joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140201f3f
Capabilities:
Parse pe header

Disassembly:
sub r8d, r8d
movzx dx, bh
mov rdx, rdi
lea edx, [r8 + 2]
jmp 0x1404b4702
mov qword [rsp + 8], rbx
xor bl, dl
btr bx, 0xb0
or bh, 0xd
mov dword [rsp + 0x18], r8d
rcl bh, cl
mov dword [rsp + 0x10], edx
movsx bx, r10b
push rbp
ror bx, 0xf6
mov rbp, rsp
clc
sbb bl, r15b
jmp 0x1404b4732
sub rsp, 0x50
mov ebx, ecx
test r8d, r8d
jne 0x1404b47d6
sub ecx, ecx
jmp 0x1404b4748
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
jmp 0x1404b4756
je 0x1404b47d6
mov ecx, 0x5a4d
cmp word [rax], cx
jmp 0x1404b4769
jne 0x1404b47d6
movsxd rcx, dword [rax + 0x3c]
test r12b, 0xad
add rcx, rax
stc
cmp r11b, r12b
cmp dword [rcx], 0x4550
jmp 0x1404b4789
jne 0x1404b47d6
mov eax, 0x20b
stc
test spl, 0xee
test bpl, r13b
cmp word [rcx + 0x18], ax
jmp 0x1404b47a5
jne 0x1404b47d6
cmp dword [rcx + 0x84], 0xe
jbe 0x1404b47d6
cmp dword [rcx + 0xf8], 0
jmp 0x1404b47c4
je 0x1404b47d6
mov ecx, ebx
jmp 0x1404b47d1
call fcn.1404b45ed
lea rax, [rbp + 0x18]
movsx r9d, bp
bswap r8d
jmp 0x1404b47e6
mov byte [rbp + 0x28], 0
jmp 0x1404b47f3
mov qword [rbp - 0x20], rax
mov ch, 0x99
lea r9, [rbp - 0x2c]
movzx rcx, si
movsx edx, r10w
jmp 0x1404b480b
lea rax, [rbp + 0x20]
cmovae r8w, ax
cqo
mov r8d, 0x618a56aa
mov qword [rbp - 0x18], rax
cmovne dx, r10w
lea r8, [rbp - 0x20]
bswap edx
cbw
lea rax, [rbp + 0x28]
mov qword [rbp - 0x10], rax
movzx eax, ax
cwd
lea rdx, [rbp - 0x28]
movsx rcx, sp
mov eax, 2
jmp 0x1404b484c
lea rcx, [rbp - 0x30]
jmp 0x1404b4855
mov dword [rbp - 0x2c], eax
jmp 0x1404b485d
mov dword [rbp - 0x28], eax
jmp 0x1404b4865
call fcn.1404b4a23
cmp dword [rbp + 0x20], 0
jmp 0x1404b4873
je 0x1404b4892
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
jmp 0x1404b488b
pop rbp
jmp 0x1404b4891
ret
mov ecx, ebx
jmp 0x1404b4899
call fcn.1404b4687
int3

Function at 0x140240fb7
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub r8d, r8d
jmp 0x14025b419
jmp 0x1404e8c78
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
shl di, cl
mov rbx, rdx
btr di, 0xeb
test r9d, 0x586f69a1
mov rdi, rcx
test rcx, rcx
jmp 0x1404e8c9f
jne 0x1404e8cc1
call fcn.1404b8b59
mov dword [rax], 0x16
jmp 0x1404e8cb5
call fcn.1404b9845
xor eax, eax
jmp 0x1404e8d9b
test rbx, rbx
jmp 0x1404e8cc9
je 0x1404e8ca5
cmp rdi, rbx
jmp 0x1404e8cd7
jae 0x1404e8cba
mov rdx, r8
movsx rcx, r15w
movzx cx, r13b
movsxd rcx, eax
lea rcx, [rsp + 0x20]
call fcn.1404a7c8f
mov rcx, qword [rsp + 0x30]
lea rdx, [rbx - 1]
stc
cmc
cmp dword [rcx + 8], 0
jmp 0x1404e8d0a
je 0x1404e8d69
dec rdx
clc
cmp rdi, rdx
jmp 0x1404e8d1c
ja 0x1404e8d39
movzx eax, byte [rdx]
test sil, 0xe2
test byte [rax + rcx + 0x19], 4
jmp 0x1404e8d33
jne 0x1404e8d10
mov rcx, rbx
test r13w, si
test r9b, 0xe9
sub rcx, rdx
xadd dl, dl
mov rdx, rbx
jmp 0x1404e8d52
and ecx, 1
test r11w, 0x35a7
test dl, spl
sub rdx, rcx
jmp 0x1404e8d66
dec rdx
cmp byte [rsp + 0x38], 0
jmp 0x1404e8d73
