joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18003a3f0
Capabilities:
Execute anti-debugging instructions

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x20
mov r8d, edx
rdtsc
mov r9, rdx
shl r9, 0x20
or r9, rax
rdtsc
shl rdx, 0x20
or rdx, rax
cmp r9, rdx
mov eax, 0x547ba2d3
mov edx, 0xba010b67
cmove edx, eax
test rcx, rcx
mov eax, 0xfc2aac61
mov edi, 0x336e34dd
cmove edi, eax
xor edi, edx
mov r9d, edx
xor r9d, 0xb3dada19
mov r10d, edx
xor r10d, 0xb6436fb
mov r11d, edx
xor r11d, 0x84571f0c
nop dword [rax + rax]
mov ebx, edi
mov eax, ebp
mov r14d, edi
imul r14d, r9d
add r14d, r10d
mov ebp, 0
mov edi, r11d
cmp r14d, 0xf65f5890
je 0x18003a460
cmp r14d, 0x374b7528
jne 0x18003a61a
mov eax, dword [rcx]
mov dword [rsp + 0xc], eax
mov r14d, dword [rsp + 0xc]
xor ebx, edx
mov eax, ebx
add r14d, dword [rsp + 0xc]
xor eax, 0x336e34dc
imul r14d, eax
add r14d, dword [rsp + 0xc]
mov r15d, dword [rsp + 0xc]
not r15d
mov esi, ebx
xor esi, 0x336e34df
imul r15d, esi
lea ebp, [r15 + r14]
inc ebp
mov r14d, ebx
xor r14d, 0x4f28e62c
mov r15d, dword [rsp + 0x14]
xor r15d, r14d
mov r12d, dword [rsp + 0x14]
or r12d, r14d
mov r13d, ebx
xor r13d, 0x341c6ec1
mov edi, ebx
xor edi, 0xb0d719d3
or edi, dword [rsp + 0x14]
add edi, r15d
add r13d, r14d
add r13d, esi
add r13d, r12d
sub r13d, edi
inc r13d
mov edi, ebx
xor edi, 0x36dd337c
imul edi, r13d
mov r14d, ebx
xor r14d, 0xc1055e17
add r14d, edi
mov dword [rsp + 0x1c], r14d
mov edi, ebx
xor edi, 0x936aa8bc
imul edi, dword [rsp + 0x1c]
mov r14d, ebx
xor r14d, 0xf67f45ab
add r14d, edi
mov edi, dword [rsp + 0x10]
not edi
mov r15d, ebx
xor r15d, 0x1a75cf2d
and r15d, edi
imul r15d, esi
mov edi, ebx
xor edi, 0xe58a30cd
mov r12d, dword [rsp + 0x10]
mov r13d, dword [rsp + 0x10]
xor r13d, ebx
xor r13d, 0xe58a30d2
add r13d, r12d
mov r12d, ebx
xor r12d, 0x336e34ca
add r12d, edi
add r12d, r15d
imul r13d, eax
add r13d, r12d
mov edi, ebx
xor edi, 0x72ec7c5a
imul edi, r13d
mov r15d, ebx
xor r15d, 0xfc5a25bf
add r15d, edi
mov dword [rsp + 0x18], r15d
mov edi, ebx
xor edi, 0x632dc9ea
imul edi, dword [rsp + 0x18]
xor ebx, 0xea925d2f
add ebx, edi
mov dword [rsp + 8], r8d
mov dword [rsp + 4], ebx
imul esi, dword [rsp + 8]
mov edi, dword [rsp + 4]
mov ebx, dword [rsp + 4]
or ebx, dword [rsp + 8]
add esi, dword [rsp + 4]
not ebx
mov r15d, dword [rsp + 8]
not r15d
add r15d, edi
add r15d, ebx
mov edi, dword [rsp + 4]
mov ebx, dword [rsp + 8]
not ebx
or ebx, edi
sub esi, ebx
imul r15d, eax
cmp ebp, r14d
lea ebp, [rsi + r15 + 1]
mov eax, 0
cmovae ebp, eax
mov edi, r11d
jmp 0x18003a460
add rsp, 0x20
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x18003a630
Capabilities:
Execute anti-debugging instructions

