joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1404de884
Capabilities:
Encode data using base64
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
sete ah
mov eax, ebx
mov ax, 0xe19
push rsi
jmp 0x1404de8b7
push rdi
not al
push r12
movsx rax, bx
push r14
cbw
movsx rax, cx
push r15
mov eax, 0x1470
jmp 0x1404de8d4
call fcn.14044aa15
sub rsp, rax
mov rax, qword [0x1400b7288]
btr r14w, 0x9d
btc r14w, r14w
and bl, 0x3d
xor rax, rsp
movzx rbx, r13w
mov qword [rsp + 0x1460], rax
lahf
movsxd r10, edx
shl r12, 0x5f
add r14, rcx
rcl r14b, cl
mov rbx, rcx
lahf
sar r15w, cl
sar r14d, 0xe1
mov rax, r10
rol edi, cl
ror cx, 0x5a
mov r14d, r9d
cmp bl, 0x56
sar rax, 6
sbb dl, r8b
and dil, 0xd0
lea rcx, [0x1400ba940]
or di, r8w
and r10d, 0x3f
stc
add dil, al
ror r12d, 0xf9
lea r14, [r14 + r8]
shrd r12, r14, 0x26
add dl, 0xa6
mov r15, r8
mov rdi, r8
shld dx, r15w, 0x8a
cmp r12, rsp
mov rax, qword [rcx + rax*8]
shr r12w, 0xe0
lea rdx, [r10 + r10*8]
sbb r12w, ax
ror r12b, 0x63
setge r12b
mov r12, qword [rax + rdx*8 + 0x28]
sub eax, eax
clc
test bpl, 0xec
mov qword [rbx], rax
stc
cmp r8, r14
jmp 0x1404de997
mov dword [rbx + 8], eax
jmp 0x1404de99f
jae 0x1404deb46
lea rax, [rsp + 0x50]
cmp rdi, r14
jmp 0x1404de9b2
jae 0x1404dea12
movzx ecx, word [rdi]
add rdi, 2
jmp 0x1404de9c4
cmp cx, 0xa
jmp 0x1404de9cd
jne 0x1404de9e3
mov edx, 0xd
mov word [rax], dx
cmp r15b, r12b
clc
add rax, 2
mov word [rax], cx
jmp 0x1404de9ef
add rax, 2
shl ecx, cl
lea rcx, [rsp + 0x6f8]
cmp r12d, r9d
cmp r13b, 0x1f
cmp rax, rcx
jmp 0x1404dea0c
jb 0x1404de9aa
and qword [rsp + 0x38], 0
btr cx, 0xe0
bsf cx, si
movzx r9d, sp
lea rcx, [rsp + 0x50]
add r8b, dil
clc
and qword [rsp + 0x30], 0
cmp sp, dx
lea r8, [rsp + 0x50]
clc
movsx r9w, cl
sub rax, rcx
xchg cl, r9b
bsf r9d, r10d
btc cx, 0x88
mov dword [rsp + 0x28], 0xd55
shr cl, cl
lea rcx, [rsp + 0x700]
test r13d, 0x1c13a2c
sar rax, 1
jmp 0x1404dea72
mov qword [rsp + 0x20], rcx
neg r9b
and r9b, bl
mov r9d, eax
ror ch, cl
inc ch
mov ecx, 0xfde9
sub edx, edx
call fcn.1404cb883
mov ebp, eax
test eax, eax
jmp 0x1404dea99
je 0x1404deb38
xor esi, esi
cmc
test eax, eax
jmp 0x1404deaa9
je 0x1404deb1f
and qword [rsp + 0x20], 0
lea rdx, [rsp + 0x700]
bt r8w, 0x2c
shrd cx, si, 0x4a
jmp 0x1404deacd
mov ecx, esi
movzx r8d, r15w
seto r8b
lea r9, [rsp + 0x40]
bts r8w, r15w
cmc
mov r8b, r10b
mov r8d, ebp
lea rdx, [rdx + rcx]
cmp r11b, cl
mov rcx, r12
clc
sub r8d, esi
jmp 0x1404deafb
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jmp 0x1404deb08
je 0x1404deb38
add esi, dword [rsp + 0x40]
cmp esi, ebp
jmp 0x1404deb19
jb 0x1404deaaf
mov eax, edi
cmp dil, 0xe3
sub eax, r15d
mov dword [rbx + 4], eax
cmp rdi, r14
jmp 0x1404deb33
jmp 0x1404de99f
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rbx], eax
setle cl
movsx ecx, di
mov rax, rbx
sal rcx, 0xda
mov rcx, qword [rsp + 0x1460]
xor rcx, rsp
jmp 0x1404deb5d
call fcn.1404a2014
lea r11, [rsp + 0x1470]
movsx r15, dx
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x40]
cmova r12w, bx
mov rsp, r11
bswap r12
pop r15
mov sil, r8b
pop r14
movsx r12, dx
cmovbe edi, r13d
bswap r12d
pop r12
movsx rsi, di
pop rdi
jmp 0x1404deba6
pop rsi
jmp 0x1404debac
ret
Function at 0x1404e218a
Capabilities:
Allocate thread local storage

