joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140613615
Capabilities:
Resolve function by parsing pe exports

Disassembly:
not dword [rsp + 0x10]
neg r14
add qword [rsp + 0x18], 0x1c394
sub edx, dword [rsp + 0xb]
test qword [rsp + 0x40], 0x339a136c
cmovo r15, rdx
jb 0x140af9b0c
and qword [rsp + 8], 0x7ea46d5a
call fcn.14060babd
push 0x7b
je 0x1406136a1
invalid
invalid
xor ecx, 0x2121148b
cmp r15w, 0x24e4
push rbp
bswap r15
movabs rdi, 0x78c52e7d3cad2042
mov rbp, r10
setg r15b
and ecx, r10d
sub rdi, 0x4fd0c9d
je 0x140bb9d49
and cl, 0xc7
push rbp
call fcn.140c1e258
add byte [rax], al
and dword [rax], ebx
invalid
mov rdi, qword [rsp + 0x60]
xor r10d, 0x3d343507
not bp
or bpl, 0x36
xor qword [rsp + 8], r13
cmp r14w, 0x30bc
lea rcx, [rbx + r14 + 0x6ad61ede]

Function at 0x14062560f
Capabilities:
Execute anti-debugging instructions

Disassembly:
ja 0x140c1d786
sub word [rsp + 0x60], 0x21a5
add dword [rsp + 0x60], 0x6cc61b23
sub qword [rsp + 0x60], 0x15ef3943
mov word [rsp + 0x60], 0x4bbb
not qword [rsp + 0x60]

Function at 0x14062b05b
Capabilities:
Execute anti-debugging instructions

Disassembly:
test r15b, r8b
push r13
push r15
mov dil, 0x38
jo 0x140633e44
mov r15, qword [rsp + 0x48]
mov qword [rsp + 0x48], 0x7ab5ac67
movabs r13, 0xb111e1d14a554b6
neg rdi
bswap r8
push r14
push 0x19f30e9a
mov r14, r13
setb r8b
not byte [rsp]
lea rdi, [r14*2 + 0x1ff94837]
jge 0x14064074c
mov r13w, word [rsp + 2]
and r8w, 0x6bb3
sete r13b
push rbp
xor word [rsp + 8], r8w
not r8w
setle byte [rsp + 0x18]
mov r13, qword [rsp + 0x20]
cmp word [rsp + 0x18], 0x6838
not r8w
call fcn.140604a84
test r15, 0x16c4ce0
push rdi
lea r15, [r15*2 + 0x7fe61cdb]
push r8
call fcn.140b6c75a

Function at 0x14063f9d7
Capabilities:
Execute anti-debugging instructions

Disassembly:
jne 0x140be8622
mov rcx, qword [rsp + 0x60]
movzx edx, r15b
not dl
call fcn.140b19ab7
sub edi, 0x79
sbb esi, dword [rax + 0x47f01ec6]
xor eax, 0x9bbd8112
push r11
movabs r11, 0x425214755a6611b5
not r11b
pushfq
test r11w, r11w
jg 0x140c1e4a7

Function at 0x140689c35
Capabilities:
Resolve function by parsing pe exports

Disassembly:
setne r11b
test r11, 0x76637dd8
push rbx
push rdx
movabs rdx, 0x504d3a73334176c5
call fcn.140bba09f
add qword [rsp + 0x20], 0xffffffffffa5f11e
not rbx
neg r15
neg dl
jae 0x14060bb22
bswap ebx
add dl, 0x4c
call fcn.140af6578

Function at 0x140689c56
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov r13b, 0xbd
not dword [rsp + 8]
push r14
mov r14, r10
movzx r9, bpl
push r9
jae 0x140b9824f
call fcn.140be861c
xlatb
scasb al, byte [rdi]
push 0xffffffffd6632447
mov dl, byte [0x121d4cf94]
mov bh, 0x50
and byte [rcx - 0x15], 0x63
mov al, 0xb7
push rcx
test eax, 0xab0d1af0
insd dword [rdi], dx
cmc
invalid
Function at 0x140af6492
Capabilities:
Execute anti-debugging instructions

Disassembly:
jb 0x140b1b716
cmp rcx, 0x57d25ec6
jae 0x140be48a4
or word [rsp + 0x50], bx
add cx, 0x4a6a
cmp r15b, 0xf2
setl byte [rsp + 0x50]
and ecx, dword [rsp + 0x54]
mov rcx, qword [rsp + 0x20]
bswap rbx
or r15, 0x2861378f
xor r15d, ebx
cmp dword [rsp + 0x50], 0x79935123
not r9d
setns r15b
add qword [rsp + 0x18], 0x7302f
not r9w
not r15b
not rbx
cmp byte [rsp + 0x50], 0x3f
not r15b
mov qword [rsp + 0x50], 0x4a793a12
cmovg rbx, r15
setg r15b

