joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400a0d00
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov r9, rdx
test rdx, rdx
jne 0x1400a0d0b
xor eax, eax
ret
lea r11, [0x1400c2ea0]
not ecx
cmp r8d, 8
jb 0x1400a0de1
mov r10d, r8d
shr r10, 3
nop word [rax + rax]
movzx edx, byte [r9]
mov eax, ecx
xor rdx, rax
shr ecx, 8
movzx eax, dl
add r8d, 0xfffffff8
movzx edx, byte [r9 + 1]
xor ecx, dword [r11 + rax*4]
mov eax, ecx
shr ecx, 8
xor rdx, rax
movzx eax, dl
movzx edx, byte [r9 + 2]
xor ecx, dword [r11 + rax*4]
mov eax, ecx
shr ecx, 8
xor rdx, rax
movzx eax, dl
movzx edx, byte [r9 + 3]
xor ecx, dword [r11 + rax*4]
mov eax, ecx
shr ecx, 8
xor rdx, rax
movzx eax, dl
movzx edx, byte [r9 + 4]
xor ecx, dword [r11 + rax*4]
mov eax, ecx
shr ecx, 8
xor rdx, rax
movzx eax, dl
movzx edx, byte [r9 + 5]
xor ecx, dword [r11 + rax*4]
mov eax, ecx
shr ecx, 8
xor rdx, rax
movzx eax, dl
movzx edx, byte [r9 + 6]
xor ecx, dword [r11 + rax*4]
mov eax, ecx
shr ecx, 8
xor rdx, rax
movzx eax, dl
movzx edx, byte [r9 + 7]
add r9, 8
xor ecx, dword [r11 + rax*4]
mov eax, ecx
shr ecx, 8
xor rdx, rax
movzx eax, dl
xor ecx, dword [r11 + rax*4]
sub r10, 1
jne 0x1400a0d30
test r8d, r8d
je 0x1400a0e0d
nop word [rax + rax]
movzx edx, byte [r9]
lea r9, [r9 + 1]
mov eax, ecx
shr ecx, 8
xor rdx, rax
movzx eax, dl
xor ecx, dword [r11 + rax*4]
add r8d, 0xffffffff
jne 0x1400a0df0
not ecx
mov eax, ecx
ret
Function at 0x1400a582c
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400a5876
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400a5876
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400a5876
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400a5876
cmp dword [rcx + 0x84], 0xe
jbe 0x1400a5876
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x1400a5878
xor al, al
add rsp, 0x28
ret
Function at 0x140011235
Capabilities:
Terminate process

Disassembly:
jmp 0x1400139e0
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x28
ret

Function at 0x1400112d0
Capabilities:
Log keystrokes via polling

Disassembly:
jmp 0x1400122e0
push rbp
push rdi
sub rsp, 0x158
lea rbp, [rsp + 0x30]
lea rdi, [rsp + 0x30]
mov ecx, 0x1a
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rax, qword [0x14001d008]
xor rax, rbp
mov qword [rbp + 0x118], rax
lea rcx, [0x1400230f3]
call fcn.1400113de
lea rdx, str.Input_CPS:
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140011087
lea rdx, [rbp + 8]
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_istream_char__struct_std::char_traits_char___std::cin]
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_istream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_istream_char__struct_std::char_traits_char__::operator___double____ptr64____ptr64]
lea rdx, str.Press_X1_button_to_autoclick_
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140011087
xor eax, eax
cmp eax, 1
je 0x140012415
mov ecx, 5
call qword [sym.imp.USER32.dll_GetKeyState]
cwde
and eax, 0x8000
test eax, eax
je 0x140012410
mov qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov ecx, 2
call qword [sym.imp.USER32.dll_mouse_event]
mov qword [rbp + 0x28], 0
jmp 0x1400123a9
mov rax, qword [rbp + 0x28]
inc rax
mov qword [rbp + 0x28], rax
cvtsi2sd xmm0, qword [rbp + 0x28]
movsd xmm1, qword [0x14001ace0]
divsd xmm1, qword [rbp + 8]
comisd xmm1, xmm0
jbe 0x1400123c4
jmp 0x14001239e
mov qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov ecx, 4
call qword [sym.imp.USER32.dll_mouse_event]
mov qword [rbp + 0x48], 0
jmp 0x1400123f5
mov rax, qword [rbp + 0x48]
inc rax
mov qword [rbp + 0x48], rax
cvtsi2sd xmm0, qword [rbp + 0x48]
movsd xmm1, qword [0x14001ace0]
divsd xmm1, qword [rbp + 8]
comisd xmm1, xmm0
jbe 0x140012410
jmp 0x1400123ea
jmp 0x140012354
lea rcx, [rbp - 0x30]
lea rdx, [0x14001ac00]
call fcn.14001136b
mov rcx, qword [rbp + 0x118]
xor rcx, rbp
call fcn.1400111f4
lea rsp, [rbp + 0x128]
pop rdi
pop rbp
ret
Function at 0x1400112da
Capabilities:
Parse pe header

