joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14000d9b0
Capabilities:
Write file on windows

Disassembly:
push rbp
push rsi
push rbx
sub rsp, 0x30
lea rbp, [rsp + 0x30]
mov rbx, rcx
lea rax, [rbp + 0x28]
mov ecx, 2
mov qword [rbp + 0x28], rdx
mov qword [rbp + 0x30], r8
mov qword [rbp + 0x38], r9
mov qword [rbp - 8], rax
call fcn.140018220
mov r8d, 0x1b
mov edx, 1
lea rcx, [0x14114c360]
mov r9, rax
call sub.msvcrt.dll_fwrite
mov rsi, qword [rbp - 8]
mov ecx, 2
call fcn.140018220
mov rdx, rbx
mov rcx, rax
mov r8, rsi
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
nop
nop dword [rax]

Function at 0x14000da20
Capabilities:
Allocate or change rwx memory

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x58
lea rbp, [rsp + 0x50]
movsxd rsi, dword [0x141178114]
mov rbx, rcx
test esi, esi
jle 0x14000db50
mov rax, qword [0x141178118]
xor r9d, r9d
add rax, 0x18
nop dword [rax]
mov r8, qword [rax]
cmp rbx, r8
jb 0x14000da6b
mov rdx, qword [rax + 8]
mov edx, dword [rdx + 8]
add r8, rdx
cmp rbx, r8
jb 0x14000daf3
add r9d, 1
add rax, 0x28
cmp r9d, esi
jne 0x14000da50
mov rcx, rbx
call fcn.14000e4d0
mov rdi, rax
test rax, rax
je 0x14000db72
mov rax, qword [0x141178118]
lea rbx, [rsi + rsi*4]
shl rbx, 3
add rax, rbx
mov qword [rax + 0x20], rdi
mov dword [rax], 0
call fcn.14000e610
mov edx, dword [rdi + 0xc]
mov r8d, 0x30
lea rcx, [rax + rdx]
mov rax, qword [0x141178118]
lea rdx, [rbp - 0x30]
mov qword [rax + rbx + 0x18], rcx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x14000db57
mov eax, dword [rbp - 0xc]
lea edx, [rax - 4]
and edx, 0xfffffffb
je 0x14000daec
lea edx, [rax - 0x40]
and edx, 0xffffffbf
jne 0x14000db00
add dword [0x141178114], 1
add rsp, 0x58
pop rbx
pop rsi
pop rdi
pop rbp
ret
cmp eax, 2
mov rcx, qword [rbp - 0x30]
mov rdx, qword [rbp - 0x18]
mov r8d, 0x40
mov eax, 4
cmove r8d, eax
add rbx, qword [0x141178118]
mov qword [rbx + 8], rcx
mov r9, rbx
mov qword [rbx + 0x10], rdx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x14000daec
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, [0x14114c3d8]
mov edx, eax
call fcn.14000d9b0
nop word [rax + rax]
xor esi, esi
jmp 0x14000da78
mov rax, qword [0x141178118]
mov edx, dword [rdi + 8]
lea rcx, [0x14114c3a0]
mov r8, qword [rax + rbx + 0x18]
call fcn.14000d9b0
mov rdx, rbx
lea rcx, [0x14114c380]
call fcn.14000d9b0
nop
nop word cs:[rax + rax]
nop dword [rax]

