joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1401ddf20
Capabilities:
Delete file

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x50
mov r8, rdx
mov rdx, rcx
lea rcx, [rsp + 0x20]
call fcn.1401e7650
mov rax, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
test rax, rax
je 0x1401ddfd5
mov rcx, qword [rsp + 0x30]
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x30], rcx
lea rcx, [rsp + 0x38]
lea rdx, [rsp + 0x20]
mov r8b, 1
call fcn.1401e0100
mov rdi, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
test rdi, rdi
je 0x1401ddfd5
mov rcx, rdi
call qword [sym.imp.kernel32.dll_DeleteFileW]
test eax, eax
je 0x1401ddfa9
test rsi, rsi
je 0x1401ddfa5
add rsi, rsi
mov r8d, 2
mov rcx, rdi
mov rdx, rsi
call fcn.14001f760
xor esi, esi
jmp 0x1401ddfd5
call qword [sym.imp.kernel32.dll_GetLastError]
mov ebx, eax
shl rbx, 0x20
or rbx, 2
test rsi, rsi
je 0x1401ddfd2
add rsi, rsi
mov r8d, 2
mov rcx, rdi
mov rdx, rsi
call fcn.14001f760
mov rsi, rbx
mov rax, rsi
add rsp, 0x50
pop rbx
pop rdi
pop rsi
ret

Function at 0x1401de6b0
Capabilities:
Write file on windows

Disassembly:
push rsi
push rdi
sub rsp, 0xa8
mov rdi, rdx
mov rsi, rcx
mov rcx, qword [rsp + 0xe0]
movups xmm0, xmmword [0x1402a1ed8]
movaps xmmword [rsp + 0x60], xmm0
mov eax, 0xffffffff
cmp r9, rax
cmovb rax, r9
test rcx, rcx
je 0x1401de6f4
mov rdx, qword [rsp + 0xe8]
mov qword [rsp + 0x80], rdx
test rcx, rcx
mov qword [rsp + 0x78], rcx
lea rdx, [rsp + 0x80]
cmove rdx, rcx
mov qword [rsp + 0x38], rdx
mov dword [rsp + 0x30], eax
mov qword [rsp + 0x28], r8
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x40], 0
mov rcx, rdi
xor edx, edx
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.ntdll.dll_NtWriteFile]
cmp eax, 0x103
jne 0x1401de75a
mov rcx, rdi
mov edx, 0xffffffff
call qword [sym.imp.kernel32.dll_WaitForSingleObject]
mov eax, dword [rsp + 0x60]
cmp eax, 0x103
je 0x1401de791
test eax, eax
js 0x1401de76b
mov rax, qword [rsp + 0x68]
mov qword [rsi + 8], rax
xor eax, eax
jmp 0x1401de784
mov ecx, eax
call qword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
shl rax, 0x20
or rax, 2
mov qword [rsi + 8], rax
mov eax, 1
mov qword [rsi], rax
add rsp, 0xa8
pop rdi
pop rsi
ret
mov byte [rsp + 0x5c], 0
mov dword [rsp + 0x58], 0
mov qword [rsp + 0x20], 0
lea rdx, [0x1402a1f40]
lea rsi, [rsp + 0x78]
lea r9, [rsp + 0x50]
mov r8d, 1
mov rcx, rsi
call fcn.1401cac00
lea rcx, [rsp + 0x58]
mov rdx, rsi
call fcn.1401d52e0
mov rcx, rax
call fcn.1401cbfb0
mov ecx, 7
int 0x29
ud2
Function at 0x1401de7f0
Capabilities:
Create udp socket