Disassembly:
jmp 0x140014d30
sub rsp, 0x38
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x140014d50
xor al, al
jmp 0x140014dd1
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x140014d63
xor al, al
jmp 0x140014dd1
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax], 0x4550
je 0x140014d8d
xor al, al
jmp 0x140014dd1
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x140014da1
xor al, al
jmp 0x140014dd1
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0x84], 0xe
ja 0x140014db3
xor al, al
jmp 0x140014dd1
mov eax, 8
imul rax, rax, 0xe
mov rcx, qword [rsp + 0x28]
cmp dword [rcx + rax + 0x88], 0
jne 0x140014dcf
xor al, al
jmp 0x140014dd1
mov al, 1
add rsp, 0x38
ret
Function at 0x1400010a8
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x50
mov eax, dword [str._nC_b_r_]
lea r10, [rbp - 0x20]
mov dword [rbp - 0x20], eax
xor r8d, r8d
mov al, byte [0x1400145cc]
mov r9d, r8d
mov byte [rbp - 0x1c], al
mov r11d, 0x8d3dcb09
mov qword [rbp - 0x10], 0x3e8
mov eax, r11d
mul r9d
shr edx, 5
movsx eax, dl
imul ecx, eax, 0x3a
mov al, r9b
inc r9d
sub al, cl
add al, 0x3a
xor byte [r10], al
inc r10
cmp r9d, 5
jl 0x1400010db
mov eax, dword [0x1400145c0]
lea r9, [rbp - 0x1b]
mov dword [rbp - 0x1b], eax
movzx eax, word [0x1400145c4]
mov word [rbp - 0x17], ax
mov al, byte [0x1400145c6]
mov byte [rbp - 0x15], al
mov eax, r11d
mul r8d
shr edx, 5
movsx eax, dl
imul ecx, eax, 0x3a
mov al, r8b
inc r8d
sub al, cl
add al, 0x3a
xor byte [r9], al
inc r9
cmp r8d, 7
jl 0x140001121
lea rcx, [rbp - 0x20]
call fcn.140001000
lea rcx, [rbp - 0x1b]
mov r10d, eax
call fcn.140001000
mov dword [rsp + 0x28], r10d
lea r9, [rbp - 0x10]
xor r8d, r8d
mov dword [rsp + 0x20], eax
lea rdx, [rbp - 8]
or rcx, 0xffffffffffffffff
call fcn.140001180
add rsp, 0x50
pop rbp
ret

Function at 0x140001180
Capabilities:
Execute syscall

Disassembly:
mov r10, rcx
mov eax, 0x2e
syscall
ret

Function at 0x140003964
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x140003790
Function at 0x140001040
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x5f]
sub rsp, 0x90
mov edx, 0x47
lea rcx, [entry0]
mov al, byte [rcx + rdx]
xor al, 0x7c
add al, 0xea
xor al, 0x11
mov byte [rcx + rdx], al
inc rdx
cmp rdx, 0x2d9
jl 0x140001068
adc eax, ebx
jle 0x14000109d
test byte [rax + 0x4f2b11c8], ah
adc bh, byte [rdi - 0x3b1ace36]
xchg esp, eax
sub byte [rbp - 7], al
adc edx, edx
invalid
Function at 0x140020a4c
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [0x14003b098]
test rax, rax
je 0x140020a96
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140020a96
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140020a96
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140020a96
cmp dword [rcx + 0x84], 0xe
jbe 0x140020a96
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140020a98
xor al, al
add rsp, 0x28
ret