Function at 0x14000e100
Capabilities:
Get thread local storage value

Disassembly:
push rbp
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0x28
lea rbp, [rsp + 0x20]
lea r13, [0x141178180]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x141178160]
test rbx, rbx
je 0x14000e165
mov r12, qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
mov ecx, dword [rbx]
call r12
mov rsi, rax
call rdi
test rsi, rsi
je 0x14000e15c
test eax, eax
jne 0x14000e15c
mov rax, qword [rbx + 8]
mov rcx, rsi
call rax
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x14000e140
mov rcx, r13
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop rbp
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
Function at 0x14000e4d0
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov rdx, qword [0x14114d870]
xor eax, eax
cmp word [rdx], 0x5a4d
jne 0x14000e4f0
movsxd r8, dword [rdx + 0x3c]
add r8, rdx
cmp dword [r8], 0x4550
je 0x14000e4f8
ret
cmp word [r8 + 0x18], 0x20b
jne 0x14000e4f0
movzx eax, word [r8 + 0x14]
sub rcx, rdx
lea rax, [r8 + rax + 0x18]
movzx r8d, word [r8 + 6]
test r8w, r8w
je 0x14000e54d
lea edx, [r8 - 1]
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
nop word cs:[rax + rax]
mov r8d, dword [rax + 0xc]
mov rdx, r8
cmp rcx, r8
jb 0x14000e544
add edx, dword [rax + 8]
cmp rcx, rdx
jb 0x14000e4f0
add rax, 0x28
cmp rax, r9
jne 0x14000e530
xor eax, eax
ret

Function at 0x14000e550
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x14114d870]
xor ecx, ecx
cmp word [rax], 0x5a4d
jne 0x14000e56f
movsxd rdx, dword [rax + 0x3c]
add rax, rdx
cmp dword [rax], 0x4550
je 0x14000e578
mov eax, ecx
ret
cmp word [rax + 0x18], 0x20b
jne 0x14000e56f
movzx ecx, word [rax + 6]
mov eax, ecx
ret

Function at 0x14000e610
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x14114d870]
xor edx, edx
cmp word [rax], 0x5a4d
jne 0x14000e62f
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
je 0x14000e638
mov rax, rdx
ret
cmp word [rcx + 0x18], 0x20b
cmove rdx, rax
mov rax, rdx
ret

Function at 0x14000f270
Capabilities:
Allocate thread local storage
Create thread
Resume thread

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x30
mov rax, qword [0x14114cc80]
mov rsi, r8
mov r8d, dword [rax]
mov rdi, rcx
mov rbp, rdx
test r8d, r8d
je 0x14000f2a0
mov ecx, dword [0x1400bf050]
test ecx, ecx
je 0x14000f320
mov ecx, 0x18
call sub.msvcrt.dll_malloc
xor ecx, ecx
lea r8, [0x14000f230]
xor edx, edx
mov qword [rax], rbp
mov rbx, rax
mov r9, rax
mov qword [rax + 8], rsi
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 4
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rbx + 0x10], rax
mov rcx, rax
test rax, rax
je 0x14000f300
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov rax, qword [rbx + 0x10]
mov qword [rdi], rax
xor eax, eax
add rsp, 0x30
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov rcx, rbx
call fcn.140018870
nop
add rsp, 0x30
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
jmp qword [sym.imp.KERNEL32.dll_GetLastError]
lock add dword [0x1400bf054], 1
jne 0x14000f360
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
cmp eax, 0xffffffff
je 0x14000f390
mov rdx, qword [fcn.140018870]
mov ecx, eax
mov dword [0x1400bf058], eax
call fcn.140018b40
test eax, eax
jne 0x14000f398
mov dword [0x1400bf050], 1
jmp 0x14000f2a0
mov edx, dword [0x1400bf050]
mov r12, qword [sym.imp.KERNEL32.dll_Sleep]
lea rbx, [0x1400bf050]
test edx, edx
jne 0x14000f2a0
nop dword [rax]
xor ecx, ecx
call r12
mov eax, dword [rbx]
test eax, eax
je 0x14000f380
jmp 0x14000f2a0
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x14000f349
call sub.msvcrt.dll_abort
nop
nop
Function at 0x14007e230
Capabilities:
Read file on windows

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
mov r12, qword [sym.imp.msvcrt.dll__errno]
mov rdi, rcx
mov rsi, rdx
mov ebx, r8d
mov rcx, qword [rdi]
call sub.msvcrt.dll__fileno_1
mov ecx, eax
mov r8d, ebx
mov rdx, rsi
call sub.msvcrt.dll__read
movsxd rbp, eax
cmp eax, 0xffffffff
je 0x14007e278
mov rax, rbp
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
call r12
cmp dword [rax], 4
je 0x14007e24a
mov rax, rbp
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret

Function at 0x140092010
Capabilities:
Read file on windows

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x38
mov rax, qword [rcx + 8]
mov rdi, rcx
test rax, rax
je 0x140092038
mov rcx, qword [rcx]
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
jmp rax
mov rbp, qword [sym.imp.msvcrt.dll__errno]
mov ebx, 4
lea rsi, [rsp + 0x2c]
nop dword [rax]
mov ecx, dword [rdi + 0x10]
mov r8d, ebx
mov rdx, rsi
call sub.msvcrt.dll__read
test eax, eax
jle 0x140092080
cdqe
add rsi, rax
sub rbx, rax
jne 0x140092050
mov eax, dword [rsp + 0x2c]
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
ret
cmp eax, 0xffffffff
jne 0x14009208c
call rbp
cmp dword [rax], 4
je 0x140092050
lea rcx, [0x141148b50]
call fcn.1400be8f0
nop
nop
nop
nop
nop
nop
nop
nop
Function at 0x14009ef30
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov qword [rbp + 0x10], rcx
mov dword [rbp - 0x14], 0x80000000
mov dword [rbp - 0x18], 0x7fffffff
mov qword [rbp - 8], 0
jmp 0x14009efc2
mov rax, qword [rbp + 0x10]
mov rdx, qword [rbp - 8]
mov eax, dword [rax + rdx*4]
and eax, 0x80000000
mov ecx, eax
mov rax, qword [rbp - 8]
lea rdx, [rax + 1]
mov rax, qword [rbp + 0x10]
mov eax, dword [rax + rdx*4]
and eax, 0x7fffffff
or eax, ecx
mov dword [rbp - 0x24], eax
mov rax, qword [rbp - 8]
lea rdx, [rax + 0x18d]
mov rax, qword [rbp + 0x10]
mov eax, dword [rax + rdx*4]
mov edx, dword [rbp - 0x24]
shr edx, 1
xor edx, eax
mov eax, dword [rbp - 0x24]
and eax, 1
test eax, eax
je 0x14009efa9
mov eax, 0x9908b0df
jmp 0x14009efae
mov eax, 0
xor eax, edx
mov ecx, eax
mov rax, qword [rbp + 0x10]
mov rdx, qword [rbp - 8]
mov dword [rax + rdx*4], ecx
add qword [rbp - 8], 1
cmp qword [rbp - 8], 0xe2
jbe 0x14009ef54
mov qword [rbp - 0x10], 0xe3
jmp 0x14009f044
mov rax, qword [rbp + 0x10]
mov rdx, qword [rbp - 0x10]
mov eax, dword [rax + rdx*4]
and eax, 0x80000000
mov ecx, eax
mov rax, qword [rbp - 0x10]
lea rdx, [rax + 1]
mov rax, qword [rbp + 0x10]
mov eax, dword [rax + rdx*4]
and eax, 0x7fffffff
or eax, ecx
mov dword [rbp - 0x20], eax
mov rax, qword [rbp - 0x10]
lea rdx, [rax - 0xe3]
mov rax, qword [rbp + 0x10]
mov eax, dword [rax + rdx*4]
mov edx, dword [rbp - 0x20]
shr edx, 1
xor edx, eax
mov eax, dword [rbp - 0x20]
and eax, 1
test eax, eax
je 0x14009f02b
mov eax, 0x9908b0df
jmp 0x14009f030
mov eax, 0
xor eax, edx
mov ecx, eax
mov rax, qword [rbp + 0x10]
mov rdx, qword [rbp - 0x10]
mov dword [rax + rdx*4], ecx
add qword [rbp - 0x10], 1
cmp qword [rbp - 0x10], 0x26e
jbe 0x14009efd6
mov rax, qword [rbp + 0x10]
mov eax, dword [rax + 0x9bc]
and eax, 0x80000000
mov edx, eax
mov rax, qword [rbp + 0x10]
mov eax, dword [rax]
and eax, 0x7fffffff
or eax, edx
mov dword [rbp - 0x1c], eax
mov rax, qword [rbp + 0x10]
mov eax, dword [rax + 0x630]
mov edx, dword [rbp - 0x1c]
shr edx, 1
xor edx, eax
mov eax, dword [rbp - 0x1c]
and eax, 1
test eax, eax
je 0x14009f091
mov eax, 0x9908b0df
jmp 0x14009f096
mov eax, 0
xor edx, eax
mov rax, qword [rbp + 0x10]
mov dword [rax + 0x9bc], edx
mov rax, qword [rbp + 0x10]
mov qword [rax + 0x9c0], 0
nop
add rsp, 0x30
pop rbp
ret
Function at 0x14009f0c0
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov qword [rbp + 0x10], rcx
mov dword [rbp + 0x18], edx
mov eax, dword [rbp + 0x18]
mov ecx, eax
call fcn.1400b1fc0
mov rdx, qword [rbp + 0x10]
mov dword [rdx], eax
mov qword [rbp - 8], 1
jmp 0x14009f138
mov rax, qword [rbp - 8]
lea rdx, [rax - 1]
mov rax, qword [rbp + 0x10]
mov eax, dword [rax + rdx*4]
mov dword [rbp - 0xc], eax
mov eax, dword [rbp - 0xc]
shr eax, 0x1e
xor dword [rbp - 0xc], eax
mov eax, dword [rbp - 0xc]
imul eax, eax, 0x6c078965
mov dword [rbp - 0xc], eax
mov rax, qword [rbp - 8]
mov ecx, eax
call fcn.1400b1ff0
add dword [rbp - 0xc], eax
mov eax, dword [rbp - 0xc]
mov ecx, eax
call fcn.1400b1fc0
mov rdx, qword [rbp + 0x10]
mov rcx, qword [rbp - 8]
mov dword [rdx + rcx*4], eax
add qword [rbp - 8], 1
cmp qword [rbp - 8], 0x26f
jbe 0x14009f0e9
mov rax, qword [rbp + 0x10]
mov qword [rax + 0x9c0], 0x270
nop
add rsp, 0x30
pop rbp
ret

