joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140019d00
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x20
cmp edx, 0x1ff
jg 0x140019da1
dec edx
cmp edx, 0x3f
ja case.0x140019d2f.64
lea rax, [0x140119168]
movsxd rdx, dword [rax + rdx*4]
add rdx, rax
jmp rdx
movzx eax, byte [rcx]
test rax, rax
je 0x140019d71
lea ecx, [rax - 1]
mov edx, 1
xor r9d, r9d
shld r9, rdx, cl
mov r10d, ecx
shr r10b, 7
movzx r10d, r10b
xor r11d, r11d
shl rdx, cl
test cl, 0x40
cmovne r9, rdx
cmovne rdx, r11
shl r10, 4
or qword [r8 + r10], rdx
or qword [r8 + r10 + 8], r9
mov r10d, eax
shr r10d, 7
mov edx, 1
xor r9d, r9d
mov ecx, eax
shld r9, rdx, cl
shl rdx, cl
xor ecx, ecx
test al, 0x40
cmovne r9, rdx
cmovne rdx, rcx
shl r10, 4
add r8, r10
jmp 0x140019ec1
cmp edx, 0x1fff
jle 0x140019dc1
cmp edx, 0x7fff
jle case.0x140019d2f.64
cmp edx, 0x8000
je case.0x140019d2f.64
cmp edx, 0x20000
jmp case.0x140019d2f.64
cmp edx, 0x7ff
xor edx, edx
mov r9d, 1
lea r10, [0x140118af0]
xor r11d, r11d
jmp 0x140019e1d
xor esi, esi
mov ecx, eax
shld rsi, r9, cl
shr cl, 7
movzx edi, cl
mov ebx, 1
mov ecx, eax
shl rbx, cl
test al, 0x40
cmovne rsi, rbx
cmovne rbx, rdx
shl rdi, 4
or qword [r8 + rdi], rbx
or qword [r8 + rdi + 8], rsi
movzx eax, ax
cmp eax, 0xff
jae case.0x140019d2f.1
mov ecx, r11d
movzx esi, r11w
cmp esi, 0x100
mov edi, 0xff
cmovae edi, esi
mov r11d, edi
inc r11d
mov ebx, ecx
nop word [rax + rax]
cmp di, bx
je 0x140019e70
mov eax, ebx
lea ebx, [rax + 1]
cmp byte [rsi + r10], 0
sete bpl
movzx r14d, bl
cmp byte [r14 + r10], 0
setne r14b
xor r14b, bpl
jne 0x140019e40
mov r11d, ebx
jmp 0x140019e7c
mov ax, 0xff
cmp esi, 0x100
jae 0x140019ed3
test cl, cl
je 0x140019de0
dec cl
xor esi, esi
shld rsi, r9, cl
mov ebx, ecx
shr bl, 7
movzx edi, bl
mov ebx, 1
shl rbx, cl
test cl, 0x40
cmovne rsi, rbx
cmovne rbx, rdx
shl rdi, 4
or qword [r8 + rdi], rbx
or qword [r8 + rdi + 8], rsi
jmp 0x140019de0
mov edx, 0x3600
xor r9d, r9d
or qword [r8], rdx
or qword [r8 + 8], r9
add rsp, 0x20
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
ret
lea rcx, str.assertion_failed:_b2___256
lea r8, [0x140118c10]
mov edx, 0x1b
call fcn.140114790
ud2
Function at 0x140044c10
Capabilities:
Encode data using base64

Disassembly:
push rbp
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x48
lea rbp, [rsp + 0x40]
mov qword [rbp], 0xfffffffffffffffe
mov rsi, rdx
mov rbx, qword [rcx]
mov qword [rbp - 8], rcx
mov r14, qword [rcx + 0x10]
mov r15d, 4
test r14, r14
mov qword [rbp - 0x18], rbx
je 0x140044c82
mov rax, r14
shr rax, 0x3d
jne 0x140044da7
lea rdi, [r14*4]
test rdi, rdi
je 0x140044c82
movzx eax, byte [0x1401c3bd1]
mov edx, 4
mov rcx, rdi
call fcn.140007260
test rax, rax
je 0x140044dae
mov r15, rax
