joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400072b0
Capabilities:
Access peb ldr_data
Authenticate hmac
Check for software breakpoints
Encrypt data using speck
Get number of processors
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x2e8
movaps xmmword [rsp + 0x2d0], xmm6
movabs r12, 0xcbf29ce484222325
movabs r14, 0x1d12a89b9e723ff5
lea rcx, [0x1400ce915]
jmp 0x1403aab1c

Function at 0x140008210
Capabilities:
Access peb ldr_data
Encrypt data using speck
Get kernel32 base address
Parse pe header

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x38
movabs r14, 0xcbf29ce484222325
lea rcx, [0x1400ce987]
jmp 0x1403ac611

Function at 0x1400fb448
Capabilities:
Access peb ldr_data
Encrypt data using rc4 prga

Disassembly:
jne 0x1401e0c43
sub r8, rdx
test r8, r8
jmp 0x140112cce
movzx eax, word [0x1400b8f10]
stc
test bp, 0x6d5a
test ax, ax
je 0x14028aa8c
cmp rdx, 0x104
mov r8b, 0x3f
movsxd r8, r12d
movsx r8d, dx
mov r8d, 0x104
jmp 0x1401f599f
je 0x14017a832
mov word [rcx], 0
jmp 0x14017a832
je 0x140128b84
mov word [r10], 0
movzx eax, word [0x1400b8f10]
xadd r8, r8
cmp rdx, 0x104
mov r8w, 0xd43
mov r8d, 0x104
jmp 0x1402874f7
je 0x1401cb7a7
xor eax, eax
test r11w, 0x7066
cmp di, 0x7f5f
nop word [rax + rax]
clc
cmp r8, rax
jmp 0x1402464c3
test ax, ax
jmp 0x1400f25b8
ret
inc rdx
jmp 0x1401783f0
jne 0x1401628ad
sub r8, rax
cmp sil, sil
test r8w, dx
test r8, r8
jmp 0x140128b78
je 0x1400f25c1
sub edx, edx
lea r9, [0x1400b8f10]
test sil, r11b
cmp r8b, spl
cmp r8, rdx
jmp 0x1401e9d88
je 0x140112cd4
mov word [rcx], ax
lahf
rcl al, cl
add rcx, 2
inc al
mov al, bl
movsx rax, sp
movzx eax, word [r9 + rdx*2 + 2]
jmp 0x1401c949c
cmovb r8, rdx
jmp 0x1401e0c34
inc rax
cmp bp, r13w
stc
test r11w, r11w
jmp 0x1401cb797
je 0x140128b7e
mov word [r10], r11w
and r11b, r14b
ror r11, 8
add r10, 2
movsx r11, r12w
movzx r11d, word [r9 + rax*2 + 2]
jmp 0x14020e69d
cmovb r8, rdx
test ax, ax
jmp 0x1401e0c2e
mov rax, qword gs:[0x30]
mov rax, qword [rax + 0x60]
mov rax, qword [rax + 0x18]
xor r8w, r10w
shl r8b, cl
mov rax, qword [rax + 0x10]
movzx r8d, word [rax + 0x58]
cmp r8, rdx
movzx r10, bp
cmovb r11w, r12w
xchg r9b, r11b
cmovae r8, rdx
ror r11, cl
rcl r10d, 0x39
mov r9, qword [rax + 0x60]
cmc
bsr r10w, r15w
setae r11b
movzx r11d, word [r9]
xadd r10, r10
shr r10d, cl
movzx r10w, r15b
lea r10, [0x1400b8f10]
clc
cmc
test r11w, r11w
jmp 0x140162893

