joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140028f70
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r14
push r15
sub rsp, 0x40
mov r14, r9
mov r15, r8
mov rdi, rdx
mov rbx, rcx
test rcx, rcx
je 0x140029158
lea rax, [0x140183e28]
cmp qword [rcx], rax
jne 0x140029158
cmp dword [rcx + 0xc], 1
je 0x140028fc1
lea rcx, str.SDL_LockTexture__:_texture_must_be_streaming
call fcn.14005ec50
jmp 0x140029090
mov qword [rsp + 0x50], rsi
xor esi, esi
test rdx, rdx
jne 0x140028fe5
mov eax, dword [rcx + 0x10]
lea rdi, [rsp + 0x30]
mov dword [rsp + 0x38], eax
mov eax, dword [rcx + 0x14]
mov dword [rsp + 0x3c], eax
mov qword [rsp + 0x30], rsi
cmp qword [rcx + 0x38], rsi
je 0x1400290a6
mov rcx, qword [rcx + 0x28]
mov eax, dword [rcx + 0x258]
cmp dword [rbx + 0x68], eax
jne 0x14002900b
call fcn.140025610
test eax, eax
js 0x140029132
mov rdx, qword [rbx + 0x38]
mov ecx, dword [rdx]
sub ecx, 0x3132564e
je 0x14002902e
sub ecx, 0xff0000
je 0x14002902e
sub ecx, 0xb
je 0x14002902e
cmp ecx, 0x242402f0
jne 0x14002905c
test rdi, rdi
je 0x14002907b
cmp dword [rdi], esi
jne 0x14002904c
cmp dword [rdi + 4], esi
jne 0x14002904c
mov eax, dword [rdx + 8]
cmp dword [rdi + 8], eax
jne 0x14002904c
mov eax, dword [rdx + 0xc]
cmp dword [rdi + 0xc], eax
je 0x14002905c
lea rcx, str.YV12__IYUV__NV12__NV21_textures_only_support_full_surface_locks
call fcn.14005ec50
mov esi, eax
jmp 0x140029089
test rdi, rdi
je 0x14002907b
movzx eax, word [rdx + 0x18]
imul eax, dword [rdi + 4]
movsxd rcx, eax
mov eax, dword [rdi]
add eax, eax
cdqe
add rcx, rax
add rcx, qword [rdx + 0x20]
jmp 0x14002907f
mov rcx, qword [rdx + 0x20]
mov qword [r15], rcx
movzx eax, word [rdx + 0x18]
mov dword [r14], eax
mov eax, esi
mov rsi, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x58]
mov rdi, qword [rsp + 0x60]
mov r14, qword [rsp + 0x68]
add rsp, 0x40
pop r15
ret
cmp qword [rcx + 0x30], rsi
je 0x140029117
movups xmm0, xmmword [rdi]
movups xmmword [rcx + 0x4c], xmm0
mov ecx, dword [rcx + 8]
test ecx, ecx
je 0x1400290ee
mov eax, ecx
and eax, 0xf0000000
cmp eax, 0x10000000
je 0x1400290ee
cmp ecx, 0x32595559
je 0x1400290e7
cmp ecx, 0x59565955
je 0x1400290e7
cmp ecx, 0x55595659
je 0x1400290e7
mov edx, 1
jmp 0x1400290f1
mov edx, 2
jmp 0x1400290f1
movzx edx, cl
mov eax, dword [rdi + 4]
imul eax, dword [rbx + 0x48]
movsxd rcx, eax
mov eax, dword [rdi]
imul eax, edx
add rcx, rax
add rcx, qword [rbx + 0x40]
mov qword [r8], rcx
mov eax, dword [rbx + 0x48]
mov dword [r9], eax
xor eax, eax
jmp 0x14002908b
mov rsi, qword [rcx + 0x28]
mov eax, dword [rsi + 0x258]
cmp dword [rcx + 0x68], eax
jne 0x14002913c
mov rcx, rsi
call fcn.140025610
test eax, eax
jns 0x14002913c
mov eax, 0xffffffff
jmp 0x14002908b
mov r9, r15
mov qword [rsp + 0x20], r14
mov r8, rdi
mov rdx, rbx
mov rcx, rsi
call qword [rsi + 0x88]
jmp 0x14002908b
lea rdx, str.texture
lea rcx, str.Parameter__s_is_invalid
call fcn.14005ec50
mov eax, 0xffffffff