jmp 0x140044c84
xor edi, edi
mov rcx, r15
mov rdx, rbx
mov r8, rdi
call fcn.14010d660
mov r8, qword [rsi + 0x30]
movzx ecx, byte [rsi + 0x158]
shr r8, cl
test r8, r8
mov qword [rbp - 0x20], r14
mov qword [rbp - 0x10], r15
je 0x140044d05
mov rax, qword [rbp - 8]
mov rcx, qword [rax + 0x18]
and ecx, 0x3f
xor eax, eax
jmp 0x140044cc8
inc rax
cmp rax, r8
je 0x140044d05
mov r9, rax
shl r9, cl
cmp rax, r14
je 0x140044d7f
mov edx, dword [r15 + rax*4]
cmp edx, r9d
je 0x140044cc0
mov r10d, edx
mov edx, edx
shr rdx, cl
cmp rdx, r14
jae 0x140044d6b
mov edx, dword [r15 + rdx*4]
cmp edx, r9d
jne 0x140044ce0
cmp rax, r14
jae 0x140044d93
mov dword [rbx + rax*4], r10d
jmp 0x140044cc0
mov rdx, qword [rbp - 8]
lea r8, [rdx + 0x18]
mov rcx, rsi
call fcn.1400757d0
mov rdx, qword [rbp - 0x20]
test rdx, rdx
je 0x140044d31
shl rdx, 2
mov r8d, 4
mov rcx, qword [rbp - 0x10]
call fcn.140007270
mov rax, qword [rbp - 8]
mov rdx, qword [rax + 8]
test rdx, rdx
mov rcx, qword [rbp - 0x18]
je 0x140044d5d
shl rdx, 2
mov r8d, 4
add rsp, 0x48
pop rbx
pop rdi
pop rsi
pop r14
pop r15
pop rbp
jmp fcn.140007270
nop
add rsp, 0x48
pop rbx
pop rdi
pop rsi
pop r14
pop r15
pop rbp
ret
lea r8, [0x14011d610]
mov rcx, rdx
mov rdx, r14
call fcn.140114830
jmp 0x140044dbb
lea r8, [0x14011d5f8]
mov rcx, r14
mov rdx, r14
call fcn.140114830
jmp 0x140044dbb
lea r8, [0x14011d628]
mov rcx, rax
mov rdx, r14
call fcn.140114830
jmp 0x140044dbb
call fcn.1400f88d0
jmp 0x140044dbb
mov ecx, 4
mov rdx, rdi
call fcn.140114490
ud2
Function at 0x1400724b0
Capabilities:
Encode data using base64

Disassembly:
push rbp
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x98
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x10], 0xfffffffffffffffe
mov rsi, rcx
mov r15, qword [rcx + 0x30]
movzx ecx, byte [rcx + 0x158]
shr r15, cl
mov rdi, r15
test r15, r15
mov qword [rbp - 0x28], r15
je 0x1400726c2
mov rax, r15
shr rax, 0x3d
jne 0x140072700
lea r14, [r15*4]
test r14, r14
je 0x140072534
movzx eax, byte [0x1401c3bd1]
mov edx, 4
mov rcx, r14
call fcn.140007260
mov rbx, rax
test rax, rax
je 0x140072707
cmp r15, 8
jae 0x14007253f
xor eax, eax
jmp 0x140072590
mov ebx, 4
cmp r15, 8
jb 0x140072530
mov rax, r15
and rax, 0xfffffffffffffff8
movdqa xmm0, xmmword [0x14011d3c0]
xor ecx, ecx
movdqa xmm1, xmmword [0x14011d3d0]
movdqa xmm2, xmmword [str._b_b_b_b]
movdqa xmm3, xmm0
paddd xmm3, xmm1
movdqu xmmword [rbx + rcx*4], xmm0
movdqu xmmword [rbx + rcx*4 + 0x10], xmm3
add rcx, 8
paddd xmm0, xmm2
cmp rax, rcx
jne 0x140072560
cmp r15, rax
je 0x14007259f
nop word cs:[rax + rax]
mov dword [rbx + rax*4], eax
lea rcx, [rax + 1]
mov rax, rcx
cmp r15, rcx
jne 0x140072590
mov qword [rbp - 0x20], rbx
mov qword [rbp - 0x18], rdi