Disassembly:
push rbx
dec bx
xor r9b, 0xb1
test ebx, 0x1bfa3dff
sub rsp, 0x20
inc r9w
mov rbx, rcx
btr dx, cx
lea r9, [0x1400c8e90]
add r8b, 0xe1
xor r8b, 0x35
movsxd rdx, eax
xor ecx, ecx
mov rdx, rdi
cqo
cmove dx, r10w
lea r8, [0x1400c8e88]
mov dl, 0xa6
setge dl
jmp 0x1404e21d7
lea rdx, [0x1400cfb70]
jmp 0x1404e21e3
call fcn.1404e24a0
test rax, rax
je 0x1404e2207
mov rcx, rbx
bt rbx, r11
add rsp, 0x20
bswap bx
pop rbx
push qword [0x1400b8d90]
ret
add rsp, 0x20
movzx ebx, bx
movzx bx, r8b
movsxd rbx, r14d
pop rbx
jmp 0x1404e221c
jmp qword [sym.imp.KERNEL32.dll_TlsAlloc]

Function at 0x1404e2326
Capabilities:
Set thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
clc
push rdi
sub r8b, al
bts rbx, r8
sub rsp, 0x20
xchg r8b, r8b
mov rbx, rdx
xchg r8b, r9b
movsxd rdx, eax
movsx r8w, cl
lea r9, [0x1400c8ea8]
jmp 0x1404e2355
mov edi, ecx
movsx edx, bp
cdq
lea rdx, [0x1400cf748]
mov ecx, 3
movzx r8, r14w
not r8b
movsx r8d, r15w
lea r8, [0x1400c8ea0]
call fcn.1404e24a0
mov rdx, rbx
mov ecx, edi
test r9b, cl
cmp r15, 0x98a5c4d
test rax, rax
je 0x1404e23a1
call qword [0x1400b8d90]
jmp 0x1404e23a7
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
movzx edi, sp
jmp 0x1404e23b8
pop rdi
jmp 0x1404e23be
ret
Function at 0x1404e3ab3
Capabilities:
Check for software breakpoints
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
xor r9d, r9d
movsx r8, di
adc r8b, bl
mov r8, rcx
clc
test edx, edx
jmp 0x1404e3acd
jne 0x1404e3b4f
mov rdx, rcx
jmp 0x1404e3adf
and r8d, 0xf
cmc
cmp r14w, di
and rdx, 0xfffffffffffffff0
clc
cmp r10b, r12b
or r10d, 0xffffffff
jmp 0x1404e3af9
xorps xmm0, xmm0
mov ecx, r8d
jmp 0x1404e3b04
shl r10d, cl
jmp 0x1404e3b0c
pcmpeqb xmm0, xmmword [rdx]
pmovmskb eax, xmm0
and eax, r10d
jne 0x1404e3b39
add rdx, 0x10
jmp 0x1404e3b26
xorps xmm0, xmm0
pcmpeqb xmm0, xmmword [rdx]
pmovmskb eax, xmm0
test eax, eax
je 0x1404e3b1d
bsf eax, eax
stc
jmp 0x1404e3b42
add rax, rdx
jmp 0x1404e3b4a
jmp 0x1404e3c84
cmp dword [reloc.d2d1.dll_Ordinal_1], 2
jmp 0x1404e3b5b
jge 0x1404e3cb3
movzx eax, dl
and r11b, r15b
ror cl, cl
or r10d, 0xffffffff
and cx, cx
mov ecx, eax
mov r11, r8
cmp cx, ax
jmp 0x1404e3b7d
shl ecx, 8
and r11, 0xfffffffffffffff0
stc
test r9b, 0x4e
test dl, r15b
or ecx, eax
stc
and r8d, 0xf
movsx rax, r8w
seto ah
jmp 0x1404e3b9f
mov eax, r10d
movd xmm0, ecx
mov ecx, r8d
jmp 0x1404e3bae
pshuflw xmm1, xmm0, 0
xorps xmm0, xmm0
pcmpeqb xmm0, xmmword [r11]
pmovmskb ebx, xmm0
shl r10d, cl
jmp 0x1404e3bc7
pshufd xmm2, xmm1, 0
movdqa xmm0, xmm2
shl eax, cl
jmp 0x1404e3bd7
pcmpeqb xmm0, xmmword [r11]
pmovmskb edx, xmm0
and edx, r10d
test rdx, rdi
cmc
and ebx, eax
jmp 0x1404e3bee
jne 0x1404e3c42
bsr ecx, edx
jmp 0x1404e3bfc
xorps xmm1, xmm1
movdqa xmm0, xmm2
lea rcx, [rcx + r11]
cmp r13, 0x368e14ee
