joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140003350
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
xor r15d, r15d
mov rbp, rdx
mov r13, rcx
cmp dword [rcx + 4], r15d
jbe 0x1400034bd
nop
mov eax, dword [r13]
add rax, r15
add rax, rbp
mov edx, dword [rax]
test edx, edx
jne 0x140003399
cmp dword [rax + 0x10], edx
je 0x1400034bd
mov r12d, dword [rax + 0xc]
mov r14, rdx
mov esi, dword [rax + 0x10]
add r12, rbp
mov rcx, r12
call qword [0x140008140]
mov rdi, rax
test rax, rax
je 0x14000358f
lea rbx, [rsi + rbp]
sub r14, rsi
mov rdx, qword [r14 + rbx]
lea rsi, [r14 + rbx]
test rdx, rdx
jne 0x1400033db
cmp qword [rbx], rdx
je 0x1400034ac
test rdx, rdx
jns 0x140003484
movsxd rax, dword [rdi + 0x3c]
cmp dword [rax + rdi], 0x4550
jne 0x14000358f
mov eax, dword [rax + rdi + 0x88]
mov eax, dword [rax + rdi + 0x1c]
add rax, rdi
mov eax, dword [rax + rdx*4]
add rax, rdi
jne 0x1400034a0
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov edx, 8
mov r8d, 0x208
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rdi, rax
test rax, rax
je 0x14000358f
lea rbx, str.C:UsersMALDEV01DesktopMaldev_codeNew_ModulesPePackerPePackerPePackerLocalPeExec.c
mov edx, 0x5c
mov rcx, rbx
call fcn.140002650
test rax, rax
je 0x14000345c
mov edx, 0x5c
mov rcx, rbx
call fcn.140002650
lea rbx, [rax + 1]
mov r9d, dword [rsi]
lea rdx, str.____Could_Not_Import___s_d____s._d__n
mov dword [rsp + 0x28], 0x6c
mov r8, r12
mov rcx, rdi
mov qword [rsp + 0x20], rbx
call qword [sym.imp.USER32.dll_wsprintfA]
jmp 0x140003553
lea rsi, [rdx + rbp]
lea rcx, [rsi + 2]
call fcn.1400014c0
mov edx, eax
mov rcx, rdi
call fcn.1400011e0
test rax, rax
je 0x1400034df
mov qword [rbx], rax
add rbx, 8
jmp 0x1400033c2
mov eax, dword [r13 + 4]
add r15, 0x14
cmp r15, rax
jb 0x140003380
mov eax, 1
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov edx, 8
mov r8d, 0x208
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rdi, rax
test rax, rax
je 0x14000358f
lea rbx, str.C:UsersMALDEV01DesktopMaldev_codeNew_ModulesPePackerPePackerPePackerLocalPeExec.c
mov edx, 0x5c
mov rcx, rbx
call fcn.140002650
test rax, rax
je 0x14000352f
mov edx, 0x5c
mov rcx, rbx
call fcn.140002650
lea rbx, [rax + 1]
mov dword [rsp + 0x28], 0x77
lea r9, [rsi + 2]
mov r8, r12
mov qword [rsp + 0x20], rbx
lea rdx, str.____Could_Not_Import___s._s____s._d__n
mov rcx, rdi
call qword [sym.imp.USER32.dll_wsprintfA]
mov ecx, 0xfffffff5
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
xor r9d, r9d
mov qword [rsp + 0x20], 0
mov rcx, rax
mov r8d, ebx
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_WriteConsoleA]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rdi
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
xor eax, eax
jmp 0x1400034c2
Function at 0x401010
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
mov rax, qword [0x0041f0a0]
xor edx, edx
mov dword [rax], 1
mov rax, qword [0x0041f0b0]
mov dword [rax], 1