mov qword [rbp - 0x10], rdi
mov qword [rbp - 8], 0
lea r14, [rbp - 0x20]
mov r15d, edi
lea rax, [rdi - 0x80000000]
cmp rax, 0xffffffff80000001
jb 0x140072664
dec r15d
mov rcx, qword [rsi + 0x158]
and ecx, 0x3f
mov r8, qword [rsi + 0x160]
mov r9, qword [rsi + 0x20]
mov rdx, qword [rsi + 0x30]
nop dword [rax]
sub rdi, 1
jb 0x14007266d
mov eax, edi
shl rax, cl
add rax, r8
cmp rax, rdx
jae 0x1400726a6
mov rax, qword [r9 + rax*8]
shr rax, 0x2a
cmp eax, 0x3ffffe
ja 0x1400725f0
mov qword [rbp], rbx
mov byte [rbp + 0xf], 0
mov rcx, r14
mov rdx, rsi
mov r8d, r15d
mov r9d, edi
call fcn.140044b20
mov dword [rsi + 0x170], r15d
test r15d, r15d
jne 0x1400725ba
mov qword [rbp], rbx
mov byte [rbp + 0xf], 0
lea rcx, str.match_states_should_be_a_proper_subset_of_all_states
lea r8, [0x1401227e0]
mov edx, 0x34
call fcn.140114670
jmp 0x14007274d
test rdi, rdi
jne 0x140072716
movdqu xmm0, xmmword [rbp - 0x20]
movdqu xmm1, xmmword [rbp - 0x10]
movdqa xmmword [rbp - 0x40], xmm1
movdqa xmmword [rbp - 0x50], xmm0
mov qword [rbp], rbx
mov byte [rbp + 0xf], 1
lea rcx, [rbp - 0x50]
mov rdx, rsi
call fcn.140044c10
nop
add rsp, 0x98
pop rbx
pop rdi
pop rsi
pop r14
pop r15
pop rbp
ret
mov qword [rbp], rbx
mov byte [rbp + 0xf], 0
lea r8, [0x140122a58]
mov rcx, rax
call fcn.140114830
jmp 0x14007274d
mov qword [rbp - 0x20], 4
mov qword [rbp - 0x18], rdi
mov qword [rbp - 0x10], rdi
mov qword [rbp - 8], 0
mov qword [rbp], 4
mov byte [rbp + 0xf], 0
lea rcx, [0x1401225a0]
lea r8, [0x140122a88]
mov edx, 0x2b
call fcn.140114790
jmp 0x14007274d
call fcn.1400f88d0
ud2
mov ecx, 4
mov rdx, r14
call fcn.140114490
ud2
dec rdi
mov qword [rbp - 0x50], rdi
mov qword [rbp], rbx
mov byte [rbp + 0xf], 0
lea rax, [0x140122790]
mov qword [rsp + 0x20], rax
lea rcx, [0x140122706]
lea r9, [0x140122550]
lea r8, [rbp - 0x50]
mov edx, 0x15
call fcn.140114b00
ud2
Function at 0x1400772f0
Capabilities:
Encode data using base64

Disassembly:
push rbp
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x48
lea rbp, [rsp + 0x40]
mov qword [rbp], 0xfffffffffffffffe
mov rsi, rdx
mov rbx, qword [rcx]
mov qword [rbp - 8], rcx
mov r14, qword [rcx + 0x10]
mov r15d, 4
test r14, r14
mov qword [rbp - 0x18], rbx
je 0x140077362
mov rax, r14
shr rax, 0x3d
jne 0x140077487
lea rdi, [r14*4]
test rdi, rdi
je 0x140077362
movzx eax, byte [0x1401c3bd1]
mov edx, 4
mov rcx, rdi
call fcn.140007260
test rax, rax
je 0x14007748e
mov r15, rax
jmp 0x140077364
xor edi, edi
mov rcx, r15
mov rdx, rbx
mov r8, rdi
call fcn.14010d660
mov r8, qword [rsi + 0x10]
test r8, r8
mov qword [rbp - 0x20], r14
mov qword [rbp - 0x10], r15
je 0x1400773e5
mov rax, qword [rbp - 8]
mov rcx, qword [rax + 0x18]
and ecx, 0x3f
xor eax, eax
jmp 0x1400773a8
inc rax
