joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14011a890
Capabilities:
Get system information on windows

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x58
mov ebp, edx
mov r14, rcx
mov dword [rcx + 0x10], edx
test edx, edx
je 0x14011a8d4
mov eax, ebp
lea rbx, [rax*8]
shl rax, 4
lea rsi, [rax + rax*2]
mov rdi, qword [0x140df0d68]
test rdi, rdi
je 0x14011a8e0
lea rbx, [rbx + rbx*2]
cmp rsi, rdi
jbe 0x14011a903
jmp 0x14011a98d
mov qword [r14], 0
jmp 0x14011a9d5
lea rcx, [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov edi, dword [rsp + 0x2c]
mov qword [0x140df0d68], rdi
lea rbx, [rbx + rbx*2]
cmp rsi, rdi
ja 0x14011a98d
test rdi, rdi
jne 0x14011a91e
lea rcx, [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov edi, dword [rsp + 0x2c]
mov qword [0x140df0d68], rdi
cmp rbx, rdi
ja 0x14011a9e7
mov rax, rdi
or rax, rbx
shr rax, 0x20
je 0x14011a93d
mov rax, rdi
xor edx, edx
div rbx
jmp 0x14011a943
mov eax, edi
xor edx, edx
div ebx
bsr rcx, rax
shl rbx, cl
mov eax, dword [r14 + 0x10]
shl eax, cl
mov dword [r14 + 0x10], eax
shl rax, 3
lea rax, [rax + rax*2]
cmp rbx, rax
jne 0x14011aa0b
lea r15, [rbx + rbx]
test rdi, rdi
jne 0x14011a984
lea rcx, [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov edi, dword [rsp + 0x2c]
mov qword [0x140df0d68], rdi
cmp r15, rdi
jbe 0x14011aa2b
test rdi, rdi
jne 0x14011a9a8
lea rcx, [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov edi, dword [rsp + 0x2c]
mov qword [0x140df0d68], rdi
mov rcx, rbx
mov rdx, rdi
call fcn.14011c1e0
mov rdi, rax
xor ecx, ecx
mov rdx, rax
mov r8d, 0x3000
mov r9d, 4
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
test rax, rax
je 0x14011aa4b
mov qword [r14], rax
test ebp, ebp
setne al
add rsp, 0x58
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
mov qword [rsp + 0x20], 0
lea rcx, str....._sanitizer_common_sanitizer_common.h
lea r8, str.__x_______0U__
mov edx, 0x19c
xor r9d, r9d
call fcn.1400c0bd0
mov qword [rsp + 0x20], rax
lea rcx, str....._sanitizer_common_sanitizer_dense_map.h
lea r8, str.__Size______sizeof_BucketT___NumBuckets__
mov edx, 0x2af
mov r9, rbx
call fcn.1400c0bd0
mov qword [rsp + 0x20], rdi
lea rcx, str....._sanitizer_common_sanitizer_dense_map.h
lea r8, str.__Size__2_______GetPageSizeCached____
mov edx, 0x2b0
mov r9, r15
call fcn.1400c0bd0
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov byte [rsp + 0x20], 0
lea rdx, str.DenseMap
lea r8, str.allocate
mov rcx, rdi
mov r9d, eax
call fcn.1400f0c80
int3
Function at 0x14011aa70
Capabilities:
Get system information on windows

