joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140007de0
Capabilities:
Execute anti-debugging instructions
Packed with generic packer

Disassembly:
pushfq
jg 0x1400058af
mov r12, r12
jle 0x1400058af
popfq
jo 0x14000dc2f
mov ah, ah
jno 0x14000dc2f
add r9, 0x36d07bcc
jl 0x14000be3e
mov r15, r15
jge 0x14000be3e
mov r14, qword [rsp + 8]
js 0x1400075f9
mov r15, r15
jns 0x1400075f9
mov r9, qword [rsp + 8]
ja 0x14000e957
mov r13, r13
jbe 0x14000e957
je 0x14000a2ac
call fcn.1400077aa
xlatb
mov esp, dword [rax + rdi]
call 0x128c2e443
xor dl, cl
invalid
movsxd r14, dword [r14]
jmp 0x140001a01
push r14
jl 0x1400058c6
xchg rbp, rbp
jge 0x1400058c6
movzx ecx, word [rsp + 0x6a]
mov r9, rbp
mov r8d, r12d
mov rdx, rbp
call fcn.14000bed3
movzx r8d, si
call fcn.140002ce8
adc al, 0xe8
invalid
add qword [rsp + 0x10], r9
ja 0x140005145
xchg rbp, rbp
jbe 0x140005145
pop r9
jo 0x14000e6a7
movsxd r9, dword [r9]
jl 0x140004639
nop
jge 0x140004639
jmp 0x14000e87b

Function at 0x140007df1
Capabilities:
Execute anti-debugging instructions

Disassembly:
push rsi
jmp 0x14000eb34
mov rsi, qword [rsp + 8]
jo 0x140004b7f
xchg bp, bp
jno 0x140004b7f
jmp fcn.14000102f

Function at 0x140007e57
Capabilities:
Execute anti-debugging instructions

Disassembly:
push rsi
je 0x14000a560
xchg r9, r9
jne 0x14000a560
test r10, 0
call fcn.14000d01e
pop rsp
sbb bl, cl
cmc
call 0x1b652098b
add byte [rax], al
call fcn.14000a7e2
or eax, 0x66e83555
test edi, 0x43e80000
adc byte [rax], al
add byte [rdx], al
or bh, dl
cmc
call 0x128c103e3
and eax, 0x4effffaf
push rsp
adc ah, bh
call 0x1504f09f0
test ebx, 0
jb 0x14000868b
call fcn.1400046ae
adc eax, 0xe83dc3ad
mov byte [rdi + 0x48000030], cl
add esp, 0x20
pop rbx
call fcn.140008ed5
movabs eax, dword [0x38880f5ee8f5d69c]
invalid

Function at 0x140007fce
Capabilities:
Execute anti-debugging instructions

Disassembly:
push rbx
jmp 0x14000e58a
movsxd rbx, dword [rbx]
jo 0x140002e3f
mov r13, r13
jno 0x140002e3f
test esi, 0
mov ebx, edx
lea r8, [rsp + 0x40]
call fcn.14000efee
invalid
mov rbx, qword [rsp + 8]
jp 0x14000b06e
xchg bl, bl
jnp 0x14000b06e
test ecx, 0
jb 0x14000d354
sub rsp, 0xa0
call fcn.140004e7d
push 0xffffffffe81bb4d5
mov rcx, qword [rsi + 0x30]
test rcx, 0
js 0x14000e262
xor edx, edx
call qword [0x140011c41]
test al, 0
call fcn.140002dc4
int3
Function at 0x140007ff7
Capabilities:
Encode data using base64
Execute anti-debugging instructions

Disassembly:
movsxd r12, dword [r12]
jl 0x140003f62
mov rbx, rbx
jge 0x140003f62
pushfq
jo 0x140006f14
mov bl, bl
jno 0x140006f14
xor r12, 0x2749442d
jg 0x1400040fc
xchg dl, dl
jle 0x1400040fc
xor eax, eax
lea r9, [rsp + 0x40]
mov edx, 0xffff
mov r8d, 0x80
mov dword [rsp + 0x20], 4
mov dword [rsp + 0x40], eax
call qword [0x140011c73]
call fcn.140002dc4
xor eax, 0xe8fc100d
lea rcx, [0x140011b56]
jmp fcn.14000102f
push r12
jo 0x14000a2cd
xchg r8, r8
jno 0x14000a2cd
mov dword [rsi + 0x50], 1
call fcn.1400057f9
js 0x140008031
push rsp
adc eax, ebp
dec dword [rdi]
invalid
mov r12, qword [rsp + 8]
jo 0x140002100
mov cx, cx
jno 0x140002100
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
lea rbp, [rsp - 0xb0]
test esi, 0
jo 0x14000c25b
sub rsp, 0x1b0
test di, 0
jo 0x14000d145
and dword [rbp + 0xe8], 0
mov ebx, edx
call fcn.14000efee
invalid
add al, 0xe8
jg 0x14000c249
invalid
mov dword [rdi + rdi*8 - 1], eax
push rcx
test edx, 0
jb 0x14000cba2
call fcn.140007ff7
invalid