cmp rax, r8
je 0x1400773e5
mov r9, rax
shl r9, cl
cmp rax, r14
je 0x14007745f
mov edx, dword [r15 + rax*4]
cmp edx, r9d
je 0x1400773a0
mov r10d, edx
mov edx, edx
shr rdx, cl
cmp rdx, r14
jae 0x14007744b
mov edx, dword [r15 + rdx*4]
cmp edx, r9d
jne 0x1400773c0
cmp rax, r14
jae 0x140077473
mov dword [rbx + rax*4], r10d
jmp 0x1400773a0
mov rdx, qword [rbp - 8]
lea r8, [rdx + 0x18]
mov rcx, rsi
call fcn.14007d910
mov rdx, qword [rbp - 0x20]
test rdx, rdx
je 0x140077411
shl rdx, 2
mov r8d, 4
mov rcx, qword [rbp - 0x10]
call fcn.140007270
mov rax, qword [rbp - 8]
mov rdx, qword [rax + 8]
test rdx, rdx
mov rcx, qword [rbp - 0x18]
je 0x14007743d
shl rdx, 2
mov r8d, 4
add rsp, 0x48
pop rbx
pop rdi
pop rsi
pop r14
pop r15
pop rbp
jmp fcn.140007270
nop
add rsp, 0x48
pop rbx
pop rdi
pop rsi
pop r14
pop r15
pop rbp
ret
lea r8, [0x140123da0]
mov rcx, rdx
mov rdx, r14
call fcn.140114830
jmp 0x14007749b
lea r8, [0x140123d88]
mov rcx, r14
mov rdx, r14
call fcn.140114830
jmp 0x14007749b
lea r8, [0x140123db8]
mov rcx, rax
mov rdx, r14
call fcn.140114830
jmp 0x14007749b
call fcn.1400f88d0
jmp 0x14007749b
mov ecx, 4
mov rdx, rdi
call fcn.140114490
ud2
Function at 0x1400c6dc0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x90
mov rdi, rdx
mov rsi, rcx
mov r15, qword [rdx]
mov rbx, qword [rdx + 8]
mov r8, qword [r15 + 0xa0]
mov r14, qword [rdx + 0x10]
mov rcx, rbx
mov rdx, r14
call fcn.1400b6360
cmp eax, 0x5c
jne 0x1400c6e0f
mov rcx, rsi
mov rdx, rdi
add rsp, 0x90
pop rbx
pop rdi
pop rsi
pop r14
pop r15
jmp fcn.1400c2d50
lea rcx, [rsp + 0x20]
mov rdx, rdi
call fcn.1400b6ea0
mov r8, qword [r15 + 0xa0]
mov rcx, rbx
mov rdx, r14
call fcn.1400b6360
mov dword [rsp + 0x50], eax
mov byte [rsp + 0x54], 0
mov byte [rsp + 0x88], 2
mov rcx, rdi
call fcn.1400b6480
movups xmm0, xmmword [rsp + 0x20]
movups xmm1, xmmword [rsp + 0x30]
movups xmm2, xmmword [rsp + 0x40]
movups xmm3, xmmword [rsp + 0x50]
movups xmmword [rsi + 8], xmm0
movups xmmword [rsi + 0x18], xmm1
movups xmmword [rsi + 0x28], xmm2
movups xmmword [rsi + 0x38], xmm3
movups xmm0, xmmword [rsp + 0x60]
movups xmmword [rsi + 0x48], xmm0
movups xmm0, xmmword [rsp + 0x70]
movups xmmword [rsi + 0x58], xmm0
movups xmm0, xmmword [rsp + 0x80]
movups xmmword [rsi + 0x68], xmm0
mov dword [rsi], 0x22
add rsp, 0x90
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
Function at 0x1400db720
Capabilities:
Encode data using xor

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rbx, r8
mov rsi, rcx
mov r14, r8
sub r14, rdx
shr r14, 3
sub rbx, rdx
je 0x1400db781
movabs rax, 0x7ffffffffffffff9
cmp rbx, rax
jae 0x1400db8c4
mov rdi, rdx
movzx eax, byte [0x1401c3bd1]
mov edx, 4
mov rcx, rbx
call fcn.140007260
test rax, rax
je 0x1400db8cb
