joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14006ec9c
Capabilities:
Read file on windows

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
mov rbx, rcx
test rcx, rcx
je 0x14006edcd
mov rax, qword [0x1400f6f48]
test rax, rax
je 0x14006ecd1
call rax
mov rsi, rax
mov rax, rsi
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
lea rdx, [0x1400b7c95]
call sym.fopen
mov rdi, rax
test rax, rax
je 0x14006edb1
mov r8d, 2
mov edx, 0
mov rcx, rax
call sym.fseek
mov rcx, rdi
call sym.ftell
mov ebp, eax
mov r8d, 0
mov edx, 0
mov rcx, rdi
call sym.fseek
test ebp, ebp
je 0x14006ed8b
lea ecx, [rbp + 1]
call sym.malloc
mov rsi, rax
test rax, rax
je 0x14006ed75
mov r9, rdi
mov r8d, ebp
mov edx, 1
mov rcx, rax
call sym.fread
mov r12, rax
cmp eax, ebp
jb 0x14006ed65
mov r12d, r12d
mov byte [rsi + r12], 0
mov r8, rbx
lea rdx, str.FILEIO:___s__Text_file_loaded_successfully
mov ecx, 3
call sym.TraceLog
jmp 0x14006eda4
lea edx, [rax + 1]
mov rcx, rsi
call sym.realloc
mov rsi, rax
jmp 0x14006ed47
mov r8, rbx
lea rdx, str.FILEIO:___s__Failed_to_allocated_memory_for_file_reading
mov ecx, 4
call sym.TraceLog
jmp 0x14006eda4
mov r8, rbx
lea rdx, str.FILEIO:___s__Failed_to_read_text_file
mov ecx, 4
call sym.TraceLog
mov esi, 0
mov rcx, rdi
call sym.fclose
jmp 0x14006ecc3
mov r8, rbx
lea rdx, str.FILEIO:___s__Failed_to_open_text_file
mov ecx, 4
call sym.TraceLog
mov rsi, rdi
jmp 0x14006ecc3
lea rdx, str.FILEIO:_File_name_provided_is_not_valid
mov ecx, 4
call sym.TraceLog
mov rsi, rbx
jmp 0x14006ecc3

Function at 0x14006f6ea
Capabilities:
Hide graphical window

Disassembly:
sub rsp, 0x28
mov rcx, qword [rcx + 0x360]
mov edx, 0
call qword [sym.imp.USER32.dll_ShowWindow]
nop
add rsp, 0x28
ret

Function at 0x14006f971
Capabilities:
Log keystrokes via polling

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x20
mov ecx, 0x10
mov rbx, qword [sym.imp.USER32.dll_GetKeyState]
call rbx
movsx esi, ax
shr esi, 0x1f
mov ecx, 0x11
call rbx
mov ebx, esi
or ebx, 2
test ax, ax
cmovns ebx, esi
mov ecx, 0x12
call qword [sym.imp.USER32.dll_GetKeyState]
mov edx, eax
mov eax, ebx
or eax, 4
test dx, dx
cmovs ebx, eax
mov ecx, 0x5b
mov rdi, qword [sym.imp.USER32.dll_GetKeyState]
call rdi
mov esi, eax
mov ecx, 0x5c
call rdi
mov edx, eax
mov eax, ebx
or eax, 8
or si, dx
cmovs ebx, eax
mov ecx, 0x14
mov rdi, qword [sym.imp.USER32.dll_GetKeyState]
call rdi
mov esi, eax
mov ecx, 0x90
call rdi
and eax, 1
shl eax, 5
and esi, 1
shl esi, 4
or eax, esi
or eax, ebx
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret
Function at 0x140070ff2
Capabilities:
Log keystrokes via polling