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x20
mov r8d, edx
rdtsc
mov r9, rdx
shl r9, 0x20
or r9, rax
rdtsc
shl rdx, 0x20
or rdx, rax
cmp r9, rdx
mov eax, 0x706cbd27
mov esi, 0xa94febb3
cmove esi, eax
test rcx, rcx
mov eax, 0x719535e2
mov r11d, 0x95e95d82
cmove r11d, eax
xor r11d, esi
mov r9d, esi
xor r9d, 0xbbf539ca
mov r10d, esi
xor r10d, 0xf5744e0c
mov edx, esi
xor edx, 0x97510c7c
jmp 0x18003a826
mov eax, dword [rcx]
mov dword [rsp + 8], eax
xor r11d, esi
mov ebp, r11d
xor ebp, 0x95e95d80
imul ebp, dword [rsp + 8]
mov eax, dword [rsp + 8]
not eax
mov ebx, r11d
xor ebx, 0x95e95d83
imul eax, ebx
add eax, ebp
mov ebp, dword [rsp + 8]
mov ebp, dword [rsp + 8]
mov r14d, r11d
xor r14d, 0x6c8a1ab9
mov r15d, dword [rsp + 0x14]
and r15d, r14d
mov r12d, r11d
xor r12d, 0x9375e546
mov ebp, dword [rsp + 0x14]
and ebp, r12d
xor r12d, dword [rsp + 0x14]
add r12d, ebp
mov ebp, r11d
xor ebp, 0x95e95d81
imul r12d, ebx
add r14d, ebp
sub r14d, r15d
add r14d, r12d
mov r15d, r11d
xor r15d, 0xef1528d5
imul r15d, r14d
mov r14d, r11d
xor r14d, 0x3f353346
add r14d, r15d
mov dword [rsp + 0x1c], r14d
mov r14d, r11d
xor r14d, 0x44e81be5
imul r14d, dword [rsp + 0x1c]
mov r15d, r11d
xor r15d, 0x8ef0e3d7
and r15d, dword [rsp + 0x10]
add r15d, dword [rsp + 0x10]
mov r12d, r11d
xor r12d, 0x710f1c28
or r12d, dword [rsp + 0x10]
mov r13d, dword [rsp + 0x10]
not r13d
add r13d, r15d
mov r15d, r11d
xor r15d, 0x710f1c29
mov edi, r11d
xor edi, 0x6a16a268
add edi, r15d
mov r15d, r11d
xor r15d, 0x1da88aa6
sub edi, r12d
imul r13d, ebx
add r13d, edi
mov edi, r11d
xor edi, 0xcbe24709
imul edi, r13d
mov r12d, r11d
xor r12d, 0x480744be
add r12d, edi
mov dword [rsp + 0x18], r12d
mov edi, r11d
xor edi, 0xbc29a0a1
imul edi, dword [rsp + 0x18]
xor r11d, 0x456b1d4e
add r11d, edi
mov dword [rsp + 4], r8d
mov dword [rsp + 0xc], r11d
imul ebp, dword [rsp + 4]
mov r11d, dword [rsp + 0xc]
mov edi, dword [rsp + 0xc]
or edi, dword [rsp + 4]
mov r12d, dword [rsp + 0xc]
not r12d
or r12d, dword [rsp + 4]
add r15d, r14d
add r12d, edi
sub ebp, r12d
mov r14d, dword [rsp + 4]
not r14d
add r14d, r11d
imul r14d, ebx
add r14d, ebp
cmp eax, r15d
mov eax, 0
cmovae r14d, eax
mov r11d, edx
mov ebx, r11d
imul ebx, r9d
add ebx, r10d
cmp ebx, 0x9a15f4e8
je 0x18003a6a0
mov eax, r14d
mov r14d, 0
mov r11d, edx
cmp ebx, 0x9ee72c08
je 0x18003a826
add rsp, 0x20
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x18003abb0
Capabilities:
Encode data using xor
Execute anti-debugging instructions

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x20
mov r9, rdx
rdtsc
mov r11, rdx
mov r10, rax
rdtsc
test r8, r8
je 0x18003aced
shl r11, 0x20
or r10, r11
shl rdx, 0x20
or rax, rdx
cmp r10, rax
mov edx, 0x18ba9ad0
mov eax, 0x5e9c8b79
cmove rax, rdx
movabs rdx, 0xc20e65a853e82a23
xor rdx, rax
mov r10, rax
xor r10, 0x5e9c8b78
movabs r11, 0x3df19a57ac17d5df
xor r11, rax
add r11, r10
inc r11
movabs rsi, 0xfaafff5658f1e5d4
xor rsi, rax
movabs rdi, 0x2e561047e31f73eb
xor rdi, rax
movabs rbx, 0x92de4a04056cae5c
xor rbx, rax
movabs r14, 0x2b0f9be0c483739f
xor r14, rax
xor rax, 0x5e9c8b7b
xor r15d, r15d
nop dword [rax]
movzx ebp, byte [r9 + r15]
mov byte [rcx + r15], bpl
mov r12, qword [rsp + 8]
and r12, rdx
mov r13, qword [rsp + 8]
xor r13, rdx
add r13, r12
mov r12, qword [rsp + 8]
not r12
add r12, r13
mov r13, qword [rsp + 8]
and r13, rdx
add r13, r11
imul r12, r10
add r12, r13
imul r12, rsi
add r12, rdi
mov qword [rsp + 0x18], r12
mov r12, qword [rsp + 0x18]
imul r12, rbx
add r12, r14
mov qword [rsp + 0x10], r15
mov qword [rsp], r12
mov r12, qword [rsp]
not r12
and r12, qword [rsp + 0x10]
add r12, qword [rsp]
imul r12, rax
mov r15, qword [rsp]
xor r15, qword [rsp + 0x10]
not r15
imul r15, r10
add r15, r10
add r15, r12
cmp r15, r8
jne 0x18003ac60
mov rax, rcx
add rsp, 0x20
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x18003ad10
Capabilities:
Encode data using xor
Execute anti-debugging instructions