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x58
mov rdi, rcx
mov ebx, dword [rcx + 0x10]
mov r14, qword [rcx]
cmp edx, 0x41
mov r9d, 0x40
cmovae r9d, edx
lea eax, [r9 - 1]
test r9d, eax
jne 0x14011aa9d
mov rdx, r9
jmp 0x14011aacf
bsr rax, r9
xor rax, 0x3f
mov ecx, eax
neg cl
mov esi, 1
mov edx, 1
shl rdx, cl
cmp rdx, r9
jbe 0x14011aba5
xor al, 0x3f
mov ecx, eax
shl rsi, cl
cmp rsi, r9
jae 0x14011abc2
mov rcx, rdi
call fcn.14011a890
mov rax, qword [rdi]
test rax, rax
je 0x14011ab81
test r14, r14
je 0x14011ab36
shl rbx, 3
lea rbx, [rbx + rbx*2]
lea r8, [r14 + rbx]
mov rcx, rdi
mov rdx, r14
call fcn.140113f40
mov rdx, qword [0x140df0d68]
test rdx, rdx
jne 0x14011ab21
lea rcx, [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov edx, dword [rsp + 0x2c]
mov qword [0x140df0d68], rdx
mov rcx, rbx
call fcn.14011c1e0
mov rcx, r14
mov rdx, rax
call fcn.1400d9b80
jmp 0x14011ab77
mov qword [rdi + 8], 0
mov ecx, dword [rdi + 0x10]
lea r9d, [rcx - 1]
and r9d, ecx
jne 0x14011abdf
test rcx, rcx
je 0x14011ab77
lea rcx, [rcx + rcx*2]
lea rcx, [rax + rcx*8]
nop dword [rax + rax]
mov dword [rax], 0xffffffff
mov qword [rax + 8], 0xffffffffffffffff
add rax, 0x18
cmp rax, rcx
jne 0x14011ab60
add rsp, 0x58
pop rbx
pop rdi
pop rsi
pop r14
ret
mov qword [rsp + 0x20], 0
lea rcx, str....._sanitizer_common_sanitizer_dense_map.h
lea r8, str.__Buckets______0_
mov edx, 0x289
xor r9d, r9d
call fcn.1400c0bd0
mov qword [rsp + 0x20], rdx
lea rcx, str....._sanitizer_common_sanitizer_common.h
lea r8, str.__size________1ULL_____up__1____
mov edx, 0x1c4
call fcn.1400c0bd0
mov qword [rsp + 0x20], rsi
lea rcx, str....._sanitizer_common_sanitizer_common.h
lea r8, str.__size________1ULL____up___
mov edx, 0x1c5
call fcn.1400c0bd0
mov qword [rsp + 0x20], 0
lea rcx, str....._sanitizer_common_sanitizer_dense_map.h
lea r8, str.___getNumBuckets_____getNumBuckets_____1________0__
mov edx, 0x10f
call fcn.1400c0bd0
int3
Function at 0x14011ac10
Capabilities:
Get system information on windows

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x58
mov ebp, edx
mov r14, rcx
mov dword [rcx + 0x10], edx
test edx, edx
je 0x14011ac4b
mov esi, ebp
mov rbx, rsi
shl rbx, 5
mov rdi, qword [0x140df0d68]
test rdi, rdi
je 0x14011ac57
shl rsi, 4
cmp rbx, rdi
jbe 0x14011ac7a
jmp 0x14011ad00
mov qword [r14], 0
jmp 0x14011ad48
lea rcx, [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov edi, dword [rsp + 0x2c]
mov qword [0x140df0d68], rdi
shl rsi, 4
cmp rbx, rdi
ja 0x14011ad00
test rdi, rdi
jne 0x14011ac95
lea rcx, [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov edi, dword [rsp + 0x2c]
mov qword [0x140df0d68], rdi
cmp rsi, rdi
ja 0x14011ad5a
mov rax, rdi
or rax, rsi
shr rax, 0x20
je 0x14011acb4
mov rax, rdi
xor edx, edx
div rsi
jmp 0x14011acba
mov eax, edi
xor edx, edx
div esi
bsr rcx, rax
shl rsi, cl
mov eax, dword [r14 + 0x10]
shl eax, cl
mov dword [r14 + 0x10], eax
shl rax, 4
cmp rsi, rax
jne 0x14011ad7e
lea r15, [rsi + rsi]
test rdi, rdi
jne 0x14011acf7
lea rcx, [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov edi, dword [rsp + 0x2c]
mov qword [0x140df0d68], rdi
cmp r15, rdi
jbe 0x14011ad9e
test rdi, rdi
jne 0x14011ad1b
lea rcx, [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov edi, dword [rsp + 0x2c]
mov qword [0x140df0d68], rdi
mov rcx, rsi
mov rdx, rdi
call fcn.14011c1e0
mov rdi, rax
xor ecx, ecx
mov rdx, rax
mov r8d, 0x3000
mov r9d, 4
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
test rax, rax
je 0x14011adbe
mov qword [r14], rax
test ebp, ebp
setne al
add rsp, 0x58
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
mov qword [rsp + 0x20], 0
lea rcx, str....._sanitizer_common_sanitizer_common.h
lea r8, str.__x_______0U__
mov edx, 0x19c
xor r9d, r9d
call fcn.1400c0bd0
mov qword [rsp + 0x20], rax
lea rcx, str....._sanitizer_common_sanitizer_dense_map.h
lea r8, str.__Size______sizeof_BucketT___NumBuckets__
mov edx, 0x2af
mov r9, rsi
call fcn.1400c0bd0
mov qword [rsp + 0x20], rdi
lea rcx, str....._sanitizer_common_sanitizer_dense_map.h
lea r8, str.__Size__2_______GetPageSizeCached____
mov edx, 0x2b0
mov r9, r15
call fcn.1400c0bd0
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov byte [rsp + 0x20], 0
lea rdx, str.DenseMap
lea r8, str.allocate
mov rcx, rdi
mov r9d, eax
call fcn.1400f0c80
int3
Function at 0x14011adf0
Capabilities:
Get system information on windows