Function at 0x1400293fc
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x1400291f8
Function at 0x1400316bc
Capabilities:
Enumerate pe sections

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
movsxd r8, dword [0x14000003c]
lea rsi, [0x140000000]
add r8, rsi
mov rbx, rdx
mov rdi, rcx
cmp dword [r8 + 0x84], 0xd
jbe 0x140031734
mov r10d, dword [r8 + 0xf0]
xor r9d, r9d
test r10d, r10d
je 0x140031734
movzx ecx, word [r8 + 0x14]
movzx r11d, word [r8 + 6]
add rcx, 0x18
mov r10d, dword [r10 + rsi + 0xc]
add rcx, r8
test r11d, r11d
je 0x140031734
mov eax, dword [rcx + 0xc]
cmp r10d, eax
jb 0x140031728
mov edx, dword [rcx + 8]
add eax, edx
cmp r10d, eax
jb 0x140031746
inc r9d
add rcx, 0x28
cmp r9d, r11d
jb 0x140031716
xor eax, eax
mov rbx, qword [rsp + 8]
mov rsi, qword [rsp + 0x10]
mov rdi, qword [rsp + 0x18]
ret
mov dword [rdi], edx
mov eax, dword [rcx + 0x24]
mov dword [rbx], eax
mov eax, dword [rcx + 0xc]
add rax, rsi
jmp 0x140031736

Function at 0x140033280
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400332ca
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400332ca
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400332ca
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400332ca
cmp dword [rcx + 0x84], 0xe
jbe 0x1400332ca
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x1400332cc
xor al, al
add rsp, 0x28
ret

Function at 0x14003c014
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x14003bd78

Function at 0x140045f30
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x140045f58
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x140045f58
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret

Function at 0x180001000
Capabilities:
Allocate or change rwx memory

Disassembly:
push rbx
sub rsp, 0x30
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x20]
mov edx, 7
mov r8d, 0x40
mov rbx, rcx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov r8d, dword [rsp + 0x20]
lea r9, [rsp + 0x20]
movabs rax, 0x9090909090909090
mov edx, 7
mov dword [rbx], eax
mov rcx, rbx
mov word [rbx + 4], ax
mov byte [rbx + 6], al
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.1800011f0
add rsp, 0x30
pop rbx
ret

Function at 0x1800011a0
Capabilities:
Create thread

Disassembly:
sub rsp, 0x38
cmp edx, 1
jne 0x1800011d6
xor eax, eax
lea r8, [0x1800010c0]
mov r9, rcx
mov qword [rsp + 0x28], rax
xor edx, edx
mov dword [rsp + 0x20], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
test rax, rax
je 0x1800011d6
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
add rsp, 0x38
ret
Function at 0x140037880
Capabilities:
Manually build aes constants
Parse pe header

Disassembly:
neg dil
rol bl, 1
inc bl
xor bl, 0x8b
inc bl
not bl
mov qword [rsp + rax*2], rsi
cwd
sub bl, 0xa3
ror bl, 1
add bl, 0x86
xor r11b, bl
bts rdi, 0x3f
imul dil
lea rbx, [rsp + rbx + 0x18]
call fcn.140031023
mov edx, 0x2125cc30
movsx ebx, dl
movzx edx, byte [r10 + rdx - 0x2125cc30]
mov edi, ebx
not rdi
xor dl, r11b
ror dl, 1
mov r8d, edi
neg dl
bt ebx, edi
dec dl
xor dl, 0x12
movsx eax, bl
inc rbx
rol dl, 1
rol r8, 0x95
bt eax, edi
and r8, rdi
xor r11b, dl
add rdx, rsp
mov esi, r8d
btc di, 0x3c
mov rdi, qword [rbx + rdx - 0x31]
movsx ecx, ax
btr bx, bx
mov qword [rbp + rbx*2 - 0x6a], rdi
div bl
movzx edx, bl
lea r8, [rax + rsi*8 + 0x723b67b8]
mov edi, dword [rbx + r10 - 0x30]
lea r10, [r10 + rbx - 0x2c]
imul si, ax
inc rsi
xor edi, r11d
bswap edi
not edi
btc rcx, 0xb2
call fcn.14004c42e

