joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1401bcef0
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x50
cmp qword [rcx + 0x68], 0
xchg r10, rbx
mov r10, rcx
xchg r10, rbx
je 0x1401bd0b1
cmp byte [rcx + 0x71], 0
je 0x1401bd0b1
xchg rbx, rax
mov rbx, qword [rcx]
xchg rbx, rax
mov edx, 0x1da2dd44
add edx, 0x53a0f2ff
xor edx, 0x6dacdd5d
add edx, 0x3ba0c8da
sub edx, 0x3fce5c5a
add edx, 0x39889c1d
sub edx, 0x13a02e34
add edx, 0xc1561878
mov qword [rsp + 0x68], rdi
call qword [rax + 0x18]
cmp eax, 0xffffffff
je 0x1401bd088
xchg rcx, r10
mov r10, qword [rbx + 0x68]
xchg rcx, r10
lea rax, [rsp + 0x60]
lea rdx, [rbx + 0x74]
xchg r8, rax
mov qword [rsp + 0x20], r8
xchg r8, rax
lea r9, [rsp + 0x50]
lea r8, [rsp + 0x30]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x1401bcfea
sub eax, 1
je 0x1401bd006
cmp eax, 2
jne 0x1401bd088
mov rdi, qword [rsp + 0x68]
mov al, 8
add al, 0x6d
sub al, 0x1b
xor al, 0x40
add al, 0x62
sub al, 0x78
xor al, 5
mov byte [rbx + 0x71], 4
add byte [rbx + 0x71], 0x2d
add byte [rbx + 0x71], 0x20
sub byte [rbx + 0x71], 0x4b
add byte [rbx + 0x71], 0x51
add byte [rbx + 0x71], 2
sub byte [rbx + 0x71], 0x4b
xor byte [rbx + 0x71], 0xe
add rsp, 0x50
nop
mov rbx, qword [rsp]
add rsp, 8
nop
add rsp, 8
jmp qword [rsp - 8]
mov byte [rbx + 0x71], 4
add byte [rbx + 0x71], 0x6b
xor byte [rbx + 0x71], 0x68
add byte [rbx + 0x71], 0x2a
xor byte [rbx + 0x71], 0x58
sub byte [rbx + 0x71], 5
xor byte [rbx + 0x71], 0x64
mov rdi, qword [rsp + 0x60]
lea rax, [rsp + 0x30]
sub rdi, rax
je 0x1401bd060
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x30]
xchg rdi, r8
mov rdi, r8
xchg rdi, r8
mov edx, 0x14640f3f
xor edx, 0x1a4b8073
add edx, 0x9c0e52
add edx, 0x61687322
sub edx, 0x44b198fc
sub edx, 0x2b8277c3
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rdi, rax
jne 0x1401bd088
cmp byte [rbx + 0x71], 0
xchg rbp, rdi
mov rbp, qword [rsp + 0x68]
xchg rbp, rdi
sete al
add rsp, 0x50
nop
xchg qword [rsp], rbx
add rsp, 8
nop
add rsp, 8
jmp qword [rsp - 8]
xchg r14, rdi
mov r14, qword [rsp + 0x68]
xchg rdi, r14
xor al, al
add rsp, 0x50
push rax
push rcx
push rcx
push rcx
push rax
push rdx
xchg qword [rsp + 0x30], rbx
add rsp, 0x38
nop
add rsp, 8
jmp qword [rsp - 8]
mov al, 9
xor al, 8
xor al, 0x34
add al, 0x1b
sub al, 0x3c
add al, 0x53
sub al, 0x45
xor al, 0x23
add rsp, 0x50
nop
add rsp, 8
xchg qword [rsp - 8], rbx
nop
add rsp, 8
jmp qword [rsp - 8]
Function at 0x1401fd580
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1401fd5ca
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1401fd5ca
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1401fd5ca
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1401fd5ca
cmp dword [rcx + 0x84], 0xe
jbe 0x1401fd5ca
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x1401fd5cc
xor al, al
add rsp, 0x28
ret

Function at 0x1401fdd50
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov edx, 0xc0000409
add rsp, 0x20
pop rbx
jmp qword [sym.imp.KERNEL32.dll_TerminateProcess]