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x58
mov rbx, rcx
mov r14d, dword [rcx + 0x10]
mov rsi, qword [rcx]
cmp edx, 0x41
mov r9d, 0x40
cmovae r9d, edx
lea eax, [r9 - 1]
test r9d, eax
jne 0x14011ae1e
mov rdx, r9
jmp 0x14011ae50
bsr rax, r9
xor rax, 0x3f
mov ecx, eax
neg cl
mov edi, 1
mov edx, 1
shl rdx, cl
cmp rdx, r9
jbe 0x14011af1f
xor al, 0x3f
mov ecx, eax
shl rdi, cl
cmp rdi, r9
jae 0x14011af3c
mov rcx, rbx
call fcn.14011ac10
mov rax, qword [rbx]
test rax, rax
je 0x14011aefb
test rsi, rsi
je 0x14011aeb3
shl r14, 4
lea r8, [rsi + r14]
mov rcx, rbx
mov rdx, rsi
call fcn.140114610
mov rdx, qword [0x140df0d68]
test rdx, rdx
jne 0x14011ae9e
lea rcx, [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov edx, dword [rsp + 0x2c]
mov qword [0x140df0d68], rdx
mov rcx, r14
call fcn.14011c1e0
mov rcx, rsi
mov rdx, rax
call fcn.1400d9b80
jmp 0x14011aef1
mov qword [rbx + 8], 0
mov ecx, dword [rbx + 0x10]
lea r9d, [rcx - 1]
and r9d, ecx
jne 0x14011af59
test rcx, rcx
je 0x14011aef1
shl rcx, 4
xor edx, edx
nop word cs:[rax + rax]
mov qword [rax + rdx], 0xffffffffffffffff
add rdx, 0x10
cmp rcx, rdx
jne 0x14011aee0
add rsp, 0x58
pop rbx
pop rdi
pop rsi
pop r14
ret
mov qword [rsp + 0x20], 0
lea rcx, str....._sanitizer_common_sanitizer_dense_map.h
lea r8, str.__Buckets______0_
mov edx, 0x289
xor r9d, r9d
call fcn.1400c0bd0
mov qword [rsp + 0x20], rdx
lea rcx, str....._sanitizer_common_sanitizer_common.h
lea r8, str.__size________1ULL_____up__1____
mov edx, 0x1c4
call fcn.1400c0bd0
mov qword [rsp + 0x20], rdi
lea rcx, str....._sanitizer_common_sanitizer_common.h
lea r8, str.__size________1ULL____up___
mov edx, 0x1c5
call fcn.1400c0bd0
mov qword [rsp + 0x20], 0
lea rcx, str....._sanitizer_common_sanitizer_dense_map.h
lea r8, str.___getNumBuckets_____getNumBuckets_____1________0__
mov edx, 0x10f
call fcn.1400c0bd0
int3
Function at 0x14011c1e0
Capabilities:
Print debug messages
Write file on windows