cmp rbx, 0x80
jae 0x1400db78d
xor ecx, ecx
jmp 0x1400db82a
xor ecx, ecx
mov eax, 4
jmp 0x1400db8ac
lea rdx, [rax + r14*8]
add rdx, 0xfffffffffffffff8
xor ecx, ecx
cmp rdx, rax
jb 0x1400db82a
lea rdx, [rax + r14*8]
add rdx, 0xfffffffffffffffc
mov r8, rax
add r8, 4
cmp rdx, r8
jb 0x1400db82a
lea rdx, [r14 - 1]
shr rdx, 0x3d
jne 0x1400db82a
mov rcx, r14
and rcx, 0xfffffffffffffffe
xor edx, edx
movdqa xmm0, xmmword [0x14011e750]
nop
movdqu xmm1, xmmword [rdi + rdx*8]
pshufd xmm2, xmm1, 0xe8
pshufd xmm1, xmm1, 0xed
movdqa xmm3, xmm2
pxor xmm3, xmm0
movdqa xmm4, xmm1
pxor xmm4, xmm0
pcmpgtd xmm4, xmm3
movdqa xmm3, xmm4
pandn xmm3, xmm1
movdqa xmm5, xmm4
pandn xmm5, xmm2
pand xmm2, xmm4
por xmm2, xmm3
pand xmm4, xmm1
por xmm4, xmm5
punpckldq xmm2, xmm4
movdqu xmmword [rax + rdx*8], xmm2
add rdx, 2
cmp rcx, rdx
jne 0x1400db7d0
cmp r14, rcx
je 0x1400db8a9
mov rdx, rcx
or rdx, 1
test bl, 8
je 0x1400db859
mov r8d, dword [rdi + rcx*8]
mov r9d, dword [rdi + rcx*8 + 4]
cmp r8d, r9d
mov r10d, r9d
cmovb r10d, r8d
cmova r9d, r8d
mov dword [rax + rcx*8], r10d
mov dword [rax + rcx*8 + 4], r9d
mov rcx, rdx
cmp r14, rdx
je 0x1400db8a9
nop
mov edx, dword [rdi + rcx*8]
mov r8d, dword [rdi + rcx*8 + 4]
cmp edx, r8d
mov r9d, r8d
cmovb r9d, edx
cmova r8d, edx
mov dword [rax + rcx*8], r9d
mov dword [rax + rcx*8 + 4], r8d
mov edx, dword [rdi + rcx*8 + 8]
mov r8d, dword [rdi + rcx*8 + 0xc]
cmp edx, r8d
mov r9d, r8d
cmovb r9d, edx
cmova r8d, edx
mov dword [rax + rcx*8 + 8], r9d
mov dword [rax + rcx*8 + 0xc], r8d
add rcx, 2
cmp r14, rcx
jne 0x1400db860
mov rcx, r14
mov qword [rsi], rax
mov qword [rsi + 8], r14
mov qword [rsi + 0x10], rcx
mov rax, rsi
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret
call fcn.1400f88d0
ud2
mov ecx, 4
mov rdx, rbx
call fcn.140114490
ud2
Function at 0x1400dfe30
Capabilities:
Encode data using xor

Disassembly:
push rbp
push rsi
sub rsp, 0x68
lea rbp, [rsp + 0x60]
mov qword [rbp], 0xfffffffffffffffe
mov rsi, rcx
movzx eax, byte [0x1401c3bd1]
mov ecx, 0x1818
mov edx, 4
call fcn.140007260
test rax, rax
je 0x1400dff4e
xor ecx, ecx
lea rdx, [0x140156460]
movdqa xmm0, xmmword [0x14011e750]
nop word cs:[rax + rax]
movdqu xmm1, xmmword [rcx + rdx]
pshufd xmm2, xmm1, 0xe8
pshufd xmm1, xmm1, 0xed
movdqa xmm3, xmm2
pxor xmm3, xmm0
movdqa xmm4, xmm1
pxor xmm4, xmm0
pcmpgtd xmm4, xmm3
movdqa xmm3, xmm4
pandn xmm3, xmm1
movdqa xmm5, xmm4
pandn xmm5, xmm2
pand xmm2, xmm4
por xmm2, xmm3
pand xmm4, xmm1
por xmm4, xmm5
punpckldq xmm2, xmm4
movdqu xmmword [rax + rcx], xmm2
add rcx, 0x10
cmp rcx, 0x1810
jne 0x1400dfe80
movabs rcx, 0xe01ef000e0100
mov qword [rax + 0x1810], rcx
mov rcx, rax
add rcx, 0x1818
mov qword [rbp - 0x20], rax
mov qword [rbp - 0x18], 0x303
