 0x1403e2e7f
movabs rbx, 0xb92b5fbb6936e685
call fcn.14033a506
invalid
neg ebx
jae 0x14033a529
mov rbx, qword [rsp + rbx*4 - 0x41e91a58]
jl 0x14034f497
jb 0x1400a288f
invalid
loope 0x1403e2ee3
sub dword [rdi + 0xfd195b], ebx
push 0xffffffffffffffaa
sbb esi, ebx
invalid
xor bh, byte [rsi + 0x6d]
movsd dword [rdi], dword [rsi]
jno 0x1403e2e96
mov cl, 0xdb
invalid
cmp ax, ax
or byte [rdi], bh
sub al, 0x25
loop 0x1403e2ec7
mov word [rbp + 0x69], ds
xor eax, 0x71cccac9
pop rsi
invalid
Function at 0x14034d163
Capabilities:
Encrypt data using rc4 prga

Disassembly:
call 0x14034d17e
setae bpl
mov rbp, qword [rsp + 0x38]
neg dword [rsp + 0x40]
cmp qword [rsp + 0x40], 0xffffffff992b1b26
call fcn.140051c48
je 0x140095fd8
cmp sil, 0x91
not esi
mov sil, 0x16
mov rsi, qword [rsp + 0x18]
jae 0x14008efb7
ja fcn.140095fd5
lea rsp, [rsp + 8]
ret

Function at 0x14039d01f
Capabilities:
Resolve function by parsing pe exports

Disassembly:
call fcn.1400295b6
stosd dword [rdi], eax
int3
stosb byte [rdi], al
cli
fistp word [rsi]
sbb dh, dl
invalid
jae 0x14036608a
jae 0x14005996e
dec ah
jmp fcn.1406d0532
mov qword [rsp + 0x18], r14
lea rax, [rax - 0x5cf8c0de]
push rdi
jge 0x14044bc2a
shr bp, 0x6d
js 0x14009ccc1
xchg qword [rsp + rbp - 0x63b6fff5], rcx
mov rbp, qword [rsp + rbp - 0x63b6fffd]
jne 0x14003323b
call fcn.140047f90
pushfq
xor rbp, 0x2c203a0a
lea rcx, [rcx - 0x75c42d00]
jns 0x1400599ce
movabs rdi, 0xc830688ca58b279a
shl edi, 0xce

Function at 0x1403fe0bb
Capabilities:
Encode data using xor

Disassembly:
push r9
mov r9, rbp
push rbx
mov rsi, qword [rsp + 0x18]
mov rsi, qword [rsi]
mov r15b, 0x2c
and r15, 0xffffffffe030c3a2
cmp r15, qword [rsp]
lea rsi, [rsi + 0x4c99102e]
mov bpl, r9b
movsx ebp, r15b
jae 0x1403ab0cc
mov qword [rsp + 0x18], rbp

Function at 0x140400837
Capabilities:
Packed with generic packer

Disassembly:
in al, dx
or al, 0xa0
jnp 0x140400843
movabs al, byte [0x2bba0b23025e447b]
push rdx
pop rbx
imul esi, dword [rdx - 8], 0xffffff8b
or al, 0x57
pop rsi
add ah, byte [rbx]
or edi, dword [rdx + 0x6b5b522b]
jb 0x140400802
mov eax, dword [rbx + 0xc]
push rdi
cmpsb byte [rsi], byte [rdi]
invalid
call fcn.140054e8f
sub byte [rsi + rbx*2], dl
xchg dword [rbp + 0x24], ecx
mov dl, 0x64
xchg ah, bh
xchg ah, bh
movsb byte [rdi], byte [rsi]
pop rdx
scasd eax, dword [rdi]
js 0x1404007fc
sahf
ja 0x1404008c7
add ebx, dword [rbp + 0xc]
push rbp
pop rsi
xchg dword [rdi - 0x11], ebx
and ah, byte [rsi + 0x78d7de78]
add ebp, dword [rax + 0x516652a0]
xchg esi, eax
and al, 0x79
scasb al, byte [rdi]
js 0x1404008a0
sub dh, byte [rbx + rax - 0x38]
clc
or bl, bh
jp 0x1404007fa
cqo
xchg esp, eax
cld
nop
xor byte [rsi], dh
cld
xchg edi, eax
cld
add dword [rsi], edi
fistp qword [rsi - 0x1045eb88]
imul eax, dword [rbx], 0x4fcd8080
xchg dword [rax - 0x5ebea536], ebx
invalid
pop r11
popfq
invalid
cmp ebx, dword [rcx + 0x26a66956]
pushfq
mov esp, 0x641716ac
in al, 0x94
mov ebp, 0xc3b194bb
xor byte [rsi + 3], bl
idiv byte [rdi - 0x48]
mov dl, 0xcf
pop rcx
invalid