je 0x1404e8d90
mov rcx, qword [rsp + 0x20]
movsx rax, r10w
and dword [rcx + 0x3a8], 0xfffffffd
stc
not dil
sal al, 0x5e
mov rax, rdx
xor di, sp
movzx di, spl
mov rbx, qword [rsp + 0x50]
or di, r8w
rcl dil, cl
test al, 0x25
add rsp, 0x40
movsx di, r14b
movzx di, sil
pop rdi
jmp 0x1404e8dbd
ret
Function at 0x140282f30
Capabilities:
Encrypt data using speck
Resolve function by parsing pe exports

Disassembly:
mov rcx, qword [rcx]
jmp 0x140298fe2
jmp 0x140449405
push rsi
push rdi
sub rsp, 0x28
mov rsi, rcx
shl ah, cl
cmovs ax, ax
sbb rax, 0x7b872ee5
mov rcx, qword [rcx + 0x18]
mov rax, qword [rcx]
test ebx, 0x783d2104
cmp r13w, bp
xor edx, edx
cmp eax, 0x676c2c91
stc
sub r8d, r8d
call qword [rax + 0x188]
mov edi, eax
movzx cx, ch
movzx rcx, r10w
lea rcx, [rsi + 0x30]
jmp 0x140449450
call fcn.14045d1d8
test edi, edi
jmp 0x14044945c
je 0x140449490
cmp edi, 0x8899000c
jmp 0x14044946d
jne 0x1404494ad
mov rcx, rsi
test ax, 0x5018
add rsp, 0x28
mov si, r13w
movsx rdi, bp
pop rdi
not si
pop rsi
jmp fcn.1404490bb
nop
btc di, r10w
bt rsi, 0x92
add rsp, 0x28
movsx rsi, si
not rdi
movzx esi, r15w
pop rdi
pop rsi
ret
mov ecx, edi
bswap r8
movabs r8, 0xad4a5352d2edebd0
movzx r9, r9w
mov dl, 3
mov r9d, 0x54
add rsp, 0x28
movsx si, dl
movzx si, al
movsxd rsi, r13d
pop rdi
movsx si, r15b
movsx esi, r9w
pop rsi
jmp 0x1404494e7
jmp fcn.1403b2acb

Function at 0x140286faa
Capabilities:
Enumerate pe sections

Disassembly:
cmp r9d, r11d
jmp 0x14024a491
jb 0x14026407b
inc r9d
add rax, 0x28
jmp 0x1400f6991
jb 0x140286ffd
sub eax, eax
jmp 0x14026407b
ret
movsxd r8, dword [rcx + 0x3c]
cbw
xchg r11w, r10w
btc r10w, ax
sub r9d, r9d
xchg r10b, r10b
bts rax, r14
lea r8, [r8 + rcx]
movsx r11w, spl
shld r11, rsi, 0x6e
mov r10, rdx
movzx eax, word [r8 + 0x14]
cmove r11d, edx
shl r11b, cl
movzx r11d, word [r8 + 6]
cmp r8, 0x41756f51
add rax, 0x18
lea rax, [rax + r8]
test r11d, r11d
je 0x14024a497
mov edx, dword [rax + 0xc]
cmp cx, bx
cmp r10, rdx
jb 0x1401061b6
mov ecx, dword [rax + 8]
stc
add ecx, edx
cmc
cmp r10, rcx
jmp 0x1401061b0

Function at 0x140299a9a
Capabilities:
Parse pe header

Disassembly:
jmp 0x1404b4702
sub r8d, r8d
xor edx, edx
jmp 0x140273ccb
Function at 0x1403c058c
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
test r14b, r8b
push r14
test r14w, 0x1e70
push r12
push rsi
push rdi
bswap r12w
btr r12d, r9d
movzx r12, ax
push rbx
xor r12d, 0xa33547b
sbb r12d, 0x129c3f0f
sub rsp, 0x28
xor r12, r12
mov r12, r8
cmc
test rdx, rdx
jmp 0x1403c05cb
je 0x1403c07eb
mov r15, rdx
rcl ebx, cl
btc bx, bp
xadd bh, bl
mov rbx, rcx
cmp sil, r14b
sub esi, esi
jmp 0x1403c063f
mov rcx, rdi
cqo
jmp 0x1403c05f4
mov rdx, r14
call fcn.1403be3d9
mov eax, dword [rbx + rsi + 0x58]
test r11w, 0x2fdb
cmp r12, r14
mov dword [r12 + rsi + 0x58], eax
shrd eax, r12d, 0xf3
rcl eax, 0x75
mov rax, qword [rbx + rsi + 0x50]
cmc
stc
cmp esi, 0x2cdc08ce
mov qword [r12 + rsi + 0x50], rax
add rsi, 0x60
jmp 0x1403c0631