Function at 0x14009f190
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov qword [rbp + 0x10], rcx
mov rax, qword [rbp + 0x10]
mov rax, qword [rax + 0x9c0]
cmp rax, 0x26f
jbe 0x14009f1bb
mov rax, qword [rbp + 0x10]
mov rcx, rax
call fcn.14009ef30
mov rax, qword [rbp + 0x10]
mov rax, qword [rax + 0x9c0]
lea rcx, [rax + 1]
mov rdx, qword [rbp + 0x10]
mov qword [rdx + 0x9c0], rcx
mov rdx, qword [rbp + 0x10]
mov eax, dword [rdx + rax*4]
mov dword [rbp - 4], eax
mov eax, dword [rbp - 4]
shr eax, 0xb
xor dword [rbp - 4], eax
mov eax, dword [rbp - 4]
shl eax, 7
and eax, 0x9d2c5680
xor dword [rbp - 4], eax
mov eax, dword [rbp - 4]
shl eax, 0xf
and eax, 0xefc60000
xor dword [rbp - 4], eax
mov eax, dword [rbp - 4]
shr eax, 0x12
xor dword [rbp - 4], eax
mov eax, dword [rbp - 4]
add rsp, 0x30
pop rbp
ret

Function at 0x1400a3450
Capabilities:
Get system information on windows

Disassembly:
push rsi
push rbx
sub rsp, 0x38
mov rbx, rdx
mov rax, qword [0x14114cc80]
mov eax, dword [rax]
test eax, eax
je 0x1400a33ee
mov r8, qword [rdx]
lea rdx, [0x1400be190]
call fcn.14000f270
test eax, eax
jne 0x1400a33e7
mov qword [rbx], 0
add rsp, 0x38
pop rbx
pop rsi
ret
mov ecx, eax
call fcn.1400bee10
mov ecx, 0x20
call fcn.1400bd670
mov rbx, rax
call fcn.14009f570
lea rdx, [rsp + 0x20]
lea r8, [0x141148da8]
mov rcx, rbx
mov qword [rsp + 0x20], 1
mov qword [rsp + 0x28], rax
call fcn.14007f4b0
lea r8, [fcn.14007fd30]
lea rdx, [0x1411504a0]
mov rcx, rbx
call fcn.1400bdef0
mov rsi, rax
mov rcx, rbx
call fcn.1400bd980
mov rcx, rsi
call fcn.14000ef90
nop
nop
nop
nop
nop
sub rsp, 0x58
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [rsp + 0x40]
xor edx, edx
test eax, eax
cmovs eax, edx
add rsp, 0x58
ret

Function at 0x1400bd9d0
Capabilities:
Allocate thread local storage
Get thread local storage value
Set thread local storage value

Disassembly:
lea rcx, [0x1400c2200]
jmp 0x14000f680

Function at 0x1400bd9e0
Capabilities:
Allocate thread local storage
Get thread local storage value
Set thread local storage value

Disassembly:
lea rcx, [0x1400c2200]
jmp 0x14000f680
Function at 0x140147bf4
Capabilities:
Execute anti-debugging instructions

Disassembly:
inc cx
jne 0x14016fba3
shl rdx, 0xed
mov byte ss:[rax + rcx*8 - 0x24000], bpl
or cx, cx
