joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18003e9c0
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov dword [rsp + 8], ecx
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x48
movzx ebx, byte [rsp + 0x90]
mov rdi, r8
imul eax, ecx, 0x226
mov r15d, ecx
mov dword [rsp + 0x28], eax
cmp ecx, eax
ja 0x18003eb96
movsxd r14, dword [rsp + 0x90]
mov r13, qword [rsp + 0x38]
mov rbp, r14
movzx esi, byte [rsp + 0x90]
mov r12, qword [rsp + 0x30]
cmp r15d, 0x4c50
ja 0x18003eb6e
je 0x18003eb96
mov eax, r15d
sub eax, 0x81
je 0x18003eb3a
sub eax, 0x2f
je 0x18003eb10
sub eax, 0x1b88
je 0x18003eaab
sub eax, 0xa48
je 0x18003eaa4
cmp eax, 0x116f
jne 0x18003ec41
movsxd rax, r14d
lea r8, [rsp + 0x38]
mov edx, 0xeb
xor ecx, ecx
lea rax, [rax*8 + 8]
mov qword [rsp + 0x38], rax
call fcn.1800124e0
mov r12, rax
mov qword [rsp + 0x30], rax
mov qword [rax], rdi
mov qword [rax + rbp*8], 0
mov ebp, 1
mov r14d, ebp
jmp 0x18003ec31
xor bl, bl
jmp 0x18003ec41
movzx eax, byte [r13]
test al, al
je 0x18003ec41
mov r12, qword [rsp + 0x98]
mov rdi, r13
movzx ecx, al
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_isspace]
test eax, eax
je 0x18003ead5
mov sil, 1
jmp 0x18003eafb
test sil, sil
je 0x18003eafb
xor sil, sil
inc r14d
inc rbp
cmp rbp, 0x1fffffff
jne 0x18003eafb
mov rdx, r12
lea rcx, str.__0CompressedRectilinearWarper_detail_cv__QAE_ABV012__Z
call fcn.180038d00
movzx eax, byte [rdi + 1]
inc rdi
test al, al
jne 0x18003eac3
mov r12, qword [rsp + 0x30]
jmp 0x18003ec31
cmp byte [rdi], 0
jne 0x18003ec64
test byte [rdi + 1], 0xf0
jne 0x18003ec64
mov dword [r9], 0
movzx eax, byte [rdi + 1]
and eax, 0xf
mov dword [r9 + 0x10], eax
jmp 0x18003ec41
mov rcx, rdx
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
test rax, rax
je 0x18003eb96
xor r9d, r9d
mov r8, rax
mov edx, 0x100
xor ecx, ecx
call fcn.1800194e0
mov ebp, 1
mov r13, rax
mov r14d, ebp
movzx esi, bpl
jmp 0x18003ec31
cmp r15d, 0x53a6
je 0x18003ebca
cmp r15d, 0x6f5d
je 0x18003ebbe
cmp r15d, 0x8b14
je 0x18003ebaa
cmp r15d, 0xa6cb
jne 0x18003ec41
movzx eax, bl
add rsp, 0x48
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
mov rcx, r12
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rcx, r13
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
jmp 0x18003ec31
mov dword [0x1800c0090], 0
jmp 0x18003ec41
movzx eax, byte [r13]
mov sil, 1
test al, al
je 0x18003ec12
mov rdi, r13
nop dword [rax]
movzx ecx, al
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_isspace]
test eax, eax
je 0x18003ebf5
mov sil, 1
mov byte [rdi], 0
jmp 0x18003ec07
test sil, sil
je 0x18003ec07
xor sil, sil
mov qword [r12 + rbp*8], rdi
inc r14d
inc rbp
movzx eax, byte [rdi + 1]
inc rdi
test al, al
jne 0x18003ebe0
mov rcx, qword [rsp + 0xa8]
lea r8, [rsp + 0x20]
mov r9, r12
mov dword [rsp + 0x20], r14d
mov edx, 0x10b
call fcn.180022380
mov rdx, qword [rsp + 0x98]
mov r9, qword [rsp + 0xa8]
imul eax, dword [rsp + 0x90], 0x37
add r15d, eax
cmp r15d, dword [rsp + 0x28]
ja 0x18003eb96
mov rdi, qword [rsp + 0xa0]
jmp 0x18003ea20
mov al, 1
jmp 0x18003eb99