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov r9d, edx
rdtsc
mov r11, rdx
mov r10, rax
rdtsc
test r8, r8
je 0x18003ae89
shl r11, 0x20
or r10, r11
shl rdx, 0x20
or rax, rdx
cmp r10, rax
mov r12d, 0x17bf3514
mov eax, 0x94ee473e
cmovne r12, rax
movabs rdx, 0xd31b3696f15b1750
xor rdx, r12
movabs r10, 0xffffffff6b11b8c0
xor r10, r12
movabs r11, 0x2ce4c9690ea4e8af
xor r11, r12
mov qword [rsp + 0x18], r11
or rax, 1
xor rax, r12
lea rsi, [rax + rdx]
inc rsi
movabs rdi, 0x2d2b88cebcc8eb53
xor rdi, r12
movabs rbx, 0xbd621004f85ced74
xor rbx, r12
movabs r14, 0x4e7a6daccba67a5b
xor r14, r12
movabs r15, 0xf719d531a4f169f0
xor r15, r12
xor r12d, r12d
nop word [rax + rax]
mov byte [rcx + r12], r9b
mov r13, qword [rsp + 0x10]
and r13, rdx
imul r13, r10
add r13, rsi
mov rbp, qword [rsp + 0x10]
or rbp, qword [rsp + 0x18]
imul rbp, rax
mov r11, rcx
mov ecx, r9d
mov r9, qword [rsp + 0x10]
and r9, rdx
add r9, rbp
add r9, r13
imul r9, rdi
add r9, rbx
mov qword [rsp + 0x20], r9
mov r9, qword [rsp + 0x20]
imul r9, r14
add r9, r15
mov qword [rsp + 8], r12
mov qword [rsp], r9
mov r9, qword [rsp]
and r9, qword [rsp + 8]
mov r12, qword [rsp + 8]
mov r13, qword [rsp]
mov rbp, qword [rsp + 8]
not rbp
and rbp, r13
add r12, qword [rsp]
imul rbp, r10
mov r13, qword [rsp]
xor r13, qword [rsp + 8]
sub rbp, r9
add r13, r12
add rbp, qword [rsp]
mov r9, qword [rsp]
mov r12, qword [rsp + 8]
not r12
or r12, r9
mov r9d, ecx
mov rcx, r11
add r12, r13
imul r12, rax
add r12, rbp
inc r12
cmp r12, r8
jne 0x18003add0
mov rax, rcx
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x142acb000
Capabilities:
Decompress data using aplib

Disassembly:
jmp 0x142acb00a
jmp 0x142acd00f
jmp fcn.141c2b058
Function at 0x1400072b0
Capabilities:
Access peb ldr_data
Encode data using base64
Encrypt data using speck
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x2e8
movaps xmmword [rsp + 0x2d0], xmm6
movabs r12, 0xcbf29ce484222325
movabs r14, 0x1d12a89b9e723ff5
lea rcx, [0x1400ce915]
jmp 0x1403a63f8

Function at 0x140008210
Capabilities:
Access peb ldr_data
Encrypt data using speck
Get kernel32 base address
Get number of processors
Parse pe header

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x38
movabs r14, 0xcbf29ce484222325
lea rcx, [0x1400ce987]
jmp 0x1403a7ec5