mov qword [rsp + rdi - 0x4827], r11
ret 8

Function at 0x140148530
Capabilities:
Execute anti-debugging instructions

Disassembly:
sub rsp, 0x18
call fcn.14015741f
shl r8b, 0x81
adc r11, rcx
btr edx, edi
or rdi, r9
bswap eax
lea r9, [r9 + rdx*8 - 0x40000004]
movsx esi, r8w
mov ecx, esi
or rcx, rbp
mov dword [r9 + rdx*4 - 0x20000000], edi
cdqe
ja fcn.14015c1e0
bt r8, 6
add r8b, dl
mov cl, byte [rdi + r9 + 7]
imul r8, rsi
jno 0x140172bd4
mov eax, 0x50b30293
lea r10, [r10 + rax - 0x50b30297]
movsx ecx, ax
movzx r8d, cx
mov r8d, dword [r10 + rax - 0x50b30293]
cdq
movsx ebp, al
xor r8d, ebx
not r8d
ror r8d, 1
rol cl, 0x42
jae 0x140160597
inc edx
rol rsi, cl
bswap edx
bts rax, 0x39
dec byte [rsp + 4]
not edx
neg si
adc rcx, rax
or r8, rdi
xor edx, 0xeb12af2a
bt ebp, ebp
shr byte [rsp + 6], 0x84
bswap edx
cdqe
neg al
mov qword [rsp + rax - 0x482d1788], rbx
neg bpl
xor dword [rsp + rax - 0x482d1788], edx
div al
push rbp
mov rbx, qword [rsp + rax - 0x482d2824]
lea rax, [r8 + rax*2 + 0xdb8ffb5]
call fcn.14015bcc5
mov r8d, 0xa2b15510
sar r8b, 0xc1
mov eax, dword [r9 + riz]
mov ecx, dword [r9 + riz + 4]
movsx edi, r8w
movzx edx, di
seto dl
push rbx
sar r8d, 0xcc
cpuid
lea r9, [rdi + r9 - 0x5510]
mov dword [rdi + r9 - 0x54fc], eax
and rdi, r8
sal r8, 0xb6
mov dword [r9 + rdi - 0xf8], ebx
xadd r8, rdi
mov dword [r9 + riz + 4], ecx
mov dword [r9 + riz], edx
mov esi, 0x272d5607
movzx ebx, si
pop rbx
movsx eax, sil
lea r10, [r10 + rsi*2 - 0x4e5aac12]
movsx edx, si
call fcn.140176d13
mov edi, 0xab22c701
bt di, di
mov esi, edi
sbb r10, 4
call fcn.140155340
sar cx, cl
inc r8d
sal edx, 0x65
movsx edi, al
setne dl
not r8d
inc r8d
or ebp, ebp
add eax, 0xfd9bd729
not dx
push rbx
sar rdx, 0xf1
xor dword [rsp + rcx], r8d
lea rbx, [rcx + rcx*8 + 0x11bb72b4]
and bx, 0x910e
call fcn.14014fbb7
xor r8d, ebx
dec r8d
mov edx, ebp
and word [rsp + rcx - 0xea26], cx
ror r8d, 3
neg r8d
dec r8d
mov qword [rsp + rcx*2 - 0x1d458], rbx
xchg dword [rsp + rcx - 0xea2e], edi
xor dword [rsp + rdi*2 - 0x1d45a], r8d
mov rbx, qword [rsp + rdi - 0xea29]
cbw
call fcn.140167a02
rol edx, 2
pop rcx
jmp 0x14015e1b9
lea r9, [r9 + rdi + 1]
rol dil, 0x67
imul dx, r8w
shl rax, cl
ror dil, 0xe1
movzx ecx, dl
sal edx, cl
mov qword [r9 + rdi - 0x40], rax
movsx eax, bpl
sal edx, cl
jmp r11