Function at 0x1400fb47a
Capabilities:
Parse pe header

Disassembly:
sub edx, edx
bt r8w, bx
sar r8w, cl
sub ecx, ecx
lea r8d, [rdx + 1]
jmp 0x1404ae968
Function at 0x140127b4c
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
movsx rdx, sp
lea edx, [r8 + 2]
jmp 0x1404ae968
mov qword [rsp + 8], rbx
mov dword [rsp + 0x18], r8d
shld ebx, ecx, 0x5b
sub ebx, r8d
dec bh
mov dword [rsp + 0x10], edx
or bh, 0xf8
sub bh, 0xd8
sal bl, cl
push rbp
rcr bpl, 0xbb
bt bp, sp
mov rbp, rsp
sub rsp, 0x50
mov ebx, ecx
test r11w, 0x5d00
test r8d, r8d
jmp 0x1404ae9a7
jne 0x1404aea45
xor ecx, ecx
jmp 0x1404ae9b4
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
jmp 0x1404ae9c2
je 0x1404aea45
mov ecx, 0x5a4d
cmp r14b, cl
jmp 0x1404ae9d5
cmp word [rax], cx
jmp 0x1404ae9dd
jne 0x1404aea45
movsxd rcx, dword [rax + 0x3c]
test r14b, r10b
jmp 0x1404ae9ef
add rcx, rax
cmp r12b, dl
cmp dword [rcx], 0x4550
jmp 0x1404aea00
jne 0x1404aea45
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jmp 0x1404aea14
jne 0x1404aea45
cmp dword [rcx + 0x84], 0xe
jmp 0x1404aea26
jbe 0x1404aea45
cmp dword [rcx + 0xf8], 0
je 0x1404aea45
mov ecx, ebx
jmp 0x1404aea40
call fcn.1404ae859
lea rax, [rbp + 0x18]
mov byte [rbp + 0x28], 0
movzx r9w, r14b
jmp 0x1404aea57
mov qword [rbp - 0x20], rax
lahf
cmovns r8, r15
cbw
lea r9, [rbp - 0x2c]
cmovo dx, r12w
lahf
lea rax, [rbp + 0x20]
jmp 0x1404aea75
mov qword [rbp - 0x18], rax
movzx r8d, r10w
cwde
lea r8, [rbp - 0x20]
cqo
lea rax, [rbp + 0x28]
mov qword [rbp - 0x10], rax
movsx eax, dx
cbw
lea rdx, [rbp - 0x28]
cmovbe rcx, rbp
mov eax, 2
lea rcx, [rbp - 0x30]
jmp 0x1404aeaa7
mov dword [rbp - 0x2c], eax
jmp 0x1404aeaaf
mov dword [rbp - 0x28], eax
jmp 0x1404aeab7
call fcn.1404aec5b
cmp dword [rbp + 0x20], 0
jmp 0x1404aeac5
je 0x1404aeae5
mov rbx, qword [rsp + 0x60]
shl rbp, cl
add rsp, 0x50
cmovae bp, di
not bpl
pop rbp
jmp 0x1404aeae4
ret
mov ecx, ebx
jmp 0x1404aeaec
call fcn.1404ae8ff
int3

Function at 0x1401326a4
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov r8, qword [rdx]
jmp 0x140264445
jmp fcn.1404c11b4

Function at 0x140153b56
Capabilities:
Encrypt data using speck
Resolve function by parsing pe exports

Disassembly:
jmp 0x1404436bc
mov rcx, qword [rcx]
jmp 0x1401157cc
push rsi
movsx eax, sp
and si, r13w
push rdi
btr esi, 0x97
sub rsp, 0x28
shr sil, 0xcb
cmp dx, r9w
mov rsi, rcx
mov al, r12b
neg al
mov rcx, qword [rcx + 0x18]
bt rax, 0x26
nop
mov rax, qword [rcx]
jmp 0x1404436f3
sub edx, edx
sub r8d, r8d
jmp 0x1404436fd
call qword [rax + 0x188]
mov edi, eax
xchg cl, ch
lea rcx, [rsi + 0x30]
jmp 0x140443710
call fcn.140457525
test edi, edi
jmp 0x14044371c
je 0x14044374d
cmp edi, 0x8899000c
jmp 0x14044372d
jne 0x140443771
mov rcx, rsi
add rsp, 0x28
pop rdi
movzx rsi, bx
mov sil, 0x72
pop rsi
jmp 0x140443748
jmp fcn.140443374
nop
mov dil, r14b
dec esi
rol dil, 0x94
add rsp, 0x28
xchg dil, dil
pop rdi
movsxd rsi, r12d
cmovge esi, r15d
movzx rsi, dx
pop rsi
jmp 0x140443770
ret
mov ecx, edi
movabs r8, 0xad4a5352d2edebd0
mov dl, 3
movzx r9w, r11b
movzx edi, r9w
sal sil, cl
mov r9d, 0x54
sar di, 0x87
add rsp, 0x28
mov si, di
cmovne rsi, rsp
movsx si, r15b
pop rdi
pop rsi
jmp 0x1404437ac
jmp fcn.1403acbcd

Function at 0x1401998a7
Capabilities:
Parse pe header

Disassembly:
sub r8d, r8d
sub edx, edx
jmp 0x140211030
jmp 0x1404ae968
Function at 0x14019da24
Capabilities:
Parse pe header

Disassembly:
ret
mov eax, 0x5a4d
cmc
clc
cmp word [rcx], ax
jmp 0x1402652d0
ret
xor eax, eax
jmp 0x1401cfe47
jne 0x1401f5640
movsxd rdx, dword [rcx + 0x3c]
cmc
test r15w, r12w
clc
lea rdx, [rdx + rcx]
jmp 0x14026ea59
cmp dword [rdx], 0x4550
jne 0x1401f5640
sub eax, eax
shr ch, 0x26
mov ecx, 0x20b
shr al, cl
cmp word [rdx + 0x18], cx
setnp al
sete al
jmp 0x14013603a

Function at 0x1401ed8f6
Capabilities:
Execute anti-debugging instructions

Disassembly:
jmp fcn.1404b25c1
mov rdx, rcx
cmovbe rcx, r13
xchg cx, cx
lea rcx, [0x1400ba2a8]
jmp 0x1400e008c