Function at 0x1400f66a2
Capabilities:
Encrypt data using rc4 prga

Disassembly:
jne 0x140121f5f
movzx eax, byte [r11 + rcx*4 + 1]
stc
cmp al, byte [rdx + 1]
jmp 0x1400e1fb0
jne 0x140121f5f
movzx eax, byte [r11 + rcx*4 + 2]
cmp ch, 0xe4
cmp r12b, dl
cmp al, byte [rdx + 2]
jne 0x140121f5f
mov byte [r11 + rcx*4 + 3], 0
movsx r10d, sp
movzx r10, r13w
bswap r10w
movzx r10d, byte [rdx]
jmp 0x14025a41f
mov r10, qword [rcx]
mov r11, qword [rcx + 0x18]
mov r9d, dword [r10 + 4]
test r15b, 0x31
imul r9d, dword [r10]
cmp r8d, 2
jmp 0x14022a4bb
inc rcx
cmp r15d, edi
clc
cmp r8d, ecx
jmp 0x140292150
test r9d, r9d
jmp 0x14025282a
mov byte [r11 + rcx*2 + 1], al
jmp 0x14024c944
movzx r10d, byte [r11 + 2]
setne cl
neg cl
mov byte [r11 + 1], cl
stc
add cl, r15b
cmp r10b, byte [rdx]
setne cl
neg cl
cmp rsi, 0x332f2ac7
mov byte [r11 + 3], cl
test r12w, 0x1fb
movzx ecx, byte [r11 + 4]
cmp cl, byte [rdx]
setne cl
clc
neg cl
jmp 0x14020decc
mov byte [r11 + 5], cl
bswap cx
movzx ecx, byte [r11 + 6]
clc
cmp cl, byte [rdx]
jmp 0x14026492c
jb 0x140264949
mov r8d, r9d
rol r10w, 0xa2
rcl ch, cl
xchg r10w, cx
and r8d, 0xfffffffc
nop word cs:[rax + rax]
movzx ecx, byte [r11]
shl r10d, 0xd0
xor r10w, 0x43d1
cmp cl, byte [rdx]
not r10b
jmp 0x140206453
jne 0x140126c87
test r9d, r9d
je 0x14024631c
lea ecx, [r9 - 1]
cmp r9w, 0x6e3d
cmp ecx, 3
jmp 0x14020edca
ret
inc rcx
stc
cmp r9b, cl
cmp r9d, ecx
jmp 0x14024e1f6
jne 0x140264978
jmp 0x14024631c
je 0x14024631c
movzx r10d, byte [rdx]
cmp cl, r14b
mov r8d, r9d
xor ecx, ecx
jmp 0x14026b942
jmp 0x140121f5f
setne cl
neg cl
clc
test r14b, bpl
mov byte [r11 + 7], cl
add r11, 8
stc
clc
add r8d, 0xfffffffc
jne 0x14020edf0
test r9b, 3
je 0x14024631c
and r9d, 3
movsx eax, r10w
adc al, dh
movzx ax, r8b
xor ecx, ecx
ror al, cl
nop word cs:[rax + rax]
movzx eax, di
neg al
movsx eax, cx
movzx eax, byte [r11 + rcx*2]
test esp, eax
stc
cmp al, byte [rdx]
not al
setne al
cmc
stc
neg al
jmp 0x1401dd45c
jmp 0x140292156
je 0x14024631c
cmp byte [r11 + rcx*4], r10b
jmp 0x1400e05e5
Function at 0x14012b030
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmc
cmp word [rcx], ax
jmp 0x1401ceeb0
jne 0x140215062
movsxd rdx, dword [rcx + 0x3c]
cmp edi, r9d
add rdx, rcx
stc
test ah, bl
cmp dword [rdx], 0x4550
jne 0x140215062
sub eax, eax
mov ecx, 0x20b
ror al, cl
shr al, cl
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
jmp 0x140265348
ret

Function at 0x14013bdd0
Capabilities:
Encrypt data using speck
Resolve function by parsing pe exports

Disassembly:
mov rcx, qword [rcx]
jmp 0x14020ea3d
jmp 0x14043f02d
push rsi
bsr ax, si
dec sil
push rdi
neg rsi
btc eax, ebp
movsxd rax, edi
sub rsp, 0x28
ror sil, 0xef
btc rsi, rax
mov rsi, rcx
xor ax, 0x29c3
mov rcx, qword [rcx + 0x18]
mov rax, qword [rcx]
stc
clc
sub edx, edx
jmp 0x14043f068
xor r8d, r8d
jmp 0x14043f070
call qword [rax + 0x188]
mov edi, eax
setne cl
movsx ecx, r9w
bswap cx
lea rcx, [rsi + 0x30]
jmp 0x14043f08b
call fcn.140452c33
test edi, edi
je 0x14043f0ba
cmp edi, 0x8899000c
jmp 0x14043f0a3
jne 0x14043f0df
mov rcx, rsi
add rsp, 0x28
pop rdi
movzx esi, dx
pop rsi
jmp fcn.14043ece0
nop
add rsp, 0x28
mov edi, 0x30cc6795
jmp 0x14043f0cb
pop rdi
movsx si, spl
setle sil
xchg sil, sil
pop rsi
jmp 0x14043f0de
ret
mov ecx, edi
add r8b, 1
stc
mov si, r14w
movabs r8, 0xad4a5352d2edebd0
bsf esi, r10d
mov dl, 3
mov r9d, 0x54
xchg dil, dil
sar sil, cl
add rsp, 0x28
not di
pop rdi
not sil
setne sil
cmovno si, si
pop rsi
jmp fcn.1403a847c

