joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14019b408
Capabilities:
Encrypt data using speck
Resolve function by parsing pe exports

Disassembly:
jmp 0x1403fd161
mov rcx, qword [rcx]
jmp 0x14017ec85
push rsi
lahf
cmp rax, 0x45117695
test bpl, 0x8f
push rdi
xchg ah, ah
ror sil, cl
seta sil
sub rsp, 0x28
sub si, 0x675b
mov rsi, rcx
mov rcx, qword [rcx + 0x18]
bsf rax, r8
sar ah, cl
movsx rax, sp
mov rax, qword [rcx]
xor edx, edx
test r8w, 0x4eb1
jmp 0x1403fd1a2
xor r8d, r8d
call qword [rax + 0x188]
mov edi, eax
movsx rcx, r12w
bswap cx
lea rcx, [rsi + 0x30]
jmp 0x1403fd1bd
call fcn.14041119c
test edi, edi
jmp 0x1403fd1c9
je 0x1403fd1f7
cmp edi, 0x8899000c
jne 0x1403fd20a
mov rcx, rsi
stc
bts edi, r9d
add rsp, 0x28
pop rdi
movsx rsi, r11w
pop rsi
jmp 0x1403fd1f2
jmp fcn.1403fce4d
nop
bswap di
add rsp, 0x28
movsx esi, r10w
movzx rsi, r10w
pop rdi
pop rsi
ret
mov ecx, edi
shr edi, 0x55
sbb dl, al
sub r9b, bpl
movabs r8, 0xad4a5352d2edebd0
bsf r9d, ecx
mov dl, 3
rcr r9d, 0x46
mov r9d, 0x54
add rsp, 0x28
pop rdi
pop rsi
jmp 0x1403fd239
jmp fcn.14036bb4e

Function at 0x1401a0c94
Capabilities:
Parse pe header

Disassembly:
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
cmp dword [rdx], 0x4550
jmp 0x1401e5800
xor eax, eax
ret
jne 0x140119594
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
clc
jmp 0x1400f626e
mov eax, 0x5a4d
cmc
clc
cmp word [rcx], ax
jmp 0x14016f306
jne 0x140119594
xor eax, eax
jmp 0x1400df193
Function at 0x1403782f9
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
cmp dh, 0x57
cmova r15d, r10d
shr r15w, cl
push r14
add r15, rbx
stc
btr r15w, 0x9a
push r13
bt r14d, r8d
push r12
push rsi
push rdi
rol r15b, 0x49
push rbx
jmp 0x140378330
sub rsp, 0x20
rcr ax, cl
mov r15, r8
mov rdi, rdi
rcl ax, cl
rol r14d, cl
mov rbx, rdx
movzx edi, bx
adc al, 0xda
mov r14, rcx
or dil, r10b
sal al, 0xdc
sub r8, rdx
bswap eax
lahf
and di, ax
sar r8, 4
clc
xor ax, 0x6f1d
movabs rax, 0xf0f0f0f0f0f0f0f1
inc dil
imul r8, rax
rcl dil, 0x3a
cmp r10b, dil
mov rdi, qword [rcx]
cmp r8b, 0x39
mov rcx, qword [rcx + 0x10]
cmp rax, 0xd725b38
sub rcx, rdi
cmp al, 0x1a
clc
sar rcx, 4
imul rcx, rax
jmp 0x1403783a8
cmp r8, rcx
jmp 0x1403783b0
jbe 0x14037840f
mov rcx, r14
movsx edx, si
mov dh, bh
mov rdx, r8
jmp 0x1403783c6
call fcn.14037860b
mov rsi, qword [r14]
cmp rbx, r15
je 0x1403785c4
nop dword [rax + rax]
movzx rdx, r10w
movsxd rcx, edi
mov rcx, rsi
mov rdx, rbx
jmp 0x1403783ee
call fcn.1403788a3
add rsi, 0x110
add rbx, 0x110
cmp rbx, r15
jne 0x1403783e3
jmp 0x1403785c4
mov rsi, qword [r14 + 8]
rol al, 0x1a
mov rcx, rsi
inc dh
movsx eax, ax
not dl
sub rcx, rdi
movzx ax, sil
cdq
btr ax, 0x66
movabs rdx, 0x7878787878787879
bsr eax, ebp
cwde
mov rax, rcx
test r15b, r9b
imul rdx
cbw
cdqe
mov rax, rdx
test spl, dil
jmp 0x140378454
shr rax, 0x3f
sar rdx, 7
jmp 0x140378461
add rdx, rax
cmp r8, rdx
jmp 0x14037846c
jbe 0x140378512
imul r13, rdx, 0x110
or r12b, r15b
clc
dec r12b
lea r12, [rbx + r13]
