joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140920f8f
Capabilities:
Encode data using base64
Packed with generic packer

Disassembly:
call fcn.140917182
and bpl, 0xb9
cmova r15d, ebp
add qword [rsp + 0x18], 0x85ac
movabs rax, 0x67a8938bfba5be03
xor al, 0x29
call fcn.1408a5fba
jno 0x1409aca49
call fcn.1409b2d76
xor byte [rdx - 0x41a7c958], 6
sbb al, 0xf0
ret 0xa
push r9
lea rbp, [rbp - 0x6756f74]
shr r8d, 0x1d
test byte [rsp + r11 - 0x877aa], 0x2c
mov r12, rbx
mov r10w, 0x2a9c
xchg qword [rsp + r11*2 - 0x10ef1c], rbp
mov r10, qword [rsp + 0x28]
mov dword [rsp + r11 - 0x877aa], 0xf331b6b1
not dword [rsp + r11*2 - 0x10ef5c]
call fcn.140984701
lea r10, [r10 + r10*2 - 0x77efe16c]
xor r10d, r10d
movabs r8, 0x8e33f31f728eae00
or r10w, r8w
jns 0x1408a4fdc
mov qword [rsp + 0x20], rcx
not r10w
bswap r10d
call fcn.14090d0a8
outsb dx, byte [rsi]
pop rcx
mov rsp, qword [rsi]
sbb dword [rdi - 0x40cd368c], 0x3fd20924
test al, 0xa1
push rdx
invalid
or r14b, 0x3d
mov qword [rsp + 0x30], r10
mov rbp, qword [rsp + 0x78]
mov r15, qword [rsp + 0x50]
not word [rsp + 0x30]
shl dword [rsp + 0x30], 0x9b
test byte [rsp + 0x30], 0xbb
mov byte [rsp + 0x30], 0xf
mov r11, qword [rsp + 8]
call fcn.14088cc97
xor byte [rsi - 0x32], dh
xor al, 0x18
adc cl, byte [rdx - 0x1d537d28]
pushfq
loop 0x14095ee8a
adc al, 0xfe
rcl byte [rax - 0x51e7edc8], cl
nop
mov esi, 0xda82f8d4
cmp byte [rdx], al
or al, 0x42
xor al, 0xac
fisubr dword ss:[rax - 0x65b05520]
jl 0x14095eeff
stosb byte [rdi], al
invalid
in eax, dx
movabs al, byte [0xad6ba4815ce6bda7]
movabs eax, dword [0x17f63010dfe6bda7]
mov r13b, 0x91
add r11, rcx
in eax, dx
sbb ch, byte [rbx - 0x77]
lea ebp, [rsi - 0x16]
lea ebx, [rcx - 0x6c]
jae 0x14095ef8a
cmpsb byte [rsi], byte [rdi]
pop rax
in eax, 0x76
sub dword [rsp + rbp + 0x61], ecx
jae 0x14095eeec
jne 0x14095ef07
imul ebp
movabs al, byte [0xcce6a5fe45e6bda7]
sub al, 0x10
ja 0x14095ef3c
jmp [rdi - 0x1942585f]
adc edx, edi
jmp 0x14095f005
invalid
jno 0x14095eeb1
mov rbp, qword [rsp + r11*2 - 0x10ef2c]
mov rbp, qword [rbp + riz]
mov qword [rsp + 0x38], r11
jb 0x140959e5f
mov r11, qword [rsp + 0x58]
add qword [rsp + 0x10], 0xffffffffbf76bcb1
shl r12, 0x46
js 0x14095a355
not word [rsp + 0x50]
or r12d, dword [rsp + 0x52]
jbe 0x1409a52eb
shl r10b, 1
mov r12, qword [rsp + 0x68]
jg 0x140953baf
or r9w, r9w
bswap rdi
call fcn.14096cedb
shr dword [rcx], cl
add eax, 0x6f25ef47
sub dword [rdi + 0x49], edx
add dword [rbx], 0xd7cd55df
sbb eax, 0x1b83f58b
sub dword [rbp + 0x271d1fb7], edx
cmp dword [rdi + 0x79], edx
int1
invalid
call fcn.140914d33
jge 0x140961696
je 0x1409954ca
jb 0x1409a2b04