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x30
mov edi, r8d
mov rsi, rcx
cmp word [rdx], 0
mov eax, 2
mov ebx, 0x17
cmove ebx, eax
mov dword [rsp + 0x28], 0x81
mov dword [rsp + 0x20], 0
mov ecx, ebx
mov edx, r8d
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.ws2_32.dll_WSASocketW]
cmp rax, 0xffffffffffffffff
je 0x1401de845
mov qword [rsi + 8], rax
mov qword [rsi], 0
jmp 0x1401de8e1
call qword [sym.imp.ws2_32.dll_WSAGetLastError]
cmp eax, 0x2726
je 0x1401de859
cmp eax, 0x2739
jne 0x1401de8aa
mov dword [rsp + 0x28], 1
mov dword [rsp + 0x20], 0
mov ecx, ebx
mov edx, edi
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.ws2_32.dll_WSASocketW]
cmp rax, 0xffffffffffffffff
je 0x1401de8a4
mov rdi, rax
mov rcx, rax
mov edx, 1
xor r8d, r8d
call qword [sym.imp.kernel32.dll_SetHandleInformation]
test eax, eax
je 0x1401de8bf
mov qword [rsi + 8], rdi
mov qword [rsi], 0
jmp 0x1401de8e1
call qword [sym.imp.ws2_32.dll_WSAGetLastError]
shl rax, 0x20
or rax, 2
mov qword [rsi + 8], rax
mov qword [rsi], 1
jmp 0x1401de8e1
call qword [sym.imp.kernel32.dll_GetLastError]
shl rax, 0x20
or rax, 2
mov qword [rsi + 8], rax
mov qword [rsi], 1
mov rcx, rdi
call qword [sym.imp.ws2_32.dll_closesocket]
mov rax, rsi
add rsp, 0x30
pop rbx
pop rdi
pop rsi
ret

Function at 0x1401df370
Capabilities:
Set current directory

Disassembly:
push rbp
push rsi
push rdi
sub rsp, 0x60
lea rbp, [rsp + 0x60]
mov qword [rbp - 8], 0xfffffffffffffffe
add rdx, rcx
mov qword [rbp - 0x38], rcx
mov qword [rbp - 0x30], rdx
mov word [rbp - 0x28], 0
lea rcx, [rbp - 0x20]
lea rdx, [rbp - 0x38]
call fcn.1401d13e0
mov rdx, qword [rbp - 0x10]
cmp rdx, qword [rbp - 0x18]
jne 0x1401df3b9
lea rcx, [rbp - 0x20]
call fcn.1401d0c80
mov rdx, qword [rbp - 0x10]
mov rsi, qword [rbp - 0x20]
mov word [rsi + rdx*2], 0
mov rcx, rsi
call qword [sym.imp.kernel32.dll_SetCurrentDirectoryW]
test eax, eax
je 0x1401df3f7
xor edi, edi
mov rdx, qword [rbp - 0x18]
test rdx, rdx
je 0x1401df3ec
add rdx, rdx
mov r8d, 2
mov rcx, rsi
call fcn.14001f760
mov rax, rdi
add rsp, 0x60
pop rdi
pop rsi
pop rbp
ret
call qword [sym.imp.kernel32.dll_GetLastError]
mov edi, eax
shl rdi, 0x20
or rdi, 2
mov rdx, qword [rbp - 0x18]
test rdx, rdx
jne 0x1401df3db
jmp 0x1401df3ec
Function at 0x1401e5970
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rsi
push rdi
sub rsp, 0x88
sub esp, 0x88

Function at 0x1401e65c0
Capabilities:
Generate random numbers via winapi

Disassembly:
sub rsp, 0x38
xorps xmm0, xmm0
movaps xmmword [rsp + 0x20], xmm0
lea rdx, [rsp + 0x20]
xor ecx, ecx
mov r8d, 0x10
mov r9d, 2
call qword [sym.imp.bcrypt.dll_BCryptGenRandom]
test eax, eax
js 0x1401e65f8
mov rax, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x28]
add rsp, 0x38
ret
call fcn.1401e6610
nop
add rsp, 0x38
ret

Function at 0x1401e6610
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
push rbp
sub rsp, 0x80
lea rbp, [rsp + 0x80]
mov qword [rbp - 8], 0xfffffffffffffffe
xorps xmm0, xmm0
movaps xmmword [rbp - 0x20], xmm0
lea rcx, [rbp - 0x20]
mov edx, 0x10
call qword [sym.imp.advapi32.dll_SystemFunction036]
test al, al
je 0x1401e6653
mov rax, qword [rbp - 0x20]
mov rdx, qword [rbp - 0x18]
add rsp, 0x80
pop rbp
ret
call qword [sym.imp.kernel32.dll_GetLastError]
shl rax, 0x20
or rax, 2
mov qword [rbp - 0x10], rax
lea rax, [rbp - 0x10]
mov qword [rbp - 0x30], rax
lea rax, [fcn.1401d30e0]
mov qword [rbp - 0x28], rax
lea rax, [0x1402a23c0]
mov qword [rbp - 0x60], rax
mov qword [rbp - 0x58], 1
mov qword [rbp - 0x40], 0
lea rax, [rbp - 0x30]
mov qword [rbp - 0x50], rax
mov qword [rbp - 0x48], 1
lea rdx, str.library_std_src_syswindows_rand.rs
lea rcx, [rbp - 0x60]
call fcn.14020ebb0
ud2