test edx, edx
jmp 0x1404e3c15
cmovne r9, rcx
clc
add r11, 0x10
jmp 0x1404e3c23
pcmpeqb xmm1, xmmword [r11]
pcmpeqb xmm0, xmmword [r11]
pmovmskb ebx, xmm1
pmovmskb edx, xmm0
test ebx, ebx
jmp 0x1404e3c3c
je 0x1404e3bf4
mov eax, ebx
neg eax
and eax, ebx
dec eax
movzx rbx, r10w
and edx, eax
bsr ecx, edx
cbw
xor ah, 0x59
mov rax, r15
add rcx, r11
neg ah
bt ax, 0x99
test edx, edx
movzx ax, r14b
cmovne r9, rcx
bswap rbx
lahf
mov rax, r9
mov bx, 0x5f30
movsx rbx, cx
movsx bx, r11b
mov rbx, qword [rsp + 8]
ret
movsx eax, byte [r8]
cmp r15b, 0xcc
cmc
cmp eax, edx
jmp 0x1404e3c9a
cmove r9, r8
cmp eax, r14d
test r9b, 0xdc
cmp byte [r8], 0
je 0x1404e3c74
inc r8
cmc
test r8b, 0xf
jmp 0x1404e3cbc
jne 0x1404e3c8a
movzx eax, dl
jmp 0x1404e3cca
movd xmm0, eax
pcmpistri xmm0, xmmword [r8], 0x40
jae 0x1404e3ced
movsxd r9, ecx
add r9, r8
jmp 0x1404e3ce6
pcmpistri xmm0, xmmword [r8], 0x40
je 0x1404e3c74
add r8, 0x10
jmp 0x1404e3cfc
jmp 0x1404e3cce
Function at 0x14061b058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.14061b1df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x14061b089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x14061b06f
add dl, dl
jne 0x14061b096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x14061b0f6
xor eax, eax
add dl, dl
jne 0x14061b0a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x14061b1ad
add dl, dl
jne 0x14061b0b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x14061b0c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x14061b0d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x14061b0dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x14061b0ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x14061b07e
mov eax, 1
add dl, dl
jne 0x14061b106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x14061b113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x14061b0fb
sub eax, ebx
mov ebx, 1
jne 0x14061b14c
mov ecx, 1
add dl, dl
jne 0x14061b12e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x14061b13b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x14061b123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14061b07e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x14061b168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x14061b175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x14061b15d
cmp eax, 0x7d00
jae 0x14061b19b
cmp eax, 0x500
jb 0x14061b196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14061b07e
cmp eax, 0x7f
ja 0x14061b19e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14061b07e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x14061b1d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x14061b07e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x14000ff1c
Capabilities:
Execute anti-debugging instructions