jmp 0x140029090
Function at 0x140033170
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
mov rcx, qword [0x140183f00]
test rcx, rcx
jne 0x140033196
lea rcx, str.Video_subsystem_has_not_been_initialized
add rsp, 0x20
pop rbx
jmp fcn.14005ec50
test rbx, rbx
je 0x1400331d3
lea rax, [rcx + 0x2f0]
cmp qword [rbx], rax
jne 0x1400331d3
test byte [rbx + 0x40], 4
jne 0x1400331e4
mov rax, qword [rcx + 0xa8]
test rax, rax
je 0x1400331be
mov rdx, rbx
call rax
xor r9d, r9d
xor r8d, r8d
mov dl, 1
mov rcx, rbx
add rsp, 0x20
pop rbx
jmp fcn.1400753c0
lea rcx, str.Invalid_window
add rsp, 0x20
pop rbx
jmp fcn.14005ec50
add rsp, 0x20
pop rbx
ret

Function at 0x1400331f0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push rbx
sub rsp, 0x20
mov rax, qword [0x140183f00]
mov rbx, rcx
test rax, rax
jne 0x140033216
lea rcx, str.Video_subsystem_has_not_been_initialized
add rsp, 0x20
pop rbx
jmp fcn.14005ec50
test rbx, rbx
je 0x140033274
add rax, 0x2f0
cmp qword [rcx], rax
jne 0x140033274
test byte [rcx + 0x40], 4
je 0x140033285
xor edx, edx
mov dword [rcx + 0x9c], 1
call fcn.140031310
mov rcx, qword [0x140183f00]
mov rax, qword [rcx + 0xb0]
test rax, rax
je 0x140033255
mov rdx, rbx
call rax
xor r9d, r9d
mov dword [rbx + 0x9c], 0
xor r8d, r8d
mov dl, 2
mov rcx, rbx
add rsp, 0x20
pop rbx
jmp fcn.1400753c0
lea rcx, str.Invalid_window
add rsp, 0x20
pop rbx
jmp fcn.14005ec50
add rsp, 0x20
pop rbx
ret
Function at 0x140037390
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x40
mov rbp, rdx
mov r15, rcx
mov edi, 1
mov edx, 0xd0
mov ecx, edi
mov r14, r9
mov rsi, r8
call qword [0x140181b28]
mov rbx, rax
test rax, rax
je 0x1400373d6
lock xadd dword [0x140181b40], edi
test rbx, rbx
jne 0x1400373ee
lea rcx, str.Out_of_memory
call fcn.14005ec50
xor eax, eax
jmp 0x140037512
mov edi, 0xffffffff
mov dword [rax + 0x10], edi
xor eax, eax
xchg dword [rbx + 0x14], eax
test rbp, rbp
je 0x140037438
mov rcx, rbp
call fcn.140039dc0
mov qword [rbx + 0xa0], rax
test rax, rax
jne 0x140037438
lea rcx, str.Out_of_memory
call fcn.14005ec50
mov rcx, rbx
call qword [fcn.1400614b0]
lock xadd dword [0x140181b40], edi
xor eax, eax
jmp 0x140037512
mov rax, rsi
mov qword [rbx + 0xb0], r15
neg rax
mov qword [rbx + 0xb8], r14
mov rax, qword [rsp + 0x88]
mov r9, rbx
sbb ecx, ecx
mov qword [rbx + 0xc8], rax
mov rax, qword [rsp + 0x80]
and ecx, 0x10000
mov qword [rbx + 0xa8], rsi
test rax, rax
je 0x14003749f
lea rdx, [rsp + 0x30]
mov dword [rsp + 0x30], 0
mov qword [rsp + 0x28], rdx
lea r8, [0x140069fd0]
mov dword [rsp + 0x20], ecx
mov edx, esi
xor ecx, ecx
call rax
jmp 0x1400374c7
lea rax, [rsp + 0x34]
mov dword [rsp + 0x34], 0
mov qword [rsp + 0x28], rax
lea r8, [0x140069fd0]
mov dword [rsp + 0x20], ecx
mov rdx, rsi
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rbx + 8], rax
test rax, rax
jne 0x14003750f
lea rcx, str.Not_enough_resources_to_create_thread
call fcn.14005ec50
test eax, eax