Function at 0x14003f270
Capabilities:
Manually build aes constants
Parse pe header

Disassembly:
add rbp, 8
btc si, 0xa
movsx edx, sil
mov qword [rsp], rsi
movzx edx, byte [r10 + riz]
movsx eax, sil
ror eax, 0xf7
mov ebx, dword [rsp]
adc r10, 0
bt eax, 0xbe
movsx r8d, bl
xor dl, r11b
and qword [rsp], rsi
xor dl, al
mov byte [rsp + 4], ah
xchg ebx, eax
ror r8, 0x21
xor dl, 1
ror dl, 1
shr ax, 0x82
sbb qword [rsp], 0x6498cca5
bts r8, rax
sbb dl, bl
movsx ecx, word [rsp + 4]
inc cx
xor r11b, dl
sal rbx, cl
dec word [rsp + rcx*2 - 5]
lea rdx, [rsp + rdx + 8]
shl rsi, 0x36
dec qword [rsp + rcx*2 - 8]
mov qword [rdx + rcx*2 - 8], rdi
add ecx, dword [rsp + rcx*4 - 0x10]
mov r8d, dword [r10 + rcx - 0x59f498df]
inc word [rsp + rcx - 0x59f498d9]
or bx, si
lea r10, [r10 + rcx - 0x59f498db]
movzx edi, word [rsp + rcx - 0x59f498db]
Function at 0x14005978a
Capabilities:
Manually build aes constants
Parse pe header

Disassembly:
dec edi
xor edi, 0xd1a83107
dec edi
sub r10w, 0x8793
push r11
setle r10b
rol bx, 0x85
xor dword [rsp + rdx], edi
pop r11
inc ebx
rol r8, cl
lea r8, [rbx*8 - 0x77cc1572]
movsxd rdi, edi
lea rax, [rcx*2 - 0x29eaacf4]
lea rdx, [rax + r8*2 - 0x54cf876c]
adc r9, rdi
rol r8, cl
not r10b
imul rdx
mov ebp, dword [rbp + rdx*2 + 4]
rol eax, cl
and r10w, r10w
cbw
jp fcn.140079fde
lea rsi, [rdi + rsi - 0x800]
sal ecx, cl
xadd r10w, dx
movzx edi, byte [rdi + rsi - 0x7ff]
xor dil, r11b
movzx eax, dl
rol rax, 0xaf
movzx ebx, cx
xor dil, 0x97
sub r10w, dx
adc dil, al
shr dx, 0xa1
jns 0x140076a03
ror dil, 1
cwd
xor dil, 0x8c
ror dil, 1
xadd cl, bh
inc r10d
lea rdx, [rdx + r10*2 - 0x5be90d70]
xor r11b, dil
add rdi, rsp
mov r10, qword [rdi + rbx*2 - 0x10100]
lea rbp, [rbp + rbx*2 - 0x10108]
xor r8w, 0x6983
cqo
mov qword [rbp + rdx*4], r10
ja fcn.140079fde
lea ecx, [rcx + rbx*2 - 0x20116e85]
cwde
shr r8, 0xe7
mov qword [rsp + rbx], r11
shr rbx, 1
neg r8d
bts edi, r8d
xor dword [rsp + rbx], ecx
pop r11
btr edx, ebx
movsxd rcx, ecx
inc r8
adc r9, rcx
add rbx, rbp
lea rbp, [rdx + rbp - 0x753e]
sal ax, 0x64
mov dword [rbp + rdx*4 - 0x1d4e8], ebx
imul rdx, rax
jae fcn.14003147f
bswap r8d
not r8d
mov eax, 0xa72e3d29
movsx ecx, di
add sil, 0x2c
bswap r8d
sbb rax, 0xffffffffd13e9211
inc r8d
ror si, 0x85
shr cl, 5
mov qword [rsp + rsi - 0xdc8d], r11
sub ecx, edi
inc di
xor dword [rsp + rsi*2 - 0x1b91a], r8d
add edi, edi
xchg rdi, rsi
imul rdi
pop r11
inc edi
movsxd r8, r8d
or dil, al
cbw
jg 0x1400520ca
adc r9, r8
movzx eax, byte [rsi + r10 - 0x770ff8fa]
btr ebx, edi
call fcn.140081fd3
bswap edi
push r8
and rbx, r8
dec edi
ror r10, cl
mov qword [rsp + rax - 0x4bac], r11
xor dword [rsp + rax - 0x4bac], edi
shl qword [rsp + rax - 0x4bb4], 0x9d
xor dl, bl
mov r11, qword [rsp + rax - 0x4bac]
and edx, 0x858be696
sal r10w, 0xc4
movsxd rdi, edi
adc r9, rdi
mov qword [rsp + rax - 0x4bac], r8
and cx, bx
movzx r8w, byte [rbp + rax - 0x4bb4]
mov cl, byte [rax + rbp - 0x4bb2]
shl byte [rsp + rax - 0x4bb4], 0x61
lea rbp, [rbp + rax - 0x4bb2]
not r8b
push r10
jbe 0x140063810
mov edx, 0xb41f2e0b
lea rcx, [rdx + rdx*4 + 0x5c3be904]
lea rcx, [rcx*8 - 0x3fc927d]
sub rsi, 4
add cx, cx
movzx r10d, cx
bswap rdx
mov edi, dword [r10 + rsi - 0xceb6]
xor edi, r11d
xadd r10, rcx
movsx r8d, cx
dec edi
neg r8d
shr edx, 0x8a
lea r10, [rcx + 0x71994e9d]
not edi
lea rbx, [r8 + r8 + 0x7eb185b7]
ror r10w, 0xc3
jns 0x14003c1bf
not cl
bswap rdx
mul byte [rsp + rax - 0x4bab]
or r8b, cl
add r10d, dword [rsp + rax + 6]
pop rdx
push r10
mov word [rbp + rdx*2 - 0x6f180000], r8w
mov qword [rsp + rdx - 0x378c0000], r9
ret 0x10
jo 0x140051519
Function at 0x14005e492
Capabilities:
Encode data using base64