Function at 0x140008122
Capabilities:
Execute anti-debugging instructions
Packed with generic packer

Disassembly:
mov rax, qword [rsp + 8]
jg 0x140003b90
mov dl, dl
jle 0x140003b90
movsxd rdx, dword [rsi + 0x10]
call fcn.14000ae3d
lea r11, [rsp + 0x50]
test dl, 0
call fcn.14000de59
sub dword [rbx], ebx
xchg ebp, eax
sti
call 0xdf0c975e
xchg byte [rcx], al
add al, ch
scasb al, byte [rdi]
lahf
add byte [rax], al
xlatb
or edi, dword [rsi + rdi*8]
call 0x16444aa36
or byte [rdi], cl
test byte [rbx + 0x4d00002f], dh
mov ecx, ecx
jne 0x140004ea8
movsxd rax, dword [rax]
je 0x140006530
mov bl, bl
jne 0x140006530
test eax, eax
jne fcn.14000d0cd
jne 0x1400086f1
call qword [0x140011eb4]
lea rdx, [rsp + 0x70]
call fcn.14000d80e
cmp eax, 0xe838fc76
je 0x14000bda5
je 0x14000439b
call fcn.14000de49
loopne 0x140003ba3
call 0x1402d83c6
add byte [rax + rdx*2 - 0x10], al
add ch, al
test byte [rbp - 0x47ffff52], al
xor al, byte [rax]
add byte [rax], al
movsxd rax, dword [rax]
jg 0x140005082
xchg rsp, rsp
jle 0x140005082
pushfq
jp 0x14000ca17
nop
jnp 0x14000ca17
pushfq
push rax
jo 0x140001eab
mov r8, r8
jno 0x140001eab
test r12, 0
call fcn.140001a3a
invalid
mov eax, edx
call fcn.14000d71d
mov dl, byte [rdi]
mov edx, 0x850fe8e3
add al, 0x8e
invalid
xor rax, 0x1a4098bd
add qword [rsp + 0x10], rax
js 0x140005423
mov r10, r10
jns 0x140005423
jne 0x140008ec4
call fcn.1400089e2
pop rbx
insd dword [rdi], dx
Function at 0x140008270
Capabilities:
Encode data using base64
Execute anti-debugging instructions

Disassembly:
sub r15, 0x312093c3
jg 0x140003b5e
xchg rdi, rdi
jle 0x140003b5e
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x40], r12
call fcn.140002dc4
outsb dx, byte [rsi]
xchg bh, ch
add ebp, eax
mov rax, rsp
mov qword [rax + 8], rbx
call fcn.140005933
int 0xb4
fadd st(1)
call 0xd98a8aac
invalid
mov r15, qword [rsp + 8]
jl 0x14000b147
mov sp, sp
jge 0x14000b147
push r15
ja 0x1400081c4
mov r14, r14
jbe 0x1400081c4
mov r8d, 8
call fcn.14000de49
pop rdx
pop rdi
retf
test edx, 0
call fcn.140002a38
xor al, 0x5b
sbb eax, 0x15ffe81b
cwde
jle 0x1400092e9
add al, ch
pushfq
invalid
pushfq
jg 0x140007ad0
mov ch, ch
jle 0x140007ad0
add rdx, 2
inc rcx
call fcn.14000364a
shr dword [rsi + rax - 2], 1
call 0x19859095d
pop rax
mov qword [rsp + 0x100], r11
mov rax, qword [rsp + 0x100]
test r9, 0
call fcn.14000c770
mov dword [rdi + 0x66e8d88e], ebp
test ecx, 0x820f0000
xchg dword [rsi - 1], esi
jmp qword [rsi + 0x33]
movsxd r15, dword [r15]
jl 0x14000b080
mov r10, r10
jge 0x14000b080
popfq
jo 0x1400011bd
mov dl, dl
jno 0x1400011bd
cmp rax, 0xffffffffffffffff
je 0x14000258d
je 0x1400092d4
call fcn.140002d76
out dx, eax
or dl, byte [rsi + 0xf9ce83d]
invalid