jns 0x14003750f
mov rcx, qword [rbx + 0xa0]
test rcx, rcx
je 0x1400374fc
call qword [fcn.1400614b0]
mov eax, edi
lock xadd dword [0x140181b40], eax
mov rcx, rbx
call qword [fcn.1400614b0]
lock xadd dword [0x140181b40], edi
xor ebx, ebx
mov rax, rbx
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x40
pop r15
pop r14
pop rdi
ret

Function at 0x14003c0b0
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
sub rsp, 0x28
cmp dword [0x140183fac], 0
jne 0x14003c0f7
xor r8d, r8d
mov dword [0x140183fac], 1
lea rdx, [0x14003bfd0]
lea rcx, str.SDL_TIMER_RESOLUTION
call fcn.1400490a0
lea rcx, [0x140183fc0]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
lea rcx, [0x140183fb0]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rax, qword [rsp + 0x30]
sub rax, qword [0x140183fb0]
imul rax, rax, 0x3e8
cqo
idiv qword [0x140183fc0]
add rsp, 0x28
ret
Function at 0x14004bd80
Capabilities:
Log keystrokes via polling

Disassembly:
sub rsp, 0x48
mov rax, qword [0x140184af0]
test rax, rax
je 0x14004bf2b
test dword [rax + 0x40], 0x4000
je 0x14004bf2b
mov qword [rsp + 0x40], rdi
mov rdi, qword [rax + 0xd8]
cmp dword [rdi + 0xa4], 0
jne 0x14004bf26
lea rcx, [rsp + 0x50]
call qword [sym.imp.USER32.dll_GetCursorPos]
test eax, eax
je 0x14004bf26
mov rcx, qword [rdi + 8]
lea rdx, [rsp + 0x50]
call qword [sym.imp.USER32.dll_ScreenToClient]
test eax, eax
je 0x14004bf26
mov qword [rsp + 0x58], rbx
mov ecx, 0x17
mov qword [rsp + 0x60], rbp
mov qword [rsp + 0x68], rsi
mov qword [rsp + 0x38], r14
mov qword [rsp + 0x30], r15
call qword [sym.imp.USER32.dll_GetSystemMetrics]
mov rsi, qword [rdi]
xor ecx, ecx
mov ebp, dword [0x140183b90]
test eax, eax
mov r14d, dword [rsp + 0x54]
mov r15d, ecx
mov rbx, qword [rsp + 0x50]
setne r15b
test rsi, rsi
je 0x14004be46
cmp ebp, 0xffffffff
mov r8d, r14d
mov edx, ebx
setne cl
mov dword [rsp + 0x20], ecx
mov rcx, rsi
call fcn.140016bc0
test eax, eax
je 0x14004be5b
mov r9d, ebx
mov dword [rsp + 0x20], r14d
xor r8d, r8d
mov edx, ebp
mov rcx, rsi
call fcn.140016d50
mov ebx, 1
mov ecx, ebx
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
mov rcx, qword [rdi]
mov esi, 3
shr eax, 0xf
mov r9d, esi
and al, bl
mov edx, ebp
test r15d, r15d
movzx r8d, al
cmove r9d, ebx
call fcn.140017220
lea ecx, [rbx + 1]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
mov rcx, qword [rdi]
mov edx, ebp
shr eax, 0xf
and al, bl
test r15d, r15d
movzx r8d, al
cmove ebx, esi
movzx r9d, bl
call fcn.140017220
lea ecx, [rsi + 1]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
mov rcx, qword [rdi]
mov r9b, 2
shr eax, 0xf
mov edx, ebp
and al, 1
movzx r8d, al
call fcn.140017220
lea ecx, [rsi + 2]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
mov rcx, qword [rdi]
mov r9b, 4
shr eax, 0xf
mov edx, ebp
and al, 1
movzx r8d, al
call fcn.140017220
lea ecx, [rsi + 3]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
mov rcx, qword [rdi]
mov r9b, 5
shr eax, 0xf