Function at 0x1405fe058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.1405fe1df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x1405fe089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1405fe06f
add dl, dl
jne 0x1405fe096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1405fe0f6
xor eax, eax
add dl, dl
jne 0x1405fe0a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1405fe1ad
add dl, dl
jne 0x1405fe0b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1405fe0c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1405fe0d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1405fe0dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x1405fe0ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x1405fe07e
mov eax, 1
add dl, dl
jne 0x1405fe106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1405fe113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1405fe0fb
sub eax, ebx
mov ebx, 1
jne 0x1405fe14c
mov ecx, 1
add dl, dl
jne 0x1405fe12e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1405fe13b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1405fe123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1405fe07e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x1405fe168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1405fe175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1405fe15d
cmp eax, 0x7d00
jae 0x1405fe19b
cmp eax, 0x500
jb 0x1405fe196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1405fe07e
cmp eax, 0x7f
ja 0x1405fe19e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1405fe07e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x1405fe1d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x1405fe07e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x140003110
Capabilities:
Encrypt data using rc4 ksa
Encrypt data using rc4 prga

Disassembly:
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x250
mov rbx, qword [0x1400067f0]
lea rsi, section..rdata
mov rax, qword [rbx]
mov qword [rsp + 0x248], rax
xor eax, eax
lea rdi, [rsp + 0x28]
mov r9, rcx
mov ecx, 8
rep movsd dword [rdi], dword [rsi]
lea r10, [rsp + 0x148]
mov r11, rdx
lea rbp, [rsp + 0x48]
mov rdx, rax
mov byte [rax + r10], al
inc rax
and edx, 0x1f
mov dl, byte [rsp + rdx + 0x28]
mov byte [rax + rbp - 1], dl
cmp rax, 0x100
jne 0x14000315b
mov r12, r10
xor esi, esi
xor r13d, r13d
mov edi, 0x100
movzx eax, byte [r12]
movzx edx, byte [rbp + rsi]
inc rsi
add eax, r13d
add eax, edx
cdq
idiv edi
movsxd rcx, edx
mov rdx, r12
inc r12
mov r13, rcx
add rcx, r10
call fcn.140003050
cmp rsi, 0x100
jne 0x140003185
lea rdi, [r9 + r11]
xor ebp, ebp
xor r12d, r12d
cmp rdi, r9
je 0x140003215
lea eax, [rbp + 1]
cdq
idiv esi
movsxd r13, edx
movzx eax, byte [rsp + r13 + 0x148]
lea rcx, [r10 + r13]
mov rbp, r13
add eax, r12d
cdq
idiv esi
movsxd r14, edx
lea rdx, [r10 + r14]
mov r12, r14
call fcn.140003050
mov cl, byte [rsp + r14 + 0x148]
add cl, byte [rsp + r13 + 0x148]
movzx ecx, cl
mov al, byte [rsp + rcx + 0x148]
xor byte [r9], al
inc r9
jmp 0x1400031c0
mov rax, qword [rsp + 0x248]
sub rax, qword [rbx]
je 0x140003227
call fcn.140002860
mov rax, r11
add rsp, 0x250
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
Function at 0x1800019f0
Capabilities:
Create thread

Disassembly:
sub rsp, 0x38
cmp edx, 1
jne 0x180001a21
xor eax, eax
lea r8, [0x1800019b0]
mov r9, rcx
mov qword [rsp + 0x28], rax
xor edx, edx
mov dword [rsp + 0x20], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
add rsp, 0x38
ret
Function at 0x14001b580
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov rbx, rcx
mov ecx, 0x10
mov rdi, rdx
call fcn.14001f500
test rax, rax
jne 0x14001b5b0
xor ecx, ecx
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
jmp fcn.1400290a0
lea rcx, [0x1400b74e6]
lea rdx, [rsp + 0x50]
mov qword [rax], rdi
mov qword [rax + 8], rcx
lea rcx, [sub.MSVCR120.dll__beginthreadex]
mov r9, rax
mov qword [rsp + 0x28], rdx
test rcx, rcx
je 0x14001b5f1
xor ecx, ecx
lea r8, [0x14001b570]
xor edx, edx
mov dword [rsp + 0x50], ecx
mov dword [rsp + 0x20], ecx
call sub.MSVCR120.dll__beginthreadex
jmp 0x14001b608
lea r8, [0x14001b570]
xor edx, edx
mov dword [rsp + 0x50], ecx
mov dword [rsp + 0x20], ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rbx + 8], rax
test rax, rax
jne 0x14001b627
lea rcx, str.Not_enough_resources_to_create_thread
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
jmp fcn.140028e70
xor eax, eax
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
Function at 0x14001f460
Capabilities:
Query environment variable

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
test rcx, rcx
je 0x14001f4f6
call fcn.140017f60
test rax, rax
je 0x14001f4f6
mov r8d, dword [0x1400defd0]
mov rdx, qword [0x1400defc8]
mov rcx, rbx
mov qword [rsp + 0x30], rdi
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
mov edi, eax
test eax, eax
je 0x14001f4ba
cmp rdi, qword [0x1400defd0]
jbe 0x14001f4e4
mov rcx, qword [0x1400defc8]
mov edx, edi
call fcn.14001f520
test rax, rax
jne 0x14001f4c7
xor eax, eax
mov rdi, qword [rsp + 0x30]
add rsp, 0x20
pop rbx
ret
mov r8d, edi
mov rdx, rax
mov rcx, rbx
mov qword [0x1400defc8], rax
mov qword [0x1400defd0], rdi
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
mov rax, qword [0x1400defc8]
mov rdi, qword [rsp + 0x30]
add rsp, 0x20
pop rbx
ret
xor eax, eax
add rsp, 0x20
pop rbx
ret

Function at 0x1400269b0
Capabilities:
Hash data using djb2

Disassembly:
mov r9d, 0x1505
lea r8, [rcx + 0x28]
mov r10d, 8
cvttss2si rax, dword [r8]
cvttss2si rdx, dword [r8 - 4]
cvttss2si rcx, dword [r8 - 0x14]
add r8, 0x40
imul edx, edx, 0x21
imul ecx, ecx, 0x21
add edx, eax
imul edx, edx, 0x21
cvttss2si rax, dword [r8 - 0x3c]
add edx, eax
cvttss2si rax, dword [r8 - 0x38]
imul edx, edx, 0x21
add edx, eax
cvttss2si rax, dword [r8 - 0x34]
imul edx, edx, 0x21
add edx, eax
cvttss2si rax, dword [r8 - 0x30]
imul edx, edx, 0x21
add edx, eax
cvttss2si rax, dword [r8 - 0x50]
imul edx, edx, 0x21
add ecx, eax
cvttss2si rax, dword [r8 - 0x64]
imul ecx, ecx, 0x40a9121
add edx, ecx
mov ecx, r9d
imul ecx, ecx, 0x6d261dff
imul eax, eax, 0x5cb8923f
sub edx, eax
cvttss2si rax, dword [r8 - 0x48]
imul eax, eax, 0x13be2b1f
sub edx, eax
cvttss2si rax, dword [r8 - 0x58]
imul eax, eax, 0x30f35d61
add edx, eax
cvttss2si rax, dword [r8 - 0x5c]
imul eax, eax, 0x4f5f0981
add edx, eax
cvttss2si rax, dword [r8 - 0x68]
imul eax, eax, 0xc3525e1
add edx, eax
cvttss2si rax, dword [r8 - 0x4c]