Function at 0x14020be91
Capabilities:
Encrypt data using rc4 prga

Disassembly:
je 0x14021e1dc
movzx r10d, byte [rdx]
sar r8, cl
mov r8d, r9d
jmp 0x1401de737
jb 0x14021814e
mov r8d, r9d
setg r10b
add r10b, r10b
rcl ch, cl
and r8d, 0xfffffffc
sub r10b, spl
add cx, 0x4323
shl ch, 0xb2
nop word cs:[rax + rax]
add cx, 0x3732
setb cl
movzx ecx, byte [r11]
cmp cl, byte [rdx]
movzx r10d, byte [r11 + 2]
setne cl
neg cl
cmp r12, rax
jmp 0x14024cd35
jne 0x140293191
movzx eax, byte [r11 + rcx*4 + 1]
cmp r14b, bpl
cmp al, byte [rdx + 1]
jmp 0x140254562
je 0x14021e1dc
and r9d, 3
rol ah, 0x2d
sbb ax, 0x1c2f
ror ah, cl
xor ecx, ecx
neg ax
nop word cs:[rax + rax]
ror al, 0xdd
sar ax, cl
movzx eax, byte [r11 + rcx*2]
stc
jmp 0x14021af70
jne 0x140293191
mov byte [r11 + rcx*4 + 3], 0
movzx r10d, byte [rdx]
jmp 0x14027b35c
sub ecx, ecx
jmp 0x140211979
add r11, 8
test r13, 0x204f4f54
stc
test rsp, r10
add r8d, 0xfffffffc
jmp 0x140218148
mov r10, qword [rcx]
shl r9b, cl
mov r11, qword [rcx + 0x18]
mov r9d, dword [r10 + 4]
cmp dil, r8b
imul r9d, dword [r10]
cmp r8d, 2
jne 0x1402575f0
test r9d, r9d
je 0x14021e1dc
lea ecx, [r9 - 1]
cmp ecx, 3
jmp 0x14010692f
jmp 0x140277a00
jne 0x140106966
test r9b, 3
jmp 0x140123cce
cmp al, byte [rdx]
setne al
cmp r14b, 0x6a
cmp edx, esp
neg al
jmp 0x140266635
ret
setne cl
test r13b, 0x96
cmp bpl, 0x7f
neg cl
test ah, 0x8e
mov byte [r11 + 3], cl
and cx, 0x5abb
movzx ecx, byte [r11 + 4]
clc
test r8b, 0x12
cmp cl, byte [rdx]
jmp 0x140235386
setne cl
test r13d, ebx
cmc
neg cl
cmp r9b, 0x4f
stc
mov byte [r11 + 5], cl
xor cx, r12w
bt cx, r12w
btr ecx, 0x84
movzx ecx, byte [r11 + 6]
cmp cl, byte [rdx]
setle cl
setne cl
neg cl
mov byte [r11 + 7], cl
jmp 0x1401fda4d
mov byte [r11 + 1], cl
cmp r10b, byte [rdx]
jmp 0x140225c13
jne 0x140293191
movzx eax, byte [r11 + rcx*4 + 2]
test sp, 0x312c
cmp al, byte [rdx + 2]
jmp 0x140127f42
test r9d, r9d
jmp 0x1400e0030
mov byte [r11 + rcx*2 + 1], al
jmp 0x140291029
je 0x14021e1dc
cmp byte [r11 + rcx*4], r10b
jmp 0x140111195
jmp 0x140293191
jne 0x140123cf6
jmp 0x14021e1dc
inc rcx
clc
cmp r9d, ecx
jmp 0x14028c642
inc rcx
clc
cmp r8d, ecx
jmp 0x1402779fa
Function at 0x140234e62
Capabilities:
Encrypt data using rc4 prga

Disassembly:
jmp 0x140442141
mov rcx, qword [rcx + 0x18]
jmp 0x140174a80
push r14
rcl cx, cl
inc ch
movzx ecx, r10w
push rsi
bt rcx, r9
push rdi
or cl, 0xbb
push rbx
xor cx, r13w
mov cl, r10b
sub rsp, 0x58
bsr cx, cx
lea rcx, [rsp + 0x28]
xor edx, edx
test dil, 0xd1
cmp bx, 0x7ed9
xor r8d, r8d
test r9w, dx
cmp rbp, r9
test r9b, 0xe0
sub r9d, r9d
call qword [sym.imp.USER32.dll_GetMessageW]
test eax, eax
je 0x140442209
lea rsi, [rsp + 0x28]
movsxd rcx, r15d
mov r14, qword [sym.imp.USER32.dll_TranslateMessage]
xchg ebx, ebx
movzx rcx, ax
mov rbx, qword [sym.imp.USER32.dll_DispatchMessageW]
jmp 0x1404421b7
mov rdi, qword [sym.imp.USER32.dll_GetMessageW]
movzx cx, r14b
cmovs rcx, rbx
setae cl
nop word [rax + rax]
movzx ecx, sp
movzx cx, bl
mov rcx, rsi
jmp 0x1404421df
call r14
mov rcx, rsi
jmp 0x1404421ea
call rbx
mov rcx, rsi
test bpl, cl
stc
cmp sil, 0xdf
sub edx, edx
xor r8d, r8d
xor r9d, r9d
call rdi
test eax, eax
jne 0x1404421d7
add rsp, 0x58
movsx rbx, dx
xchg sil, bl
mov bx, 0x64dd
pop rbx
pop rdi
movsxd r14, edi
pop rsi
xchg r14b, r14b
movzx r14d, r14w
movzx r14w, r10b
pop r14
ret