Function at 0x14022c570
Capabilities:
Encode data using base64

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
sub rsp, 0x50
mov r12, r9
mov rsi, r8
mov rbx, rdx
mov rdi, rcx
test r8, r8
jne 0x14022c59d
xor al, al
jmp 0x14022c6ff
mov rax, qword [0x14024b6c0]
lea rcx, [rsp]
xor r11d, r11d
mov qword [rcx], rax
mov rax, qword [0x14024b6c8]
mov qword [rsp + 0x60], rbp
mov qword [rcx + 8], rax
mov rax, qword [0x14024b6d0]
mov rdx, r11
mov qword [rcx + 0x10], rax
mov rax, qword [0x14024b6d8]
mov qword [rcx + 0x18], rax
mov rax, qword [0x14024b6e0]
mov qword [rcx + 0x20], rax
mov rax, qword [0x14024b6e8]
mov qword [rcx + 0x28], rax
mov rax, qword [0x14024b6f0]
mov qword [rcx + 0x30], rax
mov rax, qword [0x14024b6f8]
mov qword [rcx + 0x38], rax
movzx eax, byte [0x14024b700]
mov byte [rcx + 0x40], al
mov rax, qword [r9]
mov rcx, r8
lea rbp, [r8 + rax]
test rbx, rbx
je 0x14022c6f1
add r8, 4
nop word [rax + rax]
movzx r9d, byte [rdx + rdi]
inc rdx
shl r9d, 0x10
cmp rdx, rbx
jne 0x14022c649
mov r11d, 2
jmp 0x14022c66d
movzx eax, byte [rdx + rdi]
inc rdx
shl eax, 8
or r9d, eax
cmp rdx, rbx
jne 0x14022c663
mov r11d, 1
jmp 0x14022c66d
movzx eax, byte [rdx + rdi]
or r9d, eax
inc rdx
mov r10d, r9d
and r9d, 0x3f
cmp r8, rbp
ja 0x14022c715
mov rax, r10
shr rax, 0x12
and eax, 0x3f
movzx eax, byte [rsp + rax]
mov byte [rcx], al
mov rax, r10
shr rax, 0xc
and eax, 0x3f
movzx eax, byte [rsp + rax]
mov byte [rcx + 1], al
cmp r11, 1
jbe 0x14022c6b2
mov byte [rcx + 2], 0x3d
add rcx, 3
add r8, 3
jmp 0x14022c6ca
shr r10, 6
add rcx, 3
and r10d, 0x3f
add r8, 3
movzx eax, byte [rsp + r10]
mov byte [rcx - 1], al
test r11, r11
je 0x14022c6da
mov byte [rcx], 0x3d
inc rcx
inc r8
jmp 0x14022c6e8
movzx eax, byte [rsp + r9]
inc rcx
inc r8
mov byte [rcx - 1], al
cmp rdx, rbx
jb 0x14022c630
sub rcx, rsi
mov al, 1
mov qword [r12], rcx
mov rbp, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x78]
add rsp, 0x50
pop r12
ret
xor al, al
jmp 0x14022c6fa
Function at 0x140289db3
Capabilities:
Execute syscall

Disassembly:
mov r10, rcx
jmp 0x140b3131c
syscall
ret
Function at 0x1400072b0
Capabilities:
Access peb ldr_data
Encode data using xor
Encrypt data using speck
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x2e8
movaps xmmword [rsp + 0x2d0], xmm6
movabs r12, 0xcbf29ce484222325
movabs r14, 0x1d12a89b9e723ff5
lea rcx, [0x1400ce915]
jmp 0x1403a9800

Function at 0x140008210
Capabilities:
Access peb ldr_data
Encrypt data using speck
Get kernel32 base address
Parse pe header

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x38
movabs r14, 0xcbf29ce484222325
lea rcx, [0x1400ce987]
jmp 0x1403ab397