Function at 0x14041bd48
Capabilities:
Terminate process

Disassembly:
xchg qword [rsp + r9 + 0x50], rcx
mov r9, qword [rsp + 0x20]
shr qword [rsp + rdi - 0x5437f6dc], 0xf5
add r11b, 0x9e
and r11, 0x36ba2ea6
mov rdi, qword [rsp + 0x48]
setb bl
cmp r11b, byte [rsp + r11*4 - 0x2c03a55]
call fcn.1403c9bbd
push r15
jns 0x140072ad6

Function at 0x14047afa4
Capabilities:
Terminate process

Disassembly:
jge 0x1404dd439
push qword [rsp + 8]
popfq
lea rsp, [rsp + 0x18]
call fcn.140621a76
add dword [rsi], ecx
add dword [rax], eax
invalid
Function at 0x140483e2d
Capabilities:
Encode data using xor

Disassembly:
add rdi, qword [rsp + 0x20]
call fcn.1400299e1
xor esp, dword [0x10cd22a86]
int3
and al, 0x20
add qword [rsp + 8], 0xffffffffbff58b93
xor dil, byte [rsp + 0x25]
cmp dword [rsp + 0x20], 0x5735bfab
lea rbx, [rbx - 0x7341bdc4]
jg 0x14005e49b
fadd dword [rdx + 0x59]
jne 0x14032d872
push 0xffffffffffffffea
invalid
js 0x140338617
push qword [rsp + 0x50]
popfq
lea rsp, [rsp + 0x58]
ret
movsxd r15, ecx
xor word [rsp + 8], r15w
xchg qword [rsp + r15 - 0x7a1b5dcf], rbp
mov rcx, qword [rsp + 0x20]
shr dword [rsp + r15 - 0x7a1b5dff], 0x77
jbe 0x1400a28f0
xor byte [rsp + r15 - 0x7a1b5def], 0xaf
add qword [rsp + r15 - 0x7a1b5def], 0x1b18f00d
test r15, 0x4c2d6e04
lea rax, [rax + rsi*2 - 0x5e909bfc]
mov sil, byte [rsp + rsi - 0x4f177d7d]
lea r12, [r12 + rsi*2 - 0x5d647ecc]
jo 0x14032d87d
bswap r12d
mov qword [rsp + rsi - 0x4f177d61], rsi
xchg qword [rsp + 0x58], rax
mov rsi, qword [rsp + 0x48]
add word [rsp + 0x10], 0xb815
not r12
ja 0x1403f90c0
and r12d, 0x35add206
lea r12, [r12 + r12 - 0x4f44957]
shr qword [rsp + r12*2 - 0x6cbb522], 0x97
mov r12, qword [rsp + r12*4 - 0xd976a8c]
sub byte [rsp + 0x10], 0x9b
add byte [rsp + 0x38], 0xa1
jo 0x140348e1d

Function at 0x140485870
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sti
wait
invalid
mov rax, qword [rsp + 0x10]
mov rax, qword [rax]
setle sil
not si
add qword [rsp + 0x20], 0x458bbf
cmp sil, cl
mov esi, ecx
cmovb cx, si
lea rax, [rax - 0x20f3b1fc]
or rcx, 0x783c891a
jge 0x1404e6fb0
lodsd eax, dword [rsi]
or byte [rdi], ah
sub ecx, dword [rcx + 0x68a61ee5]
push 0xffffffffb60ae414
pushfq
xor word [rsp + 8], 0xbe39
jge 0x1404c3133
mov byte [rsp + 0x10], 0x8d
invalid
invalid
and al, 0
jnp 0x1400692fa
cmc
mov edi, 0x244c8166
adc byte [rbp + 0x798f0f68], dl
rol dword [rax], cl
cmp qword [rsp + 0x10], 0x79a55b16
call fcn.14005f85d
add dword [rax], eax
add byte [rax], al
jmp fcn.1406ebc41
xor r9, rdx
xchg qword [rsp + r9*2 - 0x7bb0], rcx
mov rdx, qword [rsp + r9*2 - 0x7bc0]
or qword [rsp + r9*2 - 0x7bc8], 0x7fa41f26
shl byte [rsp + r9 - 0x3dc8], 0x45
movsx r9d, word [rsp + r9 - 0x3dc6]
neg byte [rsp + r9*2 - 0xff10]
shl word [rsp + r9 - 0x7f6c], 0xe1
or word [rsp + r9 - 0x7f6c], 0x7623
mov r9, qword [rsp + r9*2 - 0xff00]
not qword [rsp + 0x38]
shl byte [rsp + 0x38], 0x36
and dword [rsp + 0x38], 0x6aacfa94
jl 0x140069313
xor byte [rsp + 0x38], 0xbb
push qword [rsp + 0x30]
popfq
lea rsp, [rsp + 0x50]
ret