Function at 0x14019f2ac
Capabilities:
Encrypt data using rc4 prga

Disassembly:
jne 0x140113dc4
movzx r8d, byte [rcx + 2]
movsx dx, r13b
mov rax, qword [r9 + 0xf8]
movzx rdx, r11w
cqo
movsx dx, sil
lea rdx, [rcx + 2]
jmp 0x14026befa
test byte [rax + r8*2], 4
jmp 0x140278663
mov r9, qword [rdx]
sbb r8, rcx
movzx r8d, byte [rcx]
sets dh
not dl
mov rdx, qword [r9 + 0x110]
cmp byte [r8 + rdx], 0x65
jmp 0x1401e4324
je 0x140278669
mov rax, qword [r9]
movzx r8d, dx
sete r8b
dec r8w
nop dword [rax + rax]
movsx r8w, bpl
movzx r8d, byte [rcx + 1]
inc rcx
test r10d, r14d
jmp 0x140177810
cmovne rdx, rcx
mov rcx, qword [rax]
bt eax, esp
xor al, r11b
adc ax, cx
movzx eax, byte [rcx]
movzx rcx, cx
mov byte [rdx], al
rol ah, 0x74
cwde
cmc
lea rax, [rdx + 1]
nop dword [rax]
movzx edx, di
movzx ecx, byte [rax]
movzx edx, r8b
test edx, 0x4be933e6
mov byte [rax], r8b
movzx r8d, r12w
movzx r8, bp
rcl r8b, 0xcd
lea rax, [rax + 1]
movzx r8d, cl
test dl, dl
jmp 0x14028ced8
jne 0x1401e4346
movzx eax, r8b
stc
cmp byte [rax + rdx], 0x78
jmp 0x140113db4
jne 0x14026bf26
ret
Function at 0x140236618
Capabilities:
Parse pe header

Disassembly:
jmp 0x1404a9eb0
sub r8d, r8d
sub edx, edx
jmp 0x140213760

Function at 0x1402518db
Capabilities:
Access peb ldr_data

Disassembly:
test r8, r8
jmp 0x14011b208
je 0x1401b2dfd
mov word [r10], r11w
mov r11d, r11d
movsx r11, r11w
add r10, 2
movsx r11w, r14b
not r11w
movzx r11d, word [r9 + rax*2 + 2]
jmp 0x14014abf8
je 0x14011b213
mov word [rcx], 0
ret
test ax, ax
jmp 0x140287144
jne 0x14024b7de
sub r8, rdx
clc
jmp 0x1400e0216
cmovb r8, rdx
jmp 0x140160e3e
inc rax
cmp r15b, sil
test r11w, r11w
jmp 0x1401b2de8
jmp 0x1401739fa
je 0x1400e0216
sub edx, edx
mov r9b, 0x44
lea r9, [0x1400b8f10]
jmp 0x14024b7de
jne 0x1401dae40
sub r8, rax
cmp r8d, r10d
test r8, r8
je 0x1401b2e03
mov word [r10], 0
movzx eax, word [0x1400b8f10]
movsx r8d, sp
cmp rdx, 0x104
setno r8b
bswap r8w
xchg r8w, r8w
mov r8d, 0x104
jmp 0x1401fa9b3
mov rax, qword gs:[0x30]
btr r11w, 0xd8
neg r11w
mov rax, qword [rax + 0x60]
sar r9d, 0xee
stc
movsx r10, r11w
mov rax, qword [rax + 0x18]
bt r8, 6
movsx r9w, al
btr r8, r14
mov rax, qword [rax + 0x10]
inc r9
bsf r8w, si
movzx r8d, word [rax + 0x58]
sal r9, 0x93
sbb r9, 0x68c7475e
sbb r10w, dx
cmp r8, rdx
setnp r11b
cmovae r8, rdx
sal r11b, 0xbc
movzx r11w, r13b
mov r9, qword [rax + 0x60]
rcl r11d, cl
bts r10, r9
movzx r11d, word [r9]
setns r10b
lea r10, [0x1400b8f10]
test r15d, 0xb3c255b
test r11w, r11w
je 0x1401b2df4
sub eax, eax
nop word [rax + rax]
cmp r8, rax
jmp 0x1400ef440
cmovb r8, rdx
test ax, ax
jmp 0x1401739f4
inc rdx
cmc
cmp r14d, r10d
test ax, ax
jmp 0x14013c9c9
cmp r8, rdx
je 0x14011b20e
mov word [rcx], ax
cwde
cmp di, 0x7538
add rcx, 2
movzx ax, r8b
jmp 0x14025c3c1
movzx eax, word [0x1400b8f10]
jmp 0x14013b7b8
movzx eax, word [r9 + rdx*2 + 2]
jmp 0x14020c450
je 0x1401dada7
cmp rdx, 0x104
mov r8b, 0x3e
cmovge r8w, r13w
xchg r8d, r8d
mov r8d, 0x104
jmp 0x1401461ef
Function at 0x1402c77c9
Capabilities:
Execute anti-debugging instructions