Function at 0x1400e8e04
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
cdq
cwd
lea edx, [r8 + 2]
jmp 0x1401aaaec
jmp 0x1404ad2b6
mov qword [rsp + 8], rbx
bsf ebx, r8d
bts bx, dx
btc ebx, r8d
mov dword [rsp + 0x18], r8d
dec rbx
adc rbx, rdx
btc bx, bp
mov dword [rsp + 0x10], edx
bsf bx, r15w
shl bl, 0x29
adc bl, r12b
push rbp
dec rbp
sar ebp, cl
mov rbp, rsp
btr bx, 0xdc
rcr bl, cl
mov bl, 0x91
sub rsp, 0x50
mov bh, 0x73
dec bh
cmovs rbx, rdx
mov ebx, ecx
clc
test r8d, r8d
jne 0x1404ad3a0
xor ecx, ecx
jmp 0x1404ad317
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
jmp 0x1404ad325
je 0x1404ad3a0
mov ecx, 0x5a4d
cmp word [rax], cx
jmp 0x1404ad338
jne 0x1404ad3a0
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
jmp 0x1404ad34a
cmp dword [rcx], 0x4550
jmp 0x1404ad355
jne 0x1404ad3a0
mov eax, 0x20b
stc
cmp word [rcx + 0x18], ax
jmp 0x1404ad36a
jne 0x1404ad3a0
cmp dword [rcx + 0x84], 0xe
jmp 0x1404ad37c
jbe 0x1404ad3a0
cmp dword [rcx + 0xf8], 0
jmp 0x1404ad38e
je 0x1404ad3a0
mov ecx, ebx
jmp 0x1404ad39b
call fcn.1404ad177
lea rax, [rbp + 0x18]
cwd
not r9
movsx dx, dil
mov byte [rbp + 0x28], 0
mov qword [rbp - 0x20], rax
lea r9, [rbp - 0x2c]
lea rax, [rbp + 0x20]
cwd
mov qword [rbp - 0x18], rax
movzx rax, r13w
not cl
lea r8, [rbp - 0x20]
lea rax, [rbp + 0x28]
mov qword [rbp - 0x10], rax
lea rdx, [rbp - 0x28]
movsx rax, si
lahf
mov ch, 0xe7
mov eax, 2
jmp 0x1404ad3ee
lea rcx, [rbp - 0x30]
jmp 0x1404ad3f7
mov dword [rbp - 0x2c], eax
jmp 0x1404ad3ff
mov dword [rbp - 0x28], eax
call fcn.1404ad5b5
cmp dword [rbp + 0x20], 0
je 0x1404ad425
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
movzx rbp, sp
pop rbp
jmp 0x1404ad424
ret
mov ecx, ebx
jmp 0x1404ad42c
call fcn.1404ad230
int3
Function at 0x14011079a
Capabilities:
Parse pe header

Disassembly:
sub r8d, r8d
sub edx, edx
jmp 0x140211d45
jmp 0x1404ad2b6

Function at 0x1401a117c
Capabilities:
Access peb ldr_data

Disassembly:
test r11w, r11w
jmp 0x1401be648
je 0x140155782
mov word [rcx], 0
jmp 0x140155782
je 0x1401f831a
sub edx, edx
or r9, 0x6db807a1
setbe r9b
dec r9b
lea r9, [0x1400b8f10]
cmp r13w, 0x1ea7
test al, ah
cmp r8, rdx
jmp 0x140143f40
je 0x14011ae0d
mov word [rcx], ax
bt eax, 0x14
sbb eax, r9d
add rcx, 2
cmovae ax, r9w
mov ax, ax
movzx eax, word [r9 + rdx*2 + 2]
jmp 0x1401f8304
ret
cmovb r8, rdx
test ax, ax
jmp 0x140127ad6
jmp 0x140127adc
mov rax, qword gs:[0x30]
shr r8b, 0x97
sal r8d, 0x5e
mov rax, qword [rax + 0x60]
movzx r10, r14w
mov rax, qword [rax + 0x18]
bts r8w, sp
movsx r11d, ax
inc r10w
mov rax, qword [rax + 0x10]
sar r10, cl
ror r10w, 7
shrd r8, r12, 0xcd
movzx r8d, word [rax + 0x58]
and r9w, r14w
dec r9b
bts r9w, r12w
cmp r8, rdx
cmovae r8, rdx
bts r9d, esp
movzx r10, bx
mov r9, qword [rax + 0x60]
ror r11w, cl
xadd r11d, r10d
movzx r11d, word [r9]
cmp si, bp
rol r10b, cl
lea r10, [0x1400b8f10]
cmp r14w, 0x52d0
jmp 0x1400e923b
movzx eax, word [0x1400b8f10]
test ax, ax
je 0x140190b1f
cmp rdx, 0x104
mov r8d, 0x104
jmp 0x1401bfb3e
movzx eax, word [0x1400b8f10]
cmp rdx, 0x104
movsx r8d, cx
movsxd r8, r15d
jmp 0x140282635
je 0x1401ef374
sub eax, eax
stc
test rdx, rdx
cmc
nop word [rax + rax]
cmp r8, rax
je 0x1401ef37d
mov word [r10], r11w
and r11w, r8w
jmp 0x1401c484c
cmovb r8, rdx
jmp 0x140188a48
add r10, 2
movsx r11w, spl
cmovno r11w, sp
movzx r11d, word [r9 + rax*2 + 2]
jmp 0x1401ca639
inc rax
clc
cmp rdx, r15
cmp r8b, 0xc4
test r11w, r11w
jmp 0x1401ef367
jne 0x1401be65b
sub r8, rax
cmp r15b, 0x4a
test r8, r8
je 0x1401b51b8
mov word [r10], 0
btc r8w, 0x58
rol r8b, 0x28
jmp 0x1401b51b8
inc rdx
test r15b, 0x48
cmp r8b, r11b
test ax, ax
jne 0x140127afb
sub r8, rdx
test r8, r8
jmp 0x14011ae07
mov r8d, 0x104
jmp 0x1401589c8
Function at 0x1401b9390
Capabilities:
Encrypt data using rc4 prga