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x30
lea rax, [rdx - 1]
test rdx, rax
jne 0x14011c209
lea rax, [rcx + rdx]
add rax, 0xffffffffffffffff
neg rdx
and rdx, rax
mov rax, rdx
add rsp, 0x30
pop rbx
pop rdi
pop rsi
ret
mov rsi, qword [0x14012c9c0]
mov al, 1
xchg byte [rsi], al
test al, al
jne 0x14011c29f
lea rcx, [0x14012c9c0]
call fcn.1400fae50
mov rcx, qword [0x14012c9c8]
cmp rcx, 0xffffffffffffffff
je 0x14011c2e6
lea rax, [rcx - 1]
cmp rax, 1
ja 0x14011c25f
xor eax, eax
cmp rcx, 1
sete al
or eax, 0xfffffff4
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rcx, rax
test rax, rax
je 0x14011c28a
mov qword [rsp + 0x20], 0
lea rdx, str.IsPowerOfTwo_boundary__n
lea r9, [rsp + 0x2c]
mov r8d, 0x17
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x14011c297
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.IsPowerOfTwo_boundary__n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov byte [rsi], 0
call fcn.1400d8050
xor edi, edi
mov rbx, qword [sym.imp.api_ms_win_core_synch_l1_2_0.dll_Sleep]
jmp 0x14011c2b3
add edi, 1
cmp edi, 0x63
ja 0x14011c2d0
pause
cmp byte [rsi], 0
jne 0x14011c2b0
jmp 0x14011c2d9
xor ecx, ecx
call rbx
cmp byte [rsi], 0
jne 0x14011c2b0
mov al, 1
xchg byte [rsi], al
test al, al
jne 0x14011c2b0
jmp 0x14011c21c
mov qword [rsp + 0x20], 0
lea rcx, str.gotsan.cpp
lea r8, str.__fd_____fd_t__1_______0_
mov edx, 0x250a
xor r9d, r9d
call fcn.1400c0bd0
int3

Function at 0x14011f730
Capabilities:
Get system information on windows

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x58
mov rdi, rdx
mov rsi, rcx
mov al, 1
xchg byte [rcx], al
test al, al
jne 0x14011f7ae
mov rax, qword [rsi + rdi*8 + 8]
test rax, rax
jne 0x14011f7a1
mov rdx, qword [0x140df0d68]
test rdx, rdx
jne 0x14011f773
lea rcx, [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov edx, dword [rsp + 0x2c]
mov qword [0x140df0d68], rdx
mov ecx, 0x100000
call fcn.14011c1e0
mov rbx, rax
xor ecx, ecx
mov rdx, rax
mov r8d, 0x3000
mov r9d, 4
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
test rax, rax
je 0x14011f7dc
mov qword [rsi + rdi*8 + 8], rax
mov byte [rsi], 0
add rsp, 0x58
pop rbx
pop rdi
pop rsi
pop r14
ret
xor ebx, ebx
mov r14, qword [sym.imp.api_ms_win_core_synch_l1_2_0.dll_Sleep]
jmp 0x14011f7bc
add ebx, 1
cmp ebx, 0x63
ja 0x14011f7c5
pause
jmp 0x14011f7ca
xor ecx, ecx
call r14
cmp byte [rsi], 0
jne 0x14011f7b9
mov al, 1
xchg byte [rsi], al
test al, al
jne 0x14011f7b9
jmp 0x14011f747
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov byte [rsp + 0x20], 0
lea rdx, str.TwoLevelMap
lea r8, str.allocate
mov rcx, rbx
mov r9d, eax
call fcn.1400f0c80
int3
Function at 0x14011f810
Capabilities:
Get system information on windows

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x58
mov rdi, rdx
mov rsi, rcx
mov al, 1
xchg byte [rcx], al
test al, al
jne 0x14011f88e
mov rax, qword [rsi + rdi*8 + 8]
test rax, rax
jne 0x14011f881
mov rdx, qword [0x140df0d68]
test rdx, rdx
jne 0x14011f853
lea rcx, [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov edx, dword [rsp + 0x2c]
mov qword [0x140df0d68], rdx
mov ecx, 0x40000
call fcn.14011c1e0
mov rbx, rax
xor ecx, ecx
mov rdx, rax
mov r8d, 0x3000
mov r9d, 4
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
test rax, rax
je 0x14011f8bc
mov qword [rsi + rdi*8 + 8], rax
mov byte [rsi], 0
add rsp, 0x58
pop rbx
pop rdi
pop rsi
pop r14
ret
xor ebx, ebx
mov r14, qword [sym.imp.api_ms_win_core_synch_l1_2_0.dll_Sleep]
jmp 0x14011f89c
add ebx, 1
cmp ebx, 0x63
ja 0x14011f8a5
pause
jmp 0x14011f8aa
xor ecx, ecx
call r14
cmp byte [rsi], 0
jne 0x14011f899
mov al, 1
xchg byte [rsi], al
test al, al
jne 0x14011f899
jmp 0x14011f827
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov byte [rsp + 0x20], 0
lea rdx, str.TwoLevelMap
lea r8, str.allocate
mov rcx, rbx
mov r9d, eax
call fcn.1400f0c80
int3