Function at 0x140150907
Capabilities:
Authenticate hmac

Disassembly:
dec cx
rol cx, 1
movzx edi, ax
sub cx, 0xb19e
sal qword [rsp + r8 - 0xea43], 0x1b
neg dword [rsp + r8*2 - 0x1d486]
not cx
ror cx, 1
sub rdx, rbp
not cx
xor bx, cx
add word [rsp + rax - 0x4120ffb1], 0x651e
cbw
lea r9, [r9 + r8*8 - 0x7521a]
mov word [r9 + rax - 0x4120ffb1], cx
movsx ecx, byte [rsp + rax - 0x4120ffb0]
pop rsi
jg fcn.14015c1e0
mov qword [rsp + rcx - 0x412082b0], r8
xor dword [rsp + rax - 0x4120ffa9], edi
mov rbx, qword [rsp + rcx - 0x412082a8]
mov qword [rsp + r8 - 0xea3b], rcx
pop rsi
movsx ebp, si
movsxd rdi, edi
add r11, rdi
btr rax, 3
lea r10, [r8 + r10 - 0xea45]
movzx ecx, word [rcx + r10 - 0x412082b0]
xor cx, bx
jmp 0x14014e5a1
Function at 0x140150bd0
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea r10, [r10 + rbp - 0xa4]
movzx eax, byte [r10 + rbp - 0xa3]
inc edi
mov qword [rsp + rbp - 0xa3], 0xffffffffab13d439
xor al, bl
push rbp
and rbp, 0xffffffffcd251d99
rol al, 1
sar byte [rsp + rbp - 0x7f], 0x61
neg al
bts rbp, rdi
jae 0x14014a349