Disassembly:
jmp 0x1401b7643
mov dword [rsp + 0xc], eax
add edx, edx
dec ecx
test r14b, r11b
test byte [rsp + 0xe], 0x10
je 0x140211944
mov dword [rsp + 8], edx
rcl ah, 0xc
movzx eax, word [rsp + 0xe]
bts dx, sp
mov edx, 0xffef
test r9b, 0x61
and ax, dx
mov word [rsp + 0xe], ax
clc
cmp r8w, r8w
test r9d, r9d
jmp 0x140245730
movzx ecx, word [rsp + 0xe]
dec eax
or al, r15b
mov edx, 0xbfef
shr ecx, 4
btr ax, 0x53
ror ax, cl
movsd qword [rsp + 0x10], xmm1
movzx eax, r11w
shl ah, 0x60
dec ax
and ecx, 0x7ff
sal ax, cl
rcr ah, cl
add eax, 0x13be7055
movsd qword [rsp + 0x18], xmm1
xadd rax, rax
shr al, 0x2a
adc ah, 0x47
mov rax, qword [rsp + 0x18]
test r10d, 0x28fb4299
jmp 0x1401e2132
jne 0x1401eba13
test edx, edx
jmp 0x1401eba0d
comisd xmm0, xmm1
seta r9b
test r8b, 0x10
jmp 0x140211936
shr rax, 0x30
test dil, 0xa3
test rsp, r10
and ax, dx
rol dx, cl
movsd qword [rsp + 8], xmm0
mov edx, 0x3fe0
stc
or ax, dx
jmp 0x14020602d
mov dword [r10], ecx
jmp 0x140216060
movaps xmm1, xmm0
movsd qword [rsp + 8], xmm0
jmp 0x140247085
ucomisd xmm1, xmm0
jp 0x140211584
jne 0x140211584
sub ecx, ecx
jmp 0x1400e4a07
shr rax, 0x30
test bh, 0x83
cmp bpl, r12b
and ax, dx
btc rdx, r9
add dh, 0x95
ror dl, cl
mov edx, 0x3fe0
or ax, dx
cmp al, r9b
clc
stc
mov word [rsp + 0x16], ax
sub ecx, 0x3fe
jmp 0x14025c014
je 0x1400e8a01
xor r9d, r9d
movsx ecx, r14w
movzx cx, sil
mov ecx, 0xfffffc03
jmp 0x140120677
jne 0x1400e8a01
mov edx, dword [rsp + 8]
clc
cmc
test r10b, 0x78
shr rax, 0x20
test eax, 0xfffff
jmp 0x14010121c
mov word [rsp + 0xe], ax
jmp 0x14024d79d
mov rax, qword [rsp + 8]
rcr r8b, cl
rcl cl, 0xde
mov ecx, 0x7ff0
rcl r8, cl
mov r8, rax
cmp dil, 0x41
clc
shr r8, 0x30
cmc
test cx, r8w
jmp 0x1401f8b70
jne 0x1400e5247
mov eax, dword [rsp + 0xc]
cmp r12b, dl
clc
add eax, eax
mov dword [rsp + 0xc], eax
stc
clc
test edx, edx
jmp 0x140292e2c
ret
jmp 0x1401b7643
je 0x14024574e
mov edx, 0x8000
test si, r10w
or ax, dx
cmp sil, 0x21
mov word [rsp + 0xe], ax
xor dh, 4
movsd xmm0, qword [rsp + 8]
movsx rax, bp
or al, bl
movzx edx, r10w
mov edx, 0xbfef
sar ah, cl
rcl al, cl
movsd qword [rsp + 0x10], xmm0
mov rax, qword [rsp + 0x10]
jmp 0x14012544f
xorps xmm0, xmm0
mov r10, rdx
jmp 0x1401c8163
movsd xmm0, qword [rsp + 8]
jmp 0x14022a584
movsd xmm0, qword [rsp + 0x10]
jmp 0x1401b7643
jns 0x1400e522e
or eax, 1
jmp 0x1400e522a
Function at 0x1401dab08
Capabilities:
Encrypt data using speck
Resolve function by parsing pe exports