Function at 0x14023cdf8
Capabilities:
Enumerate pe sections

Disassembly:
test r11d, r11d
jmp 0x1401c406b
add ecx, edx
cmp r10, rcx
jb 0x1401e29b9
inc r9d
test bp, 0x17ce
cmp ax, 0x5502
add rax, 0x28
test r11b, r13b
cmp r9d, r11d
jmp 0x1401c7f2c
jb 0x1400fd2d4
mov ecx, dword [rax + 8]
jmp 0x1400fd2c9
je 0x1401c7f32
mov edx, dword [rax + 0xc]
cmp r10, rdx
jmp 0x1401ac539
jb 0x1401c4071
sub eax, eax
jmp 0x1401e29b9
ret
movsxd r8, dword [rcx + 0x3c]
ror eax, 0xd9
sub r10b, r11b
xor r9d, r9d
lea r8, [r8 + rcx]
cmp r9, rdx
movsx r10, dx
mov r10, rdx
shr r11w, cl
and r11b, cl
movzx eax, word [r8 + 0x14]
movsxd r11, r13d
bsf r11d, eax
movzx r11d, word [r8 + 6]
cmp di, 0x10a0
add rax, 0x18
cmc
jmp 0x14025bbc0
lea rax, [rax + r8]
cmp rdi, rdx
jmp 0x1400e0275
Function at 0x1403b72e5
Capabilities:
Check for software breakpoints