mov rax, qword [0x0041f0c0]
mov dword [rax], 1
mov rax, qword [0x0041f090]
mov dword [rax], 1
mov rax, qword [0x0041ef50]
cmp word [rax], 0x5a4d
je 0x4010d0
mov rax, qword [0x0041f080]
mov dword [0x00422008], edx
mov eax, dword [rax]
test eax, eax
je 0x4010c2
mov ecx, 2
call sym.__set_app_type
mov rcx, 0xffffffffffffffff
call dbg._encode_pointer
mov rdx, qword [0x0041efe0]
mov qword [rdx], rax
mov rdx, qword [0x0041efd0]
mov qword [rdx], rax
mov rax, qword [0x0041f040]
mov edx, dword [rax]
mov rax, qword [sym.imp.msvcrt.dll__fmode]
mov rax, qword [rax]
mov dword [rax], edx
call dbg._setargv
mov rax, qword [0x0041ef00]
cmp dword [rax], 1
je 0x401120
xor eax, eax
add rsp, 0x28
ret
mov ecx, 1
call sym.__set_app_type
jmp 0x401075
movsxd rcx, dword [rax + 0x3c]
add rax, rcx
cmp dword [rax], 0x4550
jne 0x401058
movzx ecx, word [rax + 0x18]
cmp cx, 0x10b
je 0x401133
cmp cx, 0x20b
jne 0x401058
cmp dword [rax + 0x84], 0xe
jbe 0x401058
mov ecx, dword [rax + 0xf8]
xor edx, edx
test ecx, ecx
setne dl
jmp 0x401058
lea rcx, [dbg._matherr]
call dbg.__mingw_setusermatherr
xor eax, eax
add rsp, 0x28
ret
cmp dword [rax + 0x74], 0xe
jbe 0x401058
mov r8d, dword [rax + 0xe8]
xor edx, edx
test r8d, r8d
setne dl
jmp 0x401058
Function at 0x40bc90
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x58
movsxd rbp, dword [0x00422054]
mov rbx, rcx
mov rsi, rdx
mov rdi, r8
test ebp, ebp
jle 0x40bdaa
mov rax, qword [0x00422058]
xor r9d, r9d
add rax, 8
mov r10, qword [rax]
cmp rbx, r10
jb 0x40bcde
mov rdx, qword [rax + 8]
mov r11d, dword [rdx + 8]
add r10, r11
cmp rbx, r10
jb 0x40bd90
add r9d, 1
add rax, 0x18
cmp r9d, ebp
jne 0x40bcc2
mov rcx, rbx
call dbg.__mingw_GetSectionForAddress
test rax, rax
mov r12, rax
je 0x40bde2
lea rbp, [rbp + rbp*2]
shl rbp, 3
mov r13, rbp
add r13, qword [0x00422058]
mov qword [r13 + 0x10], rax
mov dword [r13], 0
call dbg._GetPEImageBase
mov edx, dword [r12 + 0xc]
mov r8d, 0x30
add rax, rdx
lea rdx, [rsp + 0x20]
mov qword [r13 + 8], rax
mov rax, qword [0x00422058]
mov rcx, qword [rax + rbp + 8]
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x40bdc5
mov eax, dword [rsp + 0x44]
lea edx, [rax - 4]
and edx, 0xfffffffb
je 0x40bd89
sub eax, 0x40
and eax, 0xffffffbf
je 0x40bd89
mov r9, rbp
add r9, qword [0x00422058]
mov r8d, 0x40
mov rdx, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x40bdb1
add dword [0x00422054], 1
mov r8, rdi
mov rdx, rsi
mov rcx, rbx
add rsp, 0x58
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
jmp sym.memcpy
xor ebp, ebp
jmp 0x40bceb
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.__VirtualProtect_failed_with_code_0x_x
mov edx, eax
call dbg.__report_error
mov rax, qword [0x00422058]
mov edx, dword [r12 + 8]
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov r8, qword [rax + rbp + 8]
call dbg.__report_error
lea rcx, str.Address__p_has_no_image_section
mov rdx, rbx
call dbg.__report_error
nop
nop word cs:[rax + rax]