Disassembly:
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x90
mov rsi, qword [sym.imp.USER32.dll_PeekMessageW]
mov rbp, qword [sym.imp.USER32.dll_TranslateMessage]
mov rdi, qword [sym.imp.USER32.dll_DispatchMessageW]
jmp 0x140071036
mov rbx, qword [0x1400f76f8]
test rbx, rbx
je 0x140071036
mov rcx, rbx
call sym._glfwInputWindowCloseRequest
mov rbx, qword [rbx]
test rbx, rbx
jne 0x140071026
lea rcx, [rsp + 0x60]
mov dword [rsp + 0x20], 1
mov r9d, 0
mov r8d, 0
mov edx, 0
call rsi
test eax, eax
je 0x140071072
cmp dword [rsp + 0x68], 0x12
je 0x14007101a
lea rbx, [rsp + 0x60]
mov rcx, rbx
call rbp
mov rcx, rbx
call rdi
jmp 0x140071036
call qword [sym.imp.USER32.dll_GetActiveWindow]
test rax, rax
je 0x140071144
lea rdx, str.GLFW
mov rcx, rax
call qword [sym.imp.USER32.dll_GetPropW]
mov rdi, rax
test rax, rax
je 0x140071144
mov dword [rsp + 0x40], 0xa0
mov dword [rsp + 0x44], 0x154
mov dword [rsp + 0x48], 0xa1
mov dword [rsp + 0x4c], 0x158
mov dword [rsp + 0x50], 0x5b
mov dword [rsp + 0x54], 0x157
mov dword [rsp + 0x58], 0x5c
mov dword [rsp + 0x5c], 0x15b
lea rbx, [rsp + 0x40]
lea r13, [rsp + 0x60]
lea r12, [0x1400f6f80]
mov rbp, qword [sym.imp.USER32.dll_GetKeyState]
jmp 0x140071100
add rbx, 8
cmp rbx, r13
je 0x140071144
mov esi, dword [rbx + 4]
movsxd rax, esi
movzx r14d, word [r12 + rax*2 + 0x1fa8]
mov ecx, dword [rbx]
call rbp
test ax, ax
js 0x1400710f7
movsxd rax, esi
cmp byte [rdi + rax + 0x98], 1
jne 0x1400710f7
call sym.getKeyMods
mov dword [rsp + 0x20], eax
mov r9d, 0
movsx r8d, r14w
mov edx, esi
mov rcx, rdi
call sym._glfwInputKey
jmp 0x1400710f7
mov rbx, qword [0x1400f98c8]
test rbx, rbx
je 0x1400711b2
lea rdx, [rsp + 0x3c]
lea r8, [rsp + 0x40]
mov rcx, rbx
call sym._glfwGetWindowSizeWin32
mov edx, dword [rsp + 0x3c]
mov eax, edx
shr eax, 0x1f
add eax, edx
sar eax, 1
cmp dword [rbx + 0x3a0], eax
jne 0x14007118c
mov ecx, dword [rsp + 0x40]
mov edx, ecx
shr edx, 0x1f
add edx, ecx
sar edx, 1
cmp dword [rbx + 0x3a4], edx
je 0x1400711b2
mov ecx, dword [rsp + 0x40]
mov edx, ecx
shr edx, 0x1f
add edx, ecx
sar edx, 1
pxor xmm2, xmm2
cvtsi2sd xmm2, edx
pxor xmm1, xmm1
cvtsi2sd xmm1, eax
mov rcx, rbx
call sym._glfwSetCursorPosWin32
nop
add rsp, 0x90
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
Function at 0x14007212e
Capabilities:
Log keystrokes