Disassembly:
push rsi
push rdi
sub rsi, r13
movzx si, dil
push rbx
sub rsp, 0x20
ror si, cl
mov rsi, rcx
mov qword [rcx + 8], 0
cmp qword [rcx + 0x28], 0x10
jmp 0x1403b730c
jb 0x1403b7320
mov rax, qword [rsi + 0x10]
jmp 0x1403b731b
jmp 0x1403b7324
lea rax, [rsi + 0x10]
mov qword [rsi + 0x20], 0
mov byte [rax], 0
clc
cmp qword [rsi + 0x48], 0x10
jmp 0x1403b733a
jb 0x1403b734e
mov rax, qword [rsi + 0x30]
jmp 0x1403b7349
jmp 0x1403b7361
lea rax, [rsi + 0x30]
test rcx, rsi
jmp 0x1403b7361
mov qword [rsi + 0x40], 0
test r13b, 0xff
stc
mov byte [rax], 0
test dh, 0xb6
cmp qword [rsi + 0x68], 0x10
jmp 0x1403b737e
jb 0x1403b7392
mov rax, qword [rsi + 0x50]
jmp 0x1403b738d
jmp 0x1403b739b
lea rax, [rsi + 0x50]
jmp 0x1403b739b
mov qword [rsi + 0x60], 0
jmp 0x1403b73a8
mov byte [rax], 0
jmp 0x1403b73b0
xorps xmm0, xmm0
movups xmmword [rsi + 0x7c], xmm0
sar dil, cl
adc dil, 0xe3
movups xmmword [rsi + 0x70], xmm0
stc
btr bx, r14w
mov rdi, qword [rsi + 0x90]
mov rbx, qword [rsi + 0x98]
cmp rdi, rbx
je 0x1403b7425
nop word cs:[rax + rax]
cmovne cx, r11w
movsxd rcx, eax
movsx ecx, ax
mov rcx, rdi
jmp 0x1403b73fe
call fcn.1403b7511
add rdi, 0x60
jmp 0x1403b740d
cmp rdi, rbx
jne 0x1403b73f6
mov rax, qword [rsi + 0x90]
clc
mov qword [rsi + 0x98], rax
mov dword [rsi + 0xa8], 0
cmp qword [rsi + 0xc8], 0x10
jmp 0x1403b743c
jb 0x1403b7453
mov rax, qword [rsi + 0xb0]
jmp 0x1403b744e
jmp 0x1403b745a
lea rax, [rsi + 0xb0]
mov qword [rsi + 0xc0], 0
stc
mov byte [rax], 0
clc
cmp r9b, 0xcc
cmp qword [rsi + 0xe8], 0x10
jmp 0x1403b747b
jb 0x1403b7492
mov rax, qword [rsi + 0xd0]
jmp 0x1403b748d
jmp 0x1403b7499
lea rax, [rsi + 0xd0]
mov qword [rsi + 0xe0], 0
mov byte [rax], 0
cmp qword [rsi + 0x108], 0x10
jb 0x1403b74c6
mov rax, qword [rsi + 0xf0]
jmp 0x1403b74c1
jmp 0x1403b74d3
lea rax, [rsi + 0xf0]
shrd rdi, r8, 0xac
cmc
mov qword [rsi + 0x100], 0
sbb sil, 0x83
mov byte [rax], 0
shl ebx, 0x3f
movsx rdi, r12w
add rsp, 0x20
movsxd rbx, r12d
movzx rsi, r15w
pop rbx
jmp 0x1403b74fd
pop rdi
movsx esi, r10w
movsx rsi, si
movzx rsi, dx
pop rsi
jmp 0x1403b7510
ret
Function at 0x1403ca853
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
xchg r15d, r15d
add r15d, 0x77157404
push r14
test esi, ecx
btr r14d, edi
bts r15w, r10w
push r13
cmovne r15d, r13d
bts r15w, bp
btc r13, 0xeb
push r12
and r12b, 0x65
add r12w, bp
push rsi
xor r14, 0x16a637b0
ror r15d, cl
push rdi
stc
push rbx
xchg r15b, r12b
bts r15, rsi
movsx esi, r9w
sub rsp, 0x30
rcl r13, cl
and esi, r12d
setle r12b
movaps xmmword [rsp + 0x20], xmm6
rcl r12, cl
stc
rcr r14b, 0xd0
mov r15, r9
sbb sil, cl
setno r14b
mov r12, r8
bts si, di
adc r13b, al
mov r14, rdx
movsx r13w, al
add si, 0x680d
mov r13b, 0xb5
mov r13, rcx
movzx rsi, bx
bswap rsi
rol si, cl
mov rsi, qword [rcx]
cmp ebx, r8d
test rsi, rsi
je 0x1403caa31
mov rbx, qword [r13 + 8]
cmp rsi, rbx
jmp 0x1403ca906
je 0x1403ca9d2
movaps xmm6, xmmword [0x1400bd3f0]
jmp 0x1403ca941
call fcn.14013be3f
movups xmmword [rsi + 0x10], xmm6
test r13b, r14b
mov word [rsi], 0
add rsi, 0x20
test r11, rsi
cmp sil, bpl
cmp dx, 0x2ff1
cmp rsi, rbx
je 0x1403ca9c5
mov rax, qword [rsi + 0x18]
cmp rax, 8
jmp 0x1403ca94e
jb 0x1403ca91d
mov rcx, qword [rsi]
lea rdx, [rax + rax]