Function at 0x40c9c0
Capabilities:
Parse pe header

Disassembly:
cmp word [rcx], 0x5a4d
je 0x40c9d0
xor eax, eax
ret
jmp sym._ValidateImageBase.part.0

Function at 0x40c9e0
Capabilities:
Enumerate pe sections

Disassembly:
movsxd rax, dword [rcx + 0x3c]
add rcx, rax
movzx eax, word [rcx + 0x14]
lea rax, [rcx + rax + 0x18]
movzx ecx, word [rcx + 6]
test ecx, ecx
je 0x40ca21
sub ecx, 1
lea rcx, [rcx + rcx*4]
lea r9, [rax + rcx*8 + 0x28]
mov r8d, dword [rax + 0xc]
cmp r8, rdx
mov rcx, r8
ja 0x40ca18
add ecx, dword [rax + 8]
cmp rdx, rcx
jb 0x40ca23
add rax, 0x28
cmp rax, r9
jne 0x40ca04
xor eax, eax
repz ret

Function at 0x40cad0
Capabilities:
Enumerate pe sections

Disassembly:
push rsi
push rbx
sub rsp, 0x28
mov rbx, qword [0x0041ef50]
cmp word [rbx], 0x5a4d
je 0x40caf0
xor eax, eax
add rsp, 0x28
pop rbx
pop rsi
ret
mov rsi, rcx
mov rcx, rbx
call sym._ValidateImageBase.part.0
test eax, eax
je 0x40cae4
sub rsi, rbx
mov rcx, rbx
mov rdx, rsi
add rsp, 0x28
pop rbx
pop rsi
jmp dbg._FindPESection
Function at 0x40cd40
Capabilities:
Get thread local storage value

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
lea rcx, [0x004229c0]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x004229a0]
test rbx, rbx
je 0x40cd94
mov rbp, qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, qword [sym.imp.KERNEL32.dll_GetLastError]
nop
mov ecx, dword [rbx]
call rbp
mov rsi, rax
call rdi
test eax, eax
jne 0x40cd8b
test rsi, rsi
je 0x40cd8b
mov rax, qword [rbx + 8]
mov rcx, rsi
call rax
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x40cd70
mov rax, qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
lea rcx, [0x004229c0]
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
jmp rax
Function at 0x14002982c
Capabilities:
Clear file content

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x20
mov rbx, rdx
mov rsi, r8
xor edx, edx
mov r14d, ecx
lea r8d, [rdx + 1]
call fcn.14001ce24
xor edx, edx
mov ecx, r14d
mov r12, rax
lea r8d, [rdx + 2]
call fcn.14001ce24
mov rbp, rbx
sub rbp, rax
cmp r12, 0xffffffffffffffff
je 0x14002997c
cmp rax, 0xffffffffffffffff
je 0x14002997c
xor edi, edi
test rbp, rbp
jle 0x140029927
lea edx, [rdi + 1]
mov ecx, 0x1000
call fcn.14001f738
mov rbx, rax
test rax, rax
jne 0x1400298b4
lea edi, [rax + 0xc]
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], edi
jmp 0x14002991d
mov edx, 0x8000
mov ecx, r14d
call fcn.14001a758
mov r15d, eax
mov eax, 0x1000
mov r8d, ebp
cmp rbp, rax
mov r9, rsi
mov rdx, rbx
mov ecx, r14d
cmovge r8d, eax
call fcn.14001db00
cmp eax, 0xffffffff
je 0x1400298fd
cdqe
sub rbp, rax
test rbp, rbp
jg 0x1400298c4
mov edx, r15d
mov ecx, r14d
call fcn.14001a758
jmp 0x14002991d
cmp byte [rsi + 0x38], dil
je 0x140029914
cmp dword [rsi + 0x34], 5
jne 0x140029914
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], 0xd
cmp byte [rsi + 0x30], dil
je 0x14002991d
mov edi, dword [rsi + 0x2c]
mov rcx, rbx
call fcn.14001b4ec
jmp 0x140029990
jns 0x140029990
xor r8d, r8d
mov rdx, rbx
mov ecx, r14d
call fcn.14001ce24
cmp rax, 0xffffffffffffffff
jne 0x140029948
cmp byte [rsi + 0x30], dil
je 0x140029990
mov edi, dword [rsi + 0x2c]
jmp 0x140029990
mov ecx, r14d
call fcn.140018c10
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x140029990
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov byte [rsi + 0x38], 1
mov edi, 0xd
mov dword [rsi + 0x34], eax
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], 0xd
jmp 0x140029990
xor edi, edi
cmp byte [rsi + 0x30], dil
je 0x140029989
mov eax, dword [rsi + 0x2c]
jmp 0x14002998e
mov eax, 0x16
mov edi, eax
xor r8d, r8d
mov rdx, r12
mov ecx, r14d
call fcn.14001ce24
mov rbx, qword [rsp + 0x40]
mov eax, edi
mov rdi, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop r12
ret

Function at 0x14002aa80
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x14002aaa8
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x14002aaa8
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret

Function at 0x14011bed0
Capabilities:
Encode data using xor

Disassembly:
add esp, edi
mov edx, 0xb1fbd713
sahf
invalid

Function at 0x1427551fc
Capabilities:
Encode data using xor

Disassembly:
jmp 0x142755206
push rax
push rcx
push rdx
push rbx
push rbp
push rsi
push rdi
push r8
push r9
push r10
push r11
push r12
push r13
push r14
push r15
pushfq
sub rsp, 8
stmxcsr dword [rsp]
call 0x14275522f
pop rbp
sub rbp, 0x33
sub rbp, 0x27551fc
sub rsp, 0x20
jmp 0x14275524e
mov rax, 0x27551fc
add rax, rbp
add rax, 0x84
mov rcx, 0x60b
mov rdx, 0x77c9b429
xor byte [rax], dl
inc rax
dec rcx
jne 0x14275526d
jmp 0x142755284
invalid
Function at 0x1400024a0
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov rdx, qword [0x140009730]
xor eax, eax
cmp word [rdx], 0x5a4d
jne 0x1400024c0
movsxd r8, dword [rdx + 0x3c]
add r8, rdx
cmp dword [r8], 0x4550
je 0x1400024c8
ret
cmp word [r8 + 0x18], 0x20b
jne 0x1400024c0
movzx eax, word [r8 + 0x14]
sub rcx, rdx
lea rax, [r8 + rax + 0x18]
movzx r8d, word [r8 + 6]
test r8w, r8w
je 0x14000251d
lea edx, [r8 - 1]
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
nop word cs:[rax + rax]
mov r8d, dword [rax + 0xc]
cmp rcx, r8
mov rdx, r8
jb 0x140002514
add edx, dword [rax + 8]
cmp rcx, rdx
jb 0x1400024c0
add rax, 0x28
cmp rax, r9
jne 0x140002500
xor eax, eax
ret

Function at 0x140002520
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x140009730]
xor ecx, ecx
cmp word [rax], 0x5a4d
jne 0x14000253f
movsxd rdx, dword [rax + 0x3c]
add rax, rdx
cmp dword [rax], 0x4550
je 0x140002548
mov eax, ecx
ret
cmp word [rax + 0x18], 0x20b
jne 0x14000253f
movzx ecx, word [rax + 6]
mov eax, ecx
ret

Function at 0x1400025e0
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x140009730]
xor edx, edx
cmp word [rax], 0x5a4d
jne 0x1400025ff
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
je 0x140002608
mov rax, rdx
ret
cmp word [rcx + 0x18], 0x20b
cmove rdx, rax
mov rax, rdx
ret
Function at 0x14000c43c
Capabilities:
Terminate process