Disassembly:
push qword [rsp + 3]
js 0x14000ff40
jns 0x14000ff4b
movabs r10, 0xffffffffc000a54c
jmp 0x14001061a
pop word [rsp + 3]
jmp fcn.14000ff45
movabs r9, 0x180000000
jmp 0x14001094b
push r10
jmp 0x140010640
mov r8b, byte [rsp]
push r15
cpuid
lea r13, [rsi*4]
jmp 0x140010bdf
bswap ecx
call fcn.1400106c5
jmp 0x140010719
cpuid
mov r11d, r12d
lea rbx, [r15 + riz + 0x7206f7ef]
rdtsc
rdtsc
jmp 0x1400107c1
mov r9d, r13d
bts ecx, ecx
setnp al
jmp 0x140010766
mov r9d, r13d
bts ecx, ecx
setnp al
jmp 0x140010792
cpuid
dec r8w
jmp 0x140010774
not rbx
xchg r14b, cl
bsr rcx, r13
jmp 0x1400107f4
ror r12d, 0
jns 0x140010768
cpuid
dec r8w
not rbx
xchg r14b, cl
bsr rcx, r13
jmp 0x1400107f4
bsr r14, rbp
jne 0x1400107d5
mov r10, qword [rsp]
push r9
lea r15, [r9 + r14]
jmp 0x1400107dd
xchg rdx, r8
lea rdx, [rbx + rsi]
mov r13, r10
neg ebx
jbe 0x14001075d
ja 0x140010747
mov r10, qword [rsp]
push r9
jmp 0x14001082e
add rsp, 1
rdtsc
jmp 0x140010838
sub rsp, 0x1b
lea rsp, [rsp + 3]
lea rsp, [rsp + 0x18]
not r12d
mov r15, 0xffffffffdad74ecd
jmp 0x1400107aa
mov al, byte [rsp]
mov eax, r14d
mov r10, qword [rsp]
mov r9b, byte [rsp]
mov edx, 0x484755b0
lea rdi, [rdx + r8]
jmp 0x14001085c
lea r15, [r9 + r14]
add rsp, 1
rdtsc
lea rsp, [rsp + 7]
xor r12d, 0x5f6d96a0
jmp 0x14001080e
cpuid
mov rax, r10
jmp 0x1400108a4
shr r10b, 7
jb 0x140010846
cpuid
mov rax, r10
jmp 0x1400108a4
jmp 0x1400108d2
dec r12d
mov edi, dword [rsp]
setle al
cmp ecx, r12d
je 0x14001088e
xchg r13, r10
btc r14, rbx
lea r13, [rax + riz - 0xfa88]
bt r14, r8
jmp 0x140010928
xchg r13, r10
btc r14, rbx
lea r13, [rax + riz - 0xfa88]
jmp 0x140010924
mov cx, word [rsp]
mov r9b, 0x85
jmp 0x14000ff52
bt r14, r8
ror r12d, 0
mov r9d, r12d
not r10w
jmp 0x14001090d
lea r8, [r10 + riz - 0x4fc3]
jmp 0x140010988
sub rsp, 0x12
jbe 0x140010935
lea r8, [r10 + riz - 0x4fc3]
cpuid
call fcn.1400109ae
lahf
out 0x11, al
nop
adc esp, dword [rsi - 0x75]
fadd dword [rcx + 0xf]
sahf
invalid
mov bx, ax
setle r14b
call fcn.1400106a6
mov word [rsp + 0xb], bx
lea rsp, [rsp + 2]
jmp 0x140010a35
cpuid
mov word [rsp + 0xb], bx
jmp 0x140010a30
mov bx, ax
setle r14b
lea rbp, [rsp + 8]
clc
jns 0x1400106e2
bswap ecx
jmp 0x1400106e4
lea rsp, [rsp + 2]
add r12, r9
mov r14w, word [rsp]
mov r9d, 0xfc6e4dba
call fcn.140010a1a
xchg edx, r14d
add r12, qword [rbp + riz]
mov r15b, r12b
shl r8b, cl
jmp 0x140010ae4
bswap ebx
xchg r13w, di
jmp fcn.140010a93
jl 0x140010a5c
bswap ebx
xchg r13w, di
jmp fcn.140010a93
mov r12d, dword [rsp + 0x98]
lea r11, [rbp*8]
dec bp
jle 0x140010a00
jg 0x140010965
lea rsi, [rsi + riz - 0xd]
xchg r15b, r13b
pushfq
push rax
jmp 0x140010ca9
btr r10, r9
bsr bx, r14w
mov r13, 0x517ac109
push qword [rsp + 0x28]
ret 0x30
sub rsp, 0xf
mov ax, si
lea rsp, [rsp + 7]
xchg qword [rsp + 0x28], rsi
bsr cx, r10w
xchg rcx, r15
jmp 0x140010c74