cmp r13w, r13w
add rdx, 2
jmp 0x1403ca968
cmp rdx, 0x1000
jmp 0x1403ca974
jb 0x1403ca918
mov rdi, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rdi
cmp rcx, 0x20
jmp 0x1403ca98e
jae 0x1403caad1
add rax, rax
bt dx, 0x34
sar dl, 0x5b
seta ch
add rax, 0x29
movsx ecx, sp
mov rdx, rax
movzx cx, r13b
setb ch
movsx rcx, bp
mov rcx, rdi
jmp 0x1403ca9c0
jmp 0x1403ca918
mov rsi, qword [r13]
movzx dx, ah
movsx edx, bx
rcl dh, cl
mov rdx, qword [r13 + 0x10]
test r13b, r10b
cmp r13b, 0x39
sub rdx, rsi
stc
cmp rdx, 0x1000
jmp 0x1403ca9ed
jb 0x1403caa29
mov rax, qword [rsi - 8]
cmc
clc
test r14b, bl
add rsi, 0xfffffffffffffff8
test spl, 0xfc
clc
sub rsi, rax
cmp r14w, r14w
clc
cmp rsi, 0x20
jmp 0x1403caa16
jae 0x1403caad1
add rdx, 0x27
xchg sil, cl
mov rsi, rax
xchg rcx, rcx
mov rcx, rsi
call fcn.14013be3f
mov qword [r13], r14
sal dil, cl
shl r12, 5
sar sil, cl
shl edi, cl
shld edi, r15d, 0x54
add r12, r14
bt rdi, r9
bswap di
mov qword [r13 + 8], r12
shl r15, 5
bt di, r14w
sar rbx, 0x8f
btc edi, edx
add r15, r14
shr di, 0x1c
mov qword [r13 + 0x10], r15
xor r15w, 0x6eb7
inc r14
shr bh, 0xde
movaps xmm6, xmmword [rsp + 0x20]
sbb ebx, ecx
btc r12, r12
sar dil, cl
add rsp, 0x30
pop rbx
movsxd r14, r13d
movsx r12, bp
jmp 0x1403caa9a
pop rdi
setl r15b
movzx si, r15b
pop rsi
movzx r12, r15w
movsx r12, r15w
movzx r14d, sp
pop r12
jmp 0x1403caabc
pop r13
jmp 0x1403caac7
pop r14
pop r15
jmp 0x1403caad0
ret
call fcn.1404b3a18
int3
Function at 0x1403d7e87
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r14
clc
not r11b
mov r11b, r12b
push rsi
setno r10b
add r10b, 0xcb
push rdi
push rbx
and r11d, 0x795261b7
ror r11b, cl
sal r11, 0x7b
mov r10, rcx
bts r11d, ebp
sal r11b, 0x10
add r8, rdx
adc r11w, bx
ror r11, cl
mov dword [rcx + 8], 0
xor r9d, r9d
neg r11d
sub eax, eax
sal r11, 0x81
sub ecx, ecx
cmp rdi, rsp
rcl r11, 0x1a
nop dword [rax]
bt r11d, 0x83
lea r11, [rdx + 1]
cmc
cmp ah, 0xb4
cmp r11, r8
jmp 0x1403d7ef6
ja 0x1403d8171
movzx esi, byte [rdx]
btc rdx, rsi
mov edx, esi
cmp r14b, 0x47
clc
test rdx, 0x6dbe04d9
and edx, 0x7f
shl rdx, cl
lea rax, [rax + rdx]
add rcx, 7
bt dx, 0x88
mov rdx, r11
test sil, sil
jmp 0x1403d7f2f
js 0x1403d7ee6
mov rcx, rax
jmp 0x1403d7f3d
shr rcx, 3
clc
cmp rcx, 2
jmp 0x1403d7f4b
je 0x1403d80ae
and eax, 7
cmp rcx, 1
je 0x1403d812c
cmp rax, 1
jmp 0x1403d7f67
jg 0x1403d7f97
test rax, rax
jmp 0x1403d7f75
je 0x1403d8039
cmp eax, 1
jmp 0x1403d7f83
jne 0x1403d8171
lea rdx, [r11 + 8]
jmp 0x1403d7f92
jmp 0x1403d8098
cmp eax, 5
jmp 0x1403d7f9f
je 0x1403d8094
cmp eax, 2
jne 0x1403d8171
mov rdi, r11
xor ebx, ebx
setbe al
test r13w, 0x6b46
xor ecx, ecx
nop dword [rax]
sal rax, 0xee
rol eax, cl
xadd eax, eax
lea rax, [rdi + 1]
cmp rax, r8
ja 0x1403d8171
mov rsi, rbx
clc
sbb r14b, 0x6b
movzx r14d, byte [rdi]
cqo
xor dil, r12b
mov edx, r14d
and edx, 0x7f
shl rdx, cl
add rbx, rdx
add rcx, 7
bsr rdi, rdi
mov rdi, rax
test r14b, r14b
jmp 0x1403d800b
js 0x1403d7fce
add rdx, rsi
stc
cmp ebp, 0x5c104a6d
test ecx, r8d
lea rdx, [rdx + rax]
cmp esp, 0x78f93da3
cmp rdx, r8
cmova rdx, rax
jmp 0x1403d8034
jmp 0x1403d7ecb
mov rax, r11
bsr rdx, r14
or rdx, 0x70be1aca
shl dh, 0xb5
nop word cs:[rax + rax]
add rdx, 0x1e3d6656
sub dx, bx