Function at 0x1401e6ca0
Capabilities:
Create thread

Disassembly:
push rbp
push r14
push rsi
push rdi
push rbx
sub rsp, 0x50
lea rbp, [rsp + 0x50]
mov qword [rbp - 8], 0xfffffffffffffffe
mov rdi, r8
mov r14, rdx
mov rsi, rcx
movzx eax, byte [0x140321f01]
mov ecx, 0x10
mov edx, 8
call fcn.14001f750
test rax, rax
je 0x1401e6d7f
mov rbx, rax
mov qword [rax], r14
mov qword [rax + 8], rdi
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0x10000
lea r8, [0x1401e6e10]
xor edi, edi
xor ecx, ecx
mov rdx, rsi
mov r9, rax
call qword [sym.imp.kernel32.dll_CreateThread]
mov rdx, rax
test rax, rax
jne 0x1401e6d71
mov rcx, qword [rbx]
mov qword [rbp - 0x18], rbx
mov rax, qword [rbx + 8]
mov qword [rbp - 0x20], rcx
mov qword [rbp - 0x10], rax
call qword [rax]
mov rax, qword [rbp - 0x10]
mov rdx, qword [rax + 8]
test rdx, rdx
je 0x1401e6d48
mov r8, qword [rax + 0x10]
mov rcx, qword [rbp - 0x20]
call fcn.14001f760
mov edx, 0x10
mov r8d, 8
mov rcx, qword [rbp - 0x18]
call 0x123a87243
invalid
call qword [sym.imp.kernel32.dll_GetLastError]
mov edx, eax
shl rdx, 0x20
or rdx, 2
mov edi, 1
add dword [rax], eax
add byte [rax], al
mov rax, rdi
add rsp, 0x50
pop rbx
pop rdi
pop rsi
pop r14
pop rbp
ret
mov qword [rbp - 0x10], r14
mov qword [rbp - 0x18], rdi
mov ecx, 8
mov edx, 0x10
call fcn.14020ea60
jl 0x1401e6d97
add byte [rdi], cl
invalid
Function at 0x1401e87f0
Capabilities:
Resolve dns

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x1f0
mov rsi, rcx
mov r14, qword [rdx]
mov rbx, qword [rdx + 8]
movzx edi, word [rdx + 0x10]
mov rax, qword [0x1403220a0]
cmp rax, 3
jne 0x1401e88e6
cmp rbx, 0x17f
ja 0x1401e88f8
lea r15, [rsp + 0x70]
mov rcx, r15
mov rdx, r14
mov r8, rbx
call sub.VCRUNTIME140.dll_memcpy
mov byte [rsp + rbx + 0x70], 0
inc rbx
lea rcx, [rsp + 0x28]
mov rdx, r15
mov r8, rbx
call fcn.1401f5060
cmp qword [rsp + 0x28], 0
je 0x1401e8874
lea rax, str.file_name_contained_an_unexpected_NUL_byte
mov qword [rsi + 8], rax
mov qword [rsi], 1
jmp 0x1401e8909
mov rcx, qword [rsp + 0x30]
xorps xmm0, xmm0
movaps xmmword [rsp + 0x40], xmm0
movaps xmmword [rsp + 0x60], xmm0
movaps xmmword [rsp + 0x50], xmm0
mov dword [rsp + 0x48], 1
mov qword [rsp + 0x20], 0
lea r8, [rsp + 0x40]
lea r9, [rsp + 0x20]
xor edx, edx
call qword [sym.imp.ws2_32.dll_getaddrinfo]
test eax, eax
je 0x1401e88ce
call qword [sym.imp.ws2_32.dll_WSAGetLastError]
shl rax, 0x20
or rax, 2
mov qword [rsi + 8], rax
mov eax, 1
mov qword [rsi], rax
jmp 0x1401e8909
mov rax, qword [rsp + 0x20]
mov qword [rsi + 8], rax
mov qword [rsi + 0x10], rax
mov word [rsi + 0x18], di
xor eax, eax
mov qword [rsi], rax
jmp 0x1401e8909
call fcn.14020dbc0
cmp rbx, 0x17f
jbe 0x1401e882a
mov rcx, rsi
mov rdx, r14
mov r8, rbx
mov r9d, edi
call fcn.14020dd10
mov rax, rsi
add rsp, 0x1f0
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret

Function at 0x1401e8a60
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push rsi
sub rsp, 0xb0
mov rax, rdx
mov rsi, rcx
xorps xmm0, xmm0
movaps xmmword [rsp + 0xa0], xmm0
movaps xmmword [rsp + 0x90], xmm0
movaps xmmword [rsp + 0x80], xmm0
movaps xmmword [rsp + 0x70], xmm0
movaps xmmword [rsp + 0x60], xmm0
movaps xmmword [rsp + 0x50], xmm0
movaps xmmword [rsp + 0x40], xmm0
movaps xmmword [rsp + 0x30], xmm0
mov dword [rsp + 0x2c], 0x80
lea rdx, [rsp + 0x30]
lea r8, [rsp + 0x2c]
mov rcx, rax
call qword [sym.imp.ws2_32.dll_getsockname]
cmp eax, 0xffffffff
je 0x1401e8b10
mov eax, dword [rsp + 0x2c]
movzx ecx, word [rsp + 0x30]
cmp ecx, 2
je 0x1401e8b20
cmp ecx, 0x17
jne 0x1401e8b47
cmp eax, 0x1c
jb 0x1401e8b60
movzx eax, word [rsp + 0x32]
rol ax, 8
movups xmm0, xmmword [rsp + 0x38]
mov ecx, dword [rsp + 0x34]
mov edx, dword [rsp + 0x48]
mov word [rsi], 1
movups xmmword [rsi + 4], xmm0
mov dword [rsi + 0x14], ecx
mov dword [rsi + 0x18], edx
mov word [rsi + 0x1c], ax
add rsp, 0xb0
pop rsi
ret
call qword [sym.imp.ws2_32.dll_WSAGetLastError]
shl rax, 0x20
or rax, 2
jmp 0x1401e8b4e
cmp eax, 0x10
jb 0x1401e8b7a
movzx eax, word [rsp + 0x32]
rol ax, 8
mov ecx, dword [rsp + 0x34]
mov word [rsi], 0
mov word [rsi + 6], ax
mov dword [rsi + 2], ecx
add rsp, 0xb0
pop rsi
ret
lea rax, str.invalid_argument
mov qword [rsi + 8], rax
mov word [rsi], 2
add rsp, 0xb0
pop rsi
ret
lea rcx, str.assertion_failed:_len_as_usize___mem::size_of::_c::sockaddr_in6___
lea r8, str.:__
mov edx, 0x43
call fcn.14020ec50
ud2
lea rcx, str.assertion_failed:_len_as_usize___mem::size_of::_c::sockaddr_in___library_std_src_sys_common_net.rs
lea r8, [0x1402a2c60]
mov edx, 0x42
call fcn.14020ec50
ud2
Function at 0x1401fd340
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
test r8, r8
je 0x1401fd3ba
mov rax, rdx
mov rdx, qword [rsp + 0x70]
mov esi, ecx
shr esi, 8
lea r8, [rax + r8*2]
xor r11d, r11d
mov rbx, rax
movzx edi, byte [rax + 1]
add rax, 2
lea r10, [r11 + rdi]
cmp byte [rbx], sil
jne 0x1401fd3b0
cmp r11, r10
ja 0x1401fd453
cmp r10, rdx
ja 0x1401fd467
add r11, r9
xor ebx, ebx
nop dword [rax]
cmp rdi, rbx
je 0x1401fd3b2
lea r14, [rbx + 1]
cmp byte [r11 + rbx], cl
mov rbx, r14
jne 0x1401fd390
jmp 0x1401fd427
ja 0x1401fd3ba
mov r11, r10
cmp rax, r8
jne 0x1401fd362
mov rdx, qword [rsp + 0x80]
test rdx, rdx
je 0x1401fd42b
mov r8, qword [rsp + 0x78]
add rdx, r8
movzx ecx, cx
mov al, 1
nop word cs:[rax + rax]
lea r10, [r8 + 1]
movzx r9d, byte [r8]
test r9b, r9b
js 0x1401fd400
mov r8, r10
sub ecx, r9d
jns 0x1401fd41e
jmp 0x1401fd42d
cmp r10, rdx
je 0x1401fd439
movzx r10d, byte [r8 + 1]
add r8, 2
and r9d, 0x7f
shl r9d, 8
or r9d, r10d
sub ecx, r9d
js 0x1401fd42d
xor al, 1
cmp r8, rdx
jne 0x1401fd3e0
jmp 0x1401fd42d
xor eax, eax
jmp 0x1401fd42d
mov al, 1
and al, 1
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret
lea rcx, str.called__Option::unwrap____on_a__None__valueassertion_failed:__buf.is_empty__
lea r8, str.librarycore_srcunicodeprintable.rs
mov edx, 0x2b
call fcn.14020ec50
ud2
lea r8, str.librarycore_srcunicodeprintable.rs
mov rcx, r11
mov rdx, r10
call fcn.14020f130
ud2
lea r8, str.librarycore_srcunicodeprintable.rs
mov rcx, r10
call fcn.14020f0c0
ud2
Function at 0x140200450
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.kernel32.dll_GetModuleHandleW]
test rax, rax
je 0x14020049a
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14020049a
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14020049a
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14020049a
cmp dword [rcx + 0x84], 0xe
jbe 0x14020049a
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14020049c
xor al, al
add rsp, 0x28
ret