mov qword [rbp - 0x10], rax
mov qword [rbp - 8], rcx
lea rcx, [rbp - 0x38]
lea rdx, [rbp - 0x20]
call fcn.1400d8b00
mov rax, qword [rbp - 0x28]
test rax, rax
mov qword [rbp - 0x10], rax
movups xmm0, xmmword [rbp - 0x38]
movaps xmmword [rbp - 0x20], xmm0
sete byte [rbp - 8]
lea rcx, [rbp - 0x20]
call fcn.1400e63f0
movaps xmm0, xmmword [rbp - 0x20]
movaps xmm1, xmmword [rbp - 0x10]
movups xmmword [rsi + 0x10], xmm1
movups xmmword [rsi], xmm0
mov rax, rsi
add rsp, 0x68
pop rsi
pop rbp
ret
mov ecx, 4
mov edx, 0x1818
call fcn.140114490
ud2

Function at 0x1400e00c0
Capabilities:
Encode data using xor

Disassembly:
push rbp
push rsi
sub rsp, 0x68
lea rbp, [rsp + 0x60]
mov qword [rbp], 0xfffffffffffffffe
mov rsi, rcx
movzx eax, byte [0x1401c3bd1]
mov ecx, 0x200
mov edx, 4
call fcn.140007260
test rax, rax
je 0x1400e01cd
xor ecx, ecx
lea rdx, [0x140157cc8]
movdqa xmm0, xmmword [0x14011e750]
nop word cs:[rax + rax]
movdqu xmm1, xmmword [rcx + rdx]
pshufd xmm2, xmm1, 0xe8
pshufd xmm1, xmm1, 0xed
movdqa xmm3, xmm2
pxor xmm3, xmm0
movdqa xmm4, xmm1
pxor xmm4, xmm0
pcmpgtd xmm4, xmm3
movdqa xmm3, xmm4
pandn xmm3, xmm1
movdqa xmm5, xmm4
pandn xmm5, xmm2
pand xmm2, xmm4
por xmm2, xmm3
pand xmm4, xmm1
por xmm4, xmm5
punpckldq xmm2, xmm4
movdqu xmmword [rax + rcx], xmm2
add rcx, 0x10
cmp rcx, 0x200
jne 0x1400e0110
mov rcx, rax
add rcx, 0x200
mov qword [rbp - 0x20], rax
mov qword [rbp - 0x18], 0x40
mov qword [rbp - 0x10], rax
mov qword [rbp - 8], rcx
lea rcx, [rbp - 0x38]
lea rdx, [rbp - 0x20]
call fcn.1400d8b00
mov rax, qword [rbp - 0x28]
test rax, rax
mov qword [rbp - 0x10], rax
movups xmm0, xmmword [rbp - 0x38]
movaps xmmword [rbp - 0x20], xmm0
sete byte [rbp - 8]
lea rcx, [rbp - 0x20]
call fcn.1400e63f0
movaps xmm0, xmmword [rbp - 0x20]
movaps xmm1, xmmword [rbp - 0x10]
movups xmmword [rsi + 0x10], xmm1
movups xmmword [rsi], xmm0
mov rax, rsi
add rsp, 0x68
pop rsi
pop rbp
ret
mov ecx, 4
mov edx, 0x200
call fcn.140114490
ud2
Function at 0x1400e65b0
Capabilities:
Read clipboard data

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x58
lea rbp, [rsp + 0x50]
mov qword [rbp], 0xfffffffffffffffe
mov rbx, rdx
mov rsi, rcx
mov ecx, 0xd
call qword [sym.imp.USER32.dll_GetClipboardData]
test rax, rax
je 0x1400e66ec
mov rdi, rax
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GlobalLock]
test rax, rax
je 0x1400e66ec
mov r14, rax
mov qword [rbp - 8], rbx
mov qword [rbp - 0x10], rdi
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GlobalSize]
mov r15, rax
shr r15, 1
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov ecx, 0xfde9
xor edx, edx
mov r8, r14
mov r9d, r15d
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov r13d, eax
test eax, eax