test rcx, rcx
jmp 0x14037848c
je 0x1403784ff
mov rcx, rdi
cdq
jmp 0x14037849e
mov rdx, rbx
jmp 0x1403784a6
call fcn.1403796af
add rdi, 0x110
jmp 0x1403784ba
add rbx, 0x110
clc
cmc
stc
add r13, 0xfffffffffffffef0
jne 0x140378492
mov rsi, qword [r14 + 8]
jmp 0x1403784da
jmp 0x1403784ff
mov rcx, rsi
xchg dl, dh
mov rdx, r12
call fcn.1403788a3
add rsi, 0x110
add r12, 0x110
cmp cx, 0x804
cmp r12, r15
jmp 0x140378507
jne 0x1403784df
jmp 0x1403785c4
imul r12, r8, 0x110
clc
test spl, 9
lea r12, [r12 + rdi]
cmp sil, r12b
jmp 0x14037852a
cmp rbx, r15
jmp 0x140378532
je 0x140378581
nop
setge cl
mov rcx, rdi
movsx rdx, r8w
movsxd rdx, ebp
mov rdx, rbx
jmp 0x14037854e
call fcn.1403796af
add rdi, 0x110
cmp al, sil
test bpl, 0x7b
add rbx, 0x110
jmp 0x14037856e
cmp rbx, r15
jmp 0x140378576
jne 0x14037853c
mov rsi, qword [r14 + 8]
cmc
cmp r12, rsi
jmp 0x140378589
je 0x1403785c1
mov rdi, r12
movsx ecx, r12w
mov ecx, eax
nop word [rax + rax]
mov rcx, rdi
jmp 0x1403785a6
call fcn.140372b2c
add rdi, 0x110
stc
cmp rdi, rsi
jmp 0x1403785bb
jne 0x14037859e
mov rsi, r12
mov qword [r14 + 8], rsi
bswap rdi
add rsp, 0x20
pop rbx
bswap r12d
mov r13w, 0x4e95
mov r14, rsp
pop rdi
jmp 0x1403785ea
pop rsi
movzx r14d, cx
movsx r14, r9w
pop r12
movsxd r14, esp
cmovl r13w, r14w
pop r13
movsx r15, r11w
mov r14b, 0x3f
pop r14
pop r15
ret
Function at 0x140394e44
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r14
mov al, 0xe0
push rsi
push rdi
push rbx
xor r11d, r13d
mov ax, sp
mov r11, rcx
mov eax, r13d
shr r10d, 0xd5
lea r8, [r8 + rdx]
bts r10w, bx
mov dword [rcx + 8], 0
xor r9d, r9d
lahf
bt r10w, 0x3f
lea r10, [0x1400234fc]
xor esi, esi
bsf eax, r11d
cmp r13, 0x1cd901c1
or al, 0x92
sub ecx, ecx
lea rax, [rdx + 1]
cmp rcx, 0xe187550
cmp r13b, r15b
cmp rax, r8
ja 0x14039512a
movzx edi, byte [rdx]
inc edx
rcl rdx, 4
mov edx, edi
cmp bl, al
and edx, 0x7f
cmp spl, dil
shl rdx, cl
lea rsi, [rsi + rdx]
bsr dx, r14w
sub dx, 0x4a04
add rcx, 7
mov dl, bpl
sets dh
movsx edx, sp
mov rdx, rax
test dil, dil
js 0x140394e8d
mov rcx, rsi
jmp 0x140394eef
shr rcx, 3
jmp 0x140394efb
cmp rcx, 2
jmp 0x140394f04
je 0x140395052
and esi, 7
test r13b, 0xd2
jmp 0x140394f16
cmp rcx, 1
jmp 0x140394f1f
je 0x1403950e4
cmp rsi, 5
jmp 0x140394f2e
ja 0x140395136
movsxd rcx, dword [r10 + rsi*4 + 0x371c64]
test r14w, 0x6ab8
add rcx, r10
jmp 0x140394f4a
push rcx
ret
test sil, 7
jmp 0x14039505b
jne 0x140395136
or r9d, 4
sal dx, 0x83
rol dl, 0x5b
mov dword [r11 + 8], r9d
movzx dx, cl
mov dx, 0x504a
sbb edx, edx
sub esi, esi
sub ecx, ecx
lea rdx, [rax + 1]
cmp rdx, r8
jmp 0x14039508a
ja 0x140395136
movzx edi, byte [rax]
shl al, 0xfa
mov eax, edi
and eax, 0x7f
jmp 0x1403950a0
shl rax, cl
jmp 0x1403950b0
add rsi, rax
rcr ax, cl
add rcx, 7
dec ah
shr ax, 0xc6
mov rax, rdx
jmp 0x1403950c8
test dil, dil
jmp 0x1403950d0
js 0x14039507e
mov qword [r11 + 0x18], rsi
jmp 0x1403950df
jmp 0x140394e7c
cmp esi, 1
jmp 0x1403950ec
jne 0x140395136
or r9d, 2
setns dh
bt dx, sp