Function at 0x14020cac0
Capabilities:
Link many functions at runtime

Disassembly:
push rbp
push rsi
push rdi
push rbx
sub rsp, 0x48
lea rbp, [rsp + 0x40]
mov qword [rbp], 0xfffffffffffffffe
lea rcx, str.api_ms_win_core_synch_l1_2_0.dll
call qword [sym.imp.kernel32.dll_GetModuleHandleA]
test rax, rax
je 0x14020cb21
mov rdi, rax
lea rdx, [0x140267be6]
mov rcx, rax
call qword [sym.imp.kernel32.dll_GetProcAddress]
test rax, rax
je 0x14020cb21
mov rsi, rax
lea rdx, [0x140267bf4]
mov rcx, rdi
call qword [sym.imp.kernel32.dll_GetProcAddress]
test rax, rax
je 0x14020cb21
mov rdi, rax
xor ebx, ebx
jmp 0x14020cba7
lea rcx, [0x140267b80]
call qword [sym.imp.kernel32.dll_GetModuleHandleA]
test rax, rax
je 0x14020cc1b
mov rsi, rax
lea rdx, [0x140267b8a]
mov rcx, rax
call qword [sym.imp.kernel32.dll_GetProcAddress]
test rax, rax
je 0x14020cc1b
mov rdi, rax
lea rdx, [0x140267b9d]
mov rcx, rsi
call qword [sym.imp.kernel32.dll_GetProcAddress]
test rax, rax
je 0x14020cc1b
mov rbx, rax
lea rdx, [0x140267bb1]
mov rcx, rsi
call qword [sym.imp.kernel32.dll_GetProcAddress]
test rax, rax
je 0x14020cc1b
mov rsi, rax
lea rcx, [rbp - 0x18]
mov edx, 0xc0000000
xor r8d, r8d
xor r9d, r9d
call rdi
test eax, eax
jne 0x14020cc1b
mov rdi, qword [rbp - 0x18]
movzx eax, byte [0x140321f01]
mov ecx, 0x18
mov edx, 8
call fcn.14001f750
test rax, rax
je 0x14020cc22
mov rcx, rax
mov qword [rax], rbx
mov qword [rax + 8], rsi
mov qword [rax + 0x10], rdi
xor eax, eax
lock cmpxchg qword [0x140321f98], rcx
je 0x14020cc0f
mov rsi, rax
cmp qword [rcx], 0
mov qword [rbp - 8], rcx
je 0x14020cbf8
mov rax, qword [rbp - 8]
mov rcx, qword [rax + 0x10]
call qword [sym.imp.kernel32.dll_CloseHandle]
mov edx, 0x18
mov r8d, 8
mov rcx, qword [rbp - 8]
call fcn.14001f760
mov rcx, rsi
mov rax, rcx
add rsp, 0x48
pop rbx
pop rdi
pop rsi
pop rbp
ret
call fcn.14020ca80
jmp 0x14020cc39
mov qword [rbp - 0x10], rdi
mov qword [rbp - 8], rbx
mov ecx, 8
mov edx, 0x18
call fcn.14020ea60
ud2
Function at 0x14020dd10
Capabilities:
Resolve dns