mov edx, ebp
and al, 1
movzx r8d, al
call fcn.140017220
mov r15, qword [rsp + 0x30]
mov r14, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x58]
mov rdi, qword [rsp + 0x40]
add rsp, 0x48
ret
Function at 0x14004c080
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x60
call qword [sym.imp.KERNEL32.dll_GetTickCount]
xor esi, esi
mov edi, eax
mov ebx, esi
cmp dword [0x14017bc24], ebx
je 0x14004c16a
xor r9d, r9d
mov dword [rsp + 0x20], 1
xor r8d, r8d
lea rcx, [rsp + 0x30]
xor edx, edx
call qword [sym.imp.USER32.dll_PeekMessageW]
test eax, eax
je 0x14004c16a
nop word [rax + rax]
mov r10, qword [0x140184870]
test r10, r10
je 0x14004c0ff
mov rax, qword [rsp + 0x48]
mov r9, qword [rsp + 0x40]
mov r8d, dword [rsp + 0x38]
mov rdx, qword [rsp + 0x30]
mov rcx, qword [0x140184868]
mov qword [rsp + 0x20], rax
call r10
cmp dword [rsp + 0x38], 0x200
jne 0x14004c11f
mov eax, dword [0x140183a04]
test eax, eax
je 0x14004c11f
cmp eax, dword [rsp + 0x50]
jns 0x14004c147
mov dword [0x140183a04], esi
lea rcx, [rsp + 0x30]
call qword [sym.imp.USER32.dll_TranslateMessage]
lea rcx, [rsp + 0x30]
call qword [sym.imp.USER32.dll_DispatchMessageW]
lea eax, [rdi + 1]
sub eax, dword [rsp + 0x50]
test eax, eax
jg 0x14004c147
inc ebx
cmp ebx, 3
jg 0x14004c16a
xor r9d, r9d
mov dword [rsp + 0x20], 1
xor r8d, r8d
lea rcx, [rsp + 0x30]
xor edx, edx
call qword [sym.imp.USER32.dll_PeekMessageW]
test eax, eax
jne 0x14004c0d0
cmp byte [0x140184ddb], 1
mov ebx, 0x8000
jne 0x14004c197
mov ecx, 0xa0
call qword [sym.imp.USER32.dll_GetKeyState]
test bx, ax
jne 0x14004c197
xor edx, edx
mov r8d, 0xe1
mov cl, 1
call fcn.140054a10
cmp byte [0x140184ddf], 1
jne 0x14004c1bf
mov ecx, 0xa1
call qword [sym.imp.USER32.dll_GetKeyState]
test bx, ax
jne 0x14004c1bf
xor edx, edx
mov r8d, 0xe5
mov cl, 1
call fcn.140054a10
mov rax, qword [0x140184af0]
test rax, rax
je 0x14004c1d4
test dword [rax + 0x40], 0x100000
jne 0x14004c224
cmp byte [0x140184ddd], 1
jne 0x14004c1fc
mov ecx, 0x5b
call qword [sym.imp.USER32.dll_GetKeyState]
test bx, ax
jne 0x14004c1fc
xor edx, edx
mov r8d, 0xe3
mov cl, 1
call fcn.140054a10
cmp byte [0x140184de1], 1
jne 0x14004c224
mov ecx, 0x5c
call qword [sym.imp.USER32.dll_GetKeyState]
test bx, ax
jne 0x14004c224
xor edx, edx
mov r8d, 0xe7
mov cl, 1
call fcn.140054a10
mov rbx, qword [0x140183f00]
call fcn.14003c0b0
mov rdi, rax
test rbx, rbx
je 0x14004c27a
mov rbx, qword [rbx + 0x2e0]
test rbx, rbx
je 0x14004c27a
mov rcx, qword [rbx + 0xd8]
test rcx, rcx
je 0x14004c26e
cmp dword [rcx + 0x78], esi
je 0x14004c25a
mov dword [rcx + 0x78], esi
jmp 0x14004c266
mov eax, edi
sub eax, dword [rcx + 0x7c]
cmp eax, 0xbb8
jb 0x14004c26e
mov rcx, rbx
call fcn.1400a0f50
mov rbx, qword [rbx + 0xe8]
test rbx, rbx
jne 0x14004c244
call fcn.14004bd80
mov rbx, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x60
pop rdi
ret
Function at 0x140056020
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, rcx