Disassembly:
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x180
mov qword [rsp + 0x80], 0
mov qword [rsp + 0x88], 0
mov qword [rsp + 0x90], 0
mov qword [rsp + 0x98], 0
mov qword [rsp + 0xa0], 0
mov qword [rsp + 0xa8], 0
mov qword [rsp + 0xb0], 0
mov qword [rsp + 0xb8], 0
mov qword [rsp + 0xc0], 0
mov qword [rsp + 0xc8], 0
mov qword [rsp + 0xd0], 0
mov qword [rsp + 0xd8], 0
mov qword [rsp + 0xe0], 0
mov qword [rsp + 0xe8], 0
mov qword [rsp + 0xf0], 0
mov qword [rsp + 0xf8], 0
mov qword [rsp + 0x100], 0
mov qword [rsp + 0x108], 0
mov qword [rsp + 0x110], 0
mov qword [rsp + 0x118], 0
mov qword [rsp + 0x120], 0
mov qword [rsp + 0x128], 0
mov qword [rsp + 0x130], 0
mov qword [rsp + 0x138], 0
mov qword [rsp + 0x140], 0
mov qword [rsp + 0x148], 0
mov qword [rsp + 0x150], 0
mov qword [rsp + 0x158], 0
mov qword [rsp + 0x160], 0
mov qword [rsp + 0x168], 0
mov qword [rsp + 0x170], 0
mov qword [rsp + 0x178], 0
mov qword [0x1400f91e2], 0
mov qword [0x1400f98ab], 0
lea rdi, [0x1400f91ea]
and rdi, 0xfffffffffffffff8
lea rcx, [0x1400f91e2]
sub rcx, rdi
add ecx, 0x6d1
shr ecx, 3
mov ecx, ecx
mov eax, 0
rep stosq qword [rdi], rax
lea rbp, [0x1400f9282]
mov esi, 0
mov r12, qword [sym.imp.USER32.dll_ToUnicode]
mov r13, qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov r14, r12
jmp 0x1400723db
mov dword [rsp + 0x40], 0x60
mov dword [rsp + 0x44], 0x61
mov dword [rsp + 0x48], 0x62
mov dword [rsp + 0x4c], 0x63
mov dword [rsp + 0x50], 0x64
mov dword [rsp + 0x54], 0x65
mov dword [rsp + 0x58], 0x66
mov dword [rsp + 0x5c], 0x67
mov dword [rsp + 0x60], 0x68
mov dword [rsp + 0x64], 0x69
mov dword [rsp + 0x68], 0x6e
mov dword [rsp + 0x6c], 0x6f
mov dword [rsp + 0x70], 0x6a
mov dword [rsp + 0x74], 0x6d
mov dword [rsp + 0x78], 0x6b
mov edi, dword [rsp + rsi*4 - 0x440]
jmp 0x14007240b
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0x10
lea r9, [rsp + 0x40]
lea r8, [rsp + 0x80]
mov edx, ebx
mov ecx, edi
call r14
jmp 0x14007243b
add rsi, 1
add rbp, 5
cmp rsi, 0x13d
je 0x14007247b
lea rax, [0x1400f8f68]
movzx ebx, word [rax + rsi*2]
cmp bx, 0xffff
je 0x1400723c6
lea eax, [rsi - 0x120]
cmp eax, 0xe
jbe 0x14007231f
movsx ecx, bx
mov edx, 1
call qword [sym.imp.USER32.dll_MapVirtualKeyW]
mov edi, eax
movsx ebx, bx
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0x10
lea r9, [rsp + 0x40]
lea r8, [rsp + 0x80]
mov edx, ebx
mov ecx, edi
call r12
cmp eax, 0xffffffff
je 0x1400723a0
test eax, eax
jle 0x1400723c6
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 5
mov qword [rsp + 0x20], rbp
mov r9d, 1
lea r8, [rsp + 0x40]
mov edx, 0
mov ecx, 0xfde9
call r13
jmp 0x1400723c6
add rsp, 0x180
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret

Function at 0x14007305b
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x28
cmp dword [rcx], 1
jne 0x140073072
mov ecx, dword [rcx + 4]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
add rsp, 0x28
ret
mov r8d, 0x3f
lea rdx, str.external_glfw_src_win32_thread.c
lea rcx, str.tls__win32.allocated__GLFW_TRUE
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
nop
Function at 0x1400731b7
Capabilities:
Set thread local storage value

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
lea rcx, [0x1400f8924]
call sym._glfwPlatformGetTls
test rax, rax
je 0x1400731f9
mov rcx, qword [rax + 0x2a0]
test rcx, rcx
je 0x1400731ea
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
jne 0x1400731f3
mov rcx, rbx
call qword [0x1400f8a48]
add rsp, 0x20
pop rbx
ret
mov r8d, 0x138
lea rdx, str.external_glfw_src_egl_context.c
lea rcx, str.window___NULL
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
nop