Function at 0x140008973
Capabilities:
Encode data using base64
Execute anti-debugging instructions

Disassembly:
movsxd rbp, dword [rbp]
jmp 0x140007767
push rbp
jb 0x14000baae
nop
jae 0x14000baae
mov rbp, qword [rsp + 8]
jmp 0x140002424
Function at 0x140008d39
Capabilities:
Encode data using base64
Execute anti-debugging instructions

Disassembly:
movsxd r12, dword [r12]
test edx, esi
and eax, 0x8d480000
and al, 0x60
call fcn.1400011cf
mov dh, 0xd4
xlatb
sub al, ch
mov r12, qword [rsp + 8]
jl 0x1400066a5
xchg si, si
jge 0x1400066a5
mov r8d, dword [rbp + 0x20]
call fcn.14000abe1
in al, 0xba
outsd dx, dword [rsi]
call 0x128f0c1c7
mov bl, 0xb5
invalid
push r12
jo 0x14000863b
mov rdx, rdx
jno 0x14000863b
push rdi
test rcx, 0
jne 0x14000c26a
sub rsp, 0x20
call fcn.14000e9f0
outsd dx, dword [rsi]
wait
sub al, 0xe8
js 0x140009821
xor r12d, r12d
call fcn.14000194f
out dx, eax
fsubr st(1)
call 0x188c518c5
mov rax, rsp
mov qword [rax + 8], rcx
mov rcx, qword [rsp]
mov qword [rax + 0x10], rdx
mov qword [rax + 0x18], r8
mov qword [rax + 0x20], r9
mov eax, dword [rcx + 5]
call fcn.1400011cf
jmp 0x140008db0
in eax, dx
jns 0x14000d23d
popfq
jb 0x140008fe4
xchg rbp, rbp
jae 0x140008fe4
call qword [0x140011c73]
call fcn.14000ec65
add dword [rdi + rcx*4], 0x1f
call 0x16424da66
mov edi, eax
call qword [0x14001135a]
mov ecx, dword [rsp + 0x28]
mov dword [r12], eax
call int.140009049
invalid
pop r11
js 0x14000bcad
mov rbp, rbp
jns 0x14000bcad
pop rsi
jo 0x14000c2c5
mov dl, dl
jno 0x14000c2c5
push rbp
push r14
push r15
call fcn.140002b32
add dword [rsi + rcx*2 - 0x74b7173f], esi
retf
mov ecx, dword [rdi + 0x30]
call qword [0x1400110c2]
test ebx, 0
js 0x140006997
call fcn.140008973
mov r8b, 0x8b
retf 0x5de8
retf 0x4de8
mov qword [rsp + 0x48], rsi
lea rax, [rbp - 0x70]
test r11, 0
call fcn.140007b6f
movabs eax, dword [0x55bc15ffe8d43f82]
add byte [rax], al
call fcn.140007de0
jns 0x14000ba7c
ret
ret
lea edi, [rdi - 0x6f]
mov dword [rbp - 0x70], 0x68
mov dword [rbp - 0x34], r15d
mov word [rbp - 0x30], r15w
call fcn.14000dd57
test ah, 0
js 0x14000b968
test eax, eax
je 0x14000bab9
call fcn.140006d44
xchg ecx, eax
push rdi
cmc
call 0x18087d23d
jns 0x14000c2a2
invalid
jmp qword [rsi - 0x79]

Function at 0x14000924b
Capabilities:
Encode data using base64
Execute anti-debugging instructions

Disassembly:
push r8
je 0x14000cff4
xchg r13, r13
jne 0x14000cff4
jmp fcn.14000102f
mov r8, qword [rsp + 8]
jb 0x140001aff
mov r15, r15
jae 0x140001aff
xor rsi, 0x2b4012bb
ja 0x1400029a1
mov rsi, rsi
jbe 0x1400029a1

Function at 0x140009a3f
Capabilities:
Execute anti-debugging instructions
Packed with generic packer

Disassembly:
call fcn.14000a6eb
inc dword [rbp - 9]
or al, ch

Function at 0x140009d4f
Capabilities:
Encode data using base64
Execute anti-debugging instructions