mov dword [r11 + 8], r9d
lea rdx, [rax + 8]
cmc
cmp r8b, 0x2a
stc
cmp rdx, r8
ja 0x140395136
mov rax, qword [rax]
jmp 0x14039511c
mov qword [r11 + 0x10], rax
jmp 0x140395125
jmp 0x140394e7c
mov al, 1
jmp 0x140395131
jmp 0x140395138
sub eax, eax
pop rbx
movzx rsi, sp
cmovp r14d, edi
movzx di, r15b
pop rdi
pop rsi
jmp 0x140395155
pop r14
jmp 0x14039515c
ret
Function at 0x14039f6a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
rcl r15b, cl
push r14
rcr r15b, 0x7f
or r15w, r13w
push r13
shrd r14w, r15w, 0x96
push r12
shld r13w, cx, 0x13
push rsi
push rdi
sbb r12b, dl
sar r12b, cl
bt r15, r10
push rbp
shr r15d, cl
push rbx
bswap bx
sub rsp, 0x38
setb r13b
movaps xmmword [rsp + 0x20], xmm6
xchg bx, r12w
mov r14, r9
mov r15, r8
mov r12, rdx
ror bx, cl
bswap r13w
shld r13, rdx, 0xdf
mov r13, rcx
sal bx, 0xcd
not bx
mov rbx, qword [rcx]
cmp r15w, 0x1b54
test r12, rdi
test r10b, 0xe2
test rbx, rbx
jmp 0x14039f71b
je 0x14039f880
mov rdi, qword [r13 + 8]
cmp rbx, rdi
je 0x14039f815
add rbx, 0x10
lea rbp, [0x1400bdc30]
jmp 0x14039f73e
movaps xmm6, xmmword [0x1400bc520]
jmp 0x14039f74a
jmp 0x14039f780
call fcn.140199a77
lea rax, [rbx - 0x10]
movups xmmword [rbx + 0x10], xmm6
test r11, r15
mov byte [rbx], 0
add rbx, 0x38
clc
add rax, 0x38
stc
test r12w, 0x4624
cmp rax, rdi
jmp 0x14039f77a
je 0x14039f811
mov qword [rbx - 0x10], rbp
mov rax, qword [rbx + 0x18]
test r13b, 0xa6
jmp 0x14039f794
cmp rax, 0x10
jmp 0x14039f79d
jb 0x14039f754
mov rcx, qword [rbx]
sar dh, cl
lea rdx, [rax + 1]
cmp rdx, 0x1000
jmp 0x14039f7b8
jb 0x14039f74f
mov rsi, qword [rcx - 8]
test ax, 0xb82
cmp r8b, 0xd
jmp 0x14039f7cf
add rcx, 0xfffffffffffffff8
clc
sub rcx, rsi
test esp, 0x515b5e90
jmp 0x14039f7e3
cmp rcx, 0x20
jmp 0x14039f7ec
jae 0x14039f906
add rax, 0x28
mov rdx, rax
movsx ecx, r12w
bswap cx
movzx rcx, di
mov rcx, rsi
jmp 0x14039f80c
jmp 0x14039f74f
mov rbx, qword [r13]
mov rdx, qword [r13 + 0x10]
jmp 0x14039f821
sub rdx, rbx
cmp rdx, 0x1000
jmp 0x14039f830
jb 0x14039f873
mov rax, qword [rbx - 8]
cmp ah, 0x38
sub rbx, rax
stc
add rbx, 0xfffffffffffffff8
cmp spl, 0xed
cmp rbx, 0x20
jmp 0x14039f852
jae 0x14039f906
add rdx, 0x27
jmp 0x14039f868
mov rbx, rax
jmp 0x14039f873
mov rcx, rbx
jmp 0x14039f87b
call fcn.140199a77
mov qword [r13], r12
imul rax, r15, 0x38
lea rax, [rax + r12]
cmc
adc si, 0x10ce
or si, 0x47b
mov qword [r13 + 8], rax
stc
sbb ax, r14w
imul rax, r14, 0x38
and r15b, 0x5f
or si, r11w
lea rax, [rax + r12]
and r12b, r12b
neg r12b
mov qword [r13 + 0x10], rax
xor rbp, rdi
movzx ebx, dx
movaps xmm6, xmmword [rsp + 0x20]
add rsp, 0x38
mov rdi, 0x1775532d
movsxd rbx, r11d
pop rbx
movsx r14w, dil
seta bpl
pop rbp
movzx rdi, bx
movsx r13d, r11w
movsx r12, bp
pop rdi
pop rsi
pop r12
movzx r15, dx
movsx r13d, r15w
pop r13
pop r14
movzx r15, bx
pop r15
jmp 0x14039f905
ret
call fcn.14046c35b
int3
Function at 0x1403b05b6
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
xor r15d, 0x5d806c48
cmovno r15w, r12w
push r14