imul eax, eax, 0x747c7101
add edx, eax
cvttss2si rax, dword [r8 - 0x60]
imul eax, eax, 0x3b4039a1
add edx, eax
mov r9d, edx
sub r9d, ecx
cvttss2si rcx, dword [r8 - 0x2c]
add r9d, ecx
dec r10
jne 0x1400269c0
mov eax, r9d
ret
Function at 0x140031350
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rbx, rcx
xor edx, edx
xor ecx, ecx
call fcn.14000bae0
mov ecx, 1
mov edi, eax
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
mov esi, 0x8000
test si, ax
jne 0x140031394
mov edx, edi
mov r9b, 1
mov r8, rbx
and edx, 1
xor ecx, ecx
call fcn.140031100
mov ecx, 2
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test si, ax
jne 0x1400313b6
mov edx, edi
mov r9b, 3
mov r8, rbx
and edx, 4
xor ecx, ecx
call fcn.140031100
mov ecx, 4
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test si, ax
jne 0x1400313d8
mov edx, edi
mov r9b, 2
mov r8, rbx
and edx, 2
xor ecx, ecx
call fcn.140031100
mov ecx, 5
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test si, ax
jne 0x1400313fa
mov edx, edi
mov r9b, 4
mov r8, rbx
and edx, 8
xor ecx, ecx
call fcn.140031100
mov ecx, 6
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test si, ax
jne 0x14003141c
and edi, 0x10
mov r9b, 5
mov r8, rbx
mov edx, edi
xor ecx, ecx
call fcn.140031100
mov rsi, qword [rsp + 0x38]
mov qword [rbx + 0x38], 0
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x140032370
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x60
call qword [sym.imp.KERNEL32.dll_GetTickCount]
cmp dword [0x1400db0f0], 0
mov ebx, eax
je 0x1400323f2
lea rcx, [rsp + 0x30]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov dword [rsp + 0x20], 1
call qword [sym.imp.USER32.dll_PeekMessageW]
test eax, eax
je 0x1400323f2
nop word [rax + rax]
lea rcx, [rsp + 0x30]
call qword [sym.imp.USER32.dll_TranslateMessage]
lea rcx, [rsp + 0x30]
call qword [sym.imp.USER32.dll_DispatchMessageW]
mov r11d, ebx
sub r11d, dword [rsp + 0x50]
test r11d, r11d
jle 0x1400323f2
lea rcx, [rsp + 0x30]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov dword [rsp + 0x20], 1
call qword [sym.imp.USER32.dll_PeekMessageW]
test eax, eax
jne 0x1400323b0
xor ecx, ecx
call fcn.140024450
mov edi, 0x8000
cmp byte [rax + 0xe1], 1
mov rbx, rax
jne 0x140032426
mov ecx, 0xa0
call qword [sym.imp.USER32.dll_GetKeyState]
test di, ax
jne 0x140032426
mov edx, 0xe1
xor ecx, ecx
call fcn.140023f20
cmp byte [rbx + 0xe5], 1
jne 0x14003244b
mov ecx, 0xa1
call qword [sym.imp.USER32.dll_GetKeyState]
test di, ax
jne 0x14003244b
mov edx, 0xe5
xor ecx, ecx
call fcn.140023f20
mov rbx, qword [rsp + 0x70]
add rsp, 0x60
pop rdi
ret
Function at 0x14003f5e0
Capabilities:
Log keystrokes

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x820
lea rcx, [rsp + 0x20]
call fcn.140023ea0
xor ebx, ebx
lea rdi, [0x1400c2a60]
mov qword [rsp + 0x830], rsi
movsxd rax, dword [rdi]
test eax, eax
je 0x14003f65f
test dword [rsp + rax*4 + 0x20], 0x40000000
mov rsi, rax
jne 0x14003f65f
cmp eax, 0x35
je 0x14003f65f
cmp eax, 0x1e
jl 0x14003f62b
cmp eax, 0x27
jle 0x14003f65f
mov edx, 1
mov ecx, ebx
call qword [sym.imp.USER32.dll_MapVirtualKeyW]
test eax, eax
je 0x14003f65f
mov edx, 2
mov ecx, eax