Function at 0x14049adb9
Capabilities:
Encode data using base64

Disassembly:
jg 0x14039a9c2
lea rbx, [r12*2 - 0x53ffb259]
mov r9d, dword [rsp + 0x51]
mov r12, qword [rsp + 0x78]
shr rbx, 0x35
jne fcn.140057f38
ja 0x14034fa01
jae 0x1400d347b

Function at 0x1404d5818
Capabilities:
Terminate process

Disassembly:
or qword [rsp + 0x50], 0x55bbff3b
jl 0x14047afb0
mov rbx, rbp
mov rbx, qword [rsp + 0x18]
jne 0x14045adf5
push rsi
push r15
push rbp
push rbx
pushfq
movabs rbx, 0x83a9fbb8c080548c
test bx, 0x802f
call fcn.1400a8551
Function at 0x1404e6f85
Capabilities:
Encrypt data using rc4 prga

Disassembly:
jle 0x140476710
test al, r15b
cmp dl, r9b
jmp 0x140060814
je 0x1403587da
movzx eax, byte [rcx + 1]
movsxd rdx, ebx
bswap dx
inc rcx
movzx edx, al
jmp 0x14006fde2
test al, al
jmp fcn.1403587d4
or rax, 0xffffffffffffffff
jmp 0x1400f4f2a
call fcn.1404eae71
or eax, 0x38244489
cmp eax, 0xffffffff
jne 0x1400f4f04
push rax
call fcn.140032bca
test eax, eax
je 0x1400f4f04
mov ecx, eax
call fcn.1400f0444
jmp 0x1400f4ecd
mov rcx, rbx
mov rax, rbx
lea rdx, [0x14010a800]
sar rax, 5
and ecx, 0x1f
mov rax, qword [rdx + rax*8]
imul rcx, rcx, 0x58
and byte [rax + rcx + 8], 0xfd
mov rax, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
xor r11w, 0x2518
shr qword [rsp + 0x38], 0x71
mov r11, qword [rsp + 0x28]
call fcn.1400634e4
test r14, 0x6c22dcb4
movzx r14, r11w
mov r14, qword [rsp + r14*2 - 0x3e]
setb byte [rsp + 0x38]
add dword [rsp + 0x38], 0x8d11c103
add r11d, dword [rsp + 0x38]
js 0x14002e41e
setl cl
neg cx
xchg qword [rsp + rsi - 0x5e3687a4], rax
mov rsi, qword [rsp]
neg ecx
jns fcn.140410afb
ja fcn.140447391
jns 0x1400f4ee2
shr cx, 0x30
mov rcx, qword [rsp + 0x28]
push qword [rsp + 0x18]
popfq
lea rsp, [rsp + 0x20]
ret 8