Function at 0x14001056d
Capabilities:
Execute anti-debugging instructions

Disassembly:
jmp 0x1400105da
mov qword [rsp], r15
push word [rsp + 5]
mov qword [rsp], r8
mov dword [rsp + 2], ecx
lea rsp, [rsp + 2]
lea rax, [rax + riz + 0x35]
call fcn.14001056f
Function at 0x1400105fa
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov byte [rsp + 0x14], sil
mov qword [rsp + 0xc], rbp
lea rsp, [rsp + 2]
jmp 0x140010630
mov qword [rsp + 0x68], r15
lea rsp, [rsp + 0x68]
pushfq
jmp 0x14000ff25

Function at 0x1400106c5
Capabilities:
Execute anti-debugging instructions

Disassembly:
setle bl
jmp 0x1400106c7
jmp 0x1400106af
sub rsp, 0x230
jmp 0x1400106ff
mov rsi, rsp
mov r9, rax
mov r13, rdi
and dx, 0x4c50
jns 0x1400106e9
cpuid
jmp 0x14001071b

Function at 0x1400120a5
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dword [rsp + 3], eax
mov byte [rsp + 5], dl
pushfq
pop word [rsp + 3]
jmp 0x1400120db
lea rsp, [rsp + 6]
mov qword [rsp + 0x18], r14
call fcn.1400120c5