Function at 0x140073214
Capabilities:
Set thread local storage value

Disassembly:
sub rsp, 0x28
cmp dword [rcx], 1
jne 0x14007322c
mov ecx, dword [rcx + 4]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
nop
add rsp, 0x28
ret
mov r8d, 0x45
lea rdx, str.external_glfw_src_win32_thread.c
lea rcx, str.tls__win32.allocated__GLFW_TRUE
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
nop
Function at 0x14007ac5f
Capabilities:
Register raw input devices

Disassembly:
sub rsp, 0x38
mov word [rsp + 0x20], 1
mov word [rsp + 0x22], 2
mov dword [rsp + 0x24], 1
mov qword [rsp + 0x28], 0
lea rcx, [rsp + 0x20]
mov r8d, 0x10
mov edx, 1
call qword [sym.imp.USER32.dll_RegisterRawInputDevices]
test eax, eax
je 0x14007aca1
add rsp, 0x38
ret
lea rdx, str.Win32:_Failed_to_remove_raw_input_device
mov ecx, 0x10008
call sym._glfwInputErrorWin32
jmp 0x14007ac9c

Function at 0x14007ada7
Capabilities:
Register raw input devices

Disassembly:
sub rsp, 0x38
mov word [rsp + 0x20], 1
mov word [rsp + 0x22], 2
mov dword [rsp + 0x24], 0
mov rax, qword [rcx + 0x360]
mov qword [rsp + 0x28], rax
lea rcx, [rsp + 0x20]
mov r8d, 0x10
mov edx, 1
call qword [sym.imp.USER32.dll_RegisterRawInputDevices]
test eax, eax
je 0x14007adec
add rsp, 0x38
ret
lea rdx, str.Win32:_Failed_to_register_raw_input_device
mov ecx, 0x10008
call sym._glfwInputErrorWin32
jmp 0x14007ade7

Function at 0x14007b39e
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x38
mov rsi, rcx
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov r9d, 0xffffffff
mov r8, rcx
mov edx, 0
mov ecx, 0xfde9
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov ebx, eax
test eax, eax
jne 0x14007b3e2
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
ret
movsxd rdx, eax
add rdx, rdx
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov rdi, rax
test rax, rax
je 0x14007b487
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GlobalLock]
test rax, rax
je 0x14007b49d
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rax
mov r9d, 0xffffffff
mov r8, rsi
mov edx, 0
mov ecx, 0xfde9
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov ebx, 3
mov rsi, qword [sym.imp.USER32.dll_OpenClipboard]
mov rbp, qword [sym.imp.KERNEL32.dll_Sleep]
mov rcx, qword [0x1400f8b00]
call rsi
test eax, eax
jne 0x14007b4bc
mov ecx, 1
call rbp
sub ebx, 1
jne 0x14007b44f
lea rdx, str.Win32:_Failed_to_open_clipboard
mov ecx, 0x10008
call sym._glfwInputErrorWin32
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GlobalFree]
jmp 0x14007b3d9
lea rdx, str.Win32:_Failed_to_allocate_global_handle_for_clipboard
mov ecx, 0x10008
call sym._glfwInputErrorWin32
jmp 0x14007b3d9
lea rdx, str.Win32:_Failed_to_lock_global_handle
mov ecx, 0x10008
call sym._glfwInputErrorWin32
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GlobalFree]
jmp 0x14007b3d9
call qword [sym.imp.USER32.dll_EmptyClipboard]
mov rdx, rdi
mov ecx, 0xd
call qword [sym.imp.USER32.dll_SetClipboardData]
call qword [sym.imp.USER32.dll_CloseClipboard]
jmp 0x14007b3d9
Function at 0x14007b4db
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x20
mov ebx, 3
mov rsi, qword [sym.imp.USER32.dll_OpenClipboard]
mov rdi, qword [sym.imp.KERNEL32.dll_Sleep]
mov rcx, qword [0x1400f8b00]
call rsi
test eax, eax
jne 0x14007b52f
mov ecx, 1
call rdi
sub ebx, 1
jne 0x14007b4f5
lea rdx, str.Win32:_Failed_to_open_clipboard
mov ecx, 0x10008
call sym._glfwInputErrorWin32
mov ebx, 0
mov rax, rbx
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret
mov ecx, 0xd
call qword [sym.imp.USER32.dll_GetClipboardData]
mov rbx, rax
test rax, rax
je 0x14007b586
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GlobalLock]
mov rsi, rax
test rax, rax
je 0x14007b59f
mov rcx, qword [0x1400f8b20]
call sym._glfw_free
mov rcx, rsi
call sym._glfwCreateUTF8FromWideStringWin32
mov qword [0x1400f8b20], rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
call qword [sym.imp.USER32.dll_CloseClipboard]
mov rbx, qword [0x1400f8b20]
jmp 0x14007b524
lea rdx, str.Win32:_Failed_to_convert_clipboard_to_string
mov ecx, 0x10009
call sym._glfwInputErrorWin32
call qword [sym.imp.USER32.dll_CloseClipboard]
jmp 0x14007b524
lea rdx, str.Win32:_Failed_to_lock_global_handle
mov ecx, 0x10008
call sym._glfwInputErrorWin32
call qword [sym.imp.USER32.dll_CloseClipboard]
mov rbx, rsi
jmp 0x14007b524