Disassembly:
push r13
jg 0x14000dc0d
xchg rsi, rsi
jle 0x14000dc0d
jnp 0x14000d640
call fcn.14000d01e
and ebx, 0xffffffca
cmc
call 0x1104426bd
test rdx, 0
call fcn.1400034b1
shr byte [rax + 0x1e], 0xe3
call 0x13f934371
invalid
test eax, 0x820f0000
invalid

Function at 0x14000a0fa
Capabilities:
Encode data using base64
Execute anti-debugging instructions

Disassembly:
mov rdx, qword [rsp + 8]
jg 0x14000ee13
nop
jle 0x14000ee13
mov rcx, rbx
call fcn.14000d6f9
lea rcx, [rsp + 0x30]
mov edi, eax
call fcn.140003b4e
invalid
push rdx
jo 0x140002fff
mov r15, r15
jno 0x140002fff
xor r8d, r8d
call fcn.14000add3
outsd dx, dword [rsi]
or al, ah
fucomp st(0)
Function at 0x14000a7e2
Capabilities:
Encode data using base64
Execute anti-debugging instructions

Disassembly:
mov rdx, qword [rsp + 8]
jb 0x140007879
mov rdx, rdx
jae 0x140007879
jne 0x140008d90
call fcn.14000924b
movsb byte [rdi], byte [rsi]
invalid
invalid
movsxd rdx, dword [rdx]
jg 0x14000de39
mov r14, r14
jle 0x14000de39
push rdx
jl 0x1400053ca
xchg rdi, rdi
jge 0x1400053ca
test edi, 0
jnp 0x14000cd41
and eax, 1
shr ecx, 1
neg eax
test r10, 0
jne 0x140006eaa
and eax, 0xd82374eb
mov r9d, eax
call fcn.140002327
xor byte [rcx], dh
push rbx
call 0x1646d3370
or byte [rdi], cl
add dl, 0x25
add byte [rax], al
mov di, di
jno 0x14000cdf1
shr al, 0x29
cli
invalid

Function at 0x14000a88f
Capabilities:
Encode data using base64
Execute anti-debugging instructions

Disassembly:
push rsi
jb 0x14000ade3
xchg dh, dh
jae 0x14000ade3
jb 0x14000f2e2
call fcn.1400062bf
cdq
mov esi, 0x9de8c1e9
test ebx, 0x9be80000
invalid

Function at 0x14000b123
Capabilities:
Packed with generic packer

Disassembly:
mov rdi, qword [rsp + 8]
jl 0x1400077f2
mov r13, r13
jge 0x1400077f2
mov byte [rsp + rdx + 0x24], 0
call fcn.140007b6f
movsxd rdi, dword [rdi]
jb 0x14000c29d
mov rdx, rdx
jae 0x14000c29d
push rdi
ja 0x1400072a0
xchg r13, r13
jbe 0x1400072a0
pushfq
ja 0x140003be4
xchg dx, dx
jbe 0x140003be4
push rcx
lea rcx, [0x14001193a]
call fcn.14000d8f6
outsd dx, dword [rsi]
pop rcx
mov dh, 0xe4
call 0x18e3dac60
invalid

Function at 0x14000b4e4
Capabilities:
Execute anti-debugging instructions
Packed with generic packer

Disassembly:
call [rdx + 0xf]
invalid
movabs al, byte [0xa2060d8d4851ffff]
add byte [rax], al
call fcn.140007fce
jae 0x140006fb2
invalid
push r8
js 0x14000bb8c
mov r12, r12
jns 0x14000bb8c
mov rbx, rcx
test rsi, 0
jo 0x1400021bb
add rcx, 0x40
movzx esi, r8w
mov r12, rdx
call fcn.140007296
test r13, 0
jb 0x140006fe5
test eax, eax
jne 0x140001a7d
call fcn.14000e03f
adc dword [rax - 0x15], ebx
sub al, 0xe8
mov rsi, qword [rsp + 0x40]
mov dword [rbp], r8d
call int.140006261
insd dword [rdi], dx
sub ebx, edx
invalid
mov r8, qword [rsp + 8]
jb 0x14000c4a1
xchg sp, sp
jae 0x14000c4a1
movsxd r8, dword [r8]
js 0x14000b700
xchg bl, bl
jns 0x14000b700
add rsp, 0x30
pop rdi
ret

Function at 0x14000b6b9
Capabilities:
Encode data using base64
Execute anti-debugging instructions