Function at 0x14011f8f0
Capabilities:
Get system information on windows

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x58
mov rdi, rdx
mov rsi, rcx
mov al, 1
xchg byte [rcx], al
test al, al
jne 0x14011f96e
mov rax, qword [rsi + rdi*8 + 8]
test rax, rax
jne 0x14011f961
mov rdx, qword [0x140df0d68]
test rdx, rdx
jne 0x14011f933
lea rcx, [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov edx, dword [rsp + 0x2c]
mov qword [0x140df0d68], rdx
mov ecx, 0x1000
call fcn.14011c1e0
mov rbx, rax
xor ecx, ecx
mov rdx, rax
mov r8d, 0x3000
mov r9d, 4
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
test rax, rax
je 0x14011f99c
mov qword [rsi + rdi*8 + 8], rax
mov byte [rsi], 0
add rsp, 0x58
pop rbx
pop rdi
pop rsi
pop r14
ret
xor ebx, ebx
mov r14, qword [sym.imp.api_ms_win_core_synch_l1_2_0.dll_Sleep]
jmp 0x14011f97c
add ebx, 1
cmp ebx, 0x63
ja 0x14011f985
pause
jmp 0x14011f98a
xor ecx, ecx
call r14
cmp byte [rsi], 0
jne 0x14011f979
mov al, 1
xchg byte [rsi], al
test al, al
jne 0x14011f979
jmp 0x14011f907
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov byte [rsp + 0x20], 0
lea rdx, str.TwoLevelMap
lea r8, str.allocate
mov rcx, rbx
mov r9d, eax
call fcn.1400f0c80
int3
Function at 0x14011fbc0
Capabilities:
Get system information on windows

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x58
mov rdi, rdx
mov r14, rcx
mov eax, dword [rdx + 0x400000]
mov qword [rcx], rax
xor esi, esi
lea r15, [rsp + 0x28]
mov r13, qword [sym.imp.KERNEL32.dll_GetSystemInfo]
xor ebx, ebx
jmp 0x14011fc1a
mov ecx, 0x100000
call fcn.14011c1e0
add rsi, rax
add rbx, 1
cmp rbx, 0x8000
je 0x14011fc46
mov rax, qword [rdi + rbx*8 + 0x400010]
test rax, rax
je 0x14011fc0d
mov rdx, qword [0x140df0d68]
test rdx, rdx
jne 0x14011fc00
mov rcx, r15
call r13
mov edx, dword [rsp + 0x2c]
mov qword [0x140df0d68], rdx
jmp 0x14011fc00
mov r15, qword [0x140e5b0a8]
xor edi, edi
lea rbx, [0x140e1b098]
lea r12, [rsp + 0x28]
xor ebp, ebp
jmp 0x14011fc7a
mov ecx, 0x40000
call fcn.14011c1e0
add rdi, rax
add rbp, 1
cmp rbp, 0x8000
je 0x14011fca3
mov rax, qword [rbx + rbp*8 + 8]
test rax, rax
je 0x14011fc6d
mov rdx, qword [0x140df0d68]
test rdx, rdx
jne 0x14011fc60
mov rcx, r12
call r13
mov edx, dword [rsp + 0x2c]
mov qword [0x140df0d68], rdx
jmp 0x14011fc60
add rsi, r15
lea rax, [rdi + rsi]
add rax, 0x10010
mov qword [r14 + 8], rax
mov rax, r14
add rsp, 0x58
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x18008cef2
Capabilities:
Execute anti-debugging instructions
Parse pe header