Function at 0x14067d13f
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x10], rdx
sub eax, 0xa5aff43a
mov al, r15b
cmovo eax, esp
mov qword [rsp + 8], rcx
test r8w, di
sub rsp, 0x68
movsx rcx, dx
movsx ax, bh
mov rax, qword [rsp + 0x70]
movzx rcx, di
bswap ecx
movzx ecx, r15w
mov qword [rsp + 0x30], rax
bswap eax
mov rax, qword [rsp + 0x30]
movsx cx, r11b
movsxd rcx, r14d
jmp 0x14067d18c
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x38], rax
cbw
cwde
mov rax, qword [rsp + 0x38]
setge ch
movsxd rcx, r12d
mov qword [rax], 0
mov rax, qword [rsp + 0x28]
movzx ecx, sp
movsx cx, spl
mov qword [rax + 0x10], 0
xchg al, ch
cmovbe eax, ebx
lahf
mov rax, qword [rsp + 0x28]
mov qword [rax + 0x18], 0
not cl
movsx rcx, si
lea rax, [0x1400bbf40]
movsx rcx, r8w
xchg ecx, ecx
setle ch
mov qword [rsp + 0x58], rax
movzx rcx, sp
mov rcx, qword [rsp + 0x70]
jmp 0x14067d201
call fcn.1406680b7
mov rax, qword [rsp + 0x78]
mov qword [rsp + 0x40], rax
not cl
movsxd rcx, r13d
movsx eax, r10w
mov qword [rsp + 0x20], 0xffffffffffffffff
mov ecx, ebp
inc qword [rsp + 0x20]
xor ah, 0x35
sar cx, cl
cmovge ax, r12w
mov rax, qword [rsp + 0x40]
ror cl, 0x3d
mov rcx, qword [rsp + 0x20]
clc
cmp byte [rax + rcx], 0
jmp 0x14067d24b
jne 0x14067d224
mov rax, qword [rsp + 0x20]
bswap r8d
mov qword [rsp + 0x48], rax
movzx r8d, sp
movsxd rdx, r14d
mov rax, qword [rsp + 0x48]
cqo
mov r8b, 0xa4
mov qword [rsp + 0x50], rax
mov r8, qword [rsp + 0x50]
movsx dx, r9b
movsxd rdx, r12d
movzx rcx, r11w
mov rdx, qword [rsp + 0x78]
cmova cx, cx
mov rcx, qword [rsp + 0x70]
call fcn.14067d52c
nop
and al, 0xb9
mov rax, qword [rsp + 0x70]
cmp r10d, 0xc7b02d22
clc
cmp r13b, r12b
add rsp, 0x68
ret
Function at 0x14069126d
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
jmp 0x140691289
mov qword [rsp + 8], rcx
cmp sil, 0x28
test bp, si
push rsi
push rdi
stc
sub rsp, 0x68
test si, bx
jmp 0x1406912a8
cmp qword [rsp + 0x88], 0
jmp 0x1406912b6
je 0x1406912d6
mov rax, qword [rsp + 0x88]
mov rax, qword [rax]
mov qword [rsp + 0x38], rax
jmp 0x1406912d1
jmp 0x140691357
mov rax, qword [rsp + 0x80]
jmp 0x1406912e8
mov qword [rsp + 0x40], rax
movsx eax, r8w
movzx ecx, bx
bswap rcx
mov qword [rsp + 0x20], 0xffffffffffffffff
jmp 0x140691308
inc qword [rsp + 0x20]
mov rax, qword [rsp + 0x40]
movsx cx, r10b
bts cx, r8w
xor rcx, r9
mov rcx, qword [rsp + 0x20]
cmc
jmp 0x140691331
cmp byte [rax + rcx], 0
jmp 0x14069133a
jne 0x140691308
mov rax, qword [rsp + 0x20]
setg cl
movsxd rcx, r12d
inc rax
mov qword [rsp + 0x38], rax
movzx rax, r13w
mov rax, qword [rsp + 0x38]
not cl
mov qword [rsp + 0x50], rax
lahf
mov rax, qword [rsp + 0x90]
movzx cx, ah
dec cx
mov cx, bx
mov qword [rsp + 0x48], rax
cwde
mov qword [rsp + 0x28], 0xffffffffffffffff
not rax
inc qword [rsp + 0x28]
setp ch
mov ax, 0x1796
btc ecx, 0x91
mov rax, qword [rsp + 0x48]
sub cx, 0x76ba
not ch
shr ch, 0x37
mov rcx, qword [rsp + 0x28]
cmp byte [rax + rcx], 0
jmp 0x1406913b5
jne 0x140691388
mov rax, qword [rsp + 0x28]
jmp 0x1406913c5
inc rax
mov qword [rsp + 0x30], rax
cmove rax, r15
dec ax
mov rax, qword [rsp + 0x30]
stc
cmp bp, 0x4d19
test r10b, 0xa5
cmp qword [rsp + 0x50], rax
jae 0x140691445
mov rcx, qword [rsp + 0x80]
jmp 0x1406913fb
call fcn.140699104
mov rcx, qword [rsp + 0x30]
jmp 0x14069140a
call fcn.14069906f
mov qword [rsp + 0x80], rax
test r12w, r11w
clc
cmc
cmp qword [rsp + 0x88], 0
jmp 0x14069142b
je 0x140691445
mov rax, qword [rsp + 0x88]
mov di, r10w
mov rcx, qword [rsp + 0x30]
mov qword [rax], rcx
mov rdi, qword [rsp + 0x80]
mov rsi, qword [rsp + 0x90]
mov rcx, qword [rsp + 0x30]
mov rax, r11
movzx ax, r12b
rep movsb byte [rdi], byte [rsi]
sbb sil, r11b
add ax, r9w
bswap edi
mov rax, qword [rsp + 0x80]
add rsp, 0x68
jmp 0x140691481
pop rdi
movsxd rsi, r15d
movsx si, r15b
pop rsi
ret
Function at 0x1406946be
Capabilities:
Encrypt data using rc4 prga