Function at 0x1409238be
Capabilities:
Packed with generic packer

Disassembly:
not r14
mov r8, qword [rsp + 0x20]
jle 0x14099c1ea
ja 0x14094ecd6
jne 0x140962a23

Function at 0x140924d5b
Capabilities:
Encode data using base64

Disassembly:
pop rax
push r9
push r10
pushfq
movabs r9, 0xf20494844c156911
push 0xffffffffaa0b8807
and qword [rsp], r9
xchg qword [rsp + 0x20], rax
jne 0x140967b25
pop r10
setno r10b
and r10, 0x408a4f31
lea r9, [r10 + r10*2 - 0x42e88061]
call fcn.14096cc29
Function at 0x1409297f3
Capabilities:
Encode data using base64

Disassembly:
setl byte [rsp + 0x18]
and word [rsp + 0x30], r14w
mov r15, qword [rsp + 0x28]
test byte [rsp + 0x30], 0x90
jb 0x1409aed78
jb 0x14088cc05
sub dword [rsp + 0x18], 0xb635c928
mov r14, qword [rsp + 0x38]
call fcn.14091e8bd
sbb byte [rdi + 0x21], bh
xor dword [rsi], ecx
add byte [rcx], dh
hlt

Function at 0x14092acb0
Capabilities:
Encode data using base64

Disassembly:
cmp rcx, 0xffffffffd4832f34
add qword [rsp + 0x28], 0xffffffffff6d647c
push r13
add qword [rsp + 0x28], 0xfffffffffffd4ff3
mov r13, rcx
mov rbp, r13
mov rbp, qword [rsp + 0x30]
mov rbp, qword [rbp + riz]
shr cx, 0xc6
mov qword [rsp + 0x30], rcx
cmp cx, word [rsp + 0x34]
push r8
call fcn.1409090a7
ja 0x140892930

Function at 0x14092e98e
Capabilities:
Encode data using base64

Disassembly:
neg byte [rsp + r12*2 + 0x3aa8e9c2]
xchg qword [rsp + r12*4 + 0x7551d35c], rax
mov r12, qword [rsp + r12*4 + 0x7551d334]
test qword [rsp + 0x30], 0x5abfbb38
jno 0x14099c108
neg byte [rsp + 0x30]
xor dword [rsp + 0x30], 0x63969f96
call fcn.140897685

Function at 0x14093e8ce
Capabilities:
Encode data using base64

Disassembly:
push qword [rsp + 0x58]
popfq
lea rsp, [rsp + 0x68]
ret
mov byte [rsp + r15 - 0x8d75bc8], r15b
and r15b, r15b
add dword [rsp + r15 - 0x8d75bc8], r15d
mov r15, qword [rsp + r15 - 0x8d75bd0]
jo 0x14088f335
seta byte [rsp + 0x38]
shl dword [rsp + 0x38], 0x5b
setb byte [rsp + 0x38]
cmp byte [rsp + 0x38], 5
jl 0x1408a59fb

Function at 0x1409418b8
Capabilities:
Encode data using base64

Disassembly:
add qword [rsp + 8], 0xffffffffbf76b7ca
push qword [rsp + 0x18]
popfq
lea rsp, [rsp + 0x28]
call fcn.1409c2af3
int3
bswap rbx
cmp bx, 0xc711
mov rbx, qword [rsp + 0x10]
jge 0x140891760

Function at 0x1409418da
Capabilities:
Encode data using base64

Disassembly:
lea r13, [r13 + r13*4 - 0x66c05df3]
add r13b, 0x2f
setne r13b
lea rax, [rax + r13 + 0x66c05e00]
not r13b
movabs r13, 0x461337a5be960597
setle r13b
shl r13b, 0xb5
js 0x1408a4ebe
mov qword [rsp + 0x18], rax
jns 0x14094fade
call fcn.1408a1366
int3
add r14b, byte [rsp + rbp - 0x1212ffdc]
mov rbp, qword [rsp + rbp - 0x1212ffd0]
test word [rsp + 8], r9w
jno 0x14098eed8
jae 0x1408a2705
setle cl
mov word [rsp + 0x28], cx
cmp word [rsp + r14*8], r14w
call fcn.14097b89f
push rax
push r13
movabs r13, 0x37182fa47bb06e20
pushfq
shl r13w, 0x3f
not r13b
sub r13d, r13d
setno r13b
mov rax, qword [rsp + r13 + 0x17]
jae 0x140897376
iretd
jne 0x1408a6126
jne 0x140924d29
shl r13w, 0xd2
call fcn.140937c0f
mov r9, qword [rsp + 0x58]
cmp byte [rsp + 0x60], 0x80
call fcn.1409496ef