call qword [sym.imp.USER32.dll_MapVirtualKeyW]
and eax, 0x7fff
je 0x14003f65f
lea ecx, [rax - 0x41]
cmp ecx, 0x19
ja 0x14003f65b
add eax, 0x20
mov dword [rsp + rsi*4 + 0x20], eax
inc ebx
add rdi, 4
cmp ebx, 0x80
jb 0x14003f608
lea rdx, [rsp + 0x20]
mov r8d, 0x200
xor ecx, ecx
call fcn.140023ec0
mov rsi, qword [rsp + 0x830]
mov rbx, qword [rsp + 0x838]
add rsp, 0x820
pop rdi
ret
Function at 0x14003fba0
Capabilities:
Get keyboard layout

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetKeyboardLayout]
cmp qword [0x1400e08e8], rax
mov qword [rbx + 0x1510], rax
je 0x14003fc2e
movzx r8d, ax
mov qword [0x1400e08e8], rax
mov edx, r8d
and edx, 0x3ff
sub edx, 4
je 0x14003fc01
sub edx, 0xd
je 0x14003fbf1
dec edx
jne 0x14003fc2e
xor ecx, ecx
mov dword [rbx + 0x14dc], ecx
add rsp, 0x20
pop rbx
ret
mov dword [rbx + 0x14dc], 1
add rsp, 0x20
pop rbx
ret
mov eax, 0xfc00
mov dword [rbx + 0x14dc], 1
xor ecx, ecx
and r8w, ax
mov eax, dword [rbx + 0x14dc]
mov edx, 0x800
cmp r8w, dx
cmove eax, ecx
mov dword [rbx + 0x14dc], eax
add rsp, 0x20
pop rbx
ret

Function at 0x14003fcf0
Capabilities:
Log keystrokes via input method manager

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rdi
push r12
sub rsp, 0x20
mov eax, r8d
mov rdi, rdx
lea r8, [rcx + 0x60]
mov rbp, rcx
mov r9d, 0x3e
mov edx, eax
mov rcx, rdi
call sub.IMM32.dll_ImmGetCompositionStringW
xor r12d, r12d
mov edx, 0x80
test eax, eax
mov rcx, rdi
cmovs eax, r12d
xor r9d, r9d
xor r8d, r8d
movsxd rbx, eax
shr rbx, 1
call sub.IMM32.dll_ImmGetCompositionStringW
movzx ecx, ax
mov dword [rbp + 0xc0], ecx
cmp ecx, 0x20
jae 0x14003fd88
mov edx, 0x3000
cmp word [rbp + rcx*2 + 0x60], dx
jne 0x14003fd88
lea eax, [rcx + 1]
movsxd rcx, ebx
movsxd rdx, eax
cmp rdx, rcx
jge 0x14003fd86
mov qword [rsp + 0x30], rsi
lea rdi, [rbp + rdx*2 + 0x5e]
lea rsi, [rbp + rdx*2 + 0x60]
sub rcx, rdx
rep movsw word [rdi], word [rsi]
mov rsi, qword [rsp + 0x30]
dec ebx
mov rdi, qword [rsp + 0x48]
movsxd rax, ebx
mov rbx, qword [rsp + 0x38]
mov word [rbp + rax*2 + 0x60], r12w
mov rbp, qword [rsp + 0x40]
add rsp, 0x20
pop r12
ret

Function at 0x140042050
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
xor ebx, ebx
lea ecx, [rbx + 0xd]
call qword [sym.imp.USER32.dll_IsClipboardFormatAvailable]
test eax, eax
je 0x1400420f8
mov rcx, rdi
call fcn.140041e80
mov rcx, rax
call qword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x1400420f8
lea ecx, [rbx + 0xd]
call qword [sym.imp.USER32.dll_GetClipboardData]
mov rdi, rax
test rax, rax
je 0x1400420d3
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GlobalLock]
mov rcx, rax
mov rbx, rax
call fcn.140017f80
lea rdx, str.UTF_16LE
lea rcx, str.UTF_8
lea r9, [rax + rax + 2]
mov r8, rbx
call fcn.14001f0d0
mov rcx, rdi
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
jmp 0x1400420df
lea rcx, str.Couldnt_get_clipboard_data
call fcn.1400477a0
call qword [sym.imp.USER32.dll_CloseClipboard]
test rbx, rbx
je 0x1400420f8
mov rax, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
lea rcx, [0x1400bd533]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp fcn.140018190
Function at 0x140047630
Capabilities:
Allocate thread local storage
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
call sub.KERNEL32.dll_GetCurrentThreadId
xor edi, edi
cmp qword [0x1400dec98], rdi
mov ebx, eax
jne 0x14001aff7
lea rcx, [0x1400dec90]
call fcn.14002d930
cmp qword [0x1400dec98], rdi
jne 0x14001afeb
call fcn.1400235b0
mov qword [0x1400dec98], rax
test rax, rax
jne 0x14001afeb
lea rcx, [0x1400dec90]
call fcn.14002d960
xor eax, eax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
lea rcx, [0x1400dec90]
call fcn.14002d960
mov rcx, qword [0x1400dec98]
call fcn.140023620
mov r11, qword [0x1400decb0]
test r11, r11
je 0x14001b024
nop
cmp dword [r11], ebx
je 0x14001b020
mov r11, qword [r11 + 0x10]
test r11, r11
jne 0x14001b010
jmp 0x14001b024
mov rdi, qword [r11 + 8]
mov rcx, qword [0x1400dec98]
call fcn.140023690
mov rbx, qword [rsp + 0x30]
mov rax, rdi
add rsp, 0x20
pop rdi
ret
sub rsp, 0x28
cmp dword [0x1400dd960], 0xffffffff
jne 0x14004768d
cmp dword [0x1400e097c], 0
jne 0x140047696
lea rcx, [0x1400e0978]
call fcn.14002d930
cmp dword [0x1400dd960], 0xffffffff
jne 0x140047681
cmp dword [0x1400e097c], 0
jne 0x140047681
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
cmp eax, 0xffffffff
je 0x140047677
mov dword [0x1400dd960], eax
jmp 0x140047681
mov dword [0x1400e097c], 1
lea rcx, [0x1400e0978]
call fcn.14002d960
cmp dword [0x1400e097c], 0
je 0x14004769f
add rsp, 0x28
jmp 0x14001af90
mov ecx, dword [0x1400dd960]
add rsp, 0x28
jmp qword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x1400476b0
Capabilities:
Set thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rsi, rcx
call sub.KERNEL32.dll_GetCurrentThreadId
mov rcx, qword [0x1400dec98]
mov edi, eax
call fcn.140023620
mov rbx, qword [0x1400decb0]
xor r11d, r11d
test rbx, rbx
je 0x14001b084
cmp dword [rbx], edi
je 0x14001b0d5
mov r11, rbx
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x14001b074
mov ecx, 0x18
call fcn.14001f500
mov rbx, rax
test rax, rax
je 0x14001b0ae
mov rcx, qword [0x1400decb0]
mov dword [rax], edi
mov qword [rax + 8], rsi
mov qword [rax + 0x10], rcx
mov qword [0x1400decb0], rax
mov rcx, qword [0x1400dec98]
call fcn.140023690
test rbx, rbx
jne 0x14001b108
xor ecx, ecx
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp fcn.1400290a0
test rsi, rsi
je 0x14001b0e0
mov qword [rbx + 8], rsi
jmp 0x14001b0ae
mov rax, qword [rbx + 0x10]
test r11, r11
je 0x14001b0f7
mov rcx, rbx
mov qword [r11 + 0x10], rax
call fcn.14001f530
jmp 0x14001b0ae
mov rcx, rbx
mov qword [0x1400decb0], rax
call fcn.14001f530
jmp 0x14001b0ae
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
xor eax, eax
add rsp, 0x20
pop rdi
ret
sub rsp, 0x28
cmp dword [0x1400e097c], 0
je 0x1400476c6
add rsp, 0x28
jmp 0x14001b040
mov rdx, rcx
mov ecx, dword [0x1400dd960]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
jne 0x1400476e9
lea rcx, str.TlsSetValue___failed
add rsp, 0x28
jmp fcn.140028e70
xor eax, eax
add rsp, 0x28
ret
Function at 0x14004f310
Capabilities:
Capture microphone audio

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
mov rdi, r8
mov esi, edx
xor edx, edx
mov rbx, rcx
lea r8d, [rdx + 0x12]
mov rcx, rdi
mov ebp, r9d
call fcn.140017f00