Function at 0x14007e59a
Capabilities:
Allocate thread local storage

Disassembly:
push rsi
push rbx
sub rsp, 0x28
mov rbx, rcx
mov esi, dword [rcx]
test esi, esi
jne 0x14007e5cb
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [rbx + 4], eax
cmp eax, 0xffffffff
je 0x14007e5e5
mov dword [rbx], 1
mov esi, 1
mov eax, esi
add rsp, 0x28
pop rbx
pop rsi
ret
mov r8d, 0x29
lea rdx, str.external_glfw_src_win32_thread.c
lea rcx, str.tls__win32.allocated__GLFW_FALSE
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
lea rdx, str.Win32:_Failed_to_allocate_TLS_index
mov ecx, 0x10008
call sym._glfwInputError
jmp 0x14007e5c2
Function at 0x140080b6b
Capabilities:
Link many functions at runtime

Disassembly:
push rsi
push rbx
sub rsp, 0x48
lea rax, str.libOSMesa.dll
mov qword [rsp + 0x20], rax
lea rax, str.OSMesa.dll
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x30], 0
mov eax, 1
cmp qword [0x1400f8a60], 0
je 0x140080ba8
add rsp, 0x48
pop rbx
pop rsi
ret
lea rbx, [rsp + 0x20]
lea rcx, str.libOSMesa.dll
mov rsi, qword [sym.imp.KERNEL32.dll_LoadLibraryA]
call rsi
mov qword [0x1400f8a60], rax
test rax, rax
jne 0x140080bed
add rbx, 8
mov rcx, qword [rbx]
test rcx, rcx
jne 0x140080bbb
lea rdx, str.OSMesa:_Library_not_found
mov ecx, 0x10006
call sym._glfwInputError
mov eax, 0
jmp 0x140080ba1
lea rdx, str.OSMesaCreateContextExt
mov rcx, rax
mov rbx, qword [sym.imp.KERNEL32.dll_GetProcAddress]
call rbx
mov qword [0x1400f8a68], rax
lea rdx, str.OSMesaCreateContextAttribs
mov rcx, qword [0x1400f8a60]
call rbx
mov qword [0x1400f8a70], rax
lea rdx, str.OSMesaDestroyContext
mov rcx, qword [0x1400f8a60]
call rbx
mov qword [0x1400f8a78], rax
lea rdx, str.OSMesaMakeCurrent
mov rcx, qword [0x1400f8a60]
call rbx
mov qword [0x1400f8a80], rax
lea rdx, str.OSMesaGetColorBuffer
mov rcx, qword [0x1400f8a60]
call rbx
mov qword [0x1400f8a88], rax
lea rdx, str.OSMesaGetDepthBuffer
mov rcx, qword [0x1400f8a60]
call rbx
mov qword [0x1400f8a90], rax
lea rdx, str.OSMesaGetProcAddress