Disassembly:
push rax
jmp 0x140397bf7
push r15
jmp 0x1402b51c2
jmp rbp
mov r10, rsp
shl bpl, cl
rol dh, 0xdd
sub rsp, 0x180
cwd
cmp ch, 0xff
and rsp, 0xfffffffffffffff0
shl rcx, cl
mov r9, rdi
movabs rcx, 0
ror ebp, cl
sub r9, rcx
sar bpl, cl
btc bp, 0x59
bswap rbp
lea rbp, [0x14032a3f7]
movsxd rdx, ebp
or dl, 0xc1
mov edx, dword [rdi]
add rdi, 4
stc
cmp dil, cl
xor edx, r9d
add edx, 0x7fe71416
ror edx, 2
cmc
jmp 0x14032bf63
add edx, 0x6b3944d5
ror edx, 3
cmp ecx, 0x4a974780
push r9
xor dword [rsp], edx
sar r9w, 0x15
mov r9d, 0x70cb0354
stc
pop r9
cmc
movsxd rdx, edx
cmc
add rbp, rdx
jmp 0x140320df7
push r11
push r8
cwde
movzx edx, bx
mov r11w, 0x5419
pushfq
movzx cx, bpl
cwd
push rbp
rdtsc
push r14
cdq
cdqe
push r10
push rdi
movsx r11w, bpl
push r13
movsx rax, si
movabs r11, 0
jmp 0x140391a87
push r11
rdtsc
mov rdi, qword [rsp + 0x90]
movsxd r10, ebp
not bp
dec edi
rcr r9b, 0xd0
neg edi
bswap rcx
not edi
xchg r9b, al
inc edi
rcr eax, 0x8c
cmp r8b, cl
lea rdi, [rdi + r11]
test r14d, edx
xchg cl, r10b
movabs rax, 0x100000000
bsf r10, r12
adc r9b, 0x53
bswap dx
lea rdi, [rdi + rax]
movsx bp, al
cmc
jmp 0x14032a3bb
push rdx
movsx rdx, bx
push r9
push rbx
cdq
movzx eax, r8w
cmovge rax, r14
push r12
rdtsc
push rcx
push rsi
cwd
movsxd rcx, r10d
jmp 0x140334aeb
Function at 0x1403dcd47
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
cmp bl, r10b
test ax, 0x419d
push r14
clc
push rsi
test r10b, r11b
push rdi
rol rdi, 0x7b
push rbx
sub rsp, 0x30
shrd edi, r14d, 0x3e
movaps xmmword [rsp + 0x20], xmm6
xor dil, bpl
setp dil
mov rdi, qword [rcx]
test rdi, rdi
jmp 0x1403dcd7d
je 0x1403dcef0
mov r14, rcx
rol ebx, 0x42
adc ebx, r11d
mov rbx, qword [rcx + 8]
cmc
test rsp, 0x5b3d66e5
cmp rdi, rbx
jmp 0x1403dcda0
je 0x1403dce7d
lea r15, [0x1400bed30]
jmp 0x1403dcdb2
movaps xmm6, xmmword [0x1400bd400]
jmp 0x1403dcdbe
jmp 0x1403dcde8
call fcn.140217864
movups xmmword [rdi + 0x20], xmm6
stc
mov byte [rdi + 0x10], 0
cmc
cmp bl, r12b
add rdi, 0x38
clc
cmp rdi, rbx
jmp 0x1403dcde2
je 0x1403dce74
mov qword [rdi], r15
mov rax, qword [rdi + 0x28]
jmp 0x1403dcdf8
cmp rax, 0x10
jb 0x1403dcdc8
mov rcx, qword [rdi + 0x10]
lea rdx, [rax + 1]
jmp 0x1403dce0f
cmp rdx, 0x1000
jmp 0x1403dce1b
jb 0x1403dcdc3
mov rsi, qword [rcx - 8]
test sp, 0x37d2
clc
add rcx, 0xfffffffffffffff8
clc
cmp r9b, 0xb1
cmc
sub rcx, rsi
clc
test r12b, dl
cmp r14b, r9b
cmp rcx, 0x20
jmp 0x1403dce48
jae 0x1403dcf29
add rax, 0x28
movzx edx, r13w
movzx cx, r8b
mov rdx, rax
setge cl
mov rcx, rcx
movsx ecx, cx
mov rcx, rsi
jmp 0x1403dce6f
jmp 0x1403dcdc3
mov rdi, qword [r14]
adc edx, 0x25d14f3f
mov rdx, qword [r14 + 0x10]
sub rdx, rdi
cmp dh, 0xa9
cmc
cmp rdx, 0x1000
jb 0x1403dced4
mov rax, qword [rdi - 8]
stc
add rdi, 0xfffffffffffffff8
clc
sub rdi, rax
jmp 0x1403dcea7