Function at 0x140941c93
Capabilities:
Encode data using base64
Packed with generic packer

Disassembly:
xor ebx, r9d
mov r9, qword [rsp + 0x18]
shr bx, 0x59
or bl, 0x95
and bl, 0x11
test bl, bpl
call fcn.1409a4c91
Function at 0x1409431f3
Capabilities:
Encode data using base64
Packed with generic packer

Disassembly:
push rdx
lea rdi, [rdi + r15*4 - 0x1fdb4de6]
movabs r9, 0xfb39761eeb24ed92
shr ecx, 8
movabs rdx, 0x6790233be12185ad
jns 0x14097f087
or r9, r12
xchg qword [rsp + 0x78], rdi
mov r12, qword [rsp + 0x50]
add r9b, byte [rsp + rcx + 0x43]
js 0x14098abd7
cmovge r15, r14
call fcn.14088d760
push qword [rsp + 0x58]
popfq
lea rsp, [rsp + 0x80]
ret

Function at 0x140943798
Capabilities:
Encode data using xor

Disassembly:
call fcn.14089512d
xchg edx, eax
jo 0x14092eef3
pop rsp
and bh, byte [rsp + rsi*2 + 0x4810ea36]
and ch, byte [rax]
mov esi, 0x442eb6c0
push 0x5218521a
hlt
hlt
insb byte [rdi], dx
and al, 8
or word [rsp + r13*4 - 0x447217b4], 0xc73f
jno 0x14092eea1
popfq
pop rdi
xor ecx, dword gs:[rbp + 0x13]
pop rbx
jno 0x14094378f
mov r13, 0xffffffffa17749ff
stc
add ebp, dword [rdi]
popfq
push rbp
invalid

Function at 0x14094d314
Capabilities:
Encode data using base64

Disassembly:
shr r13d, 0xef
add qword [rsp], 0xffffffffbf6e1167
mov bl, byte [rsp + r8*2 - 0x3c372b2f]
call fcn.140975f3e
xor r12w, r9w
mov r12, qword [rsp + 0x20]
shr r9b, 0x8c
shr r9w, 0xb4
jns 0x14098c8d3

Function at 0x14096128e
Capabilities:
Encode data using base64

Disassembly:
xchg qword [rsp + 0x18], rax
setge r11b
movzx r11d, r11b
push rdi
setae r11b
movabs rdi, 0x4b268201dabb6909
mov r11, qword [rsp + 0x18]
mov qword [rsp + 0x18], rax
movsxd rdi, edi
lea rdi, [rdi + rdi*8 + 0x45b7a536]
js 0x14093c709

Function at 0x140962b4b
Capabilities:
Encode data using base64

Disassembly:
push r8
xchg qword [rsp + r13 - 0x5f2b975f], rax
mov r13, qword [rsp + r12 - 0x4d08ffc0]
call fcn.1409b4d9a

Function at 0x140962b70
Capabilities:
Encode data using base64

Disassembly:
not word [rsp + 0x28]
call fcn.140913336

Function at 0x140967b3f
Capabilities:
Encode data using base64

Disassembly:
push rbx
push r8
mov rax, qword [rsp + 0x28]
mov rax, qword [rax]
jo fcn.14093e8ce
movabs rbx, 0xe633733b90015a08

Function at 0x1409696f2
Capabilities:
Encode data using base64

Disassembly:
ja fcn.140969334
mov rdi, qword [rsp + 0x20]
jl 0x1409ab37d
jge 0x140964603

Function at 0x140976a2d
Capabilities:
Encode data using base64
Packed with generic packer