mov rcx, qword [0x1400f8a60]
call rbx
mov rdx, rax
mov qword [0x1400f8a98], rax
cmp qword [0x1400f8a68], 0
je 0x140080cd4
cmp qword [0x1400f8a78], 0
je 0x140080cd4
cmp qword [0x1400f8a80], 0
je 0x140080cd4
cmp qword [0x1400f8a88], 0
je 0x140080cd4
cmp qword [0x1400f8a90], 0
je 0x140080cd4
mov eax, 1
test rdx, rdx
jne 0x140080ba1
lea rdx, str.OSMesa:_Failed_to_load_required_entry_points
mov ecx, 0x10008
call sym._glfwInputError
call sym._glfwTerminateOSMesa
mov eax, 0
jmp 0x140080ba1
Function at 0x1400836e0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push r14
push rbp
push rdi
push rsi
push rbx
mov r10, rdx
not r8d
cmp rdx, 8
jbe 0x1400837d3
mov rdx, rcx
lea r9, [0x1400d5180]
test cl, 7
je 0x14008372b
nop dword [rax]
movzx eax, byte [rcx]
add rcx, 1
xor eax, r8d
shr r8d, 8
movzx eax, al
xor r8d, dword [r9 + rax*4]
test cl, 7
jne 0x140083708
add rdx, r10
sub rdx, rcx
mov r10, rdx
mov rsi, r10
and r10d, 7
and rsi, 0xfffffffffffffff8
lea r14, [rcx + rsi]
cmp rcx, r14
jae 0x1400837d3
mov r11, rcx
lea r9, [0x1400d5180]
nop dword [rax]
mov eax, dword [r11]
add r11, 8
xor eax, r8d
mov r8d, dword [r11 - 4]
mov edi, eax
mov ebp, r8d
movzx edx, r8b
mov ebx, r8d
shr r8d, 0x10
shr ebp, 0x18
mov edx, dword [r9 + rdx*4 + 0xc00]
movzx r8d, r8b
shr edi, 0x10
xor edx, dword [r9 + rbp*4]
movzx ebp, al
movzx edi, dil
xor edx, dword [r9 + rbp*4 + 0x1c00]
mov ebp, eax
movzx eax, ah
shr ebp, 0x18
mov eax, dword [r9 + rax*4 + 0x1800]
xor edx, dword [r9 + rbp*4 + 0x1000]
movzx ebp, bh
xor edx, dword [r9 + rbp*4 + 0x800]
xor edx, dword [r9 + r8*4 + 0x400]
xor eax, edx
xor eax, dword [r9 + rdi*4 + 0x1400]
mov r8d, eax
cmp r11, r14
jb 0x140083750
add rcx, rsi
lea rdx, [rcx + r10]
lea r9, [0x1400d5180]
test r10, r10
je 0x140083802
nop dword [rax + rax]
movzx eax, byte [rcx]
add rcx, 1
xor eax, r8d
shr r8d, 8
movzx eax, al
xor r8d, dword [r9 + rax*4]
cmp rcx, rdx
jne 0x1400837e8
mov eax, r8d
not eax
pop rbx
pop rsi
pop rdi
pop rbp
pop r14
ret
Function at 0x140083b60
Capabilities:
Encode data using xor