je 0x1400e671c
mov rcx, qword [rbp - 8]
mov rax, qword [rcx + 8]
mov rbx, qword [rcx + 0x10]
movsxd r12, r13d
sub rax, rbx
cmp rax, r12
jae 0x1400e6673
mov rcx, qword [rbp - 8]
mov rdx, rbx
mov r8, r12
call fcn.14010f220
mov rax, qword [rbp - 8]
mov rdi, qword [rax]
lea rax, [rdi + rbx]
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
mov dword [rsp + 0x28], r13d
mov qword [rsp + 0x20], rax
mov ecx, 0xfde9
xor edx, edx
mov r8, r14
mov r9d, r15d
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
lea rax, [rbx + r12]
mov rdx, qword [rbp - 8]
mov qword [rdx + 0x10], rax
test rbx, rbx
je 0x1400e66bd
lea rcx, [rbx - 1]
cmp rax, rcx
jbe 0x1400e6700
lea rcx, [rbx - 1]
nop word cs:[rax + rax]
test r12, r12
je 0x1400e6700
lea r14, [rcx + 1]
dec r12
cmp byte [rdi + rcx + 1], 0
mov rcx, r14
jne 0x1400e66d0
mov qword [rdx + 0x10], r14
jmp 0x1400e6703
call sub.KERNEL32.dll_GetLastError
mov rcx, qword [0x1401c3048]
mov qword [rsi], rcx
mov dword [rsi + 8], eax
jmp 0x1400e6737
mov r14, rax
mov rcx, qword [rbp - 0x10]
call sub.KERNEL32.dll_GlobalUnlock
sub r14, rbx
mov qword [rsi + 8], r14
mov qword [rsi], 0
jmp 0x1400e6737
call sub.KERNEL32.dll_GetLastError
mov rcx, qword [0x1401c3048]
mov qword [rsi], rcx
mov dword [rsi + 8], eax
mov rcx, qword [rbp - 0x10]
call sub.KERNEL32.dll_GlobalUnlock
mov rax, rsi
add rsp, 0x58
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
Function at 0x1400e6790
Capabilities:
Write clipboard data

Disassembly:
push rbp
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x48
lea rbp, [rsp + 0x40]
mov qword [rbp], 0xfffffffffffffffe
mov rsi, rdx
mov rdi, rcx
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov ecx, 0xfde9
xor edx, edx
mov r8, rdi
mov r9d, esi
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov ebx, eax
test rsi, rsi
je 0x1400e67f1
test ebx, ebx
jne 0x1400e67f1
mov rdi, qword [0x1401c3048]
call sub.KERNEL32.dll_GetLastError
mov esi, eax
jmp 0x1400e6890
movsxd r15, ebx
lea rdx, [r15*2 + 2]
mov ecx, 0x42
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
test rax, rax
je 0x1400e68b1
mov qword [rbp - 8], rax
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GlobalLock]
mov r14, rax
test rax, rax
je 0x1400e6878
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], r14
mov ecx, 0xfde9
xor edx, edx
mov r8, rdi
mov r9d, esi
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov word [r14 + r15*2], 0
mov rcx, qword [rbp - 8]
call sub.KERNEL32.dll_GlobalUnlock
call qword [sym.imp.USER32.dll_EmptyClipboard]
test eax, eax
jne 0x1400e6860
call sub.KERNEL32.dll_GetLastError
mov ecx, 0xd
mov rdx, qword [rbp - 8]
call qword [sym.imp.USER32.dll_SetClipboardData]
test rax, rax
je 0x1400e68a2
xor edi, edi