Disassembly:
movabs r9, 0xdb0c2ab28a8bac04
shr r9, 0xcc
xchg qword [rsp + rsi - 0x1715b2a8], rcx
mov rsi, qword [rsp + 0x28]
call fcn.1408a60d0
add qword [rsp], 0xfffffffffffed5da
xor edx, 0xab339aba
movabs rcx, 0xb626e182fb2b218b
lea rdx, [rcx + rdx*2 + 0x3b3dbea9]
push r12
neg rdx
mov rcx, qword [rsp + 8]
mov rcx, qword [rcx]
jns 0x14099c119
test dx, 0xeaab
mov qword [rsp + 8], rdx
push rbp
jge 0x1409bc29c
or dx, word [rsp + 0x12]
lea rcx, [rcx + 0x41090d1f]
mov rbp, rdx
or bpl, 0x24
push r9
mov byte [rsp + rsi*2 - 0x2e2b65a0], 0x30
jl 0x14088c0b0
Function at 0x14097b4b4
Capabilities:
Encode data using base64
Packed with generic packer

Disassembly:
add qword [rsp], 0xfffffffffff25dfd
lea rsi, [rsi + 1]
sub r9b, dil
lea r10, [rdi*4 + 0x6fad889f]
movabs r14, 0x1b0c3601e510149a
ret 8
and rdi, 0x5d27d89d
push r14
not r10b
jo 0x14089539a
mov r14, rdi
add qword [rsp + 0x18], 0x9bf1d
push r11
movabs r11, 0x152125bd1abd8a39
lea r11, [rdi + r11*8 + 0x6f83bf9c]
mov rax, qword [rsp + 0x20]
mov rax, qword [rax + r14 - 0x4125589d]
neg di
add qword [rsp + 0x28], 0x9a98b
or r10, 0xffffffffb5324032
jg 0x1409b2d9e
cmovs r14d, edi
sub r11b, r10b
lea rax, [rax + r10 + 0x2f970b01]
or r11, rdi
call fcn.140908c22
mov byte [rsp + r9*2 - 0x33779e00], 0x30
add byte [rsp + r9*2 - 0x33779e00], 0x36
mov r9, qword [rsp + r9*4 - 0x66ef3c38]
mov byte [rsp + 0x20], 0x9e
and byte [rsp + 0x20], 0xa
and qword [rsp + 0x20], 0xffffffffab8bf921
add byte [rsp + 0x20], 0x86
call fcn.14088e8d2
neg qword [rsp + 8]
not qword [rsp + 8]
jne 0x1409b9fb6
mov word [rcx], fs
invalid
push qword [rsp + 0x38]
popfq
lea rsp, [rsp + 0x50]
ret
jb 0x140915191
cmp bp, 0x2238
cmovg r9w, r15w
call fcn.140966576
mov qword [rsp + 0x20], rsi
jne 0x1409943e5
call fcn.1408a3214
shl qword [rsp + 0x18], 0x51
not qword [rsp + 0x18]
ja 0x14093d129
push qword [rsp]
popfq
lea rsp, [rsp + 0x20]
ret 8
shl esi, 0x22
setae sil
call fcn.140931191
jbe 0x14088e00b
jne 0x1409632fe
pushfq
add qword [rsp + 8], 0xdc9b5
movabs rax, 0x2d27c0a55a123232
and al, al
add rax, 0x131630ab
jb 0x1409a0072
lea rax, [rax*2 - 0x76f5e979]
mov rax, qword [rsp + 8]
mov rax, qword [rax]
mov qword [rsp + 8], 0x1a970a9d
jg 0x140892118
mov qword [rsp + r11*2 - 0x10e123b8], rdx
mov qword [rsp + r11*2 - 0x10e12400], r11
test dword [rsp + r11*2 - 0x10e12400], 0xcfa1d79c
add qword [rsp + 8], 0xfffffffffffd0db4
push r10
mov rdx, qword [rsp + r11*2 - 0x10e123c0]
mov dword [rsp + r11 - 0x87091c0], 0x8dbc8a14
movabs r10, 0xbc8f408e2a14b30f
shr r11b, 0x42
cmp r11b, 0x10
mov rdx, qword [rsp + 0x10]
sete r9b
setl r9b
jg 0x140935512
cmp word [rsp + 0x18], 0x7bb1
mov qword [rsp + 0x20], r15
xchg qword [rsp + 0x38], rax
mov r15, qword [rsp + 0x10]
je fcn.140976a0b
jle 0x140967ecc
test qword [rsp + 0x20], 0xffffffff951f0b3e
lea rbp, [rbp + 0x3d239119]
push rbp
je 0x1409903e3
movabs rbp, 0x652c83066980b2ae
ja 0x1409387cb
jl 0x14088d8ad
push qword [rsp + 0x78]
popfq
lea rsp, [rsp + 0x80]
ret
neg qword [rsp + 8]
call fcn.1408a1c81
Function at 0x140983992
Capabilities:
Packed with generic packer