Function at 0x140af9be3
Capabilities:
Execute anti-debugging instructions
Resolve function by parsing pe exports

Disassembly:
ja 0x140bc84ef
jo 0x140c0993c
or byte [rsp + 0x48], 0x9d
not dword [rsp + 0x48]
add byte [rsp + 0x48], 0x84
mov qword [rsp + 0x48], 0x39944bf8
or word [rsp + 0x48], 0x1a20
cmp byte [rsp + 0x48], 0x35
setge byte [rsp + 0x48]
cmp qword [rsp + 0x48], 0x5f2346c9
seto byte [rsp + 0x48]
xor word [rsp + 0x48], 0x7b80
setle byte [rsp + 0x48]
cmp dword [rsp + 0x48], 0x6b5e1a33
push qword [rsp + 0x60]
popfq
lea rsp, [rsp + 0x70]
call fcn.140cc6afe
mov gs, ecx
sbb r12, qword [r9 + 0x4be520e1]
xor ecx, dword [rdi]
movsd dword [rdi], dword [rsi]
mov dh, 0xe2
sub esi, edi
out dx, eax
cmp bh, byte [rbx]
adc esp, eax
pinsrw mm4, eax, 0xc6
and dh, byte [rsp + rax*8 + 0x1392b36b]
cmp ecx, esp
clc
cmp r14d, dword [rbp + 0x3b350554]
leave
invalid

Function at 0x140afe646
Capabilities:
Encode data using xor

Disassembly:
call fcn.140c113c3
movsd dword [rdi], dword [rsi]
cld
push rdx
jle 0x140afe698
pop rcx
invalid
sub dl, dh
mov ch, 0xdf
nop dword [rdi]
imul ebp, dword [rbx + 0x31888642], 0x866ac06e
fnstenv [rbp - 0x64eed018]
je 0x140afe6cf
invalid
adc dword [rbx - 0xf9acc8c], ebx
mov edi, 0xea3c5ba6
xchg edi, eax
adc al, ah
pop rcx
sahf
xor al, 0xbc
std
cmp dl, byte [rsi]
enter 0xffffffffffff8998, 0x19
and ebx, 0x2e6689b1
in eax, 0x55
pop rdx
cli
out dx, eax
psllq mm3, qword cs:[rdi]
jnp 0x140afe683
invalid
xchg edi, eax
retf 0x2ea6
ja 0x140afe689
invalid

Function at 0x140b06519
Capabilities:
Execute anti-debugging instructions

Disassembly:
cmp r9b, byte [rsp + 0x31]
lea rsp, [rsp + 8]
ret
mov r9, qword [rsp + 0x28]
add qword [rsp], 0xfffffffffffa9d6d
not r8w
and r11w, 0x79c3
push rcx
sub r9, 0x56ff32d3
movabs rdi, 0x7cbf1243272270f4
push r9
pop rbp
and r11b, r8b
jle 0x140628b10
Function at 0x140b0ef6e
Capabilities:
Encode data using xor