jmp 0x1400e6890
call sub.KERNEL32.dll_GetLastError
mov esi, eax
mov rcx, qword [rbp - 8]
call qword [sym.imp.KERNEL32.dll_GlobalFree]
mov rdi, qword [0x1401c3048]
mov rax, rdi
mov edx, esi
add rsp, 0x48
pop rbx
pop rdi
pop rsi
pop r14
pop r15
pop rbp
ret
mov rcx, qword [rbp - 8]
call qword [sym.imp.KERNEL32.dll_GlobalFree]
jmp 0x1400e67de
call fcn.140113750
mov rdi, rax
mov esi, edx
jmp 0x1400e6890
Function at 0x1400e91a0
Capabilities:
Get common file path

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x478
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x3f0], 0xfffffffffffffffe
mov qword [rbp + 0x3e0], rcx
mov qword [rbp + 0x3c8], 2
xorps xmm0, xmm0
movups xmmword [rbp + 0x3d0], xmm0
mov r8d, 0x200
mov eax, 2
mov qword [rbp + 0x3e8], rax
xor edi, edi
xor ebx, ebx
xor r12d, r12d
cmp r8, 0x201
jae 0x1400e9230
jmp 0x1400e921f
jae 0x1400e92f0
cmp r8, 0x201
jae 0x1400e9230
mov esi, 0x200
lea r13, [rbp - 0x58]
mov r15, r8
jmp 0x1400e9288
sub r8, r12
sub rbx, r12
cmp rbx, r8
jae 0x1400e925f
lea rcx, [rbp + 0x3c8]
mov rdx, r12
call fcn.1401138e0
mov rax, qword [rbp + 0x3c8]
mov qword [rbp + 0x3e8], rax
mov rdi, qword [rbp + 0x3d0]
mov eax, 0xffffffff
cmp rdi, rax
mov r12d, 0xffffffff
cmovb r12, rdi
mov qword [rbp + 0x3d8], r12
mov rbx, rdi
mov rsi, r12
mov r13, qword [rbp + 0x3e8]
mov r15, r12
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov ecx, r15d
mov rdx, r13
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov r14d, eax
test eax, eax
jne 0x1400e92b1
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x1400e9358
mov r8d, r14d
cmp r15, r8
jne 0x1400e9210
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x1400e937b
add r15, r15
mov eax, 0xffffffff
cmp r15, rax
cmovae r15, rax
mov r8, r15
cmp r8, 0x201
jb 0x1400e921f
jmp 0x1400e9230
cmp rsi, r8
jb 0x1400e9395
lea rcx, [rbp + 0x3a8]
mov rdx, r13
call fcn.1400ea8c0
movups xmm0, xmmword [rbp + 0x3a8]
movups xmm1, xmmword [rbp + 0x3b8]
mov rsi, qword [rbp + 0x3e0]
movups xmmword [rsi + 0x10], xmm1
movups xmmword [rsi], xmm0
test rdi, rdi
je 0x1400e9341
add rdi, rdi
mov r8d, 2
mov rcx, qword [rbp + 0x3e8]
mov rdx, rdi
call fcn.140007270
mov rax, rsi
add rsp, 0x478
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
shl rax, 0x20
or rax, 2
mov rsi, qword [rbp + 0x3e0]
mov qword [rsi], rax
mov byte [rsi + 0x18], 2
test rdi, rdi
jne 0x1400e9329
jmp 0x1400e9341
lea rcx, str.internal_error:_entered_unreachable_code_rustc_82e1608dfa6e0b5569232559e3d385fea5a93112library_alloc_src_vecmod.rs
lea r8, str.library_std_src_syswindowsmod.rs
mov edx, 0x28
call fcn.140114790
jmp 0x1400e93aa
lea rax, str.library_std_src_syswindowsmod.rs
mov rcx, r8
mov rdx, rsi
mov r8, rax
call fcn.140114c20
ud2