test rcx, rcx
je 0x14005609c
cmp byte [rcx], 0
je 0x14005609c
mov r8d, dword [0x140185710]
mov rdx, qword [0x140185718]
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
mov edi, eax
test eax, eax
je 0x14005609c
cmp rdi, qword [0x140185710]
jbe 0x14005608a
mov rcx, qword [0x140185718]
mov edx, edi
call fcn.140061da0
test rax, rax
je 0x14005609c
mov r8d, edi
mov qword [0x140185718], rax
mov rdx, rax
mov qword [0x140185710], rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
mov rax, qword [0x140185718]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
mov rbx, qword [rsp + 0x30]
xor eax, eax
add rsp, 0x20
pop rdi
ret
Function at 0x140056540
Capabilities:
Link many functions at runtime

Disassembly:
sub rsp, 0x28
cmp byte [0x140183e2b], 0
jne 0x140056711
lea rcx, str.hid.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov qword [0x140185720], rax
test rax, rax
je 0x14005672a
lea rdx, str.HidD_GetAttributes
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1401857f0], rax
test rax, rax
je 0x140056718
mov rcx, qword [0x140185720]
lea rdx, str.HidD_GetSerialNumberString
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140185728], rax
test rax, rax
je 0x140056718
mov rcx, qword [0x140185720]
lea rdx, str.HidD_GetManufacturerString
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140185768], rax
test rax, rax
je 0x140056718
mov rcx, qword [0x140185720]
lea rdx, str.HidD_GetProductString
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1401857f8], rax
test rax, rax
je 0x140056718
mov rcx, qword [0x140185720]
lea rdx, str.HidD_SetFeature
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140185740], rax
test rax, rax
je 0x140056718
mov rcx, qword [0x140185720]
lea rdx, str.HidD_GetFeature
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140185738], rax
test rax, rax
je 0x140056718
mov rcx, qword [0x140185720]
lea rdx, str.HidD_GetIndexedString
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140185800], rax
test rax, rax
je 0x140056718
mov rcx, qword [0x140185720]
lea rdx, str.HidD_GetPreparsedData
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140185750], rax
test rax, rax
je 0x140056718
mov rcx, qword [0x140185720]
lea rdx, str.HidD_FreePreparsedData
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140185748], rax
test rax, rax
je 0x140056718
mov rcx, qword [0x140185720]
lea rdx, str.HidP_GetCaps
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140185758], rax
test rax, rax
je 0x140056718
mov rcx, qword [0x140185720]
lea rdx, str.HidD_SetNumInputBuffers
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140185730], rax
test rax, rax
je 0x140056718
mov rcx, qword [0x140185720]
lea rdx, str.HidD_SetOutputReport
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140185760], rax
test rax, rax
je 0x140056718
mov byte [0x140183e2b], 1
xor eax, eax
add rsp, 0x28
ret
mov rcx, qword [0x140185720]