Function at 0x1400120c5
Capabilities:
Execute anti-debugging instructions

Disassembly:
movabs rdx, 0xffffffffc000a54c
jmp 0x140012210
push word [rsp + 5]
je 0x140012100
push qword [rsp + 9]
mov dword [rsp + 0xa], esi
jmp 0x140012107
mov dword [rsp + 0xa], esi
pop word [rsp + 7]
mov byte [rsp + 3], r8b
call fcn.14001214d
push rcx
ror byte [rax - 1], 1
je 0x140012128
push qword [rsp + 9]
jmp 0x1400120ea
or ebx, ebp
jrcxz 0x14001216e
pop word [rsp + 7]
pop qword [rsp + 7]
mov byte [rsp + 3], r8b
jmp 0x1400121d1
mov qword [rsp + 0x20], r15
lea rsp, [rsp + 0x20]
jmp 0x1400121db
add byte [rax], al
add dl, cl
pop word gs:[rsp]
mov byte [rsp + 2], bpl
jmp 0x14001211c
pushfq
jmp 0x140011fdc
dec rbx
jo 0x14001221a
jno 0x14001221a
sub dword [rbp + 0x9bf4c25], esi
cmp dword [rsi + 0x6aae5334], esp
push rdi
mov esi, 0x8b445289
add al, 0x24
push rdx
mov r8d, dword [rsp]
mov edx, r15d
jmp 0x1400121fa
call fcn.140012265

Function at 0x140012187
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dword [rsp + 3], ecx
push qword [rsp + 1]
pop qword [rsp]
jmp 0x140012238
push word [rsp + 6]

Function at 0x1400121f1
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov qword [rsp], rdi
call fcn.1400121cb

Function at 0x14001221f
Capabilities:
Execute anti-debugging instructions

Disassembly:
jmp 0x14001224f
lea r14, [rsp + 0x10]
sub rsp, 8
jl 0x14001229b
clc
add rsp, 6
call fcn.140012329
sub byte [rbx + 0x66], cl
push qword [rsp + 6]
lea rsp, [rsp + 2]
xchg qword [rsp + 0x18], rcx
push cx
call fcn.1400121f1
adc r12, 0xffffffff911b0ac7
jo 0x140012221
jno 0x140012221
cld
invalid
call 0x1400122c7

Function at 0x140014ce0
Capabilities:
Execute anti-debugging instructions

Disassembly:
or r11d, 0x8a2d0fd6
dec eax
xchg r9d, r15d
jmp 0x140014e86
not dx
xchg r11, rbx
xchg qword [rsp], rbp
Function at 0x140014e37
Capabilities:
Execute anti-debugging instructions

Disassembly:
push qword [rsp + 7]
jne 0x140014ed1
cmc
mov cl, 0xad
mov di, r8w
jmp 0x140014eee
cmc
mov cl, 0xad
mov di, r8w
jmp 0x140014eee
jmp 0x140014ebb
bswap edi
xchg r11b, r9b
mov ecx, r13d
xchg r14w, ax
jmp 0x140014ef7
add r13b, bpl
je 0x140014ed3
bswap edi
jmp 0x140014f11
mov dil, r13b
mov rcx, 0xffffffffc599b62f
mov r15, qword [rsp]
cmp r14b, sil
jmp 0x140014f6d
xchg r11b, r9b
mov ecx, r13d
xchg r14w, ax
jmp 0x140014ef7
lea r9, [r8 + riz + 0xda]
rdtsc
setge bl
jmp 0x140014fb4
not dil
mov r15b, al
not r11d
mov ax, 0x1b02
bswap rsi
jmp 0x140014f79
jge 0x140014f9f
mov ebx, 0xb4dbe2ec
mov ebx, dword [rsp]
jmp 0x140014f41
sub rsp, 7
jno 0x14001512b
rcr r15b, 3
lea rsp, [rsp + 7]
jmp 0x14001504e
mov ebx, 0xb4dbe2ec
mov ebx, dword [rsp]
lea r9, [r8 + riz + 0xda]
rdtsc
setge bl
lea r9, [0xffffffffd51e5fde]
jmp 0x140014f50
bswap rcx
call fcn.140015021
mov al, 0x2c
movabs byte [0x3bc8a939a68a34c5], al
sti
cwde
sti
jmp 0x140014ff2
inc dil
bswap esi
mov cx, 0x4f21
bt si, r15w
je 0x140015008
bswap rcx
jmp 0x140014ff5
rcr r15b, 3
lea rsp, [rsp + 7]
jmp 0x14001504e