push rsi
inc al
push rdi
bts r15w, sp
push rbx
sub rsp, 0x20
neg ah
cwde
not si
mov r15, r8
cmp r11d, 0x10f032e6
movsx eax, r10w
mov rsi, rdx
mov r14, rcx
mov rdx, r8
sub rdx, rsi
jmp 0x1403b05fe
sar rdx, 4
bt r8d, r8d
stc
cdqe
movabs rax, 0xcccccccccccccccd
imul rdx, rax
movzx r8d, r11w
setnp r8b
xor r8b, 0xad
mov r8, qword [rcx]
cmp bp, 0x3188
jmp 0x1403b0630
mov rcx, qword [rcx + 0x10]
sub rcx, r8
clc
sar rcx, 4
imul rcx, rax
cmp rdx, rcx
jmp 0x1403b0648
jbe 0x1403b06b0
mov rcx, r14
jmp 0x1403b0656
call fcn.1403b07c7
mov rbx, qword [r14]
cmp esp, 0x6e694c0f
cmp rsi, r15
jmp 0x1403b066c
je 0x1403b079c
nop word [rax + rax]
cqo
movzx edx, bx
mov rcx, rbx
cdq
mov rdx, rsi
jmp 0x1403b068c
call fcn.1403acf89
add rbx, 0x50
add rsi, 0x50
test bpl, 0x86
cmp rsi, r15
jmp 0x1403b06a5
jne 0x1403b0680
jmp 0x1403b079c
mov rcx, qword [r14 + 8]
clc
sub rcx, r8
cmc
jmp 0x1403b06c1
sar rcx, 4
clc
imul rcx, rax
cmp rdx, rcx
jmp 0x1403b06d2
jbe 0x1403b073e
lea rdi, [rcx + rcx*4]
rcl ecx, cl
shl rdi, 4
shr dl, cl
not cl
add rdi, rsi
not ch
mov rcx, rsi
setge dh
movsx edx, cx
mov rdx, rdi
jmp 0x1403b06fc
call fcn.1403b0a9d
mov rbx, qword [r14 + 8]
clc
nop dword [rax + rax]
test r12b, bl
test r13b, 2
cmp rdi, r15
je 0x1403b079c
mov rcx, rbx
mov rdx, rdi
jmp 0x1403b0726
call fcn.1403acf89
add rbx, 0x50
clc
add rdi, 0x50
jmp 0x1403b0739
jmp 0x1403b0712
lea rbx, [rdx + rdx*4]
sal dl, 0x73
shl rbx, 4
add rbx, r8
movsx edx, di
not dh
mov rcx, rsi
not dx
mov rdx, r15
call fcn.1403b0a9d
mov rdi, qword [r14 + 8]
cmp rbx, rdi
jmp 0x1403b076b
je 0x1403b079c
mov rsi, rbx
movsxd rcx, esp
movsx rcx, ax
cmovbe ecx, r13d
nop dword [rax]
movzx rcx, r15w
mov rcx, rsi
call fcn.1403ad193
add rsi, 0x50
cmp rsi, rdi
jne 0x1403b0787
mov qword [r14 + 8], rbx
stc
shr rdi, 0x8e
add rsp, 0x20
mov r14b, dil
pop rbx
movzx esi, r11w
pop rdi
xchg sil, sil
movsx esi, r13w
pop rsi
pop r14
movzx r15w, bpl
xchg r15, r15
pop r15
ret
Function at 0x1403b0a9d
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
cmp bpl, r8b
push r14
test r14, rdx
push r12
push rsi
adc r12d, 0x4c5337d0
sub r12d, 0x16c365e
push rdi
sar r12b, 0x8c
movzx r12w, r13b
bt r12, rdx
push rbx
sub r12b, r11b
bts r12, rbx
sub rsp, 0x28
bts r12w, r15w
mov r12, r8
clc
cmp rcx, rdx
jmp 0x1403b0ae3
je 0x1403b0cde
mov r14, rdx
movzx ebx, r8w
bswap ebx
mov rbx, rcx
cmc
test r15b, dil
sub esi, esi
jmp 0x1403b0b30
mov rcx, r15
mov rdx, rdi
jmp 0x1403b0b0b
call fcn.1403778fc
lea rax, [rbx + rsi]
add rax, 0x50
test r15w, 0x6e64
add rsi, 0x50
jmp 0x1403b0b27
cmp rax, r14
je 0x1403b0cda
mov eax, dword [rbx + rsi + 8]
cmc
mov dword [r12 + rsi + 8], eax
cmp bpl, r12b
test rcx, rbx
cmc
cmp r12, rbx
jmp 0x1403b0b49
je 0x1403b0b10
cmp qword [rbx + rsi + 0x28], 0x10
jmp 0x1403b0b5a
jb 0x1403b0b6f
mov r9, qword [rbx + rsi + 0x10]
jmp 0x1403b0b6a
jmp 0x1403b0b90
lea r9, [rbx + rsi]
or edi, 0x44f7214c
lahf
jmp 0x1403b0b7f
add r9, 0x10
adc r15b, sil
movzx eax, sp
cmp r14, 0x96c7723
lea r15, [r12 + rsi]