Disassembly:
movss dword [rsp + 0x20], xmm3
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
bts rax, r8
movsx ax, bpl
btc eax, 0x95
sub rsp, 0x98
mov rax, qword [0x1400cb7b8]
cmc
clc
mov qword [rsp + 0x60], rax
cmp dl, r14b
xor al, dil
mov rax, qword [rsp + 0x60]
mov rax, qword [rax + 0x1a80]
jmp 0x140694710
mov qword [rsp + 0x70], rax
cmp qword [rsp + 0xb0], 0
jne 0x14069479f
mov rax, qword [rsp + 0xa8]
mov qword [rsp + 0x68], rax
setne al
movsx cx, ch
bswap eax
mov qword [rsp + 0x58], 0xffffffffffffffff
xchg ah, al
inc qword [rsp + 0x58]
rol ax, cl
add rax, r8
cmc
mov rax, qword [rsp + 0x68]
adc cx, 0x258f
jmp 0x140694760
mov rcx, qword [rsp + 0x58]
test dh, 0x3f
jmp 0x14069476d
cmp byte [rax + rcx], 0
jmp 0x140694776
jne 0x140694745
mov rax, qword [rsp + 0x58]
btc rcx, r9
cmp r11w, r13w
mov rcx, qword [rsp + 0xa8]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0xb0], rax
mov rax, qword [rsp + 0xb0]
test r13w, cx
cmp qword [rsp + 0xa8], rax
jmp 0x1406947b8
je 0x14069492c
mov rax, qword [rsp + 0x70]
stc
cmp r14b, 0xb9
mov rax, qword [rax + 0x2b0]
mov qword [rsp + 0x80], rax
movss xmm1, dword [0x1400c09c4]
xor ecx, ecx
call fcn.140693acb
mov dword [rsp + 0x50], eax
movsx ecx, r11w
mov rax, qword [rsp + 0x60]
mov dx, di
xchg cx, cx
movsx r9, dx
movss xmm0, dword [rax + 0x1928]
movsx r9, bx
cdq
movss dword [rsp + 0x54], xmm0
xchg ch, ah
bswap r9w
mov r9b, 0xa
mov rax, qword [rsp + 0x60]
jmp 0x14069482c
mov rax, qword [rax + 0x1920]
mov qword [rsp + 0x78], rax
mov r9b, 0x95
mov qword [rsp + 0x40], 0
lahf
jmp 0x14069484a
movss xmm0, dword [rsp + 0xb8]
rdtsc
seto r9b
movss dword [rsp + 0x38], xmm0
movzx edx, r13w
not dx
cmova rax, r15
mov rax, qword [rsp + 0xb0]
mov cx, r9w
mov qword [rsp + 0x30], rax
mov dh, 0xa3
cdq
cqo
mov rax, qword [rsp + 0xa8]
cmovs cx, r10w
movsx edx, r12w
mov qword [rsp + 0x28], rax
bswap dx
setnp ch
mov eax, dword [rsp + 0x50]
mov dword [rsp + 0x20], eax
movsx dx, r10b
movzx rdx, ax
lea r9, [rsp + 0xa0]
movsx dx, bl
movss xmm2, dword [rsp + 0x54]
movzx rcx, cx
mov rdx, qword [rsp + 0x78]
movsx rcx, r14w
bswap cx
mov rcx, qword [rsp + 0x80]
jmp 0x1406948dd
call fcn.1406e36e1
mov rax, qword [rsp + 0x60]
test r15b, 0xb2
movzx eax, byte [rax + 0x3048]
test eax, eax
jmp 0x1406948f9
je 0x14069492c
mov r8, qword [rsp + 0xb0]
movsx dx, bpl
movzx dx, bl
not cx
mov rdx, qword [rsp + 0xa8]
movzx rcx, r12w
lea rcx, [rsp + 0xa0]
call fcn.1406c1768
add rsp, 0x98
jmp 0x140694938
ret
Function at 0x14069ebad
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x48
jmp 0x14069ebc0
call fcn.1400de73e