mov eax, 0x100
mov r8d, 1
test word [rbx + 4], ax
je 0x14004f358
mov eax, 3
mov word [rdi], ax
jmp 0x14004f35c
mov word [rdi], r8w
movzx edx, word [rbx + 4]
mov eax, 0xff
mov dword [rsp + 0x28], r8d
and dx, ax
xor r9d, r9d
mov r8, rdi
mov word [rdi + 0xe], dx
movzx eax, byte [rbx + 6]
shr dx, 3
mov word [rdi + 2], ax
mov ecx, dword [rbx]
xor ebx, ebx
imul dx, ax
movzx eax, dx
mov dword [rdi + 4], ecx
mov edx, esi
mov word [rdi + 0xc], ax
mov qword [rsp + 0x20], rbx
imul eax, ecx
xor ecx, ecx
mov dword [rdi + 8], eax
test ebp, ebp
je 0x14004f3b0
call qword [sym.imp.WINMM.dll_waveInOpen]
jmp 0x14004f3b6
call qword [sym.imp.WINMM.dll_waveOutOpen]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
test eax, eax
sete bl
mov eax, ebx
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
Function at 0x1400b6d00
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x30
mov rbx, rcx
mov ecx, 0x20
call sym.opengl_program.exe_SDL_Init
test eax, eax
jns 0x1400b6d4c
call sym.opengl_program.exe_SDL_GetError
mov rbx, rax
call qword [sym.imp.MSVCR120.dll___iob_func]
lea r8, str.Couldnt_initialize_SDL
lea rdx, str._s:__s_n
lea rcx, [rax + 0x60]
mov r9, rbx
call qword [sym.imp.MSVCR120.dll_fprintf]
mov ecx, 2
call qword [sym.imp.MSVCR120.dll_exit]
int3
lea rcx, [sym.opengl_program.exe_SDL_Quit]
call fcn.1400b70b0
xor ecx, ecx
call sym.opengl_program.exe_SDL_GL_LoadLibrary
mov edx, 1
lea ecx, [rdx + 0xe]
call sym.opengl_program.exe_SDL_GL_SetAttribute
mov edx, 1
lea ecx, [rdx + 4]
call sym.opengl_program.exe_SDL_GL_SetAttribute
mov edx, 0x18
lea ecx, [rdx - 0x12]
call sym.opengl_program.exe_SDL_GL_SetAttribute
mov edx, 0x1fff0000
mov r9d, 0x20
mov rcx, rbx
mov r8d, edx
mov dword [rsp + 0x28], 0xa
mov dword [rsp + 0x20], 0x20
call sym.opengl_program.exe_SDL_CreateWindow
mov qword [0x1400dea40], rax
test rax, rax
jne 0x1400b6ded
call sym.opengl_program.exe_SDL_GetError
mov rbx, rax
call qword [sym.imp.MSVCR120.dll___iob_func]
lea r8, str.Couldnt_set_video_mode
lea rdx, str._s:__s_n
lea rcx, [rax + 0x60]
mov r9, rbx
call qword [sym.imp.MSVCR120.dll_fprintf]
mov ecx, 2
call qword [sym.imp.MSVCR120.dll_exit]
int3
mov rcx, rax
call sym.opengl_program.exe_SDL_GL_CreateContext
mov qword [0x1400dea48], rax
test rax, rax
jne 0x1400b6e36
call sym.opengl_program.exe_SDL_GetError
mov rbx, rax
call qword [sym.imp.MSVCR120.dll___iob_func]
lea r8, str.Failed_to_create_OpenGL_context
lea rdx, str._s:__s_n
lea rcx, [rax + 0x60]
mov r9, rbx
call qword [sym.imp.MSVCR120.dll_fprintf]
mov ecx, 2
call qword [sym.imp.MSVCR120.dll_exit]
int3
lea rcx, [sym.opengl_program.exe_SDL_GL_GetProcAddress]
call fcn.1400b3bb0
mov ecx, 1
call sym.opengl_program.exe_SDL_GL_SetSwapInterval
mov ecx, 0xb71
call qword [0x1400e2678]
mov ecx, 0xb44
call qword [0x1400e2678]
mov rcx, qword [0x1400dea40]
lea r8, [rsp + 0x48]
lea rdx, [rsp + 0x50]
call sym.opengl_program.exe_SDL_GetWindowSize
mov r9d, dword [rsp + 0x48]
mov r8d, dword [rsp + 0x50]
xor edx, edx
xor ecx, ecx
call qword [0x1400e23b0]
movss xmm2, dword [0x1400bcc58]
movss xmm1, dword [0x1400bcc54]
xorps xmm3, xmm3
xorps xmm0, xmm0
call qword [0x1400e2720]
add rsp, 0x30
pop rbx
ret