Disassembly:
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x88
mov ebp, r9d
mov rsi, rcx
lea rcx, [rsp + 0x30]
call fcn.1401f0b20
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x14020dd6b
lea rax, str.file_name_contained_an_unexpected_NUL_byte
mov qword [rsi + 8], rax
mov qword [rsi], 1
mov rdx, qword [rsp + 0x38]
test rdx, rdx
je 0x14020dde4
mov r8d, 1
add rsp, 0x88
pop rbx
pop rbp
pop rdi
pop rsi
jmp fcn.14001f760
mov rdi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x40]
xorps xmm0, xmm0
movaps xmmword [rsp + 0x50], xmm0
movaps xmmword [rsp + 0x70], xmm0
movaps xmmword [rsp + 0x60], xmm0
mov dword [rsp + 0x58], 1
mov qword [rsp + 0x28], 0
lea r8, [rsp + 0x50]
lea r9, [rsp + 0x28]
mov rcx, rdi
xor edx, edx
call qword [sym.imp.ws2_32.dll_getaddrinfo]
test eax, eax
je 0x14020ddf1
call qword [sym.imp.ws2_32.dll_WSAGetLastError]
shl rax, 0x20
or rax, 2
mov qword [rsi + 8], rax
mov eax, 1
mov qword [rsi], rax
mov byte [rdi], 0
test rbx, rbx
je 0x14020dde4
mov r8d, 1
mov rcx, rdi
mov rdx, rbx
call fcn.14001f760
nop
add rsp, 0x88
pop rbx
pop rbp
pop rdi
pop rsi
ret
mov rax, qword [rsp + 0x28]
mov qword [rsi + 8], rax
mov qword [rsi + 0x10], rax
mov word [rsi + 0x18], bp
xor eax, eax
mov qword [rsi], rax
mov byte [rdi], 0
test rbx, rbx
jne 0x14020ddd3
jmp 0x14020dde4
Function at 0x1400a6013
Capabilities:
Execute anti-debugging instructions

Disassembly:
jmp 0x1400a606d
lea r10, [r11 + r13]
mov dil, byte [rsp + 7]
rdtsc
mov eax, ebx
push qword [rsp + 1]
pop word [rsp + 6]
jmp 0x1400a6057

Function at 0x1400a982d
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov ebp, dword [rsp]
rdtsc
mov r13, 0xffffffffcfa3b62b
push rdi
cpuid
jmp 0x1400a9982
mov qword [rsp], rsi
btr r11d, ebx
mov r10d, ebp
mov r11w, r9w
xchg bl, al
jmp 0x1400a9817
mov r13, qword [rsp]
inc bl
not r11d
bswap r14d
setne cl
push r15
jmp 0x1400a9859
mov r13, 0xffffffffcb6427e1
xor dx, cx
push rsi
lea rsi, [r8 + r9]
mov qword [rsp], r12
bswap rdi
jmp 0x1400a9884

Function at 0x1400a9eb1
Capabilities:
Execute anti-debugging instructions

Disassembly:
bswap r15d
pop word [rsp + 1]
jmp 0x1400a9ef7
mov r15d, dword [rsp + 5]
mov r10w, word [rsp]
mov r9, qword [rsp]
jmp 0x1400aa1ab
mov sil, spl
lea rsp, [rsp + 3]
mov r12b, byte [rsp + 1]
mov r13d, r14d
mov ax, di
sub rsp, 4
jmp 0x1400a9ee1
mov r9b, r14b
mov cl, byte [rsp + 3]
rdtsc
lea r12, [r13*4]
bswap r9d
mov dil, 0xd0
jmp 0x1400a9f27
mov cx, 0x18ce
bsf r14, r12
cpuid
lea r8, [rbp + riz - 0xa3]
clc
mov bpl, 0x7c
jmp 0x1400a9f3d
mov r11, qword [rsp]
cmc
btc rbp, r9
mov esi, dword [rsp + 4]
lea r12, [rdx*8]
stc
jmp 0x1400a9f5d
xchg r9b, bl
bsr r11d, edx
push word [rsp + 1]
btc r13d, r13d
pop word [rsp]
mov word [rsp + 2], r10w
jmp 0x1400a9fad
mov ecx, r10d
mov r15w, r9w
add rsp, 4
mov r13, 0xffffffffee91120d
push word [rsp + 1]
mov byte [rsp], r14b
jmp 0x1400aa097
xchg bl, r15b
xchg word [rsp + 4], r14w
mov byte [rsp + 2], r11b
dec ebx
btr r12, rax
mov r12, rcx
jmp 0x1400aa157