Disassembly:
sub edx, edx
xor ecx, ecx
bswap r8
movsx r8w, cl
lea r8d, [rdx + 1]
jmp 0x18012891d
mov dword [rsp + 0x18], r8d
clc
cmp rdi, 0x3f33e46
mov dword [rsp + 0x10], edx
clc
cmp r9b, 0x46
push rbp
mov rbp, rsp
test dil, sil
cmp r9w, 0x74b3
test r15d, 0x7ec063d1
sub rsp, 0x50
mov qword [rbp - 0x20], 0xfffffffffffffffe
stc
jmp 0x180128959
mov qword [rsp + 0x60], rbx
mov ebx, ecx
test r8d, r8d
jmp 0x180128968
jne 0x1801289f9
sub ecx, ecx
jmp 0x180128975
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
jmp 0x180128983
je 0x1801289f9
mov ecx, 0x5a4d
cmp dil, 0x1c
cmp word [rax], cx
jmp 0x18012899a
jne 0x1801289f9
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmc
test r8w, 0x1d24
cmp dword [rcx], 0x4550
jmp 0x1801289b9
jne 0x1801289f9
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jmp 0x1801289cd
jne 0x1801289f9
cmp dword [rcx + 0x84], 0xe
jbe 0x1801289f9
cmp dword [rcx + 0xf8], 0
je 0x1801289f9
mov ecx, ebx
jmp 0x1801289f4
call fcn.180128b47
mov byte [rbp + 0x28], 0
rdtsc
lea rax, [rbp + 0x18]
mov qword [rbp - 0x18], rax
rdtsc
lea rax, [rbp + 0x20]
cwd
mov qword [rbp - 0x10], rax
mov cx, bp
lea rax, [rbp + 0x28]
movzx cx, spl
cwd
mov qword [rbp - 8], rax
mov eax, 2
not rdx
movzx r9, r8w
mov dword [rbp - 0x2c], eax
seto r9b
mov rdx, 0x7368144d
mov dword [rbp - 0x28], eax
movsx rdx, ax
movsx r9w, sil
lea r9, [rbp - 0x2c]
movzx ecx, bp
jmp 0x180128a5a
lea r8, [rbp - 0x18]
movzx cx, r9b
movsx dx, ah
lea rdx, [rbp - 0x28]
movsx ecx, si
bswap rcx
movzx rcx, r10w
lea rcx, [rbp - 0x30]
jmp 0x180128a7e
call fcn.1801286fa
nop
cmp dword [rbp + 0x20], 0
je 0x180128a9e
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
jmp 0x180128a9d
ret
mov ecx, ebx
call fcn.180128aab
int3

Function at 0x18008e096
Capabilities:
Execute anti-debugging instructions
Parse pe header

Disassembly:
sub r8d, r8d
lea edx, [r8 + 2]
jmp 0x180095fd0
jmp 0x18012891d

Function at 0x180095258
Capabilities:
Parse pe header

Disassembly:
sub eax, eax
jmp 0x180094370
ret
ret
cmp word [rax + 0x18], cx
jmp 0x1800960dc
jne 0x18008a6af
mov ecx, 0x20b
cmp r13d, 0x59f33b06
jmp 0x1800946e1
mov eax, 0x5a4d
stc
test r15w, 0x7bfd
cmp word [rcx], ax
jmp 0x18009719c
jne 0x18008a6af
mov eax, 1
jmp 0x18008e3cd
jne 0x18008a6af
movsxd rax, dword [rcx + 0x3c]
stc
cmc
lea rax, [rax + rcx]
cmc
cmp dword [rax], 0x4550
jmp 0x18009476c

Function at 0x180096b30
Capabilities:
Enumerate pe sections

Disassembly:
ret
jb 0x1800911d8
inc r9d
add rax, 0x28
cmp ebp, r12d
cmp dh, 0x66
test r12d, ebp
cmp r9d, r11d
jb 0x1800962d5
sub eax, eax
jmp 0x1800911d8
je 0x18009135b
mov edx, dword [rax + 0xc]
cmp r10, rdx
jmp 0x180097314
movsxd r8, dword [rcx + 0x3c]
sar r11w, cl
inc ax
mov rax, rcx
sub r9d, r9d
cdqe
lea r8, [r8 + rcx]
mov r10, rdx
movsxd r11, r9d
mov r11d, edx
movzx eax, word [r8 + 0x14]
btr r11d, esp
sub r11w, sp
add r11b, 0x3f
movzx r11d, word [r8 + 6]
cmp dil, r10b
cmc
add rax, 0x18
cmp r8d, 0x7dda0914
cmp bpl, cl
test cl, r11b
add rax, r8
cmp rdx, 0x51ab0896
test r11d, r11d
jmp 0x1800962cf
jb 0x180091342
mov ecx, dword [rax + 8]
cmp r8w, 0x55ff
test r9b, 0xac
add ecx, edx
cmp r10, rcx
jmp 0x18009133c
Function at 0x18011bd10
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
sub rsp, 0x28
lea rcx, [rsp + 0x30]
jmp 0x18011bd1e
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rax, qword [rsp + 0x30]
cmp r8w, 0x610d
cmc
add rsp, 0x28
jmp 0x18011bd39
ret