Function at 0x140014e5d
Capabilities:
Execute anti-debugging instructions

Disassembly:
movabs rsi, 0xe42814d1
jmp 0x1400153c6
mov r15b, r10b
mov sil, 0xc8
lea rbp, [rbp + riz - 0x96c]
mov edx, esi
rdtsc
call fcn.140014d19
movzx r13, byte [r12]
mov r11d, 0x8a4e23bb
cpuid
jmp 0x140014e29
rol r15b, 2
mov ax, sp
jmp 0x140014e51
mov ax, sp
dec ax
xchg bx, r9w
call 0x140014e5d
sbb dword [rbx + 0x2f9d6e0b], ebx
jle 0x140014e90
mov dx, word [rsp]
mov edx, dword [rsp]
inc edx
jne 0x140014e06
rol r15b, 2
jmp 0x140014e13
dec ax
xchg bx, r9w
call fcn.140014e37
mov r14b, 0xcf
rcr bx, cl
jmp 0x140014e69
inc rdi
xchg r15w, di
dec r11
xchg qword [rsp], rax
mov ecx, ebx
lea rcx, [rax + rdx]
jmp 0x140015334
bswap rcx
shr r15w, cl
lea r9, [rsi + riz - 0xdb]
jmp 0x140014d36
add r14d, 0x2a27bd56
pushfq
call fcn.14001517c
lea rsp, [rsp + 8]
not r13b
lea rax, [r13 + rbp]
jmp 0x140015359
mov dx, word [rsp]
shl dil, 3
jmp 0x14001539b
mov r14b, 0x5d
jmp 0x140015385
mov rdi, r13
mov r11d, dword [rsp]
mov rdx, 0x469f5c1e
jmp 0x140015475
js 0x140015367
mov r14b, 0x5d
jmp 0x140015385
add rdi, rsi
jmp 0x140015402
mov sil, r9b
jmp 0x1400143c1
rcr ax, cl
jp 0x1400153dc
mov sil, r9b
jmp 0x1400143c1
lea rcx, [r9*4]
setp dl
shl rdi, 2
rdtsc
bswap esi
jmp 0x14001543d
Function at 0x140015021
Capabilities:
Execute anti-debugging instructions