Disassembly:
not edi
mov rbx, rdi
or bx, di
test ebx, 0x20a354d5
cmovns r9w, di
or rdx, 0x6f8e66cb
setge dl
lea rdi, [rdx + rbx + 0x4f522d96]
setae bl
sub dil, r9b
neg dl
call fcn.140b57e4e
mov r11b, 0xd5
not r15b
mov r15b, 0xa8
js 0x140b15f67
push r15
movzx r11d, word [rsp]
test r15d, 0x28ce7cb3
jns 0x140b63155
or dl, byte [rcx]
jg 0x140b0f006
lodsd eax, dword [rsi]
cmpsb byte [rsi], byte [rdi]
sbb al, byte [rbx + 0x19cc4485]
outsd dx, dword [rsi]
invalid
cmp esp, edi
invalid
in al, dx
stosd dword [rdi], eax
stosd dword [rdi], eax
mov edi, 0x95375ee0
jno 0x140b0efb7
sub dword [rbx + 0x7b546f60], ebp
invalid
push qword [rsp + 0x10]
popfq
lea rsp, [rsp + 0x28]
call fcn.140c7b265
mov r9, qword [rsp + 0x28]
mov ebx, 0x159231dd
xor edi, ebx
and dil, dl
sub bx, dx
add dl, 0xd5
jb 0x14063e4b7
lea rbx, [rbx*8 + 0x6b5a2c5a]
test di, 0x3e39
call fcn.140b8d570
mov r11, qword [rsp + 0x20]
xor r13b, byte [rsp + 1]
xor r13, r15
cmp sil, byte [rsp]
movzx esi, r13w
not r13w
mov r15d, esi
lea r15, [r15 + r15*8 + 0x50060766]
mov sil, byte [rsp + 6]
sete r13b
not qword [rsp]
add qword [rsp + 8], 0xffffffffffa5cfb2
not r15b
lea rsi, [rsi + rsi*4 + 0x417b5df4]
and esi, esi
jo 0x140b6315f
sub byte [rsp], 0x5d
or r13w, word [rsp + 4]
bswap r13d
lea r13, [r13 + 0x3a3f4cab]
mov r15, qword [rsp + 0x38]
and r13w, word [rsp + 4]
lea rsi, [r13*4 + 0x4bcf3e61]
mov r13w, word [rsp + 6]
and esi, dword [rsp + 4]
neg rsi
not sil
and dword [rsp], 0x264e35d2
add esi, dword [rsp + 1]
or r13b, byte [rsp + 1]
setle sil
lea r13, [r13 + rsi*8 + 0x215308a4]
movsx si, r13w
add qword [rsp], 0x70041877
cmp r13b, byte [rsp + 1]
lea r13, [rsi + rsi*2 + 0x6b481f4f]
lea rsi, [r13 + r13*8 + 0x6a771c7d]
call fcn.140b68f79
add eax, 0x1a8a4d61
fcmovbe st(0), st(4)
call 0xe444e1b7
cwde
mov dh, byte [rdi + 0x7579d0ad]
mov dh, 0x7f
invalid

Function at 0x140b35594
Capabilities:
Execute anti-debugging instructions
Resolve function by parsing pe exports

Disassembly:
jno 0x140beacce
not dword [rsp + 0x28]
xor dword [rsp + 0x28], 0x1485484
add dword [rsp + 0x28], 0xd0f3291
add word [rsp + 0x38], 0x48dd
not dword [rsp + 0x40]
not r12

Function at 0x140b4587e
Capabilities:
Execute anti-debugging instructions
Resolve function by parsing pe exports

Disassembly:
test r15w, 0x70e9
ja 0x140b3d647
Function at 0x140b5b14a
Capabilities:
Execute anti-debugging instructions
Resolve function by parsing pe exports

Disassembly:
call fcn.140ba45b0
or r10d, 0x60a00d53
lea rdi, [r14 + r15 + 0x4dce18d4]
seta byte [rsp + 0x48]
neg r13d
neg r10d
jbe 0x140bb9fc4
call fcn.14063a9f1
movsx bp, word [rsp + 0x39]
jb 0x140ba0d48
and cl, r11b
jae 0x140bbaecd
invalid
sub rcx, 0x254c6cd6
not cl
mov rbx, qword [rsp + 0x20]
movabs r11, 0x68da661456830892
jg 0x140ba0d56
setbe bpl
test ecx, r11d
bswap rcx
call 0x140b5b14a
push rcx
call fcn.140b86c0f
add byte [rcx], al
add byte [rax], al
add byte [rax - 0x45], cl
cmpsd dword [rsi], dword [rdi]
imul qword [rcx + 0x76]
pop rax
mov al, 0x7b
or rsi, r12
setb r14b
add qword [rsp + 0x28], 0xffffffffffae3e65
bswap r12d
sub r12, 0x796819ab
add esi, r15d
not bx
lea rbx, [rbx*8 + 0x1ac5140f]
add r13b, 0xd2
add r13b, sil
jo 0x140c09e06
jg 0x140ba0e17
add al, 0xba
ja 0x140ba0e35
or al, 0xfb
xor al, 0x15
sbb al, 0xf3
test byte [rcx - 0x79], al
mov esi, 0x2e097b0c
mov ebp, 0x4f4b84f3
out dx, al
mov byte [rbx + rsi*4], 0x92
push rcx
or bh, byte [rbx - 0x19]
invalid
test byte [rdx - 0x1e], al
test dword cs:[rbx + rbx*4], 0x7b083949
invalid
xchg esi, eax
not byte [rax + rcx*4 + 0x36b6bf0d]
push rsp
invalid
xor rdi, qword [rsp + 0x40]
jl 0x140c1ffe7
add bp, r11w
neg cl
not r11
neg bpl
call fcn.1406095f1

Function at 0x140b659b2
Capabilities:
Execute anti-debugging instructions
Resolve function by parsing pe exports