Disassembly:
mov rcx, qword [rcx]
jmp 0x14026cd10
jmp 0x14044215f
push rsi
xor sil, 0xf0
push rdi
sub rsp, 0x28
test r11b, r14b
btr si, r9w
cmc
mov rsi, rcx
mov rcx, qword [rcx + 0x18]
jmp 0x140442188
mov rax, qword [rcx]
cmp r9b, 0x7d
clc
xor edx, edx
cmp sil, r10b
sub r8d, r8d
jmp 0x14044219d
call qword [rax + 0x188]
mov edi, eax
setle ch
lea rcx, [rsi + 0x30]
jmp 0x1404421b1
call fcn.140455d64
test edi, edi
je 0x1404421f3
cmp edi, 0x8899000c
jmp 0x1404421c9
jne 0x140442210
mov rcx, rsi
xor dil, 0x11
add rsp, 0x28
movsxd rsi, r10d
sets sil
pop rdi
movsx si, dl
movsx esi, bp
mov si, r8w
pop rsi
jmp fcn.140441e09
nop
movsxd rdi, r13d
or dil, dl
mov si, 0x34b9
add rsp, 0x28
xchg di, si
bswap di
pop rdi
pop rsi
jmp 0x14044220f
ret
mov ecx, edi
mov r9d, r11d
bsr r8w, ax
movabs r8, 0xad4a5352d2edebd0
movsx si, sil
rol r9d, 0x20
mov dl, 3
or sil, 0xb9
mov r9d, 0x54
inc dil
rcl sil, 0x9b
add dil, 0xe8
add rsp, 0x28
movsxd rdi, r14d
movzx rsi, r11w
pop rdi
bswap si
movsx si, r10b
pop rsi
jmp 0x14044225e
jmp fcn.1403ab945

Function at 0x1401f686c
Capabilities:
Parse pe header

Disassembly:
ret
cmp word [rcx], ax
jmp 0x1401ab4d4
ret
jne 0x1401fc5ce
movsxd rdx, dword [rcx + 0x3c]
cmp bx, 0x4658
lea rdx, [rdx + rcx]
cmp dword [rdx], 0x4550
jne 0x1401fc5ce
xor eax, eax
sbb al, 0xf2
bts cx, r13w
mov ecx, 0x20b
test r14b, r13b
sal al, 0x3d
cmp word [rdx + 0x18], cx
sete al
jmp 0x1400e0228
mov eax, 0x5a4d
jmp 0x1400faf9a
xor eax, eax
jmp 0x14010460f

Function at 0x1402158f0
Capabilities:
Parse pe header

Disassembly:
sub edx, edx
btr r8d, r8d
shr r8b, cl
add r8b, cl
xor ecx, ecx
movzx r8d, r8w
lea r8d, [rdx + 1]
jmp 0x1404ad2b6