shld di, r12w, 0x17
xor edi, 0x4ede155f
cmp ax, 0x77ce
add r15, 0x10
bts edi, ebx
and dil, 0x99
mov rdi, qword [rbx + rsi + 0x20]
mov rax, qword [r12 + rsi + 0x28]
test rbx, 0x76c57703
test r11b, r8b
cmp rax, rdi
jmp 0x1403b0bcb
jae 0x1403b0bf3
mov rcx, r15
jmp 0x1403b0be1
mov rdx, rdi
jmp 0x1403b0be9
call fcn.1403778fc
jmp 0x1403b0c3c
cmp rax, 0x10
jmp 0x1403b0bfc
jb 0x1403b0c0f
mov r15, qword [r12 + rsi + 0x10]
movsx ecx, r10w
movsx r8, cx
mov qword [r12 + rsi + 0x20], rdi
movzx edx, r11w
mov rcx, r15
mov rdx, r9
movsx r8d, r13w
mov r8, rdi
jmp 0x1403b0c2a
call fcn.140459a26
mov byte [r15 + rdi], 0
mov rdi, rdi
sbb rdi, r15
rcr edi, cl
mov rdi, qword [rbx + rsi + 0x40]
cmp si, dx
cmp qword [rbx + rsi + 0x48], 0x10
jb 0x1403b0c5f
mov r9, qword [rbx + rsi + 0x30]
jmp 0x1403b0c5a
jmp 0x1403b0c70
lea r9, [rbx + rsi]
shld ax, bx, 0x6f
add r9, 0x30
xadd r15b, al
lea r15, [r12 + rsi]
add r15, 0x30
not ax
add eax, r11d
movsx eax, si
mov rax, qword [r12 + rsi + 0x48]
cmp r11w, 0x6e8
cmp rax, rdi
jb 0x1403b0b00
cmp rax, 0x10
jb 0x1403b0ca4
mov r15, qword [r12 + rsi + 0x30]
mov qword [r12 + rsi + 0x40], rdi
not r8d
mov rcx, r15
bswap dx
cdq
mov rdx, r9
sete r8b
movsx r8, di
mov r8, rdi
jmp 0x1403b0cc6
call fcn.140459a26
mov byte [r15 + rdi], 0
jmp 0x1403b0cd5
jmp 0x1403b0b10
lea r12, [r12 + rsi]
mov rax, r12
add rsp, 0x28
bswap r15
pop rbx
movzx r15, dx
pop rdi
pop rsi
cmovge r15w, bx
xchg r12b, r12b
pop r12
movsxd r14, r10d
mov r15b, dil
pop r14
movzx r15, r8w
xchg r15b, r15b
pop r15
jmp 0x1403b0d0f
ret
Function at 0x1403db4d5
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rsi
shr r10b, cl
mov r10, qword [rcx]
mov rsi, qword [rcx + 0x18]
sal r9b, cl
mov r9d, dword [r10 + 4]
cmp bp, 0x33d6
test r13w, 0x259d
imul r9d, dword [r10]
test r9b, 0x2c
clc
test r13b, r8b
cmp r8d, 2
jmp 0x1403db507
jne 0x1403db683
test r9d, r9d
jmp 0x1403db515
je 0x1403db710
lea ecx, [r9 - 1]
cmp ecx, 3
jb 0x1403db614
mov r11d, r9d
cmc
mov r8b, r10b
btc r10d, esi
and r11d, 0xfffffffc
btr r8d, r10d
nop word cs:[rax + rax]
rcr r8, cl
movsx r8w, bl
nop dword [rax]
sbb r8, 0x464320d6
adc r8w, 0x6653
movzx r8d, word [rsi]
movzx r10d, word [rsi + 4]
test spl, r13b
stc
xor ecx, ecx
xor cl, spl
sal cl, 0x95
cmp r8w, word [rdx]
setne cl
neg ecx
movsxd r8, r10d
mov word [rsi + 2], cx
add r8b, spl
xor ecx, ecx
cmp r10w, word [rdx]
jmp 0x1403db592
setne cl
movsx r8, si
neg ecx
mov word [rsi + 6], cx
sbb r8b, 0x79
movzx r8d, word [rsi + 8]
stc
test dl, r13b
cmp rdx, 0x4c20178b
xor ecx, ecx
shr cl, 0x35
cmp r8w, word [rdx]
setne cl
sbb r8b, 0x80
btr r8w, r10w
neg ecx
test r11, rcx
or r8b, r8b
setns r8b
mov word [rsi + 0xa], cx
cmc
mov r8b, bl
movzx r8d, word [rsi + 0xc]
jmp 0x1403db5e6
xor ecx, ecx
inc cl
cmp r8w, word [rdx]
setae cl
setne cl
cmc
neg ecx
jmp 0x1403db5fd
mov word [rsi + 0xe], cx
add rsi, 0x10
add r11d, 0xfffffffc
jmp 0x1403db60e
jne 0x1403db55d
test r9b, 3
jmp 0x1403db61d
je 0x1403db710
and r9d, 3
stc
movzx r8d, si