Disassembly:
sahf
or dword [rax], eax
enter 0x99e, 0
invalid
jae 0x140bedb88
mov esi, 0xa11844ef
fimul dword [rbp - 0xe]
call 0x12954baf9
jb 0x140af9b59
and byte [rax], r9b
xchg dword [rax - 0x8c2a73c], esi
sahf
xchg al, dl
or ecx, edx
or eax, 0x4a932a82
cmc
jmp 0x140af9b5c
lea rcx, [rcx + rcx*2 + 0x8045d2d]
mov dword [rsp + 8], 0xefd1cb5
not word [rsp + 8]
movzx rcx, cx
push rbx
movabs rbx, 0x7d2136cf6954780f
je 0x140af9b93
movsx cx, word [rsp + 0x15]
cmp bl, 0x2d
je 0x140bbaed3
cmp cx, word [rsp + 0x14]
call fcn.140b57207

Function at 0x140b69ca1
Capabilities:
Execute anti-debugging instructions

Disassembly:
xor ecx, ebp
je 0x140b69cc2
setae cl
and rcx, 0x5d897acf
xor dword [rsp + 8], 0x79927fdc
xor cx, cx
mov cx, 0x2643
cmova bp, word [rsp + 0xd]
test dword [rsp + 0xb], ebp
not cl
call fcn.14067f344
jb 0x140bf3a3a
je fcn.140622cac
popfq
call fcn.1405fe809
mov ecx, 0xa2045af4
int 0x3f
xchg ebp, eax
jne 0x140bf02a0
push rax
invalid
Function at 0x140b69cd9
Capabilities:
Execute anti-debugging instructions

Disassembly:
and dword [rsp + 0x48], 0x6a726522
neg bl
bswap ebp
add qword [rsp + 0x10], 0xffffffffbf3dc601
mov ebx, dword [rsp + 0x48]
xor qword [rsp + 0x48], 0x3b6c51d5
or ebx, 0x4c0018a
sub r12, rbx
xor bl, 0x76
test r12w, di
setle bl
sub byte [rsp + 0x48], 0x9f
movzx di, word [rsp + 0x48]
movsxd r15, dword [rsp + 0x48]
cmovg r15, qword [rsp + 0x48]
xor word [rsp + 0x48], 0x7fb4
add qword [rsp + 0x38], 0x6259b6
lea rbp, [rbp + rbx*4 + 0x43110c76]
mov rdi, qword [rsp + 0x90]
call fcn.1405fa007
or dword [rsp + 0x58], r10d
not r15w
and qword [rsp + 0x58], 0xec81cc3
neg qword [rsp + 0x40]
lea r8, [r15 + r10*8 + 0x56f270ff]
bswap r10d
cmp dword [rsp + 0x88], 0x26b52b39
jns 0x140b4a846
add qword [rsp + 0x88], 0xcdc1dae
mov qword [rsp + 0x88], 0x697f3145
neg qword [rsp + 0x88]
lea r15, [r10 + r15*8 + 0x4c1975b6]
test dword [rsp + 0x42], r8d
mov r8, qword [rsp + 0x50]
seta r10b
jne 0x140b183f3
setbe r12b
or r12b, dil
neg r15b
jb 0x140b60e58
call fcn.140b00350
add qword [rsp + 8], 0xffffffffffaff42f
movsx r8w, word [rsp + 0x30]
sub word [rsp + 0x78], 0x28d7
cmp byte [rsp + 0x30], r15b
call fcn.140b89068
lodsb al, byte [rsi]
jmp 0x140b4a8b2
lea esp, [rsp + 0x78]
jg 0x140be5def
setbe r15b
sub r15b, byte [rsp + 0x5a]
jl 0x14062c0a7
bswap ebx
movsx bx, r12b
movabs rbx, 0x1608500c4eb45dd5
jno 0x1405fa015
and ebp, dword [rdi + 0x7d]
sbb al, 8
sar byte [rbx - 0x79], 1
jrcxz 0x140b60eb8
cmp esp, dword [rdi + 0x7faae3d0]
in al, dx
movabs eax, dword [0xdc51c93ce52f6e3]
outsb dx, byte [rsi]
sub dword [rsp + rax*8], ebx
xor dword [rcx], ebx
pop rcx
sbb al, 8
adc ch, byte [rdx - 0x48]
jrcxz 0x140b60e80
add byte [rsi + rcx*2 + 0x5d9a531c], bh
pop rsp
sbb al, 0x3f
loop 0x140b60eac
push 0xffffffffcb2f75e3
shl ebx, cl
mov cl, byte [rdx + 0x7b]
je 0x140b60ecb
jnp 0x140b60f22
sbb al, 0xd5
shl dword [rdi + 0x75881c23], 0xec
push rdx
invalid
sbb al, 0x20
mov al, 0xce
invalid
sbb al, 0xdf
or bh, byte [rbp + rdi*4 + 0x4a4c55e3]
push rdx
cli
adc byte [rcx], ah
sub al, 0xa3
sti
jge 0x140b60e6f
cmp byte [rbp + riz*4 - 0x68], al
loop 0x140b60f31
sbb al, 0x5f
test eax, 0x8cfa1baf
out 0xc7, al
cmp al, 0xe5
lodsb al, byte [rsi]
cli
invalid
cdq
out dx, eax
stosd dword [rdi], eax
in al, 0xdf
invalid
fmul qword [rcx]
pop rax
invalid
mov si, word [rsp + 0x20]
mov rdi, qword [rsp + 0x38]
mov qword [rsp + 0x38], 0x53493f80
movsx r13d, sil
js 0x140b54a71
sub r13d, dword [rsp + 0x24]
or byte [rsp + 0x20], 0x10
movsxd rsi, esi
mov r10, rsi
not r13d
jge 0x140b70af9
jle 0x140b4a82f