Function at 0x140222444
Capabilities:
Enumerate pe sections

Disassembly:
add rax, r8
cmc
stc
test r11d, r11d
jmp 0x1400f8910
je 0x14025fe77
mov edx, dword [rax + 0xc]
test r8d, r14d
cmp r10, rdx
jmp 0x14025fe4e
ret
movsxd r8, dword [rcx + 0x3c]
bt r10w, cx
and r11b, 0x18
xor r9d, r9d
movsx eax, bx
mov r11b, r10b
lea r8, [r8 + rcx]
btc r11w, r12w
sal ah, 0x95
mov r10, rdx
movzx eax, word [r8 + 0x14]
cmc
mov r11b, dil
adc r11b, cl
movzx r11d, word [r8 + 6]
cmp bp, ax
add rax, 0x18
jmp 0x1400ea3d0
jb 0x14025fe66
mov ecx, dword [rax + 8]
add ecx, edx
cmp r14b, r9b
stc
cmp r10, rcx
jb 0x1401e00a0
inc r9d
cmc
add rax, 0x28
cmp r9d, r11d
jb 0x1400f8916
sub eax, eax
jmp 0x1401e00a0
Function at 0x1403b959e
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
test r11d, 0x2e3c7aa2
cmp r10b, cl
push r14
cmc
cmp r10d, 0x4d3a558a
test r11b, r9b
push r12
sal r12w, cl
push rsi
adc r12w, 0x4f86
push rdi
sbb r12, 0x68734714
clc
ror r12, 0xce
push rbx
bt r12w, r12w
sub rsp, 0x28
rcl r12b, cl
movzx r12w, r13b
sal r12b, cl
mov r12, r8
stc
cmp sil, 0x7f
test si, r15w
test rdx, rdx
je 0x1403b97c3
mov r15, rdx
bts rbx, r9
ror bx, cl
mov rbx, rcx
clc
sub esi, esi
jmp 0x1403b9610
jmp 0x1403b965f
mov rcx, rdi
jmp 0x1403b9625
mov rdx, r14
call fcn.1403b73b1
mov eax, dword [rbx + rsi + 0x58]
mov dword [r12 + rsi + 0x58], eax
mov eax, r10d
mov rax, qword [rbx + rsi + 0x50]
jmp 0x1403b9648
mov qword [r12 + rsi + 0x50], rax
add rsi, 0x60
dec r15
jmp 0x1403b9659
je 0x1403b97bf
mov eax, dword [rbx + rsi + 8]
mov dword [r12 + rsi + 8], eax
cmp ah, cl
test ecx, edi
cmp r12, rbx
jmp 0x1403b9674
je 0x1403b962d
cmp qword [rbx + rsi + 0x28], 0x10
jmp 0x1403b9685
jb 0x1403b969a
mov r9, qword [rbx + rsi + 0x10]
jmp 0x1403b9695
jmp 0x1403b96a2
lea r9, [rbx + rsi]
add r9, 0x10
lea r14, [r12 + rsi]
add r14, 0x10
xor ax, 0x7d91
movzx eax, di
mov rdi, qword [rbx + rsi + 0x20]
sbb rax, rsi
cmp r13b, 0x49
mov rax, qword [r12 + rsi + 0x28]
stc
jmp 0x1403b96c8
cmp rax, rdi
jmp 0x1403b96d0
jae 0x1403b96ee
mov rcx, r14
movsxd rdx, r15d
mov rdx, rdi
jmp 0x1403b96e4
call fcn.1403b73b1
jmp 0x1403b9723
cmp rax, 0x10
jb 0x1403b9704
mov r14, qword [r12 + rsi + 0x10]
cdq
not r8b
movsx ecx, cx
mov qword [r12 + rsi + 0x20], rdi
mov rcx, r14
mov r8d, edi
mov rdx, r9
mov r8, rdi
call fcn.14049f837
mov byte [r14 + rdi], 0
sets r14b
mov r14, qword [rbx + rsi + 0x40]
jmp 0x1403b972d
cmp qword [rbx + rsi + 0x48], 0x10
jmp 0x1403b9738
jb 0x1403b974d
mov r9, qword [rbx + rsi + 0x30]
jmp 0x1403b9748
jmp 0x1403b975d
lea r9, [rbx + rsi]
add r9, 0x30
rcr ax, cl
cmc
bt eax, 0x7b
lea rdi, [r12 + rsi]
add rdi, 0x30
mov al, r10b
mov rax, qword [r12 + rsi + 0x48]
cmp rax, r14
jmp 0x1403b9775
jb 0x1403b9615
cmp rax, 0x10
jmp 0x1403b9784
jb 0x1403b978f
mov rdi, qword [r12 + rsi + 0x30]