test rcx, rcx
je 0x14005672a
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov qword [0x140185720], 0
mov eax, 0xffffffff
mov byte [0x140183e2b], 0
add rsp, 0x28
ret
Function at 0x14005f590
Capabilities:
Get system information on windows

Disassembly:
sub rsp, 0x58
xor eax, eax
cmp qword [0x1401858c0], rax
jne 0x14005f641
mov qword [rsp + 0x50], rbx
mov ebx, 1
mov qword [0x1401858d0], 0x40000
mov qword [0x1401858d8], 0x200000
mov dword [0x1401858e0], 7
lock cmpxchg dword [0x1401858b4], ebx
je 0x14005f5eb
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_Sleep]
xor eax, eax
lock cmpxchg dword [0x1401858b4], ebx
jne 0x14005f5d7
mov rbx, qword [rsp + 0x50]
xor ecx, ecx
cmp qword [0x1401858b8], rcx
jne 0x14005f618
mov eax, dword [0x1401858e0]
mov dword [0x140185c50], eax
mov qword [0x1401858b8], 0x58585858
mov dword [0x140185c54], ecx
xchg dword [0x1401858b4], ecx
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [rsp + 0x24]
mov qword [0x1401858c0], rax
mov eax, dword [rsp + 0x48]
mov qword [0x1401858c8], rax
xor eax, eax
add rsp, 0x58
ret
Function at 0x14006ae40
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0xd0
movdqa xmm0, xmmword [0x140168360]
mov eax, 0x7462
movzx eax, byte [rcx]
mov r10d, 0x7fff
mov dword [rbp - 0x79], 0x80007
movzx ebx, dx
mov dword [rbp - 0x75], 0xa0009
mov r11, rcx
mov dword [rbp - 0x71], 0xc000b
mov dword [rbp - 0x6d], 0xe000d
mov dword [rbp - 0x69], 0x110010
mov dword [rbp - 0x65], 0x150013
mov dword [rbp - 0x61], 0x190017
mov dword [rbp - 0x5d], 0x1f001c
mov dword [rbp - 0x59], 0x250022
mov dword [rbp - 0x55], 0x2d0029
mov dword [rbp - 0x51], 0x370032
mov dword [rbp - 0x4d], 0x42003c
mov dword [rbp - 0x49], 0x500049
mov dword [rbp - 0x45], 0x610058
mov dword [rbp - 0x41], 0x76006b
mov dword [rbp - 0x3d], 0x8f0082
mov dword [rbp - 0x39], 0xad009d
mov dword [rbp - 0x35], 0xd100be
mov dword [rbp - 0x31], 0xfd00e6
mov dword [rbp - 0x2d], 0x1330117
mov dword [rbp - 0x29], 0x1730151
mov dword [rbp - 0x25], 0x1c10198
mov dword [rbp - 0x21], 0x22001ee
mov dword [rbp - 0x1d], 0x2920256
mov dword [rbp - 0x19], 0x31c02d4
mov dword [rbp - 0x15], 0x3c3036c
mov dword [rbp - 0x11], 0x48e0424
mov dword [rbp - 0xd], 0x5830502
mov dword [rbp - 9], 0x6ab0610
mov dword [rbp - 5], 0x8120756
mov dword [rbp - 1], 0x9c308e0
mov dword [rbp + 3], 0xbd00abd
mov dword [rbp + 7], 0xe4c0cff
mov dword [rbp + 0xb], 0x114c0fba
mov dword [rbp + 0xf], 0x14ee1307
mov dword [rbp + 0x13], 0x19541706
mov dword [rbp + 0x17], 0x1ea51bdc
mov dword [rbp + 0x1b], 0x251521b6
mov dword [rbp + 0x1f], 0x2cdf28ca
mov dword [rbp + 0x23], 0x364b315b
mov dword [rbp + 0x27], 0x41b23bb9
mov dword [rbp + 0x2b], 0x4f7e4844
mov dword [rbp + 0x2f], 0x602f5771
mov dword [rbp + 0x33], 0x746269ce
mov word [rbp + 0x37], r10w
movdqu xmmword [rbp + 0x47], xmm0
cmp al, 0x58
jle 0x14006afb5
mov r9b, 0x58
jmp 0x14006afc1
xor ecx, ecx
movzx r9d, al
test al, al