dec r15
jmp 0x1403c0639
je 0x1403c07e2
mov eax, dword [rbx + rsi + 8]
test r13b, 0x4e
mov dword [r12 + rsi + 8], eax
clc
jmp 0x1403c0652
cmp r12, rbx
jmp 0x1403c065a
je 0x1403c05fc
cmp qword [rbx + rsi + 0x28], 0x10
jmp 0x1403c066b
jb 0x1403c0680
mov r9, qword [rbx + rsi + 0x10]
jmp 0x1403c067b
jmp 0x1403c068c
lea r9, [rbx + rsi]
add r9, 0x10
movzx r14, r11w
lea r14, [r12 + rsi]
test r13w, cx
cmp r8d, ecx
xor al, r13b
add r14, 0x10
clc
ror al, 0x1c
sal dil, cl
mov rdi, qword [rbx + rsi + 0x20]
or ah, 0x91
movsx ax, r15b
mov rax, qword [r12 + rsi + 0x28]
test r15b, 0x73
cmp rax, rdi
jmp 0x1403c06c3
jae 0x1403c06e3
mov rcx, r14
cmovp dx, r13w
mov rdx, rdi
jmp 0x1403c06d9
call fcn.1403be3d9
jmp 0x1403c0735
cmp rax, 0x10
jmp 0x1403c06ec
jb 0x1403c06fe
mov r14, qword [r12 + rsi + 0x10]
cwd
setge dh
cqo
mov qword [r12 + rsi + 0x20], rdi
movzx cx, sil
mov rcx, r14
movzx dx, dh
setne r8b
cdq
mov rdx, r9
movsxd r8, esi
bswap r8w
mov r8, rdi
jmp 0x1403c0726
call fcn.1404a6cac
mov byte [r14 + rdi], 0
btc r14, 0x81
mov r14, qword [rbx + rsi + 0x40]
test cl, 0x44
stc
cmp dil, 0x8f
cmp qword [rbx + rsi + 0x48], 0x10
jb 0x1403c075d
mov r9, qword [rbx + rsi + 0x30]
jmp 0x1403c0758
jmp 0x1403c0772
lea r9, [rbx + rsi]
jmp 0x1403c0766
add r9, 0x30
movsx ax, bpl
adc rax, rbx
lea rdi, [r12 + rsi]
add rdi, 0x30
shl ah, 0xe4
xchg ah, al
mov rax, qword [r12 + rsi + 0x48]
stc
test cl, r12b
cmp rax, r14
jb 0x1403c05ea
cmp rax, 0x10
jmp 0x1403c079a
jb 0x1403c07a5
mov rdi, qword [r12 + rsi + 0x30]
mov qword [r12 + rsi + 0x40], r14
setne ch
movsx r8w, bl
cdq
mov rcx, rdi
movsx r8, r8w
mov r8d, 0x23ec568c
mov rdx, r9
movsxd r8, ebp
movsx r8w, al
mov r8, r14
jmp 0x1403c07d3
call fcn.1404a6cac
mov byte [rdi + r14], 0
jmp 0x1403c05fc
lea r12, [r12 + rsi]
shr ah, cl
sbb sil, r9b
mov rax, r12
add rsp, 0x28
movzx r12, sp
movzx di, cl
cmovo r14d, esi
pop rbx
pop rdi
pop rsi
jmp 0x1403c0806
pop r12
jmp 0x1403c0810
pop r14
pop r15
ret
Function at 0x1403d9801
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r14
cmp r13b, 0x9a
bt eax, 0xe1
and ah, 0x93
push rsi
not sil
push rdi
bts si, bp
movsx esi, bp
bsf rax, r11
push rbx
cmovge rsi, rbp
sub rsp, 0x28
stc
btr si, 0xde
bsf esi, r12d
mov rsi, rcx
lea rax, fcn.140010f00
mov qword [rcx], rax
lea rax, fcn.140010f00
stc
cmp rdx, 0x4032067a
mov qword [rcx + 0x50], rax
test rcx, r12
mov rcx, qword [rcx + 0xa0]
clc
test rcx, rcx
je 0x1403d98f2
mov rdx, qword [rsi + 0xb0]
clc
sub rdx, rcx
cmc
cmp rdx, 0x1000
jmp 0x1403d987d
jb 0x1403d98c5
mov rax, qword [rcx - 8]
stc
add rcx, 0xfffffffffffffff8
cmp r12w, r12w
jmp 0x1403d9896
sub rcx, rax
cmp r11b, 0xa3
cmp dil, spl
cmp rcx, 0x20
jae 0x1403d99fe
add rdx, 0x27
movsxd rdi, r10d
movsx cx, spl
jmp 0x1403d98bb
mov rcx, rax
movzx edi, bx
movsx rdi, sp
lea rdi, [rsi + 0xa0]
jmp 0x1403d98d1
call fcn.140256fb2
xorps xmm0, xmm0
movups xmmword [rdi], xmm0
clc
jmp 0x1403d98e2
mov qword [rdi + 0x10], 0
rcl di, cl
movsx di, r12b