Function at 0x140b6b3b3
Capabilities:
Execute anti-debugging instructions

Disassembly:
cmovbe bp, word [rsp + 0x1a]
movabs rdx, 0x5fa97b1011c974bf
push rdx
mov rbp, qword [rsp + 0x38]
mov qword [rsp + 0x38], 0x28185957
sub dl, byte [rsp + 0x27]
jl 0x140b63119
Function at 0x140b73adf
Capabilities:
Encode data using xor

Disassembly:
lea rdi, [r9 + r9*2 + 0x4cfc45cd]
or edi, 0x61d44f30
setge dil
setae dil
call fcn.1405f7de6
mov bh, dh
sub byte [rdx + 0x48fa3ec6], dil
and al, 0x36
xor dword [rdi - 0x1b17d402], 0xf6fff81a
pop rsp
and al, 0x50
movsx r10d, r10w
add qword [rsp + 0x30], 0xfffffffffff02667
add dword [rsp + 0x30], 0xfff02667
xor dword [rsp + 0x18], 0x21b57aa4
add r10w, 0x1236
not byte [rsp + 0x50]
and byte [rsp + 0x40], r14b
mov r14, qword [rsp + 0x28]
neg dword [rsp + 0x10]
cmp byte [rsp + 0x40], r10b
cmovle r10w, word [rsp + 0x55]
sete r10b
call fcn.140689bba
sahf
sal dword [rbx + 0x27], cl
cdq
wait
jg 0x140b73b17
sub eax, 0xb949ee17
imul ebp, dword [rdx + 0x13], 0xb0109e65
add r9d, 0x56521543
add r9d, 0x1502521
bswap r9
movsx r9w, r9b
not r9d
cmp r9b, 0xd5
call fcn.14063482f

Function at 0x140b7b571
Capabilities:
Execute anti-debugging instructions
Resolve function by parsing pe exports

Disassembly:
call 0x140b7b571
or r15, qword [rsp + 0x30]
mov rcx, qword [rsp]
lea r8, [r14*4 + 0x70a73376]
lea r14, [r8*2 + 0x1ca64b71]
sub r14, r9
mov r9, qword [rsp + 0x40]
add qword [rsp + 0x10], 0x582152
add r14d, 0x52c044d0
movabs rdi, 0x7c300221673e3285
add rdi, r15
movzx r15, r8b
neg r8w
add word [rsp], 0x4677
jle 0x140604b42
and rcx, r15
sub r8b, 0x11
not r14w
xor edi, r15d
neg r15b
mov rdi, qword [rsp + 8]
lea rsp, [rsp + 0x10]
ret
cmp r13w, r10w
jns 0x140b7b56c
mov edx, dword [rbp + 0x24]
retf
call fcn.140b89045
cmovb r9w, word [rsp + 0x1e]
and byte [rsp + 0x20], 8
xor dword [rsp + 0x18], 0x56284353
mov dword [rsp + 0x20], 0x759e45a3
push rdi
setge r9b
sub word [rsp + 0x30], 0x3235
push r13
xor r14w, word [rsp + 5]
add r13w, r13w
add qword [rsp + 0x48], 0xfffffffffff6dd3a
mov r13, qword [rsp + 0x50]
sub r14w, word [rsp + 0x28]
sub r15, r14
setne byte [rsp + 0x28]
mov qword [rsp + 0x30], 0x5f724295
and byte [rsp + 0x38], 0x18
test r9d, 0x697f032b
cmovs r15, qword [rsp + 0x38]
and r8d, dword [rsp + 0x3c]
test byte [rsp + 3], r14b
jl 0x140ae95b3