Disassembly:
xor ax, r11w
xor ax, 0xb51f
xchg word [rsp + r10 + 0xf], r10w
add ax, 0x1aba
ror ax, 1
xor rdx, r10
sbb ax, 0xf317
xor r11w, ax
sar r8d, 0x92
sbb word [rsp + r10*2 + 0x2000a], 0xab87
push rdx
lea rax, [rsp + rax + 0x18]
shl dword [rsp + r10 + 0x10011], 0x4b
jp 0x14005728e
xor dword [rsp + r10*2 + 0x20005], r8d
mov byte [rax + rdx - 0x4912bbd0], cl
mov qword [rsp + rdx - 0x4912bbd0], r9
ret 0x10
mov cx, word [rdx + rbp + 0x49124430]
lea rbp, [rbp + r10 + 3]
mov qword [rsp + rdx + 0x49124430], rbx
push r10
sbb dil, r10b
lea rsi, [rsi + r10 - 1]
btc bx, bx
xchg byte [rsp + r10 + 1], r8b
movzx eax, word [rsi + r10*4 + 4]
jb 0x14005c4ff
cmovb r8w, dx
jae 0x140053e4b

Function at 0x140061495
Capabilities:
Encode data using base64

Disassembly:
neg ebx
lea r8, [rcx + rax*2 - 0x1bcbc4d0]
jmp 0x14008d15d
bswap r8
add r10, 4
push r8
push rbx
xor esi, r11d
xor dword [rsp + 0x1a], 0xbf809600
setg r8b
js 0x140065900
mov eax, 0xa9b5e0bb
lea rdx, [rax + rax - 0x2c6ca761]
sub rsi, 4
mov ebx, dword [rsi + riz]
lea rcx, [rdx + 0x61260b7]
sub cx, ax
sal cx, 0xcb
xor ebx, r11d
not ebx
add ebx, 0x1c1a7bb3
imul cx
rol ebx, 2
movzx edi, al
dec ebx
xor cl, 0x8a
jno 0x14004d570
movzx r8d, ax
movzx esi, al
lea rdx, [r8 + r8 - 0x5e34200]
lea rbp, [rbp + rax*2 - 0x2a29587c]
btc si, 0xbe
neg r8b
movzx edx, byte [r10 + r8*2 - 0x15982]
lea r10, [r10 + rax - 0x1514ac3e]
xor dl, r11b
lea esi, [rbx + rsi - 0x7d0c5d04]
pop rdi
mov qword [rsp + 8], r8
ror esi, 2
ror word [rsp + 0x10], 0xe1
jno 0x14006409c
xor esi, 0xeaab85b8
rol esi, 3
pop rax
xchg dword [rsp + 0xc], edi
rol word [rsp + rdi - 0xbf72], 0xec
neg esi
mov qword [rsp + rdi*4 - 0x2fdf8], rax
sal dword [rsp + rdi - 0xbf7e], 0xb5
dec esi
pop rdx
mov qword [rsp + rdi - 0xbf80], r11
xor dword [rsp + rdi - 0xbf80], esi
btr r8w, dx
ror r8, 0x95
pop r11
lea rcx, [rax*2 + 0x231c539c]
xor rdi, 0x6ea9d31d
call fcn.14002de97
mov bp, word [rbp + rax + 0x564aa800]
jb fcn.140079fde
dec ebx
ror ebx, 1
cdqe
push r11
xor dword [rsp + rax + 0x564aa800], ebx
pop r11
lea r10, [rax - 0x7c419449]
movsxd rbx, ebx
bswap r8d
lea rcx, [rdi + rcx - 0x78c7115e]
not cx
add r9, rbx
rol ecx, 0xcd
jb 0x14008cdbf