mov rdi, qword [rsi + 0x60]
cmc
stc
test rdi, rdi
jmp 0x1403d9900
je 0x1403d99d3
lea r14, [rsi + 0x60]
sub bl, bpl
cmp spl, r15b
mov rbx, qword [rsi + 0x68]
cmp rdi, rbx
jmp 0x1403d991c
je 0x1403d9959
nop dword [rax]
mov rcx, rdi
call fcn.1403b9831
add rdi, 0x110
cmc
test r13b, dl
jmp 0x1403d993e
cmp rdi, rbx
jmp 0x1403d9946
jne 0x1403d9926
mov rdi, qword [r14]
sal dh, cl
btr dx, r12w
shl dh, 0xa5
mov rdx, qword [rsi + 0x70]
sub rdx, rdi
test ax, 0x7583
test sil, sil
cmp rdx, 0x1000
jb 0x1403d99a8
mov rax, qword [rdi - 8]
stc
add rdi, 0xfffffffffffffff8
clc
sub rdi, rax
cmp dil, 0xd3
cmp bh, ah
cmp rdi, 0x20
jmp 0x1403d9990
jae 0x1403d99fe
add rdx, 0x27
mov rdi, rax
mov ecx, r14d
cmovnp rcx, rbx
movzx ecx, r15w
mov rcx, rdi
jmp 0x1403d99b0
call fcn.140256fb2
xorps xmm0, xmm0
movups xmmword [r14], xmm0
xor cl, r9b
mov qword [r14 + 0x10], 0
movsxd rdi, edx
movzx r14d, r12w
btr bx, r13w
mov rcx, rsi
cmc
add rsp, 0x28
movsx di, dl
pop rbx
movsx edi, ax
sets sil
pop rdi
not r14b
movzx r14w, cl
xchg sil, sil
pop rsi
movsxd r14, edx
pop r14
jmp fcn.1404441d2
call fcn.1404b986e
int3
Function at 0x1403e8790
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
push r14
sbb r14b, 0xe0
shl r15b, 0x96
sal r15w, 0x3a
push r13
xor r14, r11
sar r14w, 0x5b
push r12
bsr r15d, r12d
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x38
sal r14w, 0xb3
jmp 0x1403e87c6
movaps xmmword [rsp + 0x20], xmm6
bsr r14w, r13w
mov r14, r9
shl bx, 1
movzx r12, cx
mov r15, r8
bts r13w, r14w
shr bh, cl
mov r12, rdx
mov r13, rcx
shl ebx, cl
bts bx, r15w
sbb ebx, edi
mov rbx, qword [rcx]
test si, di
test rbx, rbx
jmp 0x1403e8801
je 0x1403e8931
mov rdi, qword [r13 + 8]
jmp 0x1403e8810
cmp rbx, rdi
jmp 0x1403e8818
je 0x1403e88db
lea rbp, [0x1400bed30]
movaps xmm6, xmmword [0x1400bd400]
jmp 0x1403e8831
jmp 0x1403e8854
call fcn.140256fb2
movups xmmword [rbx + 0x20], xmm6
mov byte [rbx + 0x10], 0
cmp ax, 0x27a
add rbx, 0x38
cmp rbx, rdi
je 0x1403e88cb
mov qword [rbx], rbp
or al, r10b
rol al, 0x64
mov rax, qword [rbx + 0x28]
cmp rax, 0x10
jmp 0x1403e886a
jb 0x1403e883b
mov rcx, qword [rbx + 0x10]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jmp 0x1403e8884
jb 0x1403e8836
mov rsi, qword [rcx - 8]
stc
add rcx, 0xfffffffffffffff8
clc
stc
sub rcx, rsi
stc
cmp rdx, r13
cmp rcx, 0x20
jmp 0x1403e88a5
jae 0x1403e89c9
add rax, 0x28
cwd
movzx edx, r8w
mov rdx, rax
mov rcx, r11
seto ch
mov rcx, rsi
jmp 0x1403e88c6
jmp 0x1403e8836
mov rbx, qword [r13]
test r14b, 0xdd
shrd dx, r12w, 0x1c
adc edx, edx
mov rdx, qword [r13 + 0x10]
sub rdx, rbx
cmp rdx, 0x1000
jmp 0x1403e88ee
jb 0x1403e8924
mov rax, qword [rbx - 8]
cmp r15b, 0xcf
add rbx, 0xfffffffffffffff8
stc
sub rbx, rax
cmp r8w, 0x50fc
cmp rbx, 0x20
jmp 0x1403e8913
jae 0x1403e89c9
add rdx, 0x27
movsx ecx, r11w
mov rbx, rax
mov rcx, rbx
jmp 0x1403e892c
call fcn.140256fb2
mov qword [r13], r12
test r12w, 0x6ae9
imul rax, r15, 0x38
movzx rsi, si
bsr bp, r11w
rcr r15b, 4