Disassembly:
movsxd rbx, dword [rsp + 0x10]
xchg qword [rsp + 0x30], rsi
mov r8, qword [rsp]
js 0x1408a1315
js 0x140897aa2
shl r15d, 0xf5
call fcn.14095e944
neg word [rsp + rbx - 0x631beaf1]
shl rbx, 0x41
mov rbx, qword [rsp + 8]
add qword [rsp + 0x10], 0x52be9694
shr dword [rsp + 0x10], 0x16
call fcn.14088c51c
mov rax, qword [rsp + 0x28]
jb 0x140983981
cmp qword [rsp + 0x18], 0x2f34f6a5
bswap edi
cmp r9d, dword [rsp + 0x4a]
mov rdi, qword [rsp + 0x58]
call fcn.1408924f1
shl word [rsp + r15 - 0x5c67d3ae], 0xf
movabs rdx, 0x882a03815c9d3a34
or dl, byte [rsp + r15 - 0x5c67d3aa]
mov rcx, r15
xchg qword [rsp + r15 - 0x5c67d38e], rsi
mov rcx, qword [rsp + rcx - 0x5c67d3ce]
add r15b, byte [rsp + r15 - 0x5c67d3aa]
jo 0x1409ac310
add r15w, word [rsp + r15 - 0x5c67d3ae]
xor r15w, word [rsp + 0x34]
shl word [rsp + 0x30], 0x1b
mov rdx, qword [rsp + 8]
je 0x1408a1288
call fcn.1408b4360
adc ebx, edi
invalid

Function at 0x1409839ef
Capabilities:
Packed with generic packer

Disassembly:
ja 0x1409acad3
lea rdi, [rdi + rdx + 0x59377195]
call fcn.14096772a

Function at 0x140983a22
Capabilities:
Packed with generic packer

Disassembly:
jno 0x1409bc2ac
je 0x140897340
shr dword [rsp + 0x40], 0x1f
push qword [rsp + 0x28]
popfq
lea rsp, [rsp + 0x58]
ret

Function at 0x140994ce3
Capabilities:
Encode data using base64

Disassembly:
jb 0x14099c1bb
setbe byte [rsp + rsi - 0x7683e387]
and r15, rsi
not sil
mov r15, qword [rsp + rsi - 0x7683e318]
shr esi, 0x28
js 0x140981abc
add word [rsp + rsi*2 - 0xed07a6], si
neg si
add word [rsp + rsi - 0x767bfd], si
invalid
invalid
jns 0x14097b461
cmp edi, dword [rbp + 0x7903af05]
and dword [rbx], ebx
adc dword [rdi + 0x11], ebx
vmptrld qword [rbp + 0x4943eb89]
adc dword [rbp + 0x1f4dc5eb], 0xffffffe3
int1
jns 0x140994ce0
loope 0x140994d7e
or dword [rdi + 0x1b299527], edi
sal dword [rcx - 0x23991900], cl
or al, 0x79
push rax
fdiv st(7), st(0)
push rcx
divps xmm0, xmmword [rax + 0xc]
js 0x140994d6f
fdiv st(7), st(0)
test al, 0x88
jmp 0x140994caa
ja 0x140994dca
invalid
int1
pop rbp
iretd
invalid

Function at 0x1409a0055
Capabilities:
Encode data using base64

Disassembly:
xchg qword [rsp + rcx - 0x138c0dd1], rsi
mov rcx, qword [rsp + rbx*4 + 0x4e3038e0]
call fcn.140898a70

Function at 0x1409a6382
Capabilities:
Encode data using base64

Disassembly:
lea rbx, [rbx + r12*2 - 0x659206c]
js 0x1409be31f
sub bx, word [rsp + 0x36]
je 0x140967b42
add r12w, bx
mov r9, qword [rsp + 0x80]
call fcn.14097c406
Function at 0x1409aae80
Capabilities:
Encode data using base64