Disassembly:
mov rbx, qword [rsp + 0x30]
pushfq
jb 0x14000b83c
mov si, si
jae 0x14000b83c
jmp 0x140003b11
ficom word [rdi + 0x42e20000]
int 0x1b
call 0x13fe67829
invalid
mov r12, qword [rsp + 8]
js 0x140008029
mov di, di
jns 0x140008029
js 0x14000aeba
call fcn.14000ec26
add edx, ebp
ret 0xe8e3
movsxd r12, dword [r12]
jmp 0x14000535b
outsd dx, dword [rsi]
add byte [rax], al
add cl, ch
lodsd eax, dword [rsi]
invalid
push r12
je 0x140006756
xchg bh, bh
jne 0x140006756
test edx, 0
jo 0x140005433
xor eax, eax
call fcn.14000d71d
out 0xb5, al
mov ecx, 0x5c41e8e3
pop r12
sub r12, 0x167c05c1
jb 0x14000d15b
xchg r9, r9
jae 0x14000d15b
Function at 0x14000b867
Capabilities:
Encode data using base64
Execute anti-debugging instructions

Disassembly:
popfq
ja 0x140005b8d
xchg ch, ch
jbe 0x140005b8d
cmp qword [rbx + 0x30], 0
call fcn.14000c32f
invalid
ret
pop r14
ja 0x140002113
mov di, di
jbe 0x140002113
test rax, 0
js 0x1400051e1
xor edx, edx
call fcn.140008d39
and esp, dword [rbp + 0x18]
fsub st(0), st(0)
pushfq
jmp 0x14000410f
add r15, 0x1c34e3b
ja 0x140007656
mov r12, r12
jbe 0x140007656
mov dword [rsp + 0x20], 0x7c713c
call fcn.140003bda
call fcn.14000c6e7
imul ebp, eax, 0xe9e80d97
mov eax, dword [rax + 0x10]
call fcn.14000a6eb
adc esp, dword [rbp + 0x5fe8f708]
pop rsi
ret
pop r15
jb 0x140008e5e
xchg bx, bx
jae 0x140008e5e
add r14, 0x273294fa
jg 0x140007b3a
xchg rcx, rcx
jle 0x140007b3a
movsxd r15, dword [r15]
jp 0x140003b71
mov bl, bl
jnp 0x140003b71
sub rsp, 0x20
popfq
jb 0x1400036dd
mov dl, dl
jae 0x1400036dd
mov ecx, dword [rcx + rdi*4]
test bl, 0
jb 0x1400084e0
xor edx, edx
test si, 0
call fcn.14000e03f
mov dword [rsp + rbp*8], esi
sub al, 0xe8
ret
pop r12
jl 0x140006418
xchg bp, bp
jge 0x140006418
sub qword [rsp + 0x10], r15
jg 0x140001731
mov ch, ch
jle 0x140001731
lea rcx, [rsp + 0x50]
call fcn.14000302f
mov rax, qword [0x1400112e3]
call fcn.14000c844
add al, 0x9c
stc
or al, 0xe8
ret
sub qword [rsp + 0x10], r14
jb 0x1400060c8
xchg r15, r15
jae 0x1400060c8
mov eax, dword [rsp + 0x10]
call fcn.140002d76
push rbp
rcl byte [rbp - 0x3c0917c3], cl
add byte [rdi], cl
invalid
mov rbx, qword [rsp + 8]
ja 0x14000cb51
mov al, al
jbe 0x14000cb51
mov r15, qword [rsp + 8]
jmp 0x140005d73
and al, 0x20
add al, ch
sal byte [rcx], 1
add byte [rax], al
ret
push rbx
jg 0x140007d3e
mov r8, r8
jle 0x140007d3e
popfq
ja 0x14000743d
xchg rbx, rbx
jbe 0x14000743d
call fcn.140003605
add esp, dword [rsi]
sub ebp, eax
add r11, 0x16277726
jl 0x14000c900

Function at 0x14000ba34
Capabilities:
Encode data using base64
Execute anti-debugging instructions