cmovs r9d, ecx
movsx rax, r9b
movzx edx, word [rbp + rax*2 - 0x79]
movzx eax, r8b
movzx ecx, byte [rbp + rax + 0x47]
add cl, r9b
mov byte [r11], cl
mov ecx, edx
shr ecx, 3
test r8b, 4
je 0x14006afe6
add ecx, edx
test r8b, 2
je 0x14006aff2
mov eax, edx
shr eax, 1
add ecx, eax
test r8b, 1
je 0x14006affd
shr edx, 2
add ecx, edx
mov edx, ecx
neg edx
and r8b, 8
cmove edx, ecx
movsx ecx, bx
add edx, ecx
cmp edx, r10d
jle 0x14006b027
movzx eax, r10w
mov rbx, qword [rsp + 0xe0]
add rsp, 0xd0
pop rbp
ret
mov rbx, qword [rsp + 0xe0]
mov eax, 0xffff8000
cmp edx, eax
cmovl edx, eax
movzx eax, dx
add rsp, 0xd0
pop rbp
ret
Function at 0x14006b670
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x20], rbp
push rdi
push r12
push r15
sub rsp, 0x20
mov rax, qword [rcx + 0x18]
mov r15, r8
mov r9d, dword [rcx + 4]
mov r12, rdx
mov rdi, rcx
cmp r9, rax
je 0x14006b6ed
movzx r9d, word [rcx + 0x30]
xor edx, edx
div r9
cmp dword [rcx + 0x50], 2
jne 0x14006b6cb
cmp dword [rcx + 0x70], 2
jne 0x14006b6c3
mov ecx, dword [rcx + 0x54]
cmp rax, rcx
jge 0x14006b6c3
lea rcx, str.Invalid_number_of_sample_frames_in_WAVE_fact_chunk__too_many_
call fcn.14005ec50
movsxd rcx, eax
jmp 0x14006b6ce
mov ecx, dword [rdi + 0x54]
cmp rax, rcx
jg 0x14006b6ce
mov rcx, rax
mov qword [rdi + 0x58], rcx
test rcx, rcx
jns 0x14006b6ed
mov rax, 0xffffffffffffffff
mov rbp, qword [rsp + 0x58]
add rsp, 0x20
pop r15
pop r12
pop rdi
ret
mov qword [rsp + 0x40], rbx
mov rbx, qword [rdi + 0x58]
test rbx, rbx
jne 0x14006b709
xor eax, eax
mov qword [r12], rax
mov dword [r15], eax
jmp 0x14006b79a
movzx ecx, word [rdi + 0x24]
mov rbp, 0xffffffffffffffff
test rbx, rbx
je 0x14006b726
xor edx, edx
mov rax, rbp
div rbx
cmp rax, rcx
jbe 0x14006b73d
imul rbx, rcx
test rbx, rbx
je 0x14006b74b
xor edx, edx
mov rax, rbp
div rbx
cmp rax, 2
ja 0x14006b74b
lea rcx, str.Out_of_memory
call fcn.14005ec50
jmp 0x14006b79a
mov qword [rsp + 0x50], r14
mov eax, 0xffffffff
lea r14, [rbx + rbx]
cmp r14, rax
ja 0x14006b8e7
mov rcx, qword [rdi + 0x10]
test r14, r14
mov edx, 1
mov qword [rsp + 0x48], rsi
cmovne rdx, r14
call fcn.140061da0
mov rsi, rax
test rax, rax
jne 0x14006b7ae
lea rcx, str.Out_of_memory
call fcn.14005ec50
mov rsi, qword [rsp + 0x48]
mov r14, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x58]
add rsp, 0x20
pop r15
pop r12
pop rdi
ret
xor eax, eax
mov qword [rdi + 0x10], rax
mov qword [rdi + 0x18], rax
movzx ecx, word [rdi + 0x22]
sub ecx, 6
je 0x14006b872
cmp ecx, 1
je 0x14006b7e4
mov rcx, rsi
call qword [fcn.1400614b0]
lock xadd dword [0x140181b40], ebp
lea rcx, str.Unknown_companded_encoding
jmp 0x14006b78b
test rbx, rbx
je 0x14006b8d9
mov edi, 0x84
movzx r11d, byte [rbx + rsi - 1]
dec rbx
not r11b
mov r8d, 4
movzx eax, r11b
movzx r10d, r11b
and al, 0xf
shr r10d, 4
movzx r9d, al
and r10d, 7
lea ecx, [r10 + 1]
shl r8w, cl
mov ecx, r10d
movsx eax, r8w
imul r9d, eax
movsx eax, r8w
cdq
sub eax, edx
sar eax, 1