sal edx, cl
lea rdx, [rax + 1]
test rcx, 0x3d335bf2
cmp rdx, r8
jmp 0x1403d8078
ja 0x1403d8171
cmp byte [rax], 0
jmp 0x1403d8086
mov rax, rdx
js 0x1403d8065
jmp 0x1403d7ecb
lea rdx, [r11 + 4]
cmp rdx, r8
jmp 0x1403d80a0
cmova rdx, r11
jmp 0x1403d80a9
jmp 0x1403d7ecb
test al, 7
jne 0x1403d8171
or r9d, 4
sal sil, cl
shr si, cl
btr dx, 0xe2
mov dword [r10 + 8], r9d
cmp sil, cl
or sil, r12b
mov rsi, r11
btr rdx, 0xf0
xor eax, eax
sub ecx, ecx
or edx, 0x5a6173e0
nop dword [rax]
lea rdx, [rsi + 1]
test sp, 0x103e
cmp rdx, r8
ja 0x1403d8171
movzx edi, byte [rsi]
mov esi, r14d
mov esi, edi
and esi, 0x7f
cmp r11w, r11w
shl rsi, cl
clc
stc
lea rax, [rax + rsi]
add rcx, 7
mov rsi, rdx
test dil, dil
js 0x1403d80e4
mov qword [r10 + 0x18], rax
jmp 0x1403d8127
jmp 0x1403d7ecb
cmp eax, 1
jmp 0x1403d8134
jne 0x1403d8171
or r9d, 2
adc dx, 0xca5
test r10b, 0x94
mov dword [r10 + 8], r9d
adc dh, 0x7e
lea rdx, [r11 + 8]
cmp rdx, r8
jmp 0x1403d815a
ja 0x1403d8171
mov rax, qword [r11]
mov qword [r10 + 0x10], rax
jmp 0x1403d816c
jmp 0x1403d7ecb
cmp r11, r8
movzx esi, ax
seta al
movsx r14, bx
bswap di
movzx r14d, r8w
pop rbx
pop rdi
not r14w
pop rsi
movsx r14w, r12b
movsx r14d, sp
pop r14
ret
Function at 0x1403dd87d
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rsi
xchg r10, r9
push rdi
xor r10d, r15d
push rbx
movsx r9, bp
sal r10b, cl
setnp r10b
mov r9, rcx
sub r10b, 0xe7
xadd r10w, r10w
and r10w, r11w
add r8, rdx
shl r10b, cl
mov dword [rcx + 8], 0
sbb r10b, 0x32
xor eax, eax
xor ecx, ecx
xchg r10w, r10w
btr r10w, 0x3f
xadd r10b, r10b
nop word cs:[rax + rax]
lea r10, [rdx + 1]
jmp 0x1403dd8d9
cmp r10, r8
jmp 0x1403dd8e1
ja 0x1403ddb5e
movzx edi, byte [rdx]
clc
rol dx, cl
mov edx, edi
clc
test ch, bh
and edx, 0x7f
shl rdx, cl
test bpl, al
stc
clc
lea rax, [rax + rdx]
add rcx, 7
bts rdx, r9
bsf rdx, r8
mov rdx, r10
test dil, dil
jmp 0x1403dd919
js 0x1403dd8d0
mov rcx, rax
cmc
cmp r14w, 0x1f82
test r9, 0x4efc2d38
and rcx, 0xfffffffffffffff8
test r13b, 0x1a
cmp r12b, 0x36
and eax, 7
test cl, r9b
cmp rcx, 8
je 0x1403dda9a
cmp rax, 1
jmp 0x1403dd955
jg 0x1403dd985
test rax, rax
jmp 0x1403dd963
je 0x1403dda4c
cmp eax, 1
jmp 0x1403dd971
jne 0x1403ddb5e
lea rdx, [r10 + 8]
jmp 0x1403dd980
jmp 0x1403dda89
cmp eax, 5
jmp 0x1403dd98d
je 0x1403dda81
cmp eax, 2
jmp 0x1403dd99b
jne 0x1403ddb5e
mov rsi, r10
neg eax
sub edi, edi
movzx eax, ax
movsxd rax, r10d
xor ecx, ecx
nop word cs:[rax + rax]
lea rax, [rsi + 1]
cmp r15b, 0x4d
jmp 0x1403dd9c8
cmp rax, r8
ja 0x1403ddb5e
mov r11, rdi
shl dl, cl
sar dx, cl
movzx ebx, byte [rsi]
mov edx, ebx
btr rsi, rdx
adc rsi, 0x1ad31e06
rcr sil, 0x67
and edx, 0x7f
rcl sil, 0x63
sub si, r10w
xchg sil, sil
shl rdx, cl
add rdi, rdx
mov rsi, r10
movsx si, bpl
add rcx, 7
movzx esi, r9w
mov rsi, rax
cmp ch, 0x54
test bl, bl
jmp 0x1403dda1e
js 0x1403dd9bb
lea rdx, [rdx + r11]
clc
cmc
cmp r9w, sp
lea rdx, [rdx + rax]
cmp bx, 0x65c9
test r8w, r15w
cmp rdx, r8
jmp 0x1403dda43
cmova rdx, rax
jmp 0x1403dd8b2
mov rax, r10
nop
btc rdx, r15
btr dx, 0x68
lea rdx, [rax + 1]
cmp rdx, r8
ja 0x1403ddb5e
cmp byte [rax], 0
mov ax, di
lahf
mov rax, rdx
jmp 0x1403dda76
js 0x1403dda5a
jmp 0x1403dd8b2
lea rdx, [r10 + 4]
cmp dx, r11w
cmp rdx, r8