mov qword [r12 + rsi + 0x40], r14
mov rcx, rdi
movsx edx, di
mov rdx, r9
movzx r8d, di
movsx r8, r14w
movsxd r8, edi
mov r8, r14
jmp 0x1403b97b0
call fcn.14049f837
mov byte [rdi + r14], 0
jmp 0x1403b962d
lea r12, [r12 + rsi]
mov rax, r12
bsr di, r13w
add rsp, 0x28
movsx rsi, di
pop rbx
mov rdi, rbx
movsxd rsi, r11d
pop rdi
cmovns r12, r14
movzx r15w, cl
pop rsi
pop r12
setne r15b
bswap r14
xchg r14b, r15b
pop r14
pop r15
ret
Function at 0x1403e2d37
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
push r14
shl r15b, cl
cmovnp r15w, dx
shr r15w, 0x71
push r13
btr r14w, r14w
not r14b
push r12
push rsi
shrd r13d, ebp, 0x1c
movsxd r13, esi
rcr r13, cl
push rdi
push rbp
add r14b, 0xd3
push rbx
rol r12b, cl
xadd r15w, r13w
dec r15b
sub rsp, 0x38
inc r14w
btr r15, 0x3b
neg r13w
movaps xmmword [rsp + 0x20], xmm6
mov r15b, 0xc3
and r14, 0x7f0976b7
xor r14b, r10b
mov r14, r9
bt r12w, 0x7b
btr ebx, 0xa5
mov r15, r8
mov r12, rdx
mov r13w, 0x2a0
mov r13, rcx
bsf bx, r13w
inc bl
add bx, 0x7cf0
mov rbx, qword [rcx]
test rbx, rbx
jmp 0x1403e2dc7
je 0x1403e2f2b
mov rdi, qword [r13 + 8]
clc
cmp al, r15b
cmp rsi, 0x766013a5
cmp rbx, rdi
jmp 0x1403e2de4
je 0x1403e2ed6
lea rbp, [0x1400bed10]
movaps xmm6, xmmword [0x1400bd400]
jmp 0x1403e2e2e
call fcn.140271af4
movups xmmword [rbx + 0x20], xmm6
cmp sil, bpl
test r9w, ax
clc
mov byte [rbx + 0x10], 0
stc
add rbx, 0x50
test cx, r13w
jmp 0x1403e2e20
cmp rbx, rdi
jmp 0x1403e2e28
je 0x1403e2ec8
mov qword [rbx], rbp
movzx cx, dh
lea rcx, [rbx + 0x38]
jmp 0x1403e2e3e
call fcn.1403e0218
mov rax, qword [rbx + 0x28]
jmp 0x1403e2e53
cmp rax, 0x10
jmp 0x1403e2e5c
jb 0x1403e2e02
mov rcx, qword [rbx + 0x10]
shld dx, r13w, 0xde
lea rdx, [rax + 1]
test r12b, r8b
cmp rdx, 0x1000
jmp 0x1403e2e7f
jb 0x1403e2dfd
mov rsi, qword [rcx - 8]
cmp bx, 0x152a
jmp 0x1403e2e93
add rcx, 0xfffffffffffffff8
stc
cmp r12b, dl
test bx, bp
sub rcx, rsi
cmp rcx, 0x20
jae 0x1403e2fbb
add rax, 0x28
bswap rcx
cqo
cdq
mov rdx, rax
cmovle cx, bx
movzx rcx, r15w
mov rcx, rsi
jmp 0x1403e2dfd
mov rbx, qword [r13]
sub rdx, rbp
test al, r10b
bt rdx, rbx
mov rdx, qword [r13 + 0x10]
clc
sub rdx, rbx
cmp rdx, 0x1000
jmp 0x1403e2eea
jb 0x1403e2f23
mov rax, qword [rbx - 8]
cmp sil, dil
add rbx, 0xfffffffffffffff8
cmp spl, 0xd
stc
sub rbx, rax
clc
test rdi, rsp
cmp rbx, 0x20
jmp 0x1403e2f10
jae 0x1403e2fbb
add rdx, 0x27
movsxd rcx, eax
sets bl
mov rbx, rax
mov rcx, rbx
call fcn.140271af4
mov qword [r13], r12
or ebx, r13d
cbw
lea rax, [r15 + r15*4]
shl rax, 4
neg dil
add rax, r12
bt r15, rbx
movsx r15d, r15w
cmp r9b, 0xe0
mov qword [r13 + 8], rax
sar sil, 0xf7
cwde
xadd rbp, rsi
lea rax, [r14 + r14*4]
shl rax, 4
add rax, r12
mov qword [r13 + 0x10], rax
movaps xmm6, xmmword [rsp + 0x20]
test r12w, r15w
add bh, 0xbb