btc r8d, 0xa4
xor ecx, ecx
bsr r8w, r15w
nop word cs:[rax + rax]
cmc
bt r8w, bp
xchg r8, r8
nop
sal r8d, cl
movzx r8d, word [rsi + rcx*4]
xor eax, eax
cmp r8w, word [rdx]
setne al
neg eax
mov word [rsi + rcx*4 + 2], ax
add rcx, 1
cmp r11w, r8w
test r8w, r10w
cmp r9d, ecx
jmp 0x1403db678
jne 0x1403db64f
jmp 0x1403db710
test r9d, r9d
jmp 0x1403db68b
je 0x1403db710
movzx r10d, word [rdx]
add r8w, r15w
movzx r8w, r11b
mov r8d, r9d
jmp 0x1403db6a6
sub ecx, ecx
jmp 0x1403db6ad
jmp 0x1403db6ca
add rcx, 1
clc
test r11b, r10b
cmp bl, bl
cmp r8d, ecx
jmp 0x1403db6c4
je 0x1403db710
cmp word [rsi + rcx*8], r10w
jmp 0x1403db6d4
jne 0x1403db6b2
movzx eax, word [rsi + rcx*8 + 2]
cmp rsi, rcx
cmp ax, word [rdx + 2]
jne 0x1403db6b2
movzx eax, word [rsi + rcx*8 + 4]
cmp ax, word [rdx + 4]
jmp 0x1403db6fa
jne 0x1403db6b2
mov word [rsi + rcx*8 + 6], 0
movzx r10d, word [rdx]
jmp 0x1403db6b2
pop rsi
jmp 0x1403db716
ret
Function at 0x1403e78fd
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rsi
push rdi
not rsi
sub rsp, 0x28
mov rsi, rcx
mov al, byte [rcx + 0x4828]
jmp 0x1403e7914
cmp al, 0xff
jmp 0x1403e791b
je 0x1403e792d
mov byte [rsi + 0x4828], 0xff
jmp 0x1403e7a35
mov rdi, qword [rsi]
rcr rax, cl
shld ax, bx, 0xfd
mov rax, qword [rdi + 0xc0]
test esi, 0x66205108
test r9b, bl
jmp 0x1403e794d
cmp rax, qword [rdi + 0xc8]
jmp 0x1403e7959
jae 0x1403e797b
lea rcx, [rax + 1]
jmp 0x1403e7968
mov qword [rdi + 0xc0], rcx
mov cl, byte [rax]
jmp 0x1403e7976
jmp 0x1403e7a25
cmp dword [rdi + 0x30], 0
jmp 0x1403e7984
je 0x1403e79ef
mov r8d, dword [rdi + 0x34]
setge dh
lea rdx, [rdi + 0x38]
movsx cx, al
mov rcx, qword [rdi + 0x28]
jmp 0x1403e79a2
call qword [rdi + 0x10]
mov ecx, dword [rdi + 0xc0]
stc
test sil, 0xcb
sub ecx, dword [rdi + 0xd0]
cmp di, 0x1b31
cmp ah, ah
cmc
add dword [rdi + 0xb8], ecx
jmp 0x1403e79c9
test eax, eax
jmp 0x1403e79d0
je 0x1403e79fb
cdqe
rol cl, cl
lea rax, [rax + rdi]
add rax, 0x38
mov cl, byte [rdi + 0x38]
jmp 0x1403e79ea
jmp 0x1403e7a0d
mov al, 0xff
jmp 0x1403e79f6
jmp 0x1403e7a35
mov dword [rdi + 0x30], 0
lea rax, [rdi + 0x39]
mov byte [rdi + 0x38], 0
clc
sub ecx, ecx
mov qword [rdi + 0xc8], rax
lea rax, [rdi + 0x39]
mov qword [rdi + 0xc0], rax
rcl al, 0x87
xor al, 7
cmc
mov al, 0xff
cmp cl, 0xff
jmp 0x1403e7a2f
je 0x1403e7a81
add rsp, 0x28
movzx rdi, dx
seta dil
movsx di, bpl
pop rdi
mov si, r15w
mov sil, 0x70
pop rsi
jmp 0x1403e7a54
ret
lea rcx, [rax + 1]
mov qword [rdi + 0xc0], rcx
test cx, r9w
cmp r8, 0x66b365d9
jmp 0x1403e7a70
movzx eax, byte [rax]
stc
cmp al, 0xff
jmp 0x1403e7a7b
jne 0x1403e7a35
mov rdi, qword [rsi]
mov rax, qword [rdi + 0xc0]
stc
jmp 0x1403e7a91
cmp rax, qword [rdi + 0xc8]
jmp 0x1403e7a9d
jb 0x1403e7a55
cmp dword [rdi + 0x30], 0
jmp 0x1403e7aac
je 0x1403e7b65
mov r8d, dword [rdi + 0x34]
lea rdx, [rdi + 0x38]
cmovg cx, sp
mov rcx, rax
mov rcx, qword [rdi + 0x28]
jmp 0x1403e7aca
call qword [rdi + 0x10]
mov ecx, dword [rdi + 0xc0]
cmc
jmp 0x1403e7ad9
sub ecx, dword [rdi + 0xd0]