Function at 0x1400866b9
Capabilities:
Parse pe header

Disassembly:
or cl, 0xa0
not edi
mov qword [rsp], r11
xor dword [rsp], edi
call fcn.140039ca7
xor edi, r11d
movsx r10d, r8w
neg edi
xadd r8w, r10w
btr r8d, r8d
xor edi, 0xd0b84aaf
mov qword [rsp], r8
pop r10
inc edi
jmp 0x14003ea08
Function at 0x14000cb80
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
push rbx
mov rax, rcx
add qword [rcx + 0x30], r8
mov r11, qword [rcx + 0x40]
test r11, r11
je 0x14000cbc2
mov r10d, 8
sub r10, r11
cmp r8, r10
mov rdi, r10
cmovb rdi, r8
cmp rdi, 4
jb 0x14000cbca
mov esi, dword [rdx]
mov r9d, 4
mov rcx, r9
or rcx, 1
cmp rcx, rdi
jb 0x14000cbdb
jmp 0x14000cbf2
xor r10d, r10d
jmp 0x14000cc7d
xor esi, esi
xor r9d, r9d
mov rcx, r9
or rcx, 1
cmp rcx, rdi
jae 0x14000cbf2
movzx ebx, word [rdx + r9]
lea ecx, [r9*8]
shl rbx, cl
or rsi, rbx
or r9, 2
cmp r9, rdi
jae 0x14000cc09
movzx edi, byte [rdx + r9]
shl r9d, 3
mov ecx, r9d
shl rdi, cl
or rsi, rdi
lea ecx, [r11*8]
shl rsi, cl
or rsi, qword [rax + 0x38]
mov qword [rax + 0x38], rsi
cmp r10, r8
jbe 0x14000cc29
add r11, r8
jmp 0x14000cd5b
mov r11, qword [rax + 0x18]
mov r9, qword [rax + 0x10]
mov rcx, qword [rax]
add rcx, r9
rol r9, 0xd
xor r11, rsi
xor r9, rcx
rol rcx, 0x20
mov rdi, qword [rax + 8]
add rdi, r11
rol r11, 0x10
xor r11, rdi
add rcx, r11
rol r11, 0x15
xor r11, rcx
add rdi, r9
rol r9, 0x11
mov qword [rax + 0x18], r11
xor r9, rdi
rol rdi, 0x20
mov qword [rax + 0x10], r9
mov qword [rax + 8], rdi
xor rcx, rsi
mov qword [rax], rcx
sub r8, r10
mov r11d, r8d
and r11d, 7
and r8, 0xfffffffffffffff8
cmp r10, r8
jae 0x14000ccf2
mov rcx, qword [rax]
mov r9, qword [rax + 8]
mov rdi, qword [rax + 0x18]
mov rsi, qword [rax + 0x10]
nop
add rcx, rsi
rol rsi, 0xd
mov rbx, qword [rdx + r10]
xor rsi, rcx
rol rcx, 0x20
xor rdi, rbx
add r9, rdi
rol rdi, 0x10
xor rdi, r9
add rcx, rdi
rol rdi, 0x15
add r9, rsi
rol rsi, 0x11
xor rsi, r9
rol r9, 0x20
xor rdi, rcx
xor rcx, rbx
add r10, 8
cmp r10, r8
jb 0x14000cca0
mov qword [rax + 0x18], rdi
mov qword [rax + 0x10], rsi
mov qword [rax + 8], r9
mov qword [rax], rcx
cmp r11d, 4
jb 0x14000cd10
mov r9d, dword [rdx + r10]
mov r8d, 4
mov rcx, r8
or rcx, 1
cmp rcx, r11
jb 0x14000cd22