Function at 0x140b7d9bc
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov r14, qword [rsp + 0x20]
call 0x140b1849e

Function at 0x140b86c0f
Capabilities:
Execute anti-debugging instructions
Resolve function by parsing pe exports

Disassembly:
movabs rcx, 0x4ba7709833ea7877
mov cx, 0x4724
jo 0x140bf0e78
cmp cl, 0x52
jl 0x140bb182f
push r11
pushfq
movabs r11, 0x678810b12ede128c
call fcn.14060bb1e
setns cl
push r11
mov rcx, qword [rsp + 0x10]
movabs r11, 0x42ee2072428114b0
neg r11
cmp r11, 0x64c3fe6
lea r11, [r11 + 0x49136c70]
jge 0x140be29fb
js 0x140c2f23a
jae 0x140bf0e76

Function at 0x140b89045
Capabilities:
Execute anti-debugging instructions

Disassembly:
movzx r13, r8b
mov r13, qword [rsp + 0x68]
not r8d
jl fcn.140b54a63
neg qword [rsp + 0x18]
add sil, 0x3a
not r10
call fcn.140b8e72a
Function at 0x140b91b23
Capabilities:
Resolve function by parsing pe exports

Disassembly:
not r9w
not r14b
lea r14, [r9*4 + 0x1f481662]
jno 0x140b5936a
add byte [rax], al
add byte [rdi + 0x63], bl
js 0x140629622
je 0x1406295bb
sahf
inc byte [rdx + 0x28]
mov edx, 0x48fa3ec6
and al, 0x2f
xchg dword [rdi - 0x7af7b109], esp
jno 0x140629617
out 0x18, eax
cmp al, byte [0x1351f39a9]
scasb al, byte [rdi]
and ecx, dword [rbx + rbp*4 + 0x7a240b30]
adc r15b, byte [r13 + rsi*8 + 0x1792305f]
invalid
xchg ebp, eax
movabs dword fs:[0xc8486208e47090f5], eax
jrcxz 0x14062963b
mov esp, 0x88c25e26
adc eax, 0xdc7e661e
out 0xa4, al
mov dword [rax], ecx
invalid
movsd dword [rdi], dword [rsi]
cwde
fstp xword [rsi + 0x5cd8ba2d]
out dx, al
popfq
mov ebp, 0x8f861547
out dx, al
popfq
sub edi, dword [rcx]
hlt
not r15b
neg r15b
bswap r9
not byte [rsp + 0x88]
mov r15, qword [rsp + 0xa0]
bswap r9d
mov dword [rsp + 0x88], r9d
call fcn.140afa77b
and r9d, r14d
jg 0x140b75d4c
sub r9d, 0x281a2a0e
test byte [rsp + 0x48], 0x55
call fcn.140b82353
bswap r15d
jle 0x14062959c
test word [rsp + 0x89], r15w
mov byte [rsp + 0x88], r15b
bswap r9d
bswap r9
jns 0x140b13dfd

Function at 0x140ba23ed
Capabilities:
Execute anti-debugging instructions
Resolve function by parsing pe exports

Disassembly:
mov r13d, r14d
jns 0x140b6e4ec
call rax
jmp 0x140c3473b
or r12w, 0x60b7
sub r12b, 0x24
neg r14
xor r15w, word [rsp + 0x8b]
lea r12, [r8 + 0x603b1917]
and r15w, word [rsp + 0x8b]
add rcx, r15
and word [rsp + 0x88], 0x7531
neg r12d
movzx rcx, word [rsp + 0x88]
cmp bx, 0xcbe
setne r13b
mov word [rsp + 0x88], 0x2b
not r15
cmp cl, r15b
lea rcx, [rcx + rcx + 0x1bd7461b]
lea r15, [r15 + r15*8 + 0x6c3129bf]
not qword [rsp + 0x78]
mov rcx, qword [rsp + 0x48]
setge r15b
xor qword [rsp + 0x78], r15
sets r15b
add dword [rsp + 0x78], 0x20e24607
jbe 0x140683575
jle 0x140bd6cc0
not dword [rsp + 0x78]
or byte [rsp + 0x78], 0x9b
add r15b, r15b
cmovl r15d, dword [rsp + 0x79]
mov qword [rsp + 0x78], r15
setno byte [rsp + 0x78]
mov rbx, qword [rsp + 0x178]
mov rdi, qword [rsp + 0x150]
jmp 0x140c34750
add rsp, 0x158
cmovge bp, r13w
pop rsi
pop rbp
jmp 0x140c34763
ret