add rax, r12
setne bpl
shr r15d, cl
mov qword [r13 + 8], rax
rcr dil, cl
imul rax, r14, 0x38
movsx ebp, ax
adc r14b, 0xe5
btc rdi, 0x13
add rax, r12
mov qword [r13 + 0x10], rax
btr r15w, 0x1a
neg r12b
cmp r11w, si
movaps xmm6, xmmword [rsp + 0x20]
sar sil, cl
clc
add rsp, 0x38
pop rbx
movzx ebp, ax
pop rbp
movsx r14w, bpl
cmovp r12d, esi
mov r14, 0x1ed02c8a
pop rdi
not r15d
seto r14b
movzx r12, bx
pop rsi
not r14w
xchg r13b, r15b
movzx r15d, r12w
pop r12
pop r13
movzx r14w, r13b
pop r14
pop r15
ret
call fcn.1404b986e
int3
Function at 0x1403e9f6f
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
push r14
bt r14w, 0xbc
push r13
cmc
test ch, 0xf4
btr r15w, 0xda
push r12
push rsi
ror r15b, cl
btr r14w, r13w
movsx r12, r12w
push rdi
push rbp
rcl r15w, cl
dec r13
xor r13, 0x2da23d5
push rbx
cmovle r15w, bp
add r12w, r8w
jmp 0x1403e9fb3
sub rsp, 0x38
sar r14b, 0x92
add r13w, dx
movaps xmmword [rsp + 0x20], xmm6
bsf r13w, r10w
mov r15b, 0xb2
bts r15, r8
mov r14, r9
mov r15, r8
mov r12, rdx
and r13b, 0x52
bsf bx, r11w
mov r13, rcx
bt bx, 0x87
rcl bl, cl
bsr rbx, r9
mov rbx, qword [rcx]
test bh, 0xef
stc
clc
test rbx, rbx
je 0x1403ea163
mov rdi, qword [r13 + 8]
cmp spl, 0x6c
stc
cmp rbx, rdi
jmp 0x1403ea012
je 0x1403ea105
lea rbp, [0x1400bed10]
jmp 0x1403ea024
movaps xmm6, xmmword [0x1400bd400]
jmp 0x1403ea05d
call fcn.140256fb2
movups xmmword [rbx + 0x20], xmm6
cmp bpl, r13b
mov byte [rbx + 0x10], 0
jmp 0x1403ea048
add rbx, 0x50
cmp r10, r8
cmp rbx, rdi
jmp 0x1403ea057
je 0x1403ea0f6
mov qword [rbx], rbp
bswap cx
movsx rcx, r14w
jmp 0x1403ea06c
lea rcx, [rbx + 0x38]
jmp 0x1403ea075
call fcn.1403e7445
mov rax, qword [rbx + 0x28]
cmp rax, 0x10
jb 0x1403ea035
mov rcx, qword [rbx + 0x10]
lea rdx, [rax + 1]
cmp cl, r8b
cmp r9b, 0x90
cmp rdx, 0x1000
jmp 0x1403ea0a3
jb 0x1403ea030
mov rsi, qword [rcx - 8]
test r10w, si
test r13d, 0x61c17218
add rcx, 0xfffffffffffffff8
sub rcx, rsi
jmp 0x1403ea0c8
cmp rcx, 0x20
jmp 0x1403ea0d1
jae 0x1403ea213
add rax, 0x28
movzx edx, di
bswap rdx
movzx dx, sil
mov rdx, rax
mov rcx, rsi
jmp 0x1403ea0f1
jmp 0x1403ea030
mov rbx, qword [r13]
xadd rdx, rdx
btc edx, r13d
rcr dl, 0xa5
mov rdx, qword [r13 + 0x10]
test sil, 0x2c
stc
sub rdx, rbx
jmp 0x1403ea116
cmp rdx, 0x1000
jb 0x1403ea156
mov rax, qword [rbx - 8]
cmc
clc
add rbx, 0xfffffffffffffff8
stc
jmp 0x1403ea133
sub rbx, rax
cmp rbx, 0x20
jae 0x1403ea213
add rdx, 0x27
mov cl, 0xa5
mov cl, r15b
movsx bx, r11b
mov rbx, rax
jmp 0x1403ea156
mov rcx, rbx
jmp 0x1403ea15e
call fcn.140256fb2
mov qword [r13], r12
jmp 0x1403ea16f
lea rax, [r15 + r15*4]
and r15b, r11b
shl rax, 4
test r10b, 0x22
sbb rsi, 0x45ae6d96
lea rax, [rax + r12]
mov bpl, 0x7b
mov qword [r13 + 8], rax
inc r15w
test r13b, r9b
movzx ebx, cx
lea rax, [r14 + r14*4]
shl rax, 4
movsxd r14, ecx
rcr sil, cl
movzx bp, cl
lea rax, [rax + r12]
mov qword [r13 + 0x10], rax
movaps xmm6, xmmword [rsp + 0x20]
xor dil, 0x81
add rsp, 0x38
movzx esi, r11w