Function at 0x18011cf53
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
sub rsp, 0x18
or r8, r9
sal r8w, 0x2c
mov r8, rcx
sar al, cl
mov eax, 0x5a4d
cmc
cmp r9b, spl
cmp word [0x180000000], ax
jne 0x18011d0a2
movsxd rcx, dword [0x18000003c]
cmp r12b, sil
neg dx
rcr dl, 4
lea rdx, [0x180000000]
clc
test bpl, 0x8d
add rcx, rdx
jmp 0x18011cfa5
cmp dword [rcx], 0x4550
jmp 0x18011cfb0
jne 0x18011d0a2
mov eax, 0x20b
test rdi, r14
cmp word [rcx + 0x18], ax
jne 0x18011d0a2
sub r8, rdx
btr dx, r9w
sbb dl, 0x23
movzx eax, word [rcx + 0x14]
cmp r10w, 0x3055
shrd r9w, bp, 0xd6
lea rdx, [rcx + 0x18]
bts r9w, r12w
bt r9d, r13d
lea rdx, [rdx + rax]
xchg r9b, al
sar ah, cl
movzx eax, word [rcx + 6]
and r9b, spl
lea rcx, [rax + rax*4]
movzx r9w, dil
sbb r9b, r10b
lea r9, [rdx + rcx*8]
mov qword [rsp], rdx
cmp spl, sil
cmp r12w, 0xea8
test r11w, 0x7158
cmp rdx, r9
jmp 0x18011d02b
je 0x18011d069
mov ecx, dword [rdx + 0xc]
test rbx, 0x6986194b
test ax, bx
cmp r8, rcx
jmp 0x18011d046
jb 0x18011d060
mov eax, dword [rdx + 8]
add eax, ecx
cmc
cmp r8, rax
jmp 0x18011d05a
jb 0x18011d06b
add rdx, 0x28
jmp 0x18011d010
sub edx, edx
test rdx, rdx
jne 0x18011d080
sub al, al
jmp 0x18011d07b
jmp 0x18011d0b5
cmp dword [rdx + 0x24], 0
jmp 0x18011d089
jge 0x18011d096
xor al, al
jmp 0x18011d0b5
mov al, 1
jmp 0x18011d09d
jmp 0x18011d0b5
sub al, al
jmp 0x18011d0a9
jmp 0x18011d0b5
add rsp, 0x18
jmp 0x18011d0be
ret