add r9w, ax
mov eax, 0x80
shl ax, cl
add r9w, ax
sub r9w, di
movsx ecx, r9w
movzx eax, cx
neg ax
test r11b, r11b
cmovns ax, cx
mov word [rsi + rbx*2], ax
test rbx, rbx
jne 0x14006b7f2
mov qword [r12], rsi
xor eax, eax
mov dword [r15], r14d
jmp 0x14006b790
test rbx, rbx
je 0x14006b8d9
nop word [rax + rax]
movzx r8d, byte [rbx + rsi - 1]
dec rbx
movzx edx, r8b
xor dl, 0xd5
and dl, 0x7f
movzx eax, dl
shr dl, 4
and al, 0xf
movzx ecx, al
movzx eax, cx
or ax, 0x10
test dl, dl
cmove ax, cx
shl ax, 4
or ax, 8
cmp dl, 1
jbe 0x14006b8c0
movzx ecx, dl
dec ecx
shl ax, cl
movsx ecx, ax
movzx eax, cx
neg ax
test r8b, r8b
cmovns cx, ax
mov word [rsi + rbx*2], cx
test rbx, rbx
jne 0x14006b880
mov qword [r12], rsi
xor eax, eax
mov dword [r15], r14d
jmp 0x14006b790
lea rcx, str.WAVE_file_too_big
call fcn.14005ec50
jmp 0x14006b795
Function at 0x140090100
Capabilities:
Allocate thread local storage
Get thread local storage value

Disassembly:
push rdi
sub rsp, 0x20
xor edi, edi
cmp dword [0x14017e6fc], 0xffffffff
jne 0x140090159
cmp dword [0x140185cd8], edi
jne 0x140090165
lea rcx, [0x140185cdc]
call fcn.140068860
cmp dword [0x14017e6fc], 0xffffffff
jne 0x140090153
cmp dword [0x140185cd8], edi
jne 0x140090153
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
cmp eax, 0xffffffff
je 0x140090149
mov dword [0x14017e6fc], eax
jmp 0x140090153
mov dword [0x140185cd8], 1
mov dword [0x140185cdc], edi
cmp dword [0x140185cd8], edi
je 0x14009027e
mov qword [rsp + 0x38], rsi
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp qword [0x140183f98], rdi
mov esi, eax
jne 0x140090232
mov ecx, 1
mov qword [rsp + 0x30], rbx
xchg dword [0x140183f08], ecx
mov ebx, edi
test ecx, ecx
je 0x1400901f9
cmp ebx, 0x20
jge 0x1400901a0
inc ebx
pause
jmp 0x1400901ea
cmp dword [0x140183fac], edi
jne 0x1400901e2
xor r8d, r8d
mov dword [0x140183fac], 1
lea rdx, [0x14003bfd0]
lea rcx, str.SDL_TIMER_RESOLUTION
call fcn.1400490a0
lea rcx, [0x140183fc0]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
lea rcx, [0x140183fb0]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_Sleep]
mov eax, 1
xchg dword [0x140183f08], eax
test eax, eax
jne 0x140090195
cmp qword [0x140183f98], rdi
mov rbx, qword [rsp + 0x30]
jne 0x14009022c
call fcn.140055920
mov qword [0x140183f98], rax
test rax, rax
jne 0x14009022c
mov rsi, qword [rsp + 0x38]
mov rax, rdi
mov dword [0x140183f08], edi
add rsp, 0x20
pop rdi
ret
mov dword [0x140183f08], edi
mov rcx, qword [0x140183f98]
call qword [0x140183a20]
mov rax, qword [0x140183fa0]
test rax, rax
je 0x140090263
nop dword [rax + rax]
cmp dword [rax], esi
je 0x14009025f
mov rax, qword [rax + 0x10]
test rax, rax
jne 0x140090250
jmp 0x140090263
mov rdi, qword [rax + 8]
mov rcx, qword [0x140183f98]
call qword [0x140183a30]
mov rsi, qword [rsp + 0x38]
mov rax, rdi
add rsp, 0x20
pop rdi
ret
mov ecx, dword [0x14017e6fc]
add rsp, 0x20
pop rdi
jmp qword [sym.imp.KERNEL32.dll_TlsGetValue]