Disassembly:
push rbp
push rdi
push rsi
push rbx
mov rax, r8
mov rbx, rdx
not rax
cmp rdx, 4
jbe 0x140083c18
mov r8, rcx
lea r9, [0x1400d71c0]
test cl, 3
je 0x140083bb2
nop word cs:[rax + rax]
movzx edx, byte [rcx]
add rcx, 1
xor edx, eax
shr rax, 8
movzx edx, dl
xor rax, qword [r9 + rdx*8]
test cl, 3
jne 0x140083b90
add r8, rbx
mov rbx, r8
sub rbx, rcx
mov rdi, rbx
and ebx, 3
and rdi, 0xfffffffffffffffc
lea rsi, [rcx + rdi]
cmp rcx, rsi
jae 0x140083c18
mov r10, rcx
lea r9, [0x1400d71c0]
nop
mov edx, dword [r10]
add r10, 4
xor edx, eax
shr rax, 0x20
mov r11d, edx
movzx r8d, dl
movzx ebp, dh
shr edx, 0x10
shr r11d, 0x18
mov r8, qword [r9 + r8*8 + 0x1800]
movzx edx, dl
xor r8, qword [r9 + r11*8]
xor rax, r8
xor rax, qword [r9 + rbp*8 + 0x1000]
xor rax, qword [r9 + rdx*8 + 0x800]
cmp r10, rsi
jb 0x140083bd0
add rcx, rdi
lea r8, [rcx + rbx]
lea r9, [0x1400d71c0]
test rbx, rbx
je 0x140083c41
movzx edx, byte [rcx]
add rcx, 1
xor edx, eax
shr rax, 8
movzx edx, dl
xor rax, qword [r9 + rdx*8]
cmp rcx, r8
jne 0x140083c28
not rax
pop rbx
pop rsi
pop rdi
pop rbp
ret
Function at 0x14008b080
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
xor r10d, r10d
mov rsi, qword [rsp + 0x60]
mov r11, rcx
mov ebx, edx
cmp rsi, 4
jbe 0x14008b12a
mov r12d, dword [rcx + 4]
lea eax, [rbx - 5]
sub edx, r12d
cmp edx, 5
cmova r12d, eax
mov eax, dword [rcx]
sub rsi, 5
nop dword [rax + rax]
movzx edi, byte [r9 + r10]
lea rbp, [r10 + 1]
lea edx, [rdi + 0x18]
cmp dl, 1
ja 0x14008b140
lea edi, [rbx + r10]
mov ecx, edi
sub ecx, r12d
movzx r12d, byte [r9 + r10 + 4]
lea r13d, [r12 - 1]
cmp ecx, 5
ja 0x14008b148
test ecx, ecx
je 0x14008b0fe
xor edx, edx
add eax, eax
add edx, 1
and eax, 0xee
cmp ecx, edx
jne 0x14008b0f0
cmp r13b, 0xfd
jbe 0x14008b1d0
mov ecx, eax
shr ecx, 1
cmp eax, 9
jbe 0x14008b1e0
or eax, 0x11
mov r10, rbp
mov r12d, edi
cmp rsi, r10
jae 0x14008b0c0
mov dword [r11], eax
mov dword [r11 + 4], r12d
mov rax, r10
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
mov r10, rbp
jmp 0x14008b11e
mov eax, 1
cmp r13b, 0xfd
jbe 0x14008b118
xor eax, eax
xor ecx, ecx
movzx edx, byte [r9 + r10 + 3]
shl r12d, 0x18
add rbp, r9
shl edx, 0x10
or edx, r12d
movzx r12d, byte [rbp]
or edx, r12d
movzx r12d, byte [r9 + r10 + 2]
shl r12d, 8
or edx, r12d
test r8b, r8b
jne 0x14008b1f0
sub edx, edi
sub edx, 5
test eax, eax
jne 0x14008b1f8
mov eax, edx
mov ecx, edx
add r10, 5
mov r12d, edi
shr eax, 0x18
shr ecx, 0x10
and eax, 1
movzx ecx, cl
neg eax
movzx eax, al
shl eax, 8
or eax, ecx
movzx ecx, dh
movzx edx, dl
shl eax, 8
or eax, ecx
shl eax, 8
or eax, edx
mov dword [rbp], eax
xor eax, eax