add rsp, 0x38
xchg r15d, r13d
pop rbx
mov esi, r15d
movzx r14d, cx
not r12b
pop rbp
movzx r15w, dil
movzx esi, r8w
pop rdi
jmp 0x1403e2f9b
pop rsi
movsx r15d, r8w
pop r12
mov r15w, bx
movzx r13w, r10b
bswap r14w
pop r13
pop r14
pop r15
jmp 0x1403e2fba
ret
call fcn.1404b245b
int3
Function at 0x14041e714
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rsi
inc sil
sar r9d, cl
mov r10, qword [rcx]
xor r9w, 0x663
bts r9w, bp
movsxd rsi, edx
mov rsi, qword [rcx + 0x18]
cmp r14b, 0x78
ror r9b, 0xfe
mov r9d, dword [r10 + 4]
imul r9d, dword [r10]
cmp r11b, 0x1e
test rcx, r8
cmp r8d, 2
jmp 0x14041e750
jne 0x14041e8fe
test r9d, r9d
jmp 0x14041e75e
je 0x14041e992
lea ecx, [r9 - 1]
cmp ecx, 3
jmp 0x14041e770
jb 0x14041e87e
mov r11d, r9d
not r8b
movsx r10w, bl
xor r8b, spl
and r11d, 0xfffffffc
or r8d, r14d
movzx r10d, r9w
movzx r10w, dl
nop word cs:[rax + rax]
ror r10d, 9
movzx r8d, word [rsi]
test r13w, 0x182a
clc
movzx r10d, word [rsi + 4]
test r8, 0x35952fba
xor ecx, ecx
sbb cl, bl
jmp 0x14041e7c5
cmp r8w, word [rdx]
jmp 0x14041e7ce
setne cl
neg ecx
bsf r8w, bx
cmp r13w, 0x4c32
not r8w
mov word [rsi + 2], cx
add r8d, r9d
movsx r8w, cl
sub ecx, ecx
sets cl
cmp r10w, word [rdx]
setne cl
neg ecx
bt r8d, 0x97
add r8b, 0x83
shl r8, cl
mov word [rsi + 6], cx
rcr r8, 0xe8
movzx r8d, word [rsi + 8]
cmp r9w, 0x4bbc
stc
xor ecx, ecx
sbb cl, 0x6a
and cl, r10b
cmp r8w, word [rdx]
setne cl
or r8b, al
btc r8w, 0xd9
dec r8
neg ecx
mov word [rsi + 0xa], cx
test r9w, 0x5a42
movzx r8d, word [rsi + 0xc]
test cx, 0x247f
test r10w, r15w
sub ecx, ecx
cmp r8w, word [rdx]
setne cl
neg ecx
jmp 0x14041e862
mov word [rsi + 0xe], cx
test spl, 0x30
add rsi, 0x10
clc
jmp 0x14041e874
add r11d, 0xfffffffc
jne 0x14041e7a5
test r9b, 3
jmp 0x14041e887
je 0x14041e992
and r9d, 3
movsxd r8, r14d
movsx r8d, bx
sar r8b, cl
xor ecx, ecx
adc r8b, 0xa8
bts r8, rdx
nop word cs:[rax + rax]
btc r8w, 0xcd
movzx r8d, word [rsi + rcx*4]
cmp r15w, r14w
jmp 0x14041e8c8
xor eax, eax
sub al, r14b
shl al, cl
cmp r8w, word [rdx]
jmp 0x14041e8d8
setne al
cmc
neg eax
jmp 0x14041e8e3
mov word [rsi + rcx*4 + 2], ax
jmp 0x14041e8ed
inc rcx
cmp r9d, ecx
jne 0x14041e8b6
jmp 0x14041e992
test r9d, r9d
jmp 0x14041e906
je 0x14041e992
movzx r10d, word [rdx]
rol r8w, 0x1a
mov r8d, r9d
test dil, 0xd9
jmp 0x14041e921
xor ecx, ecx
jmp 0x14041e928
jmp 0x14041e93e
inc rcx
cmp r8d, ecx
jmp 0x14041e938
je 0x14041e992
cmp word [rsi + rcx*8], r10w
jmp 0x14041e948
jne 0x14041e92d
movzx eax, word [rsi + rcx*8 + 2]
cmp ax, word [rdx + 2]
jmp 0x14041e95c
jne 0x14041e92d
movzx eax, word [rsi + rcx*8 + 4]
cmp ax, word [rdx + 4]
jmp 0x14041e970
jne 0x14041e92d
mov word [rsi + rcx*8 + 6], 0
movsx r10, cx
mov r10b, 0x65
movzx r10d, word [rdx]
jmp 0x14041e98d
jmp 0x14041e92d
pop rsi
jmp 0x14041e998
ret