Function at 0x18011dbc0
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dword [rsp + 8], ecx
sub rsp, 0x28
xchg ch, ch
cmovno cx, r14w
mov ecx, 0x17
jmp 0x18011dbd9
call qword [sym.imp.KERNEL32.dll_IsProcessorFeaturePresent]
test eax, eax
jmp 0x18011dbe6
je 0x18011dc06
mov eax, dword [rsp + 0x30]
movsx ecx, sp
xchg cx, cx
mov ecx, ecx
mov ecx, eax
jmp 0x18011dbff
int 0x29
jmp 0x18011dc06
lea rcx, [0x180081d30]
jmp 0x18011dc12
call fcn.18011dce1
mov rax, qword [rsp + 0x28]
mov qword [0x180081e28], rax
shld ax, r10w, 0xaa
lea rax, [rsp + 0x28]
xor dx, dx
shrd edx, ebx, 0xf7
add rax, 8
movzx rcx, dx
mov qword [0x180081dc8], rax
sar eax, cl
rdtsc
mov rax, qword [0x180081e28]
mov qword [0x180081ca0], rax
or rax, r10
btc dx, sp
cdqe
mov dword [0x180081c90], 0xc0000409
bsf ax, r14w
movsx ax, r15b
mov dword [0x180081c94], 1
add rdx, 0x60d04a18
jmp 0x18011dc8c
mov dword [0x180081ca8], 1
bt rax, r15
cmovae rax, r13
rdtsc
mov eax, 8
imul rax, rax, 0
lea rcx, [0x180081cb0]
jmp 0x18011dcbb
mov edx, dword [rsp + 0x30]
mov qword [rcx + rax], rdx
bswap cx
lea rcx, [0x18006b878]
jmp 0x18011dcd2
call fcn.18011d9e1
add rsp, 0x28
jmp 0x18011dce0
ret
Function at 0x18011e8a2
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov rax, rsp
neg r10w
movzx r11d, si
test sil, 0x7c
mov qword [rax + 8], rbx
movsx r11w, sil
shl r11b, cl
shr r11, 0x44
mov qword [rax + 0x10], rbp
btr r11d, 0x11
mov qword [rax + 0x18], rsi
xor r10b, r15b
mov qword [rax + 0x20], rdi
sub di, 0x3127
push r14
movsx rsi, r14w
mov bl, byte [rcx]
not bpl
lea r10, [rcx + 1]
sbb sil, r9b
shr esi, cl
btr r14w, r13w
mov byte [rdx], bl
mov esi, r9d
lea r14, [0x180000000]
test sil, r15b
mov rbp, r8
add di, 0x2430
mov r11, rdx
bt rdi, 0xe1
mov rdi, rcx
test al, r15b
cmc
cmp r14b, 0xbe
test bl, 4
jmp 0x18011e925
je 0x18011e97f
movzx ecx, byte [r10]
and ecx, 0xf
add eax, 0x5eeb0384
and ax, si
test rbx, 0x76d94dd7
movsx rax, byte [rcx + r14 + 0x6b8a0]
cmc
jmp 0x18011e952
mov cl, byte [rcx + r14 + 0x6b8b0]
clc
cmc
stc
sub r10, rax
mov eax, dword [r10 - 4]
jmp 0x18011e96a
shr eax, cl
cmp dil, 0x58
clc
cmp r11b, spl
mov dword [rdx + 4], eax
test eax, esi
clc
cmp dx, 0x12a9
test bl, 8
jmp 0x18011e987
je 0x18011e9a0
mov eax, dword [r10]
jmp 0x18011e999
add r10, 4
mov dword [rdx + 8], eax
test bl, 0x10
jmp 0x18011e9a8
je 0x18011e9bb
mov eax, dword [r10]
shl r8b, cl
add r10, 4
mov dword [rdx + 0xc], eax
movsxd rax, dword [r10]
lea r8, [r10 + 4]
cmp dil, 0x26
xor r9d, r9d
cmp byte [rsp + 0x30], r9b
jmp 0x18011e9d3
jne 0x18011ea7f
test bl, 2
je 0x18011ea7f
lea rdx, [rax + rbp]
movzx ecx, byte [rdx]
inc r10
rcr al, cl
and ecx, 0xf
movsx rax, byte [rcx + r14 + 0x6b8a0]
mov cl, byte [rcx + r14 + 0x6b8b0]
test sp, bp
bswap r10
bsr r10w, bx
sub rdx, rax
mov r10d, dword [rdx - 4]
cmc
shr r10d, cl
stc
cmp cl, r15b
mov dword [r11 + 0x10], r9d
cmp ax, r11w
test dl, spl
test si, 0x79b1
test r10d, r10d
jmp 0x18011ea34
je 0x18011ea83
mov eax, dword [rdx]
mov ecx, dword [rdx + 4]
jmp 0x18011ea49
lea rdx, [rdx + 8]
cmc
cmp eax, esi
jmp 0x18011ea55
je 0x18011ea71
inc r9d
cmp r9d, r10d
jmp 0x18011ea66
jb 0x18011ea3a
jmp 0x18011ea83
mov dword [r11 + 0x10], ecx
jmp 0x18011ea7a
jmp 0x18011ea83
mov dword [rdx + 0x10], eax
stc
test bl, 1
jmp 0x18011ea8b
je 0x18011ead2
movzx ecx, byte [r8]
not bx
and ecx, 0xf
bts ax, sp
or sil, bpl
setb bl
movsx rdx, byte [rcx + r14 + 0x6b8a0]
cbw
mov cl, byte [rcx + r14 + 0x6b8b0]
sub r8, rdx
sbb bpl, 0xe2
mov edx, dword [r8 - 4]
shr edx, cl
mov dword [r11 + 0x14], edx
inc si
btc bp, bp
and al, 0xb7
mov rbx, qword [rsp + 0x10]
sub r8, rdi
cwde
mov sil, r13b
mov rbp, qword [rsp + 0x18]
mov rax, r8
setl sil
mov rsi, qword [rsp + 0x20]
cmovnp di, dx
bswap di
mov rdi, qword [rsp + 0x28]
movzx r14d, r12w
jmp 0x18011eb09
pop r14
ret