jmp 0x14000cd3d
xor r9d, r9d
xor r8d, r8d
mov rcx, r8
or rcx, 1
cmp rcx, r11
jae 0x14000cd3d
lea rcx, [rdx + r8]
movzx esi, word [r10 + rcx]
lea ecx, [r8*8]
shl rsi, cl
or r9, rsi
or r8, 2
cmp r8, r11
jae 0x14000cd57
add r10, r8
movzx edx, byte [rdx + r10]
shl r8d, 3
mov ecx, r8d
shl rdx, cl
or r9, rdx
mov qword [rax + 0x38], r9
mov qword [rax + 0x40], r11
pop rbx
pop rdi
pop rsi
ret
Function at 0x14000d550
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x40
movaps xmmword [rsp + 0x30], xmm6
mov ecx, dword [0x140123120]
test ecx, ecx
je 0x14000d57c
dec ecx
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 1
jbe 0x14000d595
add rax, 8
jmp 0x14000d630
lea rcx, [0x140123108]
call fcn.140082430
mov ecx, eax
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 1
ja 0x14000d573
je 0x14000d62e
xorps xmm0, xmm0
movaps xmmword [rsp + 0x20], xmm0
lea rcx, [rsp + 0x20]
mov edx, 0x10
call sub.bcryptprimitives.dll_ProcessPrng
movaps xmm6, xmmword [rsp + 0x20]
movzx eax, byte [0x1401bb111]
mov edx, 0x18
xor ecx, ecx
call fcn.140089d40
test rax, rax
je 0x14000d65d
mov rbx, rax
mov rsi, rax
lea rax, [0x140123108]
mov qword [rsi], rax
movups xmmword [rsi + 8], xmm6
mov ecx, dword [0x140123120]
test ecx, ecx
je 0x14000d63d
dec ecx
call sub.KERNEL32.dll_TlsGetValue
mov rdi, rax
mov ecx, dword [0x140123120]
test ecx, ecx
je 0x14000d64d
dec ecx
add rbx, 8
mov rdx, rsi
call sub.KERNEL32.dll_TlsSetValue
test rdi, rdi
je 0x14000d629
mov rcx, qword [0x1401bb0c8]
xor edx, edx
mov r8, rdi
call fcn.1400fda74
mov rax, rbx
jmp 0x14000d630
xor eax, eax
movaps xmm6, xmmword [rsp + 0x30]
add rsp, 0x40
pop rbx
pop rdi
pop rsi
ret
lea rcx, [0x140123108]
call fcn.140082430
mov ecx, eax
jmp 0x14000d5f3
lea rcx, [0x140123108]
call fcn.140082430
mov ecx, eax
jmp 0x14000d607
ud2
Function at 0x14001d1c0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
sub rsp, 0x48
movdqa xmmword [rsp + 0x30], xmm9
movdqa xmmword [rsp + 0x20], xmm8
movdqa xmmword [rsp + 0x10], xmm7
movdqa xmmword [rsp], xmm6
cmp r8, 0x80
jb 0x14001d3dd
movdqu xmm4, xmmword [rdx]
movdqu xmm3, xmmword [rdx + 0x10]
movdqu xmm2, xmmword [rdx + 0x20]
movdqu xmm1, xmmword [rdx + 0x30]
not ecx
movd xmm0, ecx
pxor xmm0, xmm4