Disassembly:
movsxd r15, dword [r15]
jl 0x140005ef5
mov bp, bp
jge 0x140005ef5
push rcx
lea rcx, [0x140011548]
jmp fcn.14000102f
push r15
jg 0x14000d191
mov rdx, rdx
jle 0x14000d191
mov qword [rsp + 0x20], rax
call qword [0x140011962]
call fcn.140008122
invalid
mov r15, qword [rsp + 8]
jo 0x14000537a
xchg rdx, rdx
jno 0x14000537a
mov r8d, 0x36a8b810
call fcn.140002a38
fbstp tbyte [rbp + rbx + 0x1b]
call 0x1645d5d05
or byte [rdi], cl
test byte [rcx - 0x4d], dh
invalid
Function at 0x14000bd16
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov rsi, qword [rsp + 8]
jl 0x140006632
xchg cl, cl
jge 0x140006632
mov rdi, qword [r11 + 0x20]
mov rsp, r11
call fcn.140006926
cli
invalid
test edx, 0
call fcn.14000474a
mov ch, 0xc8
sub dword [0x18c8baefd], 0x820f0824
imul ebx, dword [rsi], 0xff8b4800
jae 0x14000c482
je 0x140006885
call fcn.140005b53
scasb al, byte [rdi]
leave
invalid
movsxd rsi, dword [rsi]
jo 0x140009374
xchg rdx, rdx
jno 0x140009374
mov r12, rax
call fcn.140005154
movabs dword [0x67bfe8e8304634], eax
add byte [rsi], ah
sar byte [rcx - 0x3d], 0xe8
mov rdx, rdi
call fcn.140007804
mov r8d, dword [rsi]
mov rdx, qword [rsi + 0x10]
call fcn.140008973
wait
jne 0x1400065fe
retf 0x48e8
call fcn.140001f69
ret 0x3ee5
push rsi
jl 0x14000546e
mov bh, bh
jge 0x14000546e
ret

Function at 0x14000befe
Capabilities:
Encode data using base64
Execute anti-debugging instructions

Disassembly:
push r10
je 0x14000ea54
mov rbp, rbp
jne 0x14000ea54
mov r10, qword [rsp + 8]
jp 0x14000457b
mov cl, cl
jnp 0x14000457b
mov dword [rsp + 0x38], r12d
call fcn.14000e6a8
fcom dword [rbp + 0xf9de83f]
invalid

Function at 0x14000c004
Capabilities:
Encode data using base64
Execute anti-debugging instructions
Packed with generic packer

Disassembly:
popfq
jb 0x140009c50
mov r8, r8
jae 0x140009c50
test si, 0
call fcn.14000ecc3
and ecx, ebp
cmp eax, 0xffffffff
jne 0x14000ada6
jne 0x140005bbb
call int.140006261
shl byte [0xcb42348b], 1
sbb dword [rcx - 0x75], ecx
int1
mov edi, r8d
call fcn.140007356
outsd dx, dword [rsi]
outsd dx, dword [rsi]
fsub st(0), st(0)
mov dword [rsp + 0x18], esi
mov qword [rsp + 0x20], rdi
push rbp
mov rbp, rsp
test bh, 0
jo 0x14000c86e
call fcn.14000e03f
pop rdi
mov esp, 0xe8e82ceb
invalid
sub qword [rsp + 0x10], r9
je 0x140002eb4
xchg dx, dx
jne 0x140002eb4
mov rdi, qword [rsp + 8]
jp 0x14000458d
xchg r10, r10
movsxd rdi, dword [rdi]
jl 0x14000cd88
xchg dl, dl
jge 0x14000cd88
mov qword [rsp + 8], rbx
call fcn.14000194f
in eax, dx
cmp bl, al
jmp 0xfe858175
movsxd r9, dword [r9]
js 0x14000d9d8
xchg r14, r14
jns 0x14000d9d8
test ebx, 0
call fcn.1400071f0
call 0x128c731b4
mov rdi, qword [rsp + 8]
jg 0x14000716a
mov di, di
jle 0x14000716a
jle 0x140004c5b
call fcn.140005933
shr dword [rax + 0x45e8c1d8], 1
imul edx, edx, 0x3ff
test dx, 0
call fcn.14000e802
mov ebp, 0xe8c49366
ret
pop r9
jp 0x1400095a7
nop
jnp 0x1400095a7
mov edx, 0xa9a01d26
mov r9d, 0xed
mov r8d, 0x230baa8
call fcn.140003bda
lea rcx, [rbp - 0x78]
mov edx, 0x4101b48f
mov rbx, qword [rax + 0x10]
mov r9d, 0xd358692a
mov r8d, 0x373326a3
call fcn.1400077aa
xlatb
xor eax, 0x4ce83825
mov ecx, dword [rsp + 8]
jo 0x140007334
mov al, al
jno 0x140007334
jb 0x14000f170
call fcn.14000a6eb
iretd
xor r9, 0x9bd2fcd
jb 0x1400061f1
xchg rcx, rcx
jae 0x1400061f1
mov eax, r10d
call fcn.140007356
invalid
push rdi
jl 0x1400082fe
mov rsi, rsi
jge 0x1400082fe
jne 0x14000ca8c
call fcn.140006926
or dh, dh
out dx, eax
add ch, al
test dword [rbp - 0x7f], edi
invalid
call fcn.14000b123
adc byte ss:[rdx], dl
invalid
pushfq
jb 0x14000deb7
xchg rcx, rcx
pushfq
js 0x14000ba11
xchg rcx, rcx
jns 0x14000ba11
mov ecx, eax
sar byte [rbx - 1], 1
jmp [rbx - 0x1726f51b]
Function at 0x14000c097
Capabilities:
Encode data using base64
Execute anti-debugging instructions