Disassembly:
call fcn.140996cd2
movabs r8, 0x4c15d70f640e73a6
neg r8d
not r8d
bswap r8d
call fcn.1408a21df
mov qword [rsp + 0x18], rdi
shl r12, 0xbb
js 0x14096a5e0
sbb al, 0x48
add dword [rsp], 0xbf66c526
and r10, qword [rsp + r13*8 + 0x20]
xor r13, r10
xchg qword [rsp + r10 - 0x13b9], rax
mov r13, qword [rsp + r10 - 0x13c9]
not word [rsp + r10 - 0x13e1]
jl 0x14088ecff
bswap r10d
jno 0x140898cc9
call fcn.140896c97
push qword [rsp + 0x18]
popfq
lea rsp, [rsp + 0x28]
call fcn.1409c2af3
mov qword [rsp + 8], 0x309483f7
lea rsp, [rsp + 8]
call fcn.1409c2af3
call fcn.140949ff6
movsd dword [rdi], dword [rsi]
out dx, eax
ja 0x14096a56e
lahf
cmp dword [rdi], eax
add qword [r11 - 0x50227a81], rsp
mov ch, 0xbb
cmc
sar qword [0x14fcc7d7d], 1
sub dword [rdi], edx
mov ecx, 0xdd674b31
add eax, 0xed433d07
xchg ebx, eax
test al, 0x50
push r11
invalid
add qword [rsp + r12 - 0x80000000], 0xffffffffbf66fd39
shr r12, 0x44
not r12w
jae 0x140947253
jb 0x140898dae
mov r15, qword [rsp + r15*2 - 0x405c1804]
setge byte [rsp + 0x10]
sub byte [rsp + 0x10], 0xac
and qword [rsp + 0x10], 0x488a914
mov byte [rsp + 0x10], 0x85
push qword [rsp + 0x18]
popfq
lea rsp, [rsp + 0x28]
ret 8

Function at 0x1409b270f
Capabilities:
Encode data using base64

Disassembly:
movabs r14, 0xee9fcc914a0f038d
mov dil, 0x3c
jo 0x140970b1d
movabs rcx, 0x400021962c318519
test cx, di
mov qword [rsp + 0x30], rax
push 0x1d261f23
push rbx
ja 0x14095e2cd
jle fcn.1409a52b6
mov word [rsp + 0x10], r15w
push rcx
lea rcx, [rcx - 0x32c02158]
not r15
mov qword [rsp], r15
lea r15, [r15 + r15*4 + 0x32ace034]
add qword [rsp + 0x18], r15
sub byte [rsp + 0x18], 0x31
jae 0x14098670e
xchg qword [rsp + 0x28], rcx
mov r15, qword [rsp + 0x10]
ja 0x1409058ab
jae 0x14088ce2b
sub byte [rsp], 0x34
push qword [rsp + 0x20]
popfq
lea rsp, [rsp + 0x28]
ret
mov rcx, r8
lea r11, [rcx + r8*2 - 0x6519c4a]
add qword [rsp + 8], 0xffffffffbf6bc887
jg 0x1408a1b8a
xchg qword [rsp + 0x58], rax
movzx r15w, r8b
movsx r8d, byte [rsp + 0x2a]
je 0x140892975
xchg qword [rsp + 0x68], rsi
mov rdi, qword [rsp + r8*2 + 0x38]
test r8d, 0x2bf3a19
lea r11, [r8 + r11*2 + 0x4ab5da27]
call fcn.1409616fa

Function at 0x1409b6840
Capabilities:
Encode data using base64
Encode data using xor

Disassembly:
sub rdi, 0x110f3e8e
sub rdi, 0xffffffffee327ab1
jg 0x140969304
Function at 0x1400040b0
Capabilities:
Set current directory