Function at 0x140150d83
Capabilities:
Authenticate hmac

Disassembly:
lea rsp, [rsp + 0x20]
jbe 0x140150da8
mov edx, 0xc10b492e
and edx, 0x2500009a
mov ecx, edx
lea edx, [rcx - 0x1000006]
lea ecx, [rbx + rcx - 0x100000e]
mov eax, 0xcea93623
lea rax, [rax + rax*2 - 0xfcb52d0]
shl ecx, 3
sal edx, 3
mov rax, rbp
push 0xffffffffa2bc9431
add rax, rdx
neg byte [rsp + 6]
mov qword [rbp + riz - 8], rax
lea rsp, [rsp + 8]
mov qword [rbp + riz - 0x10], rsp
sub rsp, rcx
and rsp, 0xfffffffffffffff0
add rsp, rcx
push 0x30824325
test ebx, ebx
push 0xfffffffffd243409
push 0x2b177c2d
lea rsp, [rsp + 0x18]
je 0x1401695fb
mov eax, 0x2297d233
or al, 0x21
neg ax
mov rax, qword [rbp + rbx*8]
jbe 0x140163c10
sub r10, r8
btc di, si
cqo
add ecx, eax
adc dl, byte [r10 + rdx*2]
xor dl, bl
xor dl, dil
mov qword [rsp + rax*2 - 0x17c08], r8
rol cl, 0x81
movsx ebp, di
sbb dl, 0x30
rol dl, 1
sub dl, 0x86
dec edi
sub bpl, cl
inc r8b
neg dl
xor bl, dl
dec dword [rsp + rdi - 0x560ec909]
btc r8w, r8w
rol dword [rsp + rax*8 - 0x5f04d], cl
lea rdx, [rsp + rdx + 0x18]
ror ebp, 0xf4
bts esi, 0x19
mov rcx, qword [rdx + rdi - 0x560ec915]
sbb rbp, 0xffffffff8c3012a0
push rsi
lea r9, [r9 + rax*2 - 0x17c20]
add ebp, 0x95224f92
mov dword [rsp + rsi*2 - 0x4000144], 0x61be0f8a
mov qword [r9 + rax - 0xbe0c], rcx
jbe 0x14016e671
lea r9, [rax + r9 + 1]
or qword [rsp + rax*2 + 3], rax
xadd qword [rsp + rax*2 + 2], rbp
sar r8d, 0xf1
shl rdx, cl
sal word [rsp + rax + 6], 0xb
not eax
mov qword [r9 + riz], rdx
shr rax, 0xc5
mov ecx, r8d
bt rax, 8
mov qword [rsp + rax - 0x7ffffff], r11
ret 8
sub rsp, 0x20
call fcn.140171369
cmp ebx, 4
call fcn.14015a0a0
mov eax, 0xb707c8bf
mov rax, qword [rbp + riz]
jmp 0x14015a6c7
lea rcx, [rax + rbp - 0x66c435c8]
adc byte [rsp + rdi - 0x560ec90e], 0x20
pop rax
pop r8
pop rdi
pop rax
jae fcn.14015c1e0

Function at 0x14015112e
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea rsp, [rsp + 0x18]
jne 0x1401533c1
mov r9d, 0x3cb6508e
mov r9, rax
call fcn.14016dc72
mov eax, 0xd81adea7
mov rax, qword [rbp + rbx*8 + 0x20]
push rax

Function at 0x14015209c
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov qword [rsp + rax*2 + 0x56d9ffc4], r8
mov r8, qword [rsp + rax*2 + 0x56d9ffdc]
call fcn.140173fb3

Function at 0x1401520b1
Capabilities:
Execute anti-debugging instructions

Disassembly:
sal edx, 3
sar eax, 0x73
mov rax, rbp
jbe 0x1401627fa
js 0x140171228
sar byte [rsp + rdx*4 + 6], 1
sbb cx, 0x2b8e
xor cx, dx
dec byte [rsp + rdx + 1]
push rdx
mov byte [rsp + rdx*2 + 5], bpl
rol cx, 1
pop rsi
neg cx
cwde
ror cx, 1
xor bx, cx
sal rbp, 0xc
bswap rbp
lea rcx, [rsp + rcx + 8]
xadd sil, bpl
and bpl, byte [rsp + rdx + 4]
cbw
mov eax, dword [rdx + rcx + 1]
neg ebp
inc edx

Function at 0x14015854b
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea rsp, [rsp + 0x20]
je 0x14015f6c6
Function at 0x14015c764
Capabilities:
Execute anti-debugging instructions

Disassembly:
rol ecx, 3
mov qword [rsp + rdi], r8
inc ecx
pop rax
or r8w, 0xec10
btc rdx, 0x1b
push rbx
movzx ebx, al
xor dword [rsp + rdi*2], ecx
pop rbx
movsxd rcx, ecx
ror r8b, 0xa4
jae 0x14014853c