Disassembly:
rol dil, 0
xchg rsi, rax
setle r15b
mov r14b, r11b
pushfq
jmp 0x14001502d
mov si, word [rsp + 3]
mov dl, r14b
push r9
jmp 0x14001500a
mov r11d, dword [rsp + 4]
push dx
jns 0x1400150a4
mov r14, 0x7def4da1
jmp 0x140015079
bswap r14d
xchg r14, rsi
xchg r11w, bx
cmp si, r10w
jmp 0x1400150e8
lea rsp, [rsp + 2]
jmp 0x1400150b0
jbe 0x140015063
bswap r14d
xchg r14, rsi
jmp 0x14001508e
xchg r11w, bx
cmp si, r10w
xchg qword [rsp + 0xf], rcx
jmp 0x1400150ed
mov r14, 0x7def4da1
lea rsp, [rsp + 2]
lea rsp, [rsp + 0x18]
not dil
lea rax, [r15*8]
sub rsp, 0x1c
jmp 0x140015080
not dil
xor rsi, rsi
jmp 0x140015114
adc r9w, 0x4d32
neg sil
xchg dx, r15w
xchg r15b, bl
jmp 0x14001514f
xchg qword [rsp + 0xf], rcx
mov r9w, 0x1010
lea rsp, [rsp + 4]
lea rsp, [rsp + 0x18]
jmp 0x1400150c6
xchg dx, r15w
xchg r15b, bl
xchg sil, r11b
jmp 0x140015152
jge 0x1400150d2
adc r9w, 0x4d32
neg sil
jmp 0x1400150fe
add bpl, dil
btr edx, r11d
jns 0x14001515b
bt ecx, ebx
jmp 0x1400151ea
xchg sil, r11b
xchg ebx, ecx
mov r14d, r13d
not bl
jmp 0x140015139
bt ecx, ebx
xchg edi, r9d
rdtsc
inc r12
setne dil
jmp 0x1400151bd
setae al
jmp 0x1400151a9
setae al
call 0x1400151cf
fcom qword [rsi - 0x3c]
movabs dword [0x78cd3e5bcb4ee95e], eax
out dx, al
stc
fsub dword [rsi + 0x45]
xchg ebx, ecx
xchg r11w, r9w
xchg cx, si
bswap r9
btc r11, rbp
jne 0x1400151a6
je 0x140015190
bswap r15
mov eax, edx
xchg edx, edi
pop rsi
jmp 0x14001520a
xchg edi, r9d
rdtsc
jmp 0x140015163
sub rsp, 3
jp 0x14001529a
mov edx, 0xc2501975
jmp 0x140015232
dec r13b
mov dx, r9w
mov dil, 0x63
xchg r9w, r15w
rdtsc
jmp 0x1400151f4
lea rsp, [rsp + 1]
jmp 0x1400152ae
btc r15w, bp
bswap esi
pop si
jmp 0x14001521c
jbe 0x140015254
xchg edi, r15d
mov r14, rbp
jmp 0x14001527e
xchg edi, r15d
mov r14, rbp
lea r14, [rcx + riz - 0x5034a3e2]
mov r9d, dword [rsp]
lea rbx, [r15*8]
mov r11, 0xffffffffbc0fe388
jmp 0x1400152d2
lea r14, [rcx + riz - 0x5034a3e2]
mov r9d, dword [rsp]
lea rbx, [r15*8]
jmp 0x14001526e
mov edx, 0xc2501975
btc r15w, bp
bswap esi
pop si
lea rsp, [rsp + 1]
neg r13b
xchg r15, rax
xchg r9b, al
neg ecx
jmp 0x14001523e
xchg di, bx
mov r11b, byte [rsp]
cpuid
push dx
neg r11
jmp 0x14001530a
xor r13b, 0x74
mov cl, byte [rsp]
neg dx
jno 0x1400152bb
jo 0x1400152ff
push dx
neg r11
jmp 0x14001530a
lea r14, [rsi*4]
call fcn.14001537e
mov word [rdi], es
xchg edi, eax
add dword [rax + 0x3784153a], edi
xchg di, bx
mov r11b, byte [rsp]
cpuid
jmp 0x1400152e0
mov edx, r8d
lea rsp, [rsp + 2]
ror r13b, 0
not dx
btc r14d, ebp
jmp 0x1400153b3
jp 0x1400152e8
lea r14, [rsi*4]
jmp 0x1400152f0

Function at 0x14001537e
Capabilities:
Execute anti-debugging instructions

Disassembly:
jmp 0x140015341
or sil, r9b
jg 0x140015357
jle 0x140015357
Function at 0x140acf058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.140acf1df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x140acf089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x140acf06f
add dl, dl
jne 0x140acf096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x140acf0f6
xor eax, eax
add dl, dl
jne 0x140acf0a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x140acf1ad
add dl, dl
jne 0x140acf0b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140acf0c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140acf0d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140acf0dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x140acf0ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x140acf07e
mov eax, 1
add dl, dl
jne 0x140acf106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140acf113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140acf0fb
sub eax, ebx
mov ebx, 1
jne 0x140acf14c
mov ecx, 1
add dl, dl
jne 0x140acf12e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x140acf13b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140acf123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x140acf07e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x140acf168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x140acf175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140acf15d
cmp eax, 0x7d00
jae 0x140acf19b
cmp eax, 0x500
jb 0x140acf196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x140acf07e
cmp eax, 0x7f
ja 0x140acf19e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x140acf07e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x140acf1d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x140acf07e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20