stc
jmp 0x1403e7ae9
add dword [rdi + 0xb8], ecx
clc
test eax, eax
jmp 0x1403e7af7
je 0x1403e7b27
cdqe
lea rcx, [rdi + rax]
sub al, r13b
movzx ax, dil
sal ax, cl
add rcx, 0x38
movsx rax, dx
cwde
mov ah, ch
movzx eax, byte [rdi + 0x38]
jmp 0x1403e7b22
jmp 0x1403e7b3f
mov dword [rdi + 0x30], 0
lea rcx, [rdi + 0x39]
cmp r13w, 0x7069
cmc
mov byte [rdi + 0x38], 0
xor eax, eax
mov qword [rdi + 0xc8], rcx
lea rcx, [rdi + 0x39]
clc
mov qword [rdi + 0xc0], rcx
test edx, 0x4a53626f
cmp al, 0xff
je 0x1403e7a81
jmp 0x1403e7a35
xor eax, eax
jmp 0x1403e7a35
Function at 0x1403f82f6
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rsi
cmp rdi, 0x55952ad3
cbw
push rdi
xadd ax, di
lahf
push rbx
sub rsp, 0x90
movaps xmmword [rsp + 0x80], xmm7
or sil, dl
bt di, r11w
movsxd rax, ecx
movaps xmmword [rsp + 0x70], xmm6
or sil, cl
mov si, sp
mov rdi, rdx
cmc
shr ax, cl
mov rsi, rcx
mov rax, qword [rdx]
cmc
cmp r8w, r10w
cmp qword [rax + 0x18], 8
jb 0x1403f834c
mov rax, qword [rax]
movsxd rcx, r8d
bts r9d, r9d
test spl, 0x7b
bt r9d, 0x41
lea r9, [rax + rcx*2]
bt ax, 0xbb
bswap ax
sub ebx, ebx
neg rax
rcl rax, cl
xor al, dl
nop word cs:[rax + rax]
neg ah
btc rax, r11
shr ax, cl
nop dword [rax]
bsf ax, r15w
adc ah, 0x1f
movsx eax, si
movzx eax, word [r9 + rbx*2]
test r12, r11
cmp ax, 0xa
je 0x1403f83be
test ax, ax
je 0x1403f83be
add rbx, 1
jmp 0x1403f83b9
jmp 0x1403f8393
test byte [rdi + 0x1c], 4
jmp 0x1403f83c7
jne 0x1403f8551
mov rcx, qword [rdi + 0x10]
cbw
jmp 0x1403f83db
mov rax, qword [rdi + 8]
mov rax, qword [rax + 8]
mov dx, 0x460
movsx edx, bp
mov qword [rsp + 0x40], rax
movsxd rdx, ebx
bswap dx
mov dword [rsp + 0x30], ebx
mov dx, 0x2df6
mov dword [rsp + 0x28], 2
mov dword [rsp + 0x20], 0
movsx edx, r11w
movzx dx, spl
cmovge r8w, r13w
lea rdx, [rsp + 0x38]
xchg r8b, r8b
movzx r8d, r10w
mov r8w, 0x157f
lea r8, [rsp + 0x40]
call fcn.1403fcbcb
xorps xmm0, xmm0
movaps xmmword [rsp + 0x50], xmm0
movaps xmmword [rsp + 0x40], xmm0
movsxd rax, r11d
mov dword [rsp + 0x60], 0
cdqe
jmp 0x1403f8455
mov rcx, qword [rsp + 0x38]
movsx rax, ax
mov rax, qword [rcx]
lea rdx, [rsp + 0x40]
jmp 0x1403f846b
call qword [rax + 0x1e0]
test eax, eax
jmp 0x1403f8478
je 0x1403f84a9
mov ecx, eax
movabs r8, 0xe31b45c42a775183
cmovnp r9w, dx
mov dl, 3
cmovb r9d, esp
xchg r9w, r9w
movzx r9w, r10b
mov r9d, 0x4f
call fcn.14036bb4e
movss xmm6, dword [rsp + 0x4c]
cdq
movss xmm7, dword [rsp + 0x50]
movsx rdx, r15w
lea rcx, [rsp + 0x38]
or dl, 0xb1
lea rdx, [rsp + 0x40]
sub r8d, r8d
jmp 0x1403f84cf
call fcn.1403f88e2
movss xmm0, dword [rdi + 0x18]
jmp 0x1403f84de
movss dword [rsi], xmm0
jmp 0x1403f84e7
addss xmm6, xmm0
movss dword [rsi + 4], xmm6
inc cx
shr rcx, 0x72
movss xmm0, dword [rsp + 0x50]
sbb cx, dx
movss dword [rsi + 8], xmm0
sbb cx, r9w
mov dword [rsi + 0xc], 0
rol cx, cl
setb cl
movss dword [rsi + 0x10], xmm7
movsx ecx, r10w
cmovge cx, r14w
cmc
mov dword [rsi + 0x14], ebx
stc
test esi, ecx
rcl rcx, cl
mov rcx, qword [rsp + 0x38]