cmp rdi, 0x20
jmp 0x1403dceb0
jae 0x1403dcf29
add rdx, 0x27
jmp 0x1403dcec6
mov rdi, rax
xchg cx, cx
movsx rcx, r15w
movzx ecx, r15w
mov rcx, rdi
jmp 0x1403dcedc
call fcn.140217864
xorps xmm0, xmm0
movups xmmword [r14], xmm0
mov qword [r14 + 0x10], 0
movaps xmm6, xmmword [rsp + 0x20]
bsr rdi, rcx
stc
ror r14b, cl
add rsp, 0x30
movsxd rsi, esi
pop rbx
movzx di, r9b
movsx rsi, sp
bswap rsi
pop rdi
pop rsi
pop r14
movsx r15, r15w
movzx r15d, sp
movsx r15d, r11w
pop r15
jmp 0x1403dcf28
ret
call fcn.1404aef74
int3
Function at 0x1403de0a7
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
push r14
and r15b, 6
ror r15b, 0x88
sar r14b, 0x51
push r13
push r12
btr r12w, di
push rsi
xor r15b, cl
push rdi
adc r14b, al
sal r14d, cl
sbb r13d, esp
push rbp
xchg r15, r13
sub r14b, 0x8e
btr r15w, 0xbb
push rbx
bsr r12, r13
sub rsp, 0x38
movaps xmmword [rsp + 0x20], xmm6
setns r12b
shrd r15w, r9w, 0xbf
add r14b, 0x4d
mov r14, r9
stc
ror r12b, 0xdc
mov r15, r8
mov r12, rdx
mov r13, rcx
bsf bx, r15w
mov rbx, qword [rcx]
test rbx, rbx
jmp 0x1403de119
je 0x1403de258
mov rdi, qword [r13 + 8]
cmc
clc
cmp ebx, 0x7ca45819
cmp rbx, rdi
jmp 0x1403de133
je 0x1403de1ff
lea rbp, [0x1400bed30]
movaps xmm6, xmmword [0x1400bd400]
jmp 0x1403de14c
jmp 0x1403de178
call fcn.140217864
movups xmmword [rbx + 0x20], xmm6
clc
cmp edi, edi
mov byte [rbx + 0x10], 0
clc
add rbx, 0x38
cmp spl, 0x1b
cmp rbx, rdi
jmp 0x1403de172
je 0x1403de1fb
mov qword [rbx], rbp
mov rax, qword [rbx + 0x28]
test r14d, 0x5e2471e1
test r11b, r15b
cmp rax, 0x10
jmp 0x1403de192
jb 0x1403de156
mov rcx, qword [rbx + 0x10]
lea rdx, [rax + 1]
test r14b, r8b
jmp 0x1403de1a8
cmp rdx, 0x1000
jmp 0x1403de1b4
jb 0x1403de151
mov rsi, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
stc
sub rcx, rsi
test bh, 0x12
cmp dx, r14w
cmp rcx, 0x20
jmp 0x1403de1d6
jae 0x1403de2d9
add rax, 0x28
movzx ecx, r11w
seta ch
mov rdx, rax
movsx ecx, ax
movzx ecx, r8w
xchg ch, ch
mov rcx, rsi
jmp 0x1403de151
mov rbx, qword [r13]
mov rdx, qword [r13 + 0x10]
clc
sub rdx, rbx
test r8, 0x52314562
cmp rdx, 0x1000
jmp 0x1403de21a
jb 0x1403de250
mov rax, qword [rbx - 8]
stc
clc
cmc
add rbx, 0xfffffffffffffff8
sub rbx, rax
cmp rbx, 0x20
jmp 0x1403de237
jae 0x1403de2d9
add rdx, 0x27
movsx cx, al
movsxd rbx, ebx
mov rbx, rax
movzx cx, r13b
mov rcx, rbx
call fcn.140217864
mov qword [r13], r12
bswap si
btr bp, 0xae
imul rax, r15, 0x38
add rax, r12
cmc
movzx r15d, r15w
mov qword [r13 + 8], rax
rcl rdi, 6
movzx ebp, si
imul rax, r14, 0x38
movsx rsi, r14w
sbb r14d, r15d
add rax, r12
and bp, r12w
movsxd rbx, r8d
sal rsi, 0x7f
mov qword [r13 + 0x10], rax
and rsi, 0x7d140e94
movaps xmm6, xmmword [rsp + 0x20]
rcl dil, 0x92
add rsp, 0x38
pop rbx
bswap r15w
mov dil, r8b
pop rbp
movzx r15, r11w
movsx r15w, bpl
pop rdi
pop rsi
pop r12