cmova rdx, r10
jmp 0x1403dda95
jmp 0x1403dd8b2
cmp eax, 2
jmp 0x1403ddaa2
jne 0x1403ddb5e
mov dword [r9 + 8], 2
bsf rsi, rax
adc dh, cl
btr esi, edi
mov rsi, r10
adc dl, r15b
test dil, al
and dx, 0x3468
sub eax, eax
cmovns dx, r11w
sub ecx, ecx
sete dh
nop word [rax + rax]
ror dx, cl
cmp rdx, rsp
sub edx, 0x2e0b33c5
lea rdx, [rsi + 1]
cmp rdx, r8
ja 0x1403ddb5e
movzx r11d, byte [rsi]
inc si
bt si, 0xc2
ror sil, 0x92
mov edi, r11d
movsx rsi, r11w
and edi, 0x7f
dec sil
rcl si, 0x93
sbb sil, 0x7e
shl rdi, cl
shr rsi, cl
lea rax, [rax + rdi]
add rcx, 7
rcl rsi, cl
mov rsi, rdx
test r11b, r11b
jmp 0x1403ddb33
js 0x1403ddae5
mov qword [r9 + 0x10], rdx
cmp sil, 0xb4
test bpl, cl
cmp r14w, r9w
mov qword [r9 + 0x18], rax
add rdx, rax
test bp, 0x7a42
stc
cmp rdx, r8
jbe 0x1403dd8b2
cmp r10, r8
seta al
pop rbx
xchg si, di
movzx rdi, r12w
pop rdi
cmovl esi, ebx
pop rsi
ret
Function at 0x1403f17bf
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
bsr r15, rax
xor r15w, 0x272
movsx r15, bx
push r14
push r13
bts r15d, edx
adc r15w, 0x5c64
push r12
neg r15w
xadd r15d, r12d
jmp 0x1403f17ec
push rsi
or r12w, r13w
cmc
not sil
push rdi
movzx r15w, r10b
adc si, 0x3549
movsx r13w, dil
push rbx
sub rsp, 0x30
sal r13b, 0x3d
sar r13w, 0xb6
bts r13w, bx
movaps xmmword [rsp + 0x20], xmm6
mov r14b, r8b
bt r15w, 0xbc
mov r15, r9
mov r12, r8
mov r14, rdx
mov r13, rcx
rol si, cl
ror sil, cl
mov rsi, qword [rcx]
cmc
test rsi, rsi
je 0x1403f1975
mov rbx, qword [r13 + 8]
jmp 0x1403f1852
cmp rsi, rbx
jmp 0x1403f185a
je 0x1403f1924
movaps xmm6, xmmword [0x1400bd400]
jmp 0x1403f1896
call fcn.14013be3f
movups xmmword [rsi + 0x10], xmm6
test r8b, 0x65
mov byte [rsi], 0
add rsi, 0x20
cmp r8b, sil
test r10b, 0x30
stc
cmp rsi, rbx
jmp 0x1403f1890
je 0x1403f191a
mov rax, qword [rsi + 0x18]
cmp r10b, r8b
cmp r8b, 0xa7
cmp rax, 0x10
jmp 0x1403f18aa
jb 0x1403f1871
mov rcx, qword [rsi]
btc dx, 0x71
adc dl, 0x30
inc dh
lea rdx, [rax + 1]
cmp rdx, 0x1000
jmp 0x1403f18cd
jb 0x1403f186c
mov rdi, qword [rcx - 8]
test rsp, rbp
cmp r12b, 0xaf
add rcx, 0xfffffffffffffff8
cmp sil, 0xa6
cmc
sub rcx, rdi
stc
cmp rcx, 0x20
jae 0x1403f19f4
add rax, 0x28
movzx ecx, r13w
cqo
mov rdx, rax
movsx ecx, r10w
movsxd rcx, r8d
movzx ecx, r13w
mov rcx, rdi
jmp 0x1403f1915
jmp 0x1403f186c
mov rsi, qword [r13]
stc
mov dl, r8b
dec dh
mov rdx, qword [r13 + 0x10]
stc
cmc
sub rdx, rsi
cmp r8d, r15d
cmp rdx, 0x1000
jb 0x1403f1968
mov rax, qword [rsi - 8]
clc
add rsi, 0xfffffffffffffff8
cmc
sub rsi, rax
cmp rsi, 0x20
jae 0x1403f19f4
add rdx, 0x27
setg sil
mov rsi, rax
movsx cx, r14b
movsx rcx, bp
mov rcx, rsi
jmp 0x1403f1970
call fcn.14013be3f
mov qword [r13], r14
shl r12, 5
xadd sil, bl
add r12, r14
movzx rbx, ax
xor bl, 0x31
clc
mov qword [r13 + 8], r12
shl r15, 5
stc
shr r12d, cl
ror sil, 0xea
lea r15, [r15 + r14]
mov qword [r13 + 0x10], r15
mov sil, 0xfb
adc r14b, sil
movaps xmm6, xmmword [rsp + 0x20]
sub r13w, bp
stc
add rsp, 0x30
not r13b
movzx r13w, bl
pop rbx
pop rdi
mov r12b, 0xf8
setg sil
pop rsi
mov r12b, 0xc1
xchg r12b, r14b
not r14b
pop r12
movsxd r13, esi
movzx r15, r13w
sets r14b
pop r13
movsxd r14, esp
pop r14
jmp 0x1403f19ec
pop r15
jmp 0x1403f19f3
ret
call fcn.1404b3a18
int3