add rdx, 0x40
add r8, 0xffffffffffffffc0
movabs rax, 0x154442bd4
movq xmm4, rax
movdqa xmm5, xmmword [0x140124760]
nop word cs:[rax + rax]
movdqa xmm6, xmm0
pclmulqdq xmm6, xmm4, 0
movdqa xmm7, xmm0
pclmulqdq xmm7, xmm5, 0x11
movdqu xmm0, xmmword [rdx]
pxor xmm0, xmm6
pxor xmm0, xmm7
movdqu xmm6, xmmword [rdx + 0x10]
movdqu xmm7, xmmword [rdx + 0x20]
movdqu xmm8, xmmword [rdx + 0x30]
movdqa xmm9, xmm3
pclmulqdq xmm9, xmm4, 0
pxor xmm9, xmm6
pclmulqdq xmm3, xmm5, 0x11
pxor xmm3, xmm9
movdqa xmm6, xmm2
pclmulqdq xmm6, xmm4, 0
pxor xmm6, xmm7
pclmulqdq xmm2, xmm5, 0x11
pxor xmm2, xmm6
movdqa xmm6, xmm1
pclmulqdq xmm6, xmm4, 0
pxor xmm6, xmm8
pclmulqdq xmm1, xmm5, 0x11
pxor xmm1, xmm6
add rdx, 0x40
add r8, 0xffffffffffffffc0
cmp r8, 0x3f
ja 0x14001d230
movabs rax, 0x1751997d0
movq xmm4, rax
movdqa xmm6, xmm0
pclmulqdq xmm6, xmm4, 0
movdqa xmm5, xmmword [0x140124770]
pclmulqdq xmm0, xmm5, 0x11
pxor xmm0, xmm6
pxor xmm0, xmm3
movdqa xmm3, xmm0
pclmulqdq xmm3, xmm4, 0
pclmulqdq xmm0, xmm5, 0x11
pxor xmm0, xmm3
pxor xmm0, xmm2
movdqa xmm2, xmm0
pclmulqdq xmm2, xmm4, 0
pclmulqdq xmm0, xmm5, 0x11
pxor xmm0, xmm2
pxor xmm0, xmm1
cmp r8, 0x10
jb 0x14001d35a
nop word cs:[rax + rax]
movdqu xmm1, xmmword [rdx]
add r8, 0xfffffffffffffff0
add rdx, 0x10
movdqa xmm2, xmm0
pclmulqdq xmm2, xmm4, 0
pxor xmm2, xmm1
pclmulqdq xmm0, xmm5, 0x11
pxor xmm0, xmm2
cmp r8, 0xf
ja 0x14001d330
movdqa xmm1, xmmword [0x140124770]
pclmulqdq xmm1, xmm0, 1
psrldq xmm0, 8
pxor xmm0, xmm1
pxor xmm1, xmm1
pxor xmm2, xmm2
pblendw xmm2, xmm0, 3
movabs rax, 0x163cd6124
movq xmm3, rax
pclmulqdq xmm3, xmm2, 0
psrldq xmm0, 4
pxor xmm0, xmm3
pxor xmm2, xmm2
pblendw xmm2, xmm0, 3
pclmulqdq xmm2, xmmword [0x140124780], 0x10
pblendw xmm2, xmm1, 0xfc
movabs rax, 0x1db710641
movq xmm1, rax
pclmulqdq xmm1, xmm2, 0
pxor xmm1, xmm0
pextrd ecx, xmm1, 1
not ecx
test r8, r8
je 0x14001d3fb
movaps xmm6, xmmword [rsp]
movaps xmm7, xmmword [rsp + 0x10]
movaps xmm8, xmmword [rsp + 0x20]
movaps xmm9, xmmword [rsp + 0x30]
add rsp, 0x48
jmp fcn.14001cd70
mov eax, ecx
movaps xmm6, xmmword [rsp]
movaps xmm7, xmmword [rsp + 0x10]
movaps xmm8, xmmword [rsp + 0x20]
movaps xmm9, xmmword [rsp + 0x30]
add rsp, 0x48
ret