movsxd r15, esp
movsx esi, sp
pop rbx
movsxd rdi, ecx
mov r14b, dil
pop rbp
movzx r15d, ax
cmovne r14w, r10w
not r12w
pop rdi
jmp 0x1403ea1e9
pop rsi
pop r12
bswap r13w
movsx r14w, al
movsx r13d, ax
pop r13
not r15w
pop r14
movsx r15, dx
mov r15b, 0x17
mov r15b, r12b
pop r15
jmp 0x1403ea212
ret
call fcn.1404b986e
int3
Function at 0x1403f5058
Capabilities:
Authenticate hmac

Disassembly:
push r14
sub r14d, 0x45745130
push rsi
push rdi
push rbx
shl bl, 0xc4
lahf
sub rsp, 0x28
cmovs ax, r10w
shl sil, 0x80
mov rbx, rdx
or rsi, 0x686f08e5
mov r14, rcx
movzx esi, si
xchg sil, al
lea rsi, [rdx + r8]
mov eax, dword [rcx + 8]
test al, 2
jmp 0x1403f5096
jne 0x1403f515d
mov dil, 1
test r14b, spl
cmp bp, 0x4c16
test al, 4
jmp 0x1403f50ae
je 0x1403f52ae
lea rax, [rbx + 1]
cmp rax, rsi
jmp 0x1403f50c0
ja 0x1403f52ac
mov byte [rbx], 0x12
ror rcx, 0x41
add cl, sil
mov rcx, qword [r14 + 0x40]
cmp rcx, 0x80
jmp 0x1403f50e0
jb 0x1403f5277
nop word cs:[rax + rax]
mov dx, 0x2406
xchg dl, dh
btr edx, 0xc9
lea rdx, [rax + 1]
test r14, 0x33eb53c4
cmp rdx, rsi
jmp 0x1403f510d
ja 0x1403f52ac
mov ebx, ecx
or bl, 0x80
test al, spl
jmp 0x1403f5120
mov byte [rax], bl
cmc
or bl, 0x5e
adc al, 0x24
mov rbx, rcx
bt eax, ecx
shr rbx, 7
mov rax, rdx
clc
cmp rcx, 0x3fff
movzx cx, dil
mov ecx, r12d
mov ecx, 0x489f3984
mov rcx, rbx
jmp 0x1403f5152
ja 0x1403f50fa
jmp 0x1403f5282
test r8, r8
jmp 0x1403f5165
jle 0x1403f52ac
mov byte [rbx], 0xa
mov cl, r15b
inc rbx
mov rcx, qword [r14 + 0x20]
clc
cmp rcx, 0x80
jmp 0x1403f5185
jb 0x1403f520f
nop dword [rax + rax]
test bp, 0x2aac
sub ax, r10w
lea rax, [rbx + 1]
cmp r12d, esi
cmp rax, rsi
jmp 0x1403f51ab
ja 0x1403f52ac
mov edx, ecx
clc
jmp 0x1403f51b9
or dl, 0x80
test edi, 0x4ec531c2
cmp cx, r11w
test r14b, r8b
mov byte [rbx], dl
adc bl, r9b
bsr ebx, r13d
xor edx, 0x645b16b7
mov rdx, rcx
sbb ebx, 0x6a74189b
shr rdx, 7
movsxd rbx, ebp
rol bl, 0x3c
mov rbx, rax
jmp 0x1403f51f4
cmp rcx, 0x3fff
bswap cx
movsxd rcx, edx
mov rcx, rdx
ja 0x1403f519c
jmp 0x1403f5221
mov rax, rbx
shrd edx, r13d, 0x36
mov rdx, rcx
shr ecx, 0x4e
shl rcx, 0x8e
lea rcx, [rax + 1]
clc
test r9b, 0x5c
cmp rcx, rsi
ja 0x1403f52ac
mov byte [rax], dl
mov r8, qword [r14 + 0x20]
btr bx, sp
shld rbx, rbx, 0xe4
rcl bh, cl
lea rbx, [rcx + r8]
test esp, 0x6e397e49
test bl, spl
cmp r11b, 0x27
cmp rbx, rsi
ja 0x1403f52ac
cmp qword [r14 + 0x28], 0x10
jb 0x1403f52dc
mov rdx, qword [r14 + 0x10]
jmp 0x1403f5272
jmp 0x1403f52e5
mov rdx, rax
mov rbx, rcx
xor cl, 0x96
dec cl
lea rcx, [rdx + 1]
cmp rcx, rsi
jmp 0x1403f528e
ja 0x1403f52ac
mov byte [rdx], bl
mov r8, qword [r14 + 0x40]
lea rax, [rcx + r8]
cmp rax, rsi
jmp 0x1403f52a6
jbe 0x1403f52f8
sub edi, edi
mov eax, edi
add rsp, 0x28
jmp 0x1403f52b9
pop rbx
jmp 0x1403f52c3
pop rdi
mov r14d, 0x198d6de8
bswap si
movsxd rsi, ebp
pop rsi
movsx r14, r15w
bswap r14w
pop r14
ret
lea rdx, [r14 + 0x10]
jmp 0x1403f52e5
call fcn.1404a6cac
mov eax, dword [r14 + 8]