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push r15
sub rsp, 0xb0
xor r14d, r14d
mov dword [rsp + 0x20], r14d
lea rcx, [rax - 0x78]
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_GetStartupInfoW]
nop
mov rax, qword gs:[0x30]
mov rbx, qword [rax + 8]
mov esi, r14d
xor eax, eax
lock cmpxchg qword [0x140014c60], rbx
je 0x14000c4a3
cmp rax, rbx
jne 0x14000c496
mov ebx, 1
mov esi, ebx
jmp 0x14000c4a8
mov ecx, 0x3e8
call qword [sym.imp.api_ms_win_core_synch_l1_2_0.dll_Sleep]
jmp 0x14000c47b
mov ebx, 1
mov eax, dword [0x140014c68]
cmp eax, ebx
jne 0x14000c4c0
mov edi, 0x1f
mov ecx, edi
call sub.msvcrt.dll__amsg_exit
jmp 0x14000c52c
mov eax, dword [0x140014c68]
test eax, eax
jne 0x14000c521
mov dword [0x140014c68], ebx
lea r15, [0x14000eba0]
lea rdi, [0x14000eb88]
mov qword [rsp + 0x30], rdi
mov eax, r14d
mov dword [rsp + 0x24], eax
cmp rdi, r15
jae 0x14000c513
test eax, eax
jne 0x14000c517
cmp qword [rdi], r14
je 0x14000c508
mov rax, qword [rdi]
mov rcx, qword [0x14000eb40]
call rcx
mov dword [rsp + 0x24], eax
add rdi, 8
mov qword [rsp + 0x30], rdi
jmp 0x14000c4ea
test eax, eax
je 0x14000c527
mov eax, 0xff
jmp 0x14000c682
mov dword [0x1400143e4], ebx
mov edi, 0x1f
mov eax, dword [0x140014c68]
cmp eax, ebx
jne 0x14000c553
lea rdx, [0x14000eb80]
lea rcx, [0x14000eb48]
call sub.msvcrt.dll__initterm
mov dword [0x140014c68], 2
test esi, esi
jne 0x14000c561
mov rax, r14
xchg qword [0x140014c60], rax
cmp qword [0x140014c80], r14
je 0x14000c594
lea rcx, [0x140014c80]
call fcn.14000ca70
test eax, eax
je 0x14000c594
xor r8d, r8d
lea edx, [r8 + 2]
xor ecx, ecx
mov rax, qword [0x140014c80]
mov r9, qword [0x14000eb40]
call r9
mov rax, qword [sym.imp.msvcrt.dll__wcmdln]
mov rcx, qword [rax]
test rcx, rcx
jne 0x14000c5ad
mov eax, 0xff
jmp 0x14000c682
mov qword [rsp + 0x28], rcx
mov edx, dword [rsp + 0x20]
movzx eax, word [rcx]
cmp ax, 0x20
ja 0x14000c633
test ax, ax
je 0x14000c5c8
test edx, edx
jne 0x14000c633
sub ax, bx
cmp ax, di
ja 0x14000c5de
add rcx, 2
mov qword [rsp + 0x28], rcx
movzx eax, word [rcx]
jmp 0x14000c5c8
test byte [rsp + 0x7c], bl
movzx eax, word [rsp + 0x80]
mov r9d, 0xa
cmovne r9d, eax
mov r8, rcx
xor edx, edx
lea rcx, [0x140000000]
call fcn.140001878
mov dword [0x1400143e0], eax
cmp dword [0x140014400], r14d
jne 0x14000c61c
mov ecx, eax
call qword [sym.imp.msvcrt.dll_exit]
cmp dword [0x1400143e4], r14d
jne 0x14000c631
call qword [sym.imp.msvcrt.dll__cexit]
mov eax, dword [0x1400143e0]
jmp 0x14000c682
cmp ax, 0x22
jne 0x14000c647
mov eax, r14d
test edx, edx
sete al
mov edx, eax
mov dword [rsp + 0x20], eax
add rcx, 2
mov qword [rsp + 0x28], rcx
jmp 0x14000c5b6
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov r14, qword [r11 + 0x28]
mov rsp, r11
pop r15
ret
sub rsp, 0x28
call fcn.140178000
add rsp, 0x28
jmp 0x14000c43c
Function at 0x140958291
Capabilities:
Execute anti-debugging instructions

Disassembly:
jmp 0x140958332
cld
rdtsc
xchg dword [rsp], eax
add rsp, 0
bswap edx
cld
xchg byte [rsp], r8b
lea r13, [rcx + rcx]
ror bpl, 3
mov r12b, 0x3d
jmp 0x1409582bc
pop word [rsp]
mov rcx, qword [rsp]
rdtsc
pop word [rsp]
bsf r11d, r15d
lea r11, [0x530cda67]
jmp 0x1409582e5

Function at 0x140959f61
Capabilities:
Execute anti-debugging instructions

Disassembly:
xchg byte [rsp], cl
xchg word [rsp], bx
mov bx, 0x38ee
lea r11, [r14 + r14]
jmp 0x140959f33
lea rsp, [rsp + 5]
lea r9, [r11 + riz]
mov ecx, dword [rsp + 4]
lea rsp, [rsp + 0xc]
lea rsi, [0xffffffffe10f9a02]
dec bp
jmp 0x140959ee3
push word [rsp]
not r9w
push rcx
neg al
push r12
mov r12b, 0x1d
jmp 0x140959f4a
lea r9, [r13 + r13]
neg eax
rdtsc
lea r9, [rax + rcx]
mov r11w, cx
bts ebp, r10d
jmp 0x140959f18
push qword [rsp + 4]
xchg byte [rsp + 5], cl
mov qword [rsp + 0x12], r9
xchg r8d, eax
jmp 0x140959f7e
mov word [rsp + 0x10], bp
jmp 0x140959ef9
mov rsi, 0x3c41d07d
mov word [rsp + 0xa], ax
setb r13b
jmp 0x140959fc6
shl eax, 0x12
mov eax, dword [rsp + 0x13]
mov word [rsp + 9], r8w
sub rsp, 0xa
cpuid
bt ax, si
jmp 0x140959f68
setle r13b
xchg word [rsp + 0x1b], bx
sbb r8d, esp
not ebp
pushfq
neg rsi
jmp 0x140959fb0