test rcx, rcx
jmp 0x1403f853b
je 0x1403f85ad
mov rax, qword [rcx]
jmp 0x1403f8549
call qword [rax + 0x10]
jmp 0x1403f85ad
movss xmm0, dword [rdi + 0x18]
cvtsi2ss xmm1, ebx
movss dword [rsi], xmm0
jmp 0x1403f8563
mulss xmm1, dword [0x1400beacc]
addss xmm1, xmm0
movss dword [rsi + 4], xmm1
movzx eax, cx
mov eax, 0x44047e01
mov qword [rsi + 8], 0x3fa00000
movzx rax, dx
cdqe
lahf
mov rax, qword [rdi + 8]
jmp 0x1403f8594
movss xmm0, dword [rax + 0xc]
addss xmm0, dword [0x1400beab0]
movss dword [rsi + 0x10], xmm0
movsx rdi, r14w
mov dword [rsi + 0x14], ebx
movaps xmm6, xmmword [rsp + 0x70]
mov rdi, 0x5787653a
movaps xmm7, xmmword [rsp + 0x80]
add rsp, 0x90
movsx esi, cx
pop rbx
mov esi, ecx
pop rdi
movzx rsi, ax
bswap rsi
movsx rsi, dx
pop rsi
jmp 0x1403f85e0
ret
Function at 0x1403f9669
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
jmp 0x1403f967d
push r14
xor r15, 0x5b3d42fb
or r15w, 0x1feb
push rsi
cmp r10b, r15b
push rdi
push rbp
dec bp
rcl bpl, 0xc5
btc r15, r10
push rbx
mov r14d, 0x5b1233e1
sub rsp, 0x28
bts bx, cx
movzx r14w, al
movsx rbx, si
mov r15d, r9d
or ebx, 0x1e43ea8
mov ebp, r8d
bts rbx, r14
cmp dil, r10b
movsxd rbx, ebx
mov r14, rdx
shr bl, cl
ror bx, cl
sal ebx, cl
mov rbx, rcx
or cx, 0x44ea
lea rcx, [rdx + 0x20]
shr dh, cl
mov edx, r8d
sub r8, 0x43564985
rcr r8b, 0x98
add r8, r15
mov r8d, r9d
sub r9d, r9d
call fcn.1403f989b
test r15d, r15d
jmp 0x1403f9707
jle 0x1403f97c0
test rax, rax
jmp 0x1403f9715
je 0x1403f97c0
movsxd rsi, ebp
cwd
mov ecx, r15d
bts dx, r9w
sub ebp, ebp
cmove edx, edx
mov rdx, rsi
jmp 0x1403f976f
movzx edi, word [rdi + rdx*2]
clc
mov word [rax + rbp*2], di
test r9b, r13b
jmp 0x1403f974a
add rbp, 1
jmp 0x1403f9756
add rdx, 1
test rdi, 0x5def6aaa
cmp rcx, rbp
jmp 0x1403f9769
je 0x1403f97cf
mov di, 0x2a
cmp r15b, 0xd2
cmc
test byte [rbx + 0x1c], 4
jmp 0x1403f9781
jne 0x1403f973a
mov rdi, qword [rbx]
jmp 0x1403f9794
cmp qword [rdi + 0x10], rdx
jmp 0x1403f979d
jbe 0x1403f9890
cmp qword [rdi + 0x18], 8
jmp 0x1403f97ad
jb 0x1403f9735
mov rdi, qword [rdi]
jmp 0x1403f97bb
jmp 0x1403f9735
movsxd rsi, ebp
xadd dil, cl
btc edi, esp
shrd rcx, r15, 0x2e
mov rbx, qword [rbx]
mov rdi, qword [rbx + 0x10]
sub rcx, rbx
mov rcx, rdi
jmp 0x1403f97e1
sub rcx, rsi
jmp 0x1403f97e9
jb 0x1403f9890
movsxd rax, r15d
test r8b, dil
stc
cmp rcx, rax
jmp 0x1403f97fe
cmovb rax, rcx
cmp qword [rbx + 0x18], 8
mov rcx, rbx
jb 0x1403f9815
mov rcx, qword [rbx]
ror edx, cl
lea rcx, [rcx + rsi*2]
stc
bts r8d, edx
sub rdi, rax
mov rbp, rdi
xchg dl, dh
and dh, ch
bsf dx, r12w
sub rbp, rsi
stc
shr r8w, cl
adc r8, rdx
lea rdx, [rcx + rax*2]
cmc
movzx r8w, r13b
lea r8, [rbp + 2]
stc
add r8, rbp
call fcn.140459a26
mov qword [rbx + 0x10], rdi
ror sil, cl
or sil, 0x44
shr si, 0x2b
mov byte [r14 + 0x16], 0
add rsp, 0x28
movzx rdi, r14w
not rbx
pop rbx
pop rbp
movsx r15d, ax
bswap r15d
seto sil
pop rdi
pop rsi
mov r15, rdx
pop r14
cmovge r15d, r12d
movsxd r15, ebx
pop r15
ret
call fcn.1403f8d09
int3