mov qword [rsp + 0x38], rax
jmp 0x14069ebd6
mov rax, qword [rsp + 0x58]
mov byte [rax], 1
rol ax, cl
mov rax, qword [rsp + 0x50]
test r11b, 0x34
cmc
cmp dword [rax], 0
jmp 0x14069ebf3
jle 0x14069ec16
mov rax, qword [rsp + 0x50]
jmp 0x14069ec03
mov rax, qword [rax + 8]
jmp 0x14069ec0c
mov qword [rsp + 0x28], rax
jmp 0x14069ec23
mov qword [rsp + 0x28], 0
xchg ch, al
cdqe
mov rax, qword [rsp + 0x58]
movzx rcx, r8w
not cl
mov rcx, qword [rsp + 0x28]
jmp 0x14069ec38
mov qword [rax + 8], rcx
mov rax, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x50]
jmp 0x14069ec4b
mov ecx, dword [rcx]
jmp 0x14069ec52
mov dword [rax + 0x10], ecx
movzx cx, r12b
lahf
cmove cx, r8w
mov rax, qword [rsp + 0x58]
setnp ch
bswap cx
mov dword [rax + 0x14], 0
movsx cx, r12b
cmovg cx, bp
movsxd rax, ebp
mov rax, qword [rsp + 0x58]
mov dword [rax + 0x18], 0
xorps xmm0, xmm0
cdqe
movss dword [rsp + 0x30], xmm0
movzx rax, r15w
xorps xmm0, xmm0
movss dword [rsp + 0x34], xmm0
movsxd rax, r9d
not ch
mov rax, qword [rsp + 0x30]
mov cl, r11b
cmovnp ecx, r10d
mov ch, 0x9e
mov rcx, qword [rsp + 0x58]
jmp 0x14069ecc0
mov qword [rcx + 0x1c], rax
mov eax, 0x819025ad
not al
mov rax, qword [rsp + 0x38]
movsx rcx, cx
movzx rcx, bx
mov rax, qword [rax + 8]
mov cl, r10b
bswap cx
mov rcx, qword [rsp + 0x58]
jmp 0x14069ecec
mov qword [rcx + 0x24], rax
mov rax, qword [rsp + 0x38]
mov rax, qword [rax + 0xb8]
movzx rcx, bx
not rcx
setnp ch
mov rcx, qword [rsp + 0x58]
jmp 0x14069ed10
mov qword [rcx + 0x2c], rax
mov dword [rsp + 0x20], 0
jmp 0x14069ed21
jmp 0x14069ed43
mov eax, dword [rsp + 0x20]
jmp 0x14069ed2f
inc eax
jmp 0x14069ed36
mov dword [rsp + 0x20], eax
xor ax, r11w
bt ax, r15w
mov rax, qword [rsp + 0x50]
cmp r10b, 0x96
stc
mov eax, dword [rax]
test r9w, bp
clc
cmp dword [rsp + 0x20], eax
jge 0x14069ee1b
movsxd rax, dword [rsp + 0x20]
rcl ch, 0xd
movzx cx, sil
mov rcx, qword [rsp + 0x50]
clc
test bl, r12b
cmc
mov rcx, qword [rcx + 8]
cmc
cmp r10b, 0xba
cmp al, spl
mov rax, qword [rcx + rax*8]
rcr ch, cl
mov rcx, qword [rsp + 0x58]
mov ecx, dword [rcx + 0x18]
stc
add ecx, dword [rax + 0x20]
sub al, r14b
xchg al, ah
add eax, 0xf2812cbe
mov eax, ecx
bswap ecx
shr cl, cl
movsx rcx, r13w
mov rcx, qword [rsp + 0x58]
cmp di, 0xe2b8
mov dword [rcx + 0x18], eax
mov ax, r10w
btc ax, r15w
movsxd rax, dword [rsp + 0x20]
rol ch, 0x84
rcr cl, 0
neg cx
mov rcx, qword [rsp + 0x50]
cmp r13w, di
test r12d, 0xad382a82
mov rcx, qword [rcx + 8]
cmp cx, r9w
cmc
mov rax, qword [rcx + rax*8]
mov rcx, qword [rsp + 0x58]
test r13b, r11b
clc
mov ecx, dword [rcx + 0x14]
cmp r8w, ax
cmp rsp, 0x6a16a519