jmp 0x1403f52f3
jmp 0x1403f509c
cmp qword [r14 + 0x48], 0x10
jmp 0x1403f5302
jb 0x1403f5316
mov r14, qword [r14 + 0x30]
jmp 0x1403f5311
jmp 0x1403f5323
add r14, 0x30
jmp 0x1403f5323
mov rdx, r14
jmp 0x1403f532b
call fcn.1404a6cac
jmp 0x1403f52ae
Function at 0x140401660
Capabilities:
Access peb ldr_data

Disassembly:
sub rsp, 0x28
jmp 0x14040166d
test r8, r8
jmp 0x140401675
je 0x1404016ea
movzx r9d, word [r8]
test r9w, r9w
jmp 0x140401688
je 0x140401721
xor eax, eax
test rcx, rcx
mov r10, rcx
cmp r9b, r8b
cmc
nop dword [rax + rax]
test r12b, 0xa8
cmp r12b, bl
cmp rdx, rax
jmp 0x1404016b1
je 0x1404018c9
mov word [r10], r9w
add r10, 2
movzx r9d, word [r8 + rax*2 + 2]
jmp 0x1404016ca
inc rax
clc
jmp 0x1404016d3
test r9w, r9w
jmp 0x1404016dc
jne 0x1404016a9
sub rdx, rax
jmp 0x140401724
movzx r9d, word [0x1400b8f10]
test r9w, r9w
je 0x140401737
cmp rdx, 0x104
jmp 0x140401708
mov r8d, 0x104
jmp 0x140401713
cmovb r8, rdx
jmp 0x14040171c
jmp 0x14040185a
mov r10, rcx
test rdx, rdx
jmp 0x14040172c
jne 0x1404018c9
jmp 0x1404018d4
mov rax, qword gs:[0x30]
movsx r8, r9w
mov rax, qword [rax + 0x60]
xor r10b, dil
mov rax, qword [rax + 0x18]
ror r8b, cl
mov rax, qword [rax + 0x10]
movsx r9, cx
sar r10b, 0x67
movzx r8d, word [rax + 0x58]
bts r10w, r10w
not r11
cmp r8, rdx
xchg r11b, r10b
cmovl r10, rdi
cmovae r8, rdx
rol r9b, cl
and r9, r12
neg r10
mov r9, qword [rax + 0x60]
movsxd r11, edi
movzx r11d, word [r9]
btr r10w, 0x32
lea r10, [0x1400b8f10]
stc
jmp 0x1404017a0
test r11w, r11w
jmp 0x1404017a9
je 0x140401800
xor eax, eax
test r11w, r11w
cmc
nop word cs:[rax + rax]
cmc
test edi, 0x45fc18e6
cmp r8, rax
jmp 0x1404017d3
je 0x14040180e
mov word [r10], r11w
dec r11b
add r10, 2
movzx r11d, word [r9 + rax*2 + 2]
jmp 0x1404017ef
inc rax
cmc
test r11w, r11w
jne 0x1404017cb
sub r8, rax
test r8, r8
jmp 0x140401808
je 0x140401819
mov word [r10], 0
rcl r8w, 0xfc
movzx r9d, word [0x1400b8f10]
bsf r8w, r10w
mov r10b, cl
cmp rdx, 0x104
movsx r8, r10w
mov r10w, r11w
mov r8d, 0x104
mov r10w, 0x7ed5
cmovb r8, rdx
mov r10, rcx
cmc
test r9w, r9w
jmp 0x140401854
je 0x1404018bb
xor edx, edx
lea rax, [0x1400b8f10]
inc r10d
mov r10, rcx
jmp 0x14040186e
nop dword [rax + rax]
cmp r8, rdx
jmp 0x14040187e
je 0x1404018c9
mov word [r10], r9w
cmc
bsr r9w, sp
add r10, 2
movzx r9w, dil
movzx r9d, word [rax + rdx*2 + 2]
jmp 0x1404018a2
inc rdx
test r9w, r9w
jmp 0x1404018ae
jne 0x140401876
sub r8, rdx
cmc
test r11b, cl
test r8, r8
jmp 0x1404018c3
je 0x1404018d4
mov word [r10], 0
mov eax, 0x16785952
movabs rax, 0xe039ec0d24fefd13
mov qword [rsp], rax
movzx eax, ax
movzx rax, r8w
lahf
movabs rax, 0x2247bce40ef3a5e6
mov qword [rsp + 8], rax
movzx dx, r12b
jmp 0x140401906
movabs rdx, 0xe05dec612491fd3d
jmp 0x140401915
mov qword [rsp + 0x10], rdx
jmp 0x14040191f
mov qword [rsp + 0x18], rax
cdqe
not rax
seto ah
lea rax, [rsp + 0x10]
movdqa xmm0, xmmword [rsp]
pxor xmm0, xmmword [rax]
movdqa xmmword [rsp], xmm0
movd eax, xmm0