pop r13
cmove r14d, esp
pop r14
movzx r15w, r14b
not r15b
movzx r15d, r9w
pop r15
ret
call fcn.1404aef74
int3
Function at 0x1403df80b
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
shld r15w, r12w, 0xa3
xor r15w, r12w
btc r15d, 0x86
push r14
movsx r15, r8w
movzx r14, r11w
or r14b, 0x37
push r13
not r13b
push r12
stc
push rsi
rcr r14, 0xf4
test bx, r12w
btr r12, rdi
push rdi
rcl r15b, 0xf4
adc r12w, dx
push rbp
sar r15w, cl
sub r15d, esp
push rbx
btr r14d, r9d
sub rsp, 0x38
movaps xmmword [rsp + 0x20], xmm6
rol r15, 0x1c
mov r14, r9
mov r15, r8
ror r12w, 0x7b
cmp r13b, 0xa8
xchg r12b, bl
mov r12, rdx
adc bh, 0xc3
shr bh, cl
mov r13, rcx
bsr bx, r10w
mov rbx, qword [rcx]
cmp spl, r12b
stc
test rbx, rbx
je 0x1403df9f6
mov rdi, qword [r13 + 8]
cmp di, 0x5f49
cmp spl, bl
stc
cmp rbx, rdi
jmp 0x1403df8a9
je 0x1403df99d
lea rbp, [0x1400bed10]
jmp 0x1403df8bb
movaps xmm6, xmmword [0x1400bd400]
jmp 0x1403df8c7
jmp 0x1403df8f6
call fcn.140217864
movups xmmword [rbx + 0x20], xmm6
jmp 0x1403df8da
mov byte [rbx + 0x10], 0
jmp 0x1403df8e3
add rbx, 0x50
stc
cmp rbx, rdi
jmp 0x1403df8f0
je 0x1403df990
mov qword [rbx], rbp
setno cl
lea rcx, [rbx + 0x38]
jmp 0x1403df905
call fcn.1403dcd47
mov rax, qword [rbx + 0x28]
cmp rax, 0x10
jb 0x1403df8d1
mov rcx, qword [rbx + 0x10]
mov dl, spl
xchg dx, dx
or dx, ax
lea rdx, [rax + 1]
jmp 0x1403df931
cmp rdx, 0x1000
jmp 0x1403df93d
jb 0x1403df8cc
mov rsi, qword [rcx - 8]
cmp r15, 0x46522a7c
clc
add rcx, 0xfffffffffffffff8
sub rcx, rsi
cmp cx, 0x2e46
clc
cmp cl, r15b
cmp rcx, 0x20
jmp 0x1403df968
jae 0x1403dfa90
add rax, 0x28
mov rdx, rax
mov rcx, 0x20f67cc0
movzx rcx, bx
movsxd rcx, ebp
mov rcx, rsi
jmp 0x1403df98b
jmp 0x1403df8cc
mov rbx, qword [r13]
adc rdx, 0x5c6f2682
rol dl, cl
mov rdx, qword [r13 + 0x10]
sub rdx, rbx
cmp rdx, 0x1000
jmp 0x1403df9b0
jb 0x1403df9e9
mov rax, qword [rbx - 8]
test r13b, 0x9f
add rbx, 0xfffffffffffffff8
cmp r15, r14
sub rbx, rax
stc
cmp rbx, 0x20
jmp 0x1403df9d2
jae 0x1403dfa90
add rdx, 0x27
xchg ebx, ebx
jmp 0x1403df9e3
mov rbx, rax
movsxd rcx, r8d
mov rcx, rbx
jmp 0x1403df9f1
call fcn.140217864
mov qword [r13], r12
rol sil, cl
lea rax, [r15 + r15*4]
xchg bpl, bl
shl rax, 4
or sil, spl
add rax, r12
rcl bh, 9
movsxd rdi, ecx
btr bp, 0xe0
mov qword [r13 + 8], rax
shld rdi, r9, 0xd9
lea rax, [r14 + r14*4]
add bx, bp
adc bx, ax
movzx r14w, bpl
shl rax, 4
clc
lea rax, [rax + r12]
shr bx, 0xb1
mov qword [r13 + 0x10], rax
movaps xmm6, xmmword [rsp + 0x20]
add rsp, 0x38
mov r14w, 0x5c5f
pop rbx
movzx bp, cl
movsx r13w, bpl
mov bpl, r11b
pop rbp
pop rdi
sete r12b
pop rsi
mov r13w, r15w
movzx r13, bp
pop r12
movsxd r13, r12d
mov r14b, spl
movsx r13, r8w
pop r13
mov r14b, r9b
pop r14
movsx r15d, r14w
movsx r15w, r9b
pop r15
jmp 0x1403dfa8f
ret
call fcn.1404aef74
int3