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rbx, qword [0x140100a58]
movzx ebp, r9b
movzx esi, dl
mov r10d, ecx
test r8b, r8b
je 0x1400040ee
inc dword [0x140104d48]
add rbx, 0x150
mov qword [0x140100a58], rbx
mov rax, rbx
lea rcx, [0x140104bd0]
mov edx, 2
nop dword [rax]
lea rax, [rax + 0x80]
movups xmm0, xmmword [rcx]
lea rcx, [rcx + 0x80]
movups xmmword [rax - 0x80], xmm0
movups xmm1, xmmword [rcx - 0x70]
movups xmmword [rax - 0x70], xmm1
movups xmm0, xmmword [rcx - 0x60]
movups xmmword [rax - 0x60], xmm0
movups xmm1, xmmword [rcx - 0x50]
movups xmmword [rax - 0x50], xmm1
movups xmm0, xmmword [rcx - 0x40]
movups xmmword [rax - 0x40], xmm0
movups xmm1, xmmword [rcx - 0x30]
movups xmmword [rax - 0x30], xmm1
movups xmm0, xmmword [rcx - 0x20]
movups xmmword [rax - 0x20], xmm0
movups xmm1, xmmword [rcx - 0x10]
movups xmmword [rax - 0x10], xmm1
sub rdx, 1
jne 0x140004100
movups xmm0, xmmword [rcx]
movups xmmword [rax], xmm0
movups xmm1, xmmword [rcx + 0x10]
movups xmmword [rax + 0x10], xmm1
movups xmm0, xmmword [rcx + 0x20]
movups xmmword [rax + 0x20], xmm0
movups xmm1, xmmword [rcx + 0x30]
movups xmmword [rax + 0x30], xmm1
movups xmm0, xmmword [rcx + 0x40]
movups xmmword [rax + 0x40], xmm0
mov dword [rbx + 0x3c], r10d
test r8b, r8b
je 0x14000418e
lea rcx, [0x1401072b0]
call fcn.14001ac90
xor edi, edi
cmp dword [0x140104d68], edi
mov qword [0x140107e68], rdi
je 0x1400041c2
mov rax, qword [0x140102ef0]
lea rcx, [0x1400cef3c]
test rax, rax
je 0x1400041bc
mov rax, qword [rax]
test rax, rax
cmovne rcx, rax
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
test sil, sil
jne 0x14000424e
cmp byte [rbx + 0x12e], dil
jne 0x1400041f6
cmp bpl, 0x65
sete dil
mov byte [rbx + 0x12e], dil
test dil, dil
je 0x1400041f6
mov qword [rbx], 0xffffffffffffffff
mov dword [rbx + 0x34], 0xffffffff
cmp dword [0x140107e74], 0
je 0x140004208
cmp dword [0x140107e70], 0
jne 0x140004211
cmp byte [rbx + 0x12e], 0
je 0x14000424e
cmp byte [rbx + 0x12e], 0
mov byte [rbx + 0x12c], 0
jne 0x14000424e
cmp dword [0x140107e74], 0
jge 0x140004236
mov dword [rbx + 0x120], 0xffffffff
jmp 0x14000424e
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [rbx + 0x11c], eax
mov eax, dword [0x140107e74]
mov dword [rbx + 0x120], eax
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x1400052d0
Capabilities:
Write clipboard data

Disassembly:
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
cmp qword [0x140107f18], 0
mov rdi, r8
mov rsi, rdx
je 0x1400052f7
xor eax, eax
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
test rsi, rsi
je 0x14000535b
mov eax, 0xffffffff
cmp r8, rax
jne 0x14000531c
or rax, 0xffffffffffffffff
nop word [rax + rax]
inc rax
cmp word [rdx + rax*2], 0
jne 0x140005310
mov edi, eax
test rdi, rdi
je 0x14000535b
lea rdx, [rdi + 1]
lea rcx, [0x140107f00]
call fcn.140005380
test rax, rax
je 0x1400052ea
mov qword [rsp + 0x30], rbx
mov r8, rdi
mov rbx, qword [0x140107f18]
mov rdx, rsi
mov rcx, rbx
call fcn.1400b3da4
xor eax, eax
mov word [rbx + rdi*2], ax
mov rbx, qword [rsp + 0x30]
lea rcx, [0x140107f00]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp fcn.140005440