Function at 0x14095a0ef
Capabilities:
Execute anti-debugging instructions

Disassembly:
dec cl
bsf ax, bx
jmp 0x14095a142
xchg byte [rsp + 0x17], r12b
xchg al, cl
pop word [rsp + 0xd]
mov eax, ebx
jmp 0x14095a188
mov byte [rsp + 1], r12b
pop r12w
xchg r9d, r11d
mov eax, dword [rsp]
jmp 0x14095a1a4
mov eax, 0x21538a08
sub rsp, 5
xchg qword [rsp + 7], rsi
xchg r13, rax
pop word [rsp + 0x1a]
mov r8b, byte [rsp + 0x12]
jmp 0x14095a172
push di
mov r11w, word [rsp]
mov r8, qword [rsp + 6]
mov r13b, byte [rsp + 0x14]
lea rax, [rcx + rbp]
jmp 0x14095a208
mov r9, 0x3746c7aa
pop word [rsp + 6]
neg r9b
jmp 0x14095a236
rdtsc
xchg r8w, cx
add rsp, 2
mov al, byte [rsp + 0x1c]
mov cx, word [rsp + 0x1a]
mov rbp, 0xffffffffd006a3dc
jmp 0x14095a1cf
rcr si, 1
neg r8b
adc r12, rcx
and r12b, 0x1b
mov cx, di
xchg word [rsp + 8], r9w
jmp 0x14095a1e5
mov dl, byte [rsp + 0x15]
mov r9w, word [rsp + 0xd]
mov rbp, r10
cpuid
jmp 0x14095a2b0
mov r11w, r15w
bsr ecx, esi
std
pop r13w
pop word [rsp + 0x13]
mov byte [rsp + 0xd], spl
jmp 0x14095a220
sbb si, r10w
mov byte [rsp + 2], r9b
mov r8w, r9w
mov dword [rsp + 7], esp
push word [rsp + 0xb]
xchg qword [rsp], r8
jmp 0x14095a272
add rsp, 0xe
mov ecx, dword [rsp]
bsr r8w, di
sbb al, 0xe5
push word [rsp + 7]
mov word [rsp + 7], r10w
jmp 0x14095a288

Function at 0x14095a1c2
Capabilities:
Execute anti-debugging instructions

Disassembly:
neg r13w
lea rsp, [rsp]
mov r9w, 0x8449
dec r8
jmp 0x14095a083
dec dl
setl r8b
xchg r8w, bx
rcr rsi, 8
cmp r9d, esp
mov r12w, 0xc1c6
jmp 0x14095a055
xchg rbp, rcx
push rcx
rdtsc
push word [rsp + 7]
lea r11, [rax + riz + 0x35]
jmp 0x14095a0b0
bsr si, di
rdtsc
rdtsc
add rsp, 0x1d
xor r8w, 0x20e8
bswap r11d
jmp 0x14095a06b
bswap r12
mov r12d, 0x346b44b
call fcn.14095a0c0
mov word [rdi], ds
mov dword [rsp + 5], r13d
xchg r9b, r13b
pop bx
mov r11d, ebp
mov ecx, ebp
push qword [rsp + 9]
jmp 0x14095a099
xchg r13, rax
push qword [rsp + 4]
jmp 0x14095a0d8
Function at 0x14095a8d2
Capabilities:
Execute anti-debugging instructions

Disassembly:
pop r13w
neg r9w
bsf edx, r11d
setbe r12b
jmp 0x14095a8e4
not r13d
bswap eax
rdtsc
mov r8w, si
xchg byte [rsp + 7], r9b
jmp 0x14095a8bc
rdtsc
mov r12d, dword [rsp + 0xe]
mov rbx, rsp
xchg dword [rsp + 0x1b], edx
xchg byte [rsp + 0x10], r11b
not r12d
jmp 0x14095a924
mov dx, r14w
mov r12, qword [rsp + 0x28]
xchg qword [rsp + 0x30], rax
mov byte [rsp + 0xe], r13b
bswap rbp
stc
jmp 0x14095a90e
Function at 0x140960d8a
Capabilities:
Execute anti-debugging instructions