Function at 0x140ba242e
Capabilities:
Execute anti-debugging instructions

Disassembly:
test r14w, 0x74f2
mov rdi, qword [rsp + 0x38]
mov r9b, 0xf1
call fcn.140b8f434
movzx edi, word [rsp + 0x30]
add qword [rsp + 0x18], 0xffffffffbf41cc08
sub r11b, byte [rsp + 0x66]
sub r14b, byte [rsp + 0x65]
mov rbp, qword [rsp + 0x70]
test byte [rsp + 0x3d], dil
not r11w
call fcn.140bf0ee0
neg rdi
lea r14, [r11 + r11*2 + 0xf673a0f]
mov word [rsp], 0x367d
mov rbx, qword [rsp]
mov r14d, r11d
mov rdi, qword [rsp + 0x18]
mov di, word [rsp + 0x1a]
lea rcx, [rdi + rsi*8 + 0x68ae3927]
or r11, 0x2df946d7
xor qword [rsp], 0x41975acf
bswap ebx
movzx bx, cl
add qword [rsp + 0x20], 0xffffffffffab49cd
cmp ebx, ecx
jns 0x140b22962
Function at 0x140ba28f2
Capabilities:
Execute anti-debugging instructions

Disassembly:
movabs r14, 0x1cb23f846a9a2d23
push rbx
bswap r12d
mov r12, qword [rsp + 0x38]
mov qword [rsp + 0x38], 0x7ab5ac67
movzx r11d, byte [rsp + 0x1a]
mov rdx, qword [rsp + 0x18]
push 0x2b1f6447
jge 0x140be0aa6
not esi
call fcn.140623320
leave
push rcx
xchg byte [rax], ah
sar byte [rax + rdi*2 + 0x3c], 1
pop r12
push 0x416c4ef4
cld
sbb ch, byte [rdi]
invalid
neg r12b
push rdx
jl 0x140c12a84
neg cl
lea rcx, [rcx + rcx*8 + 0x3195123f]
call fcn.140b19b10
add cx, word [rsp + 0x25]
mov rbx, r11
and qword [rsp + 0x20], r11
add dl, byte [rsp + 0x20]
cmove r14, rcx
call int.14061a873
cmp al, 3
loopne 0x140be0b2d
mov ss, word [rbp + rbx*4 - 0x1e6ec138]
out dx, eax
insb byte [rdi], dx
cmp ebp, dword [rdx + 0x75c7219d]
xchg ecx, eax
xchg ecx, eax
mov byte [rdx + 0x1b], dl
hlt
xor byte [rbx - 0x30944f5f], ch
jne 0x140be0ad5
cmp bh, byte [rdi + 0x7d]
test al, 0xe1
xor al, 0x76
xor cl, byte [rdx - 0x49]
or eax, 0x5c7853a0
jne 0x140be0b66
mov dh, reloc.WS2_32.dll_select
retf
imul ecx, dword [rdx + riz*4], 0x2e
movabs byte [0x4d96b757bbfca81c], al
retf 0x30e
mov edi, 0x66fff2ea
xor dword [rsp + 0x20], 0x8b48044a
push rsp
and al, 0x18
jge 0x140b04a78
neg byte [rsp + 0x20]
jbe 0x140b414fe
lea r12, [r12 + r12 + 0x15a151fb]
jae 0x140c09e30
neg r12w
movabs rdx, 0x7624586849e04499
push rbx
push r8
jl 0x140c2012f
popfq
int 0x47
adc dword [rcx + 0x61dcfa4b], esp
jle 0x140c12a44
pop rdi
fstp xword [rax + 0xae8ad20]
add dl, byte [rbp + 0x2d]
popfq
invalid
push rcx
push r12
mov r8, r12
add qword [rsp + 0x28], 0xffffffffbf979c18
call fcn.140b68fe7