Function at 0x1400aa0e9
Capabilities:
Execute anti-debugging instructions

Disassembly:
pop word [rsp + 4]
ror r9b, cl
mov eax, esi
mov dword [rsp + 4], r9d
jmp 0x1400aa122
mov r15w, r12w
push qword [rsp + 6]
push qword [rsp + 6]
sbb rdi, 0x5d2cd95b
not r15d
mov di, r8w
jmp 0x1400aa10c

Function at 0x1400aa5f5
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea rsp, [rsp + 0x14]
lea r9, [r12 + 0x2c]
xchg rbx, rdi
jmp 0x1400aa5fb
mov si, word [rsp]
jmp 0x1400aa5df
mov r13, 0x382df3dc
mov r9w, r10w
mov ebx, dword [rsp + 2]
jmp 0x1400aa723
not r9d
bsr r12d, esp
mov r14d, edx
xchg r8b, r10b
mov r14d, 0xa46c3455
bswap rdx
jmp 0x1400aa629
mov r15, 0x773c020f
xchg r14d, ecx
xchg r8w, r9w
bswap r13
sub rsp, 0x1f
push word [rsp + 0x17]
jmp 0x1400aa64f
mov byte [rsp + 2], cl
xchg r9b, r10b
pop r13
bt di, ax
xchg r8d, esi
mov r14, qword [rsp]
jmp 0x1400aa6bf
Function at 0x1400aa7f9
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov r12w, word [rsp + 1]
push word [rsp + 1]
xchg qword [rsp], r9
jmp 0x1400aa858
xchg edi, r10d
mov cx, 0x5fec
mov r12, r10
lea rsp, [rsp + 7]
jmp 0x1400aa8af
mov r9, 0xffffffffcc0773d2
not r14d
lea rbx, [r11 + r11]
std
mov edi, 0x5c3d380d
mov rbx, qword [rsp + 4]
jmp 0x1400aa842
setae r11b
mov word [rsp], bx
add rbx, 0xffffffffc64d9807
jmp 0x1400aa8d6
bswap rbx
bswap rbx
neg ecx
rdtsc
rdtsc
dec r8
jmp 0x1400aa899
mov dil, 0xfc
mov esi, 0x288ddf87
mov rbp, 0xffffffffd65e6da5
jmp 0x1400aa8ea
xchg r12, rax
neg r10b
sub rsp, 0x10
pop r12
mov dx, bx
mov cx, di
jmp 0x1400aa8c0
not rbp
bsr r8d, r12d
pop word [rsp + 2]
mov byte [rsp + 5], r12b
jmp 0x1400aa9c5
pop cx
add rsp, 1
mov r13b, byte [rsp + 5]
cld
jmp 0x1400aa98e
mov eax, r13d
push qword [rsp + 3]
xchg byte [rsp + 0xf], r14b
pop qword [rsp]
bswap r14
mov byte [rsp + 4], r14b
jmp 0x1400aa921
mov dx, word [rsp + 7]
lea rdi, [rdx + riz + 0x1396]
pop di
xchg r12w, ax
push word [rsp + 5]
mov r15b, pe_nt_image_headers64
jmp 0x1400aa937
add rsp, 7
mov r9d, 0xaa898306
mov r15b, 0xf8
jmp 0x1400aa9a7
mov rdx, 0xffffffffbe941ed5
pushfq
bt r9d, r10d
mov r9, rdx
bswap r11d
push word [rsp + 7]
jmp 0x1400aa978
add rsp, 2
bswap rcx
lea r11, [r8 + r15]
xchg byte [rsp + 2], r14b
ror r14d, cl
jmp 0x1400aa9eb
mov r11b, byte [rsp + 3]
mov bpl, byte [rsp + 5]
lea r13, [0xffffffffe18bd64b]
lea rcx, [0x7cc30cf1]
setne sil
not r15b
jmp 0x1400aa95a
sub rax, 0x2c160be3
xchg r15, rdi
push qword [rsp + 1]
pop word [rsp]
jmp 0x1400aaa36
mov r15b, 0x9f
mov ebx, 0x8c9fc6ec
cpuid
rcl r9b, 4
jmp 0x1400aaa69
pop word [rsp + 7]
mov r10b, 0x94
and r13b, 0x14
xchg byte [rsp + 5], r15b
inc r14
mov r14, 0xffffffffcd2b11d5
jmp 0x1400aaa20
pop qword [rsp + 7]
inc r10w
mov byte [rsp + 0x1c], r9b
jmp 0x1400aac89
sub rsp, 0x1a
mov cx, 0xfa69
lea r14, [0xffffffffe130320e]
push qword [rsp + 3]
jmp 0x1400aaa53
mov byte [rsp + 0xd], cl
mov qword [rsp + 3], rbx
dec r13w
sub rsp, 0x1e
rdtsc
rcr dl, 7
jmp 0x1400aaaef
dec ax
std
xchg bl, r12b
mov qword [rsp + 0xe], rax
inc bl
xchg r9b, dl
jmp 0x1400aaaa1
mov word [rsp + 0x38], r12w
mov dil, byte [rsp + 0x13]
xchg bpl, al
jmp 0x1400aab21
push r8w
lea r13, [0xfffffffff3618eeb]
sub rsp, 6
xchg r9w, bp
xchg rsi, rbx
mov r12d, ebx
jmp 0x1400aaad9
setnp bl
mov word [rsp + 0x2c], si
call fcn.1400aab0b
pop qword [rsp + 0xc]
mov byte [rsp + 8], r9b
mov bl, byte [rsp + 7]
mov r15d, dword [rsp + 8]
mov dword [rsp + 0x11], ebp
xchg word [rsp + 4], bx
jmp 0x1400aaac6
neg r14d
lea rsp, [rsp + 7]
setne r14b
mov r8, 0xfffffffffe36ab26
mov word [rsp + 9], si
xchg sil, al
jmp 0x1400aab5b
Function at 0x1400aacd1
Capabilities:
Execute anti-debugging instructions