Disassembly:
xchg dword [rsp + 5], r8d
dec r9
mov ax, word [rsp + 5]
xor ax, r11w
mov r12b, 0x16
bswap r8d
jmp 0x140960d9c
adc rcx, rbx
mov qword [rsp], r12
xchg qword [rsp], rdx
push word [rsp + 6]
jmp 0x140960d62
bsf dx, r8w
mov r11b, byte [rsp + 8]
btr rdi, r14
mov si, sp
push r9
mov qword [rsp + 6], r15
jmp 0x140961491
mov al, 0x6b
pop r12w
setp r8b
xchg word [rsp + 0x1b], ax
jmp 0x140960e41
lea rsi, [r15*4]
mov ax, word [rsp + 1]
lea rcx, [r9 + riz + 0xc7]
sub rsp, 0xd
not rbx
mov r11b, byte [rsp + 0x1b]
jmp 0x140960dd9
mov al, r8b
pop r11
push r14w
inc r8w
rdtsc
jmp 0x140960e57
xchg bx, r12w
pop qword [rsp + 0xe]
mov byte [rsp + 0x17], bl
lea rax, [rsi + r13]
jmp 0x140960e12
pop di
rdtsc
xchg word [rsp + 0xc], dx
xchg r11b, dl
push r13
pop word [rsp + 0x16]
jmp 0x140960e28
mov rdi, 0xffffffffbf0b41af
mov word [rsp + 6], bx
add rsp, 0xf
jmp 0x140960eb5
bswap r12d
sub rsp, 0x12
mov r11w, r9w
mov rbx, qword [rsp + 0xb]
xchg dword [rsp + 0xc], r12d
mov r11d, 0x36cdc337
jmp 0x140960def
rdtsc
cld
neg r9
mov r8w, word [rsp]
mov edx, dword [rsp]
rcr r10d, 0x19
jmp 0x140960ed3
mov r9, 0xffffffffadae1ccb
mov si, bx
mov r8w, word [rsp]
mov esi, 0xea18af89
add rsp, 5
mov r9w, r12w
jmp 0x140960e8f
rdtsc
mov dil, 0x77
mov dl, byte [rsp]
mov byte [rsp], r15b
xchg r8, rcx
mov ecx, r11d
jmp 0x140960f24
bsf cx, bx
xchg ecx, edi
lea rcx, [rcx + r9]
mov ebx, r8d
not r12d
mov r10w, 0xc957
jmp 0x140960e6f
setbe r8b
mov edx, ecx
lea rsp, [rsp]
bsr edi, edx
jmp 0x140960f71
mov r8d, dword [rsp]
add rsp, 0
btr rdi, rdx
ror di, 0xc
mov edx, dword [rsp]
mov esi, 0x5cadcb2
jmp 0x140960f0e
inc rax
mov bx, di
setnp sil
sbb di, 0x95eb
jmp 0x140960f9f
bsr r10, rbx
mov r11b, bl
mov r11w, r10w
bsf edx, r12d
cpuid
push ax
jmp 0x140960f3e
mov sil, 0x50
add rsp, 0
mov dx, r12w
cmc
lea rcx, [rbp + riz - 0x7c]
mov r9w, word [rsp]
jmp 0x140960f54
mov r11w, bx
clc
xchg esi, r11d
mov eax, dword [rsp]
pop si
jmp 0x140960fcd
inc bl
mov rcx, 0x31b9ad1b
mov sil, dil
mov byte [rsp + 1], dl
xchg ebx, r8d
mov edx, r12d
jmp 0x140960f89
setae r9b
mov r8w, 0x4717
cpuid
std
mov r8b, bpl
jmp 0x1409613b4
btc r10w, sp
xchg r8b, r9b
bswap ecx
xchg r8, r12
mov ecx, 0x645ccfb2
jmp 0x140960fb7
bts rbx, rdx
not rdx
mov r12w, word [rsp + 8]
pop rdx
xchg di, cx
xchg word [rsp], r10w
jmp 0x140960ef4
lea rsp, [rsp]
setge sil
bsf rsi, rcx
mov r10, rcx
jmp 0x140961203
bsf r8, r9
rcl r9w, 4
mov r12b, 0x1f
xchg r8d, r10d
mov bx, r13w
neg r8b
jmp 0x140961002
cmp r9b, bl
add rsp, 0
sete r11b
call fcn.1409610e1
lea r11, [r10 + r14]
cmc
clc
mov byte [rsp], r11b
mov rdi, qword [rsp]
clc
jmp 0x140961018
mov r10w, bx
xchg byte [rsp], dl
cpuid
mov edx, r14d
mov cx, 0xf4b2
neg rbx
jmp 0x140961316
push word [rsp + 7]
mov r9d, r12d
rdtsc
not r9w
pop r10
pop si
jmp 0x140960fe7