jmp 0x14008b11e
or eax, 1
jmp 0x14008b118
cmp ecx, 3
je 0x14008b115
jmp 0x14008b157
lea edx, [rdi + rdx + 5]
test eax, eax
je 0x14008b18d
lea rax, [0x1400d9560]
mov r13d, 0xfffffffb
mov r12d, dword [rax + rcx*4]
mov ecx, 4
mov eax, 3
sub r13d, edi
sub ecx, r12d
sub eax, r12d
mov r12d, 1
shl ecx, 3
shl eax, 3
shl r12d, cl
sub r12d, 1
jmp 0x14008b248
xor edx, r12d
lea ecx, [rdi + rdx + 5]
add edx, r13d
test r8b, r8b
cmovne edx, ecx
mov ecx, eax
mov r14d, edx
shr r14d, cl
mov ecx, r14d
sub ecx, 1
cmp cl, 0xfd
ja 0x14008b238
jmp 0x14008b18d
Function at 0x14008bc80
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
xor eax, eax
mov r8, qword [rsp + 0x58]
mov r11d, edx
cmp r8, 7
jbe 0x14008bd78
sub r8, 8
jmp 0x14008bcc0
and edx, 0x7f
cmp dl, 0x17
je 0x14008bd88
mov rax, rcx
cmp r8, rcx
jb 0x14008bd78
lea r10, [r9 + rax]
lea rcx, [rax + 2]
movzx ebx, byte [r10]
mov edx, ebx
cmp bl, 0xef
jne 0x14008bca8
lea rbx, [r9 + rax + 1]
movzx r10d, byte [rbx]
test r10b, 0xd
jne 0x14008bcb4
lea rdi, [r9 + rcx]
mov edx, r10d
lea rsi, [r9 + rax + 3]
add eax, r11d
movzx r12d, byte [rdi]
shl edx, 8
movzx ebp, byte [rsi]
and r10d, 0xf
and edx, 0xf000
mov r13d, r12d
shl r13d, 0x10
and r13d, 0xf0000
or edx, r13d
mov r13d, r12d
shr r12d, 4
shl r13d, 7
and r12d, 0xe
and r13d, 0x800
or edx, r13d
or edx, r12d
mov r12d, ebp
shl ebp, 0xd
shl r12d, 4
and ebp, 0x100000
and r12d, 0x7f0
or edx, r12d
or edx, ebp
add eax, edx
mov edx, eax
shr edx, 0xd
and edx, 0xfffffff0
or edx, r10d
mov byte [rbx], dl
mov edx, eax
shr eax, 1
shr edx, 9
mov byte [rdi], dl
mov byte [rsi], al
add rcx, 2
mov rax, rcx
cmp r8, rcx
jae 0x14008bcc0
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
movzx edx, byte [r9 + rax + 1]
movzx esi, byte [r9 + rcx]
shl edx, 8
shl esi, 0x10
or edx, esi
or edx, ebx
movzx ebx, byte [r9 + rax + 3]
shl ebx, 0x18
or ebx, edx
and edx, 0xe80
je 0x14008be08
lea rdi, [r9 + rax + 4]
mov edx, ebx
mov esi, dword [rdi]
shl edx, 8
lea ecx, [rsi - 3]
xor edx, ecx
lea rcx, [rax + 6]
and edx, 0xf8003
jne 0x14008bcb4
mov edx, esi
lea ecx, [r11 + rax]
and ebx, 0xfffff000
shl edx, 0xc
or edx, 0x117
mov dword [r10], edx
mov edx, esi
shr esi, 0x13
shr edx, 0x14
and esi, 0x1000
add edx, ecx
sub edx, esi
add edx, ebx
bswap edx
mov dword [rdi], edx
jmp 0x14008be45
mov edx, ebx
lea esi, [rbx - 0x3117]
shr edx, 0x1b
shl esi, 0x12
mov edi, edx
and edi, 0x1d
cmp esi, edi
jae 0x14008bd68
lea rsi, [r9 + rax + 4]
shl edx, 7
mov ecx, dword [rsi]
mov edi, ecx
and edi, 0xfffff000
or edx, edi
or edx, 0x17
mov dword [r10], edx
mov edx, ecx
shld edx, ebx, 0x14
mov dword [rsi], edx
lea rcx, [rax + 8]
jmp 0x14008bcb4