Disassembly:
pop r8w
mov byte [rsp + 0x15], al
jmp 0x1400aaf2e
lea r14, [rdi + r8]
rdtsc
xchg rbx, rdx
xchg dx, si
add rsp, 0
jmp 0x1400aad77
mov r13d, 0x3503fac
bt r9d, esi
cmc
mov cx, 0x3dcd
lea rbp, [0xffffffffbdff09ba]
add rsp, 0
jmp 0x1400aad12
xchg word [rsp], r9w
lea rsp, [rsp + 1]
mov si, 0xe0dd
jmp 0x1400aad8d
clc
mov eax, ecx
neg rdx
rdtsc
lea rsp, [rsp + 1]
push sp
jmp 0x1400aad45
std
mov r13b, byte [rsp]
mov r9w, r8w
mov dl, 0x19
mov rbx, qword [rsp]
mov r12w, 0xe35a
jmp 0x1400aad5b
bswap r9d
lea r14, [rdx + rbx]
xchg ecx, r12d
lea rsp, [rsp + 1]
pop r8
setno dil
jmp 0x1400aaeef
cld
lea r8, [rax + riz - 0x7dd4]
lea r12, [rdx + r13]
xchg dl, cl
mov cx, 0x7f19
pop dx
jmp 0x1400aad28
pushfq
mov r12, qword [rsp + 8]
bswap r13
xchg bp, r9w
lea rbx, [rsp + rax]
xchg si, r11w
call fcn.1400aade5
lea r14, [rcx*8]
pop r15
mov r14d, r15d
mov bp, word [rsp]
rdtsc
dec r9b
jmp 0x1400aae35
bswap esi
cmc
mov dx, word [rsp]
sub r14b, 0x36
rdtsc
setge dl
jmp 0x1400aae93
mov byte [rsp + 0xe], r8b
not al
mov ebp, dword [rsp + 3]
stc
pop word [rsp + 0x14]
lea rsp, [rsp + 0x14]
jmp 0x1400aadb3