Function at 0x140ba2b63
Capabilities:
Execute anti-debugging instructions

Disassembly:
not r15w
mov r15w, 0x57ac
jno 0x140be1f86
mov esi, 0xb61944ef
sar byte [rdi], 0x95
mov r15, qword [rsp]
lea rsp, [rsp + 8]
ret 8
movabs r12, 0x501a015855c20b88
mov r15, qword [rsp + 0x28]
mov qword [rsp + 0x28], 0x32e2c07d
cmp r14b, 0x78
jo 0x140612f5b
lea rdi, [r14 + rdi*8 + 0x76397824]
add r14d, 0x3ca96d6f
push r15
mov r14w, 0x97a
lea r12, [r14*2 + 0x3c724230]
test r12w, di
jae 0x140bee7e6
and dil, dil
push rdx
lea r12, [r12*8 + 0x1dce56a0]
push r9
mov r15, r12
mov r9, r14
or r9d, edi
add qword [rsp + 0x18], 0x9853
push rdi
mov rdx, qword [rsp]
mov r15, qword [rsp + 0x18]
mov r9w, word [rsp + 5]
xor r9b, byte [rsp + 4]
xor r9b, byte [rsp + 5]
and r14, 0x686b05c9
not dword [rsp]
not r12
add byte [rsp], dl
and r14d, r12d
lea r9, [r12 + r14*2 + 0x6ad6255b]
cmovbe r9w, word [rsp + 6]
test r9w, r12w
cmove edi, dword [rsp + 4]
add di, r9w
or r12w, word [rsp + 6]
call fcn.1406862f8
Function at 0x140ba44fb
Capabilities:
Resolve function by parsing pe exports

Disassembly:
add cx, 0x610
not r11b
and r11b, byte [rsp + 0x1d]
not r11d
neg dword [rsp + 0x18]
mov r11, qword [rsp + 0x28]
call fcn.140619e59
or r11b, byte [rsp + 0x1d]
not r11b
mov r11b, byte [rsp + 0x1e]
mov r12, qword [rsp + 8]
or rcx, rcx
neg r11
or r11b, r11b
seta byte [rsp + 0x18]
add qword [rsp], 0xfffffffffff27f9e
mov dword [rsp + 0x18], 0x75c956e1
sub cl, byte [rsp + 0x1c]
neg r11
xor ecx, 0xc2340f4
or word [rsp + 0x18], cx
setne r11b
and dword [rsp + 0x18], 0x1415470b
and r11, rcx
lea rcx, [rcx + 0x1927749c]
setne byte [rsp + 0x18]
not byte [rsp + 0x18]
jno 0x140af7177

Function at 0x140bad508
Capabilities:
Execute anti-debugging instructions

Disassembly:
and dword [rsp + 0x98], 0x453a670d
sub dword [rsp + 0x60], 0x58f920a0
or qword [rsp + 0x60], 0x289a633e
jns 0x140af560e
sahf
not dword [rbx + 0xe]
movsd dword [rdi], dword [rsi]
in eax, dx
xor eax, 0xf446695
mov edi, 0x832494
add byte [rax], al
push qword [rsp + 0xc8]
popfq
lea rsp, [rsp + 0xd0]
call fcn.140c7b265
and word [rsp + 0xa8], 0xd35
xor word [rsp + 0x98], 0x33bc
test qword [rsp + 0x60], 0x5b88047d
mov byte [rsp + 0x60], 0xa0
jge 0x140685cfc
not byte [rsp + 0xa8]
setge byte [rsp + 0x60]
js 0x140b08e8d
setne byte [rsp + 0xa8]
test qword [rsp + 0x98], 0x7fb60578
mov qword [rsp + 0x60], 0xd292921
jl fcn.140bfad52
jge 0x14062b01e

Function at 0x140bae329
Capabilities:
Execute anti-debugging instructions

Disassembly:
and al, 0xb9
adc eax, 0x2d9fdcc1
int3
sbb eax, 0x36a86bd
push rdx
jmp 0x147e45a6b
add al, 0x97
mov bl, 0x5b
xor dh, byte [rax]
shl byte [rdi + 0x28], 1
sub dword [rbx + 0xc], edi
lodsb al, byte [rsi]
jae 0x140bae2bc
cwde
invalid
xchg ebx, eax
xchg esi, eax
or al, 0xaa
cmc
movsd dword [rdi], dword [rsi]
pop rbp
fcom dword [rbp + 0x16]
insd dword [rdi], dx
and al, 0x92
mov ds, edx
fcom dword [rdx + 0x1cf28f60]
sub ch, byte [rax + rsi*2 - 0x6db3d4ed]
jo 0x140bae290
mov esp, 0x1709708f
loop 0x140bae34a
jno 0x140bae2e8
jne 0x140bae2a8
jle 0x140bae277
xchg esi, eax
retf
jo 0x140bae35b
stosb byte [rdi], al
std
xchg esi, eax
jo 0x140bae2a8
inc byte [rbp + 0x5a]
invalid
push rdi
movabs rdi, 0x68193d5d37e83bb5
movabs r9, 0x521007b022ca75fc
push r9
mov rdi, qword [rsp + 8]
mov byte [rsp], 0xea
jns 0x140af8b8b
cmc
jp 0x140bae300
add edi, dword [rax + riz*4 - 0xed9a186]
jmp 0x1107bd0d4
jmp 0x1107bd0d4