Function at 0x14015cea8
Capabilities:
Execute anti-debugging instructions

Disassembly:
and dword [rsp + 0xc], esi
movzx eax, sil
xor ecx, ebx
movsx ebp, di
pop rdx
xor ecx, 0x28101cbb
or bpl, sil
bts ebp, eax
jb 0x140167bc8
lea ecx, [rcx + rbp - 0x42ddeb7f]
neg ecx
rol ecx, 1
mov edx, eax
mov byte [rsp + rax - 0x92], bpl
and qword [rsp + rax*2 - 0x12a], rsi
mov qword [rsp + rax*4 - 0x254], rbx
xor dword [rsp + rax - 0x95], ecx
sub si, dx
pop rbx
lea r8, [rbp*8 + 0x7028a714]
sal rdx, 0x32
setnp r8b
movsxd rcx, ecx
adc r11, rcx
jmp r11

Function at 0x14015e140
Capabilities:
Execute anti-debugging instructions

Disassembly:
not bp
ror bp, 1
push rcx
not bp
call fcn.1401782e5
mov edx, 0x6a2ea826
lea r10, [rdx + r10 - 0x6a2ea82a]
movsx ecx, dx
mov r8d, dword [r10 + rdx - 0x6a2ea826]
movsx edi, dx
sal cl, cl
movzx eax, dl
xor r8d, ebx
not r8d
bt cx, cx
movzx esi, dx
lea rbp, [rdx + rcx*4 + 0x232b0310]
sbb r8d, 0xa43cf8a7
not r8d
neg r8d
not r8d
neg rcx
xchg edi, eax
xor r8d, 0x34366610
inc edi
add cl, al
push rbx
xor dword [rsp + rdx - 0x6a2ea826], r8d
pop rbx
cwd
sal di, 0x68
jae 0x14016be81
movzx ecx, sil
mov cl, byte [rcx + r9 - 0xa9]
lea r9, [rsi + r9 - 0x751298ab]
shl edi, cl
ror si, 0x2f
lea rcx, [rsi + rsi - 0x60fdf07d]
sar esi, cl
mov dword [rsi + r9 - 0x3a], edi
movsx ebp, sil
lea r10, [rsi + r10 - 0x3e]
mov r8d, dword [rsi + r10 - 0x3a]
btr bp, 0xbb
xor r8d, ebx
neg r8d
sub esi, ecx
movzx eax, bpl
lea r8d, [r8 + rbp - 0x980dacd]
neg rbp
call fcn.140149d7f
movsxd r8, r8d
adc r11, r8
mov r8d, 0xc1185bb8
push r8
mov esi, dword [r9 + rdx - 0x6a2effff]
mov cl, byte [r9 + rdi*2 - 0x4dfc]
and edi, 0x6b96a08c
call fcn.140172b80
mov edi, dword [r9]
mov esi, 0x751298ad
jmp 0x14016bc4b

Function at 0x14015f577
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov r8d, 0x541e1c2b
mov cx, word [r8 + r9 - 0x541e1c2b]
mov qword [rsp + r8 - 0x541e1c2b], r8
lea rax, [r8 + 0x34303098]
lea r9, [r8 + r9 - 0x541e1c29]
pop rdi
shl r8b, 5
lea r10, [r10 + rdi - 0x541e1c2c]
cbw
call fcn.14016fa9c
mov ecx, 0xb5bb5a3e
sub r10, 4
bt cx, cx
mov edx, dword [r10 + riz]
mov ebp, ecx
movzx edi, bpl
xor edx, ebx
mov eax, 0x5cbbf795
inc edx
xor edx, 0xc3f4916
ror eax, 0x8d
ror cl, 4
xadd di, ax
lea edx, [rcx + rdx - 0x4090b33d]
movzx esi, cx
call fcn.140176e56