Disassembly:
mov dh, 0xca
add byte [rax], al
and dword [rbx + 8], 0
call fcn.14000b616
invalid
push rax
movabs dword [0x48e8d4016c070000], eax
mov eax, dword [0x140011d34]
test esi, 0
jne 0x140008814
call fcn.1400052e4
and al, 0xda
loopne 0x1400012a8
call 0x18dd19e30
invalid
mov qword [rdi + 0x10], rbp
mov dword [rdi + 4], esi
test al, 0
call fcn.14000d8f6
jmp 0x1400012c2
invalid
push rdi
mov rbp, rsp
call fcn.14000c097
add dl, byte [rax - 0x1617397b]
sar dword [rcx], 0
mov r12, qword [rdi + 0x10]
test r12, r12
je 0x1400012fb
call fcn.14000d80e
out dx, al
sbb ah, bh
cmp al, ch
test rdi, 0
jne 0x14000c1d3
xor eax, 0x88aadba8
test ah, 0
jb 0x140006253
cmp dword [rcx], eax
call fcn.1400062bf
test dword [0x131e8e245], ebp
invalid
call fcn.140005fd4
call fcn.14000de59
invalid
jge 0x140006252
invalid
invalid
movsxd r13, dword [r13]
je 0x14000c13a
mov rsp, rsp
jne 0x14000c13a
mov r8, qword [rsp + 8]
jb 0x14000f1b1
xchg bl, bl
jae 0x14000f1b1
invalid
fisttp dword [rdi]
test ch, cl
invalid
lea rcx, [0x140011a75]
jmp fcn.14000102f
stosb byte [rdi], al
push r13
jb 0x14000ea9f
mov dx, dx
jae 0x14000ea9f
add rdi, rdi
adc eax, 0x52c4
mov rbx, rax
test rcx, 0
js 0x140009e55
test rax, rax
je 0x140007cf3
je 0x14000b673
test dh, 0
call fcn.1400094b4
sub cl, byte [rbp + 0x41e83ef7]
push r14
jb 0x14000a23d
xchg rbp, rbp
jae 0x14000a23d
mov r13, qword [rsp + 8]
jb 0x140007089
mov r9, r9
jae 0x140007089
jnp 0x14000881a
cmp ecx, dword [rsi + 4]
jbe 0x140002a4e
jbe 0x140001ffd
mov eax, dword [rsi]
lea edx, [rax + rax]
test ch, 0
jb 0x14000f359
cmp eax, ebp
call fcn.1400089e2
int 0x2a
lodsb al, byte [rsi]
and al, 0xe8
movsxd r8, dword [r8]
jl 0x1400046e7
mov ax, ax
jge 0x1400046e7
mov dword [rsp + 0x38], r12d
call int.14000c004
insb byte [rdi], dx
invalid
lea edx, [rsp + 0x70]

Function at 0x14000c770
Capabilities:
Encode data using base64
Execute anti-debugging instructions
Packed with generic packer