add ecx, dword [rax + 0x10]
mov eax, ecx
mov rcx, qword [rsp + 0x58]
jmp 0x14069ee0e
mov dword [rcx + 0x14], eax
jmp 0x14069ee16
jmp 0x14069ed26
add rsp, 0x48
jmp 0x14069ee24
ret
Function at 0x1406c1dec
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rcx
rdtsc
shl ax, 0x3c
push rsi
sbb al, r8b
push rdi
cwd
sub rsp, 0x98
mov rax, qword [0x1400cb7b8]
cqo
movzx dx, r12b
mov qword [rsp + 0x60], rax
lea rdx, [0x1400bc184]
mov rcx, qword [rsp + 0xb0]
jmp 0x1406c1e2c
call fcn.14070a66f
mov qword [rsp + 0x40], rax
cmp cl, r10b
test rsi, 0xffffffffc80e2b1f
cmp qword [rsp + 0x40], 0
je 0x1406c1e62
mov rax, qword [rsp + 0x40]
cmove cx, r10w
mov qword [rsp + 0xb0], rax
cbw
bswap eax
mov rax, qword [rsp + 0xb0]
movsxd rcx, edi
jmp 0x1406c1e74
mov qword [rsp + 0x58], rax
mov cx, 0x93ad
dec ecx
mov ax, r15w
mov qword [rsp + 0x28], 0xffffffffffffffff
inc cx
inc qword [rsp + 0x28]
mov rax, qword [rsp + 0x58]
clc
movsx rcx, r12w
cmp edx, r14d
mov rcx, qword [rsp + 0x28]
cmp r15b, 0
clc
cmp byte [rax + rcx], 0
jne 0x1406c1e8f
mov rax, qword [rsp + 0x28]
cqo
shl edx, 0xb0
sal rdx, cl
mov qword [rsp + 0x38], rax
bsf dx, r15w
cbw
mov rax, qword [rsp + 0x38]
add rax, 0x11
xor rcx, rcx
test ah, 0xaa
mov qword [rsp + 0x68], rax
rcr ch, 0x1b
cmp r15d, esp
test r10w, cx
mov rax, qword [rsp + 0x60]
not rdx
cdq
stc
add rax, 0x3038
cwd
bswap ecx
cdq
mov qword [rsp + 0x70], rax
jmp 0x1406c1f0d
mov rdx, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x70]
jmp 0x1406c1f1c
call fcn.1406c37b5
mov qword [rsp + 0x30], rax
movsx eax, di
lea rax, [rsp + 0x20]
mov qword [rsp + 0x78], rax
or eax, 0xa834ab1b
xor ax, si
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x48], rax
cmp qword [rsp + 0x48], 0
jmp 0x1406c1f50
je 0x1406c1f74
mov rcx, qword [rsp + 0x48]
jmp 0x1406c1f60
call fcn.14068ba9f
mov qword [rsp + 0x50], rax
jmp 0x1406c1f6f
jmp 0x1406c1f86
mov qword [rsp + 0x50], 0
movsx eax, di
nop
mov dx, r9w
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x80], rax
rcl dl, cl
sub r8d, r8d
mov rdx, qword [rsp + 0x38]
movzx rcx, dx
bswap ecx
mov cl, 0x27
mov rcx, qword [rsp + 0xb0]
call fcn.14069195e
mov rcx, qword [rsp + 0x30]
mov dil, r11b
mov dword [rcx], eax
movsx rdi, sp
mov rax, qword [rsp + 0x38]
setg cl
movzx si, sil
inc rax
sar sil, 0x2b
mov rcx, qword [rsp + 0x30]
jmp 0x1406c1fe4
add rcx, 0x10
mov rdi, rcx
mov rsi, qword [rsp + 0xb0]
movzx rcx, r10w
sete cl
mov rcx, rax
rep movsb byte [rdi], byte [rsi]
shr ax, cl
mov rax, qword [rsp + 0x30]
add rsi, 0xffffffffa901780c
mov dil, cl
cmc
add rsp, 0x98
pop rdi
pop rsi
jmp 0x1406c2020
ret