Function at 0x1400056c0
Capabilities:
Read clipboard data

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x230
xor ecx, ecx
mov rbx, r8
mov edi, edx
test r8, r8
je 0x1400056dc
mov dword [r8], ecx
lea eax, [rdx - 0xc000]
cmp eax, 0x3fff
ja 0x1400057bb
mov r8d, 0x104
lea rdx, [rsp + 0x20]
mov ecx, edi
call qword [sym.imp.USER32.dll_GetClipboardFormatNameW]
mov r8d, reloc.WSOCK32.dll_inet_ntoa
lea rdx, str.Link_Source
lea rcx, [rsp + 0x20]
call fcn.1400aba40
test eax, eax
je 0x1400057a8
lea rdx, str.ObjectLink
lea rcx, [rsp + 0x20]
call fcn.1400ab8c0
test eax, eax
je 0x1400057a8
lea rdx, str.OwnerLink
lea rcx, [rsp + 0x20]
call fcn.1400ab8c0
test eax, eax
je 0x1400057a8
lea rdx, str.Native
lea rcx, [rsp + 0x20]
call fcn.1400ab8c0
test eax, eax
je 0x1400057a8
lea rdx, str.Embed_Source
lea rcx, [rsp + 0x20]
call fcn.1400ab8c0
test eax, eax
je 0x1400057a8
lea rdx, str.MSDEVColumnSelect
lea rcx, [rsp + 0x20]
call fcn.1400ab8c0
test eax, eax
je 0x14000579d
lea rdx, str.MSDEVLineSelect
lea rcx, [rsp + 0x20]
call fcn.1400ab8c0
test eax, eax
jne 0x1400057c0
test rbx, rbx
je 0x1400057a8
mov dword [rbx], 1
xor eax, eax
mov rbx, qword [rsp + 0x240]
add rsp, 0x230
pop rdi
ret
mov word [rsp + 0x20], cx
mov ecx, edi
call qword [sym.imp.USER32.dll_GetClipboardData]
mov rbx, qword [rsp + 0x240]
add rsp, 0x230
pop rdi
ret
Function at 0x14000c3b0
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
mov eax, 0x1040
call fcn.1400bfa50
sub rsp, rax
cmp byte [0x140108b1c], 0
mov rbx, rdx
mov rbp, rcx
jne 0x14000c53d
cmp dword [0x140105d0c], 0
jne 0x14000c3eb
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x140105d0c], eax
inc dword [0x140108b18]
mov qword [rsp + 0x1050], rsi
mov qword [rsp + 0x1058], rdi
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov r9d, dword [0x140108b18]
mov ecx, eax
sub ecx, dword [0x140105d0c]
cmp r9d, dword [0x140102404]
mov edx, dword [0x140102400]
mov dword [0x140105d08], eax
jbe 0x14000c4a6
cmp ecx, edx
jae 0x14000c4a6
mov dword [rsp + 0x20], ecx
lea r8, str._u_hotkeys_have_been_received_in_the_last__ums._n_nDo_you_want_to_continue__n_see_MaxHotkeysPerInterval_in_the_help_file_
lea rcx, [rsp + 0x40]
mov edx, 0x800
mov esi, 1
call fcn.14008b9a0
call fcn.14000b1a0
xor edi, edi
mov byte [0x140108b1c], sil
xor r8d, r8d
mov dword [0x140100a50], edi
lea edx, [rsi + 3]
mov qword [rsp + 0x20], rdi
lea rcx, [rsp + 0x40]
xorps xmm3, xmm3
call fcn.140091370
cmp eax, 7
jne 0x14000c491
xor r8d, r8d
lea edx, [rsi + 4]
lea rcx, [0x1401072b0]
call fcn.14001b180
mov eax, dword [0x140105d08]
mov dword [0x140100a50], esi
mov byte [0x140108b1c], dil
jmp 0x14000c4ae
xor edi, edi
mov esi, edi
cmp ecx, edx
jbe 0x14000c4be
mov dword [0x140108b18], edi
mov dword [0x140105d0c], eax
test esi, esi
jne 0x14000c52d
movzx eax, byte [rbp + 0xf]
lea r8, [0x1400cefc0]
mov byte [0x140107e2e], al
xor r9d, r9d
inc byte [rbx + 0x22]
mov rcx, qword [rbx]
mov dword [rsp + 0x30], edi
mov rdx, rcx
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], edi
call fcn.140082b00
dec byte [rbx + 0x22]
test eax, eax
jne 0x14000c4f9
mov byte [rbx + 0x27], al
jmp 0x14000c52d
cmp byte [rbx + 0x27], 0
je 0x14000c52d
mov byte [rbx + 0x27], 0
call qword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [rbx + 0x18]
cmp eax, 0x3e8
ja 0x14000c52d
movzx r8d, word [rbp + 4]
xor r9d, r9d
mov rcx, qword [0x140104d70]
mov edx, 0x312
call qword [sym.imp.USER32.dll_PostMessageW]
mov rsi, qword [rsp + 0x1050]
mov rdi, qword [rsp + 0x1058]
mov rbx, qword [rsp + 0x1060]
add rsp, 0x1040
pop rbp
ret