Disassembly:
mov edi, ecx
invalid
mov eax, dword [rcx]
pushfq
jp 0x14000a0af
mov ax, ax
jnp 0x14000a0af
mov r8, qword [rsp + 8]
js 0x14000f32f
mov cl, cl
jns 0x14000f32f
cmp qword [rcx + 8], 0xffffffffffffffff
call fcn.140007df1
invalid
xor r8, 0x277115ce
jb 0x14000a5a7
xchg r8, r8
jae 0x14000a5a7
add qword [rsp + 0x10], r8
jb 0x14000db81
mov rdi, rdi
jae 0x14000db81
mov rcx, rsi
call rax
call fcn.140005933
invalid
push r8
jp 0x140004ff0
xchg cx, cx
jnp 0x140004ff0
lea r9, [rsp + 0x50]
mov edx, 0xffff
mov r8d, 0x1001
mov rcx, rbx
call fcn.14000c8cc
invalid
popfq
jmp 0x14000a0ea
movsxd r8, dword [r8]
ja 0x140002d66
xchg al, al
jbe 0x140002d66
js 0x140002c2f
test eax, eax
je 0x14000f358
je 0x1400028f6
mov dword [rsp + 0x70], 0x2a
add byte [rax - 0x73], cl
push rsp
and al, 0x70
lea rdx, [rsp + 0x70]
call fcn.14000e802
jle 0x14000f357
xchg ebx, eax
invalid
Function at 0x14000cb90
Capabilities:
Encode data using base64
Execute anti-debugging instructions

Disassembly:
pushfq
ja 0x14000aabd
mov bp, bp
jbe 0x14000aabd
movsxd r15, dword [r15]
js 0x140004de7
mov r12, r12
jns 0x140004de7
mov r15, qword [rsp + 8]
jl 0x1400057e7
mov dh, dh
jge 0x1400057e7
sub qword [rsp + 0x10], r15
jl 0x14000de86
xchg r12, r12
jge 0x14000de86
mov rbx, rax
mov rax, qword [rax + 0x1140]
call fcn.1400046ae
ret 0xc3f6
xor r15, 0x3f27a899
jo 0x14000966b
mov r12, r12
jno 0x14000966b
push r15
jb 0x140008d26
xchg cx, cx
jae 0x140008d26
jmp fcn.14000102f
pushfq
jmp fcn.140002c6b

Function at 0x14000cd4c
Capabilities:
Encode data using base64
Execute anti-debugging instructions
Packed with generic packer

Disassembly:
ret
pop r12
je 0x140001cc3
mov rbp, rbp
jne 0x140001cc3
ret
call fcn.140006c94
scasb al, byte [rdi]
leave
imul al
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
call fcn.1400015c9
je 0x140009d3d
adc bh, byte [rbx]
call 0x1645d2823
or byte [rdi], cl
mov word [rbp + 0x47], es
add byte [rax], al
mov r11, qword [rsp + 8]
jl 0x14000e423
nop
jge 0x14000e423
popfq
jp 0x1400073b3
nop
jnp 0x1400073b3
imul r10d, r10d, 0x3ff
test ecx, 0
jnp 0x140002047
sub r10d, 0x6106d3cd
call fcn.140009d2a
xchg edx, eax
cmp dword [rcx], edi
sbb al, 0xe8
mov dword [rsp + 0x28], ebp
mov qword [rsp + 0x20], rdi
call fcn.140007e57
fsubr st(1)
leave
call 0xc80ff26f
push r13
invalid
mov byte [rbp - 0x79], bh
invalid
insb byte [rdi], dx
and al, 8
push r11
jl 0x140009cd3
xchg cl, cl
jge 0x140009cd3
movsxd r11, dword [r11]
jl 0x140004eca
xchg r14, r14
jge 0x140004eca
lea rcx, [0x140011bb1]
call fcn.14000c770
push rbx
pop rsp
mov ds, eax
call 0x158474792
call fcn.14000cd4c
movsb byte [rdi], byte [rsi]
or al, 0xbb
xlatb
call 0x1b182f3f4
out dx, eax
invalid

Function at 0x14000d01e
Capabilities:
Encode data using base64
Execute anti-debugging instructions

Disassembly:
push r9
je 0x140002bcb
xchg rsp, rsp
jne 0x140002bcb
mov qword [r11 + 8], rbx
push rdi
call fcn.14000de49
or ah, dh
retf 0xe836

Function at 0x14000d29c
Capabilities:
Encode data using base64
Execute anti-debugging instructions
Packed with generic packer

Disassembly:
movsxd r12, dword [r12]
jo 0x140001e5f
mov rax, rax
jno 0x140001e5f
mov r12, qword [rsp + 8]
jp 0x14000404e
xchg rbx, rbx
jnp 0x14000404e
push r12
jb 0x14000421c
xchg dh, dh
jae 0x14000421c
jne 0x1400012d2
call fcn.14000ec26
lahf
pop rax
ret 0xe8e3

Function at 0x14000d6f9
Capabilities:
Encode data using base64
Execute anti-debugging instructions

Disassembly:
mov qword [rsp + 8], rbx
push rdi
call fcn.14000a6eb
mov edx, 0xe808f720