add rcx, 0xfffffffffffffffe
cmp r11b, r15b
clc
nop word cs:[rax + rax]
cmc
cmp word [rcx + 2], 0
jmp 0x140401960
lea rcx, [rcx + 2]
jmp 0x140401969
jne 0x140401956
test ax, ax
jmp 0x140401977
je 0x1404019c7
lea rdx, [rsp + 2]
clc
nop word cs:[rax + rax]
jmp 0x140401998
mov word [rcx], ax
dec ax
add rcx, 2
test r9w, ax
movzx eax, word [rdx]
clc
test dil, r15b
add rdx, 2
cmc
test r8d, 0x317e196d
test ax, ax
jmp 0x1404019c1
jne 0x140401998
mov word [rcx], 0
add rsp, 0x28
jmp 0x1404019d5
ret
Function at 0x1404259d0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rsi
bsf r9, r14
movsxd r10, r15d
mov r10, qword [rcx]
mov rsi, qword [rcx + 0x18]
sub r9, 0x4bf36a5a
rcr r9d, 0x6f
ror r9w, cl
mov r9d, dword [r10 + 4]
clc
imul r9d, dword [r10]
cmp r12w, r11w
test r8b, 0xcf
jmp 0x140425a04
cmp r8d, 2
jne 0x140425b9c
test r9d, r9d
jmp 0x140425a16
je 0x140425c40
lea ecx, [r9 - 1]
clc
cmp ecx, 3
jb 0x140425b26
mov r11d, r9d
stc
neg r10b
and r11d, 0xfffffffc
movsx r8w, dil
btr r10w, 0x60
bt r8w, 0xa7
nop word cs:[rax + rax]
rcr r10w, cl
movzx r8d, word [rsi]
movzx r10d, word [rsi + 4]
xor ecx, ecx
cmp r8w, word [rdx]
movsx r8, si
jmp 0x140425a6f
setne cl
and r8b, r11b
neg ecx
btr r8d, 0x78
mov word [rsi + 2], cx
bt r8w, 0x23
xor ecx, ecx
ror r8b, 0x91
rol cl, cl
cmp r10w, word [rdx]
setle r8b
jmp 0x140425a9b
setne cl
neg ecx
mov r8b, bpl
bsr r8w, si
mov word [rsi + 6], cx
btr r8d, 0x1b
rol r8, 0xb4
bt r8w, 0x26
movzx r8d, word [rsi + 8]
cmp dl, bpl
jmp 0x140425ac8
xor ecx, ecx
cmp r8w, word [rdx]
setne cl
sub r8, rdi
neg ecx
mov word [rsi + 0xa], cx
xadd r8b, r8b
shl r8w, cl
rol r8b, cl
movzx r8d, word [rsi + 0xc]
clc
sub ecx, ecx
adc cl, r10b
rcr cl, 0x6e
cmp r8w, word [rdx]
jmp 0x140425afc
setne cl
neg ecx
cmc
mov word [rsi + 0xe], cx
stc
jmp 0x140425b0c
add rsi, 0x10
clc
jmp 0x140425b17
add r11d, 0xfffffffc
jmp 0x140425b20
jne 0x140425a57
test r9b, 3
je 0x140425c40
and r9d, 3
cmova r8, rsi
xor r8w, r10w
xor ecx, ecx
neg r8w
btc r8d, 0x34
nop word cs:[rax + rax]
stc
mov r8, 0x68b20e7b
movsx r8w, r11b
movzx r8d, word [rsi + rcx*4]
sub eax, eax
xchg al, al
sub al, r12b
adc al, 0xec
cmp r8w, word [rdx]
setne al
jmp 0x140425b7a
neg eax
jmp 0x140425b81
mov word [rsi + rcx*4 + 2], ax
inc rcx
cmp r9d, ecx
jmp 0x140425b91
jne 0x140425b5f
jmp 0x140425c40
test r9d, r9d
je 0x140425c40
movzx r10d, word [rdx]
add r8w, bp
bts r8, r8
btc r8w, 0x2b
mov r8d, r9d
clc
xor ecx, ecx
jmp 0x140425bc2
jmp 0x140425be9
inc rcx
cmp r11, 0x53663ca3
test rcx, 0x508b0668
cmp al, r11b
cmp r8d, ecx
jmp 0x140425be3
je 0x140425c40
cmp word [rsi + rcx*8], r10w
jmp 0x140425bf3
jne 0x140425bc7
movzx eax, word [rsi + rcx*8 + 2]
test rdx, r13
cmp ax, word [rdx + 2]
jmp 0x140425c0a
jne 0x140425bc7
movzx eax, word [rsi + rcx*8 + 4]
cmp ax, word [rdx + 4]
jmp 0x140425c1e
jne 0x140425bc7
mov word [rsi + rcx*8 + 6], 0
setp r10b
movsxd r10, eax
movzx r10d, word [rdx]
jmp 0x140425c3b
jmp 0x140425bc7
pop rsi
jmp 0x140425c46
ret