joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140137570
Capabilities:
Set socket configuration

Disassembly:
mov byte [rsp + 0x10], dl
mov qword [rsp + 8], rcx
sub rsp, 0x38
mov rax, qword [0x140298e80]
xor rax, rsp
mov qword [rsp + 0x28], rax
movzx eax, byte [rsp + 0x48]
test eax, eax
je 0x14013759f
mov dword [rsp + 0x20], 1
jmp 0x1401375a7
mov dword [rsp + 0x20], 0
mov eax, dword [rsp + 0x20]
mov dword [rsp + 0x24], eax
lea r8, [rsp + 0x24]
mov edx, 0x8004667e
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.WS2_32.dll_ioctlsocket]
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.1401dae20
add rsp, 0x38
ret

Function at 0x140137df0
Capabilities:
Hash data using fnv

Disassembly:
mov byte [rsp + 0x10], dl
mov dword [rsp + 8], ecx
movsx eax, byte [rsp + 0x10]
mov ecx, dword [rsp + 8]
xor ecx, eax
mov eax, ecx
mov eax, eax
imul rax, rax, 0x1000193
ret
Function at 0x140149e70
Capabilities:
Terminate process

Disassembly:
sub rsp, 0x88
mov byte [rsp + 0x22], 1
mov byte [rsp + 0x21], 0
mov byte [rsp + 0x20], 1
movzx r8d, byte [rsp + 0x20]
movzx edx, byte [rsp + 0x21]
movzx ecx, byte [rsp + 0x22]
call fcn.140144770
movzx eax, al
test eax, eax
jne 0x140149f2f
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x23]
call fcn.140143960
mov rcx, rax
call fcn.1401434c0
xor r9d, r9d
xor r8d, r8d
mov rdx, rax
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
mov rax, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
mov qword [rsp + 0x30], rax
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x24]
call fcn.140143ba0
mov rcx, rax
call fcn.1401434c0
mov qword [rsp + 0x28], rax
mov rdx, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x30]
call fcn.14001d420
mov qword [rsp + 0x38], rax
lea rdx, [0x140021930]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov ecx, 0x1388
call qword [sym.imp.KERNEL32.dll_Sleep]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
xor r8d, r8d
movabs rdx, 0x300000800000000
mov rcx, qword [0x1402b0cd0]
call sub.VMM.dll_VMMDLL_ConfigSet
xor r8d, r8d
movabs rdx, 0x300000700000000
mov rcx, qword [0x1402b0cd0]
call sub.VMM.dll_VMMDLL_ConfigSet
xor r8d, r8d
movabs rdx, 0x300000500000000
mov rcx, qword [0x1402b0cd0]
call sub.VMM.dll_VMMDLL_ConfigSet
xor r8d, r8d
movabs rdx, 0x300000600000000
mov rcx, qword [0x1402b0cd0]
call sub.VMM.dll_VMMDLL_ConfigSet
xor r8d, r8d
movabs rdx, 0x2000000300000000
mov rcx, qword [0x1402b0cd0]
call sub.VMM.dll_VMMDLL_ConfigSet
mov r8d, 0x7fffffff
movabs rdx, 0x2000000700000000
mov rcx, qword [0x1402b0cd0]
call sub.VMM.dll_VMMDLL_ConfigSet
mov r8d, 0x7fffffff
movabs rdx, 0x2000000800000000
mov rcx, qword [0x1402b0cd0]
call sub.VMM.dll_VMMDLL_ConfigSet
add rsp, 0x88
ret
Function at 0x140154690
Capabilities:
Connect socket
Resolve dns

Disassembly:
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
sub rsp, 0xa8
mov rax, qword [0x140298e80]
xor rax, rsp
mov qword [rsp + 0x90], rax
mov qword [rsp + 0x28], 0xffffffffffffffff
mov r8d, Ordinal_50
xor edx, edx
lea rcx, [rsp + 0x50]
call sub.VCRUNTIME140.dll_memset
mov dword [rsp + 0x54], 0
mov dword [rsp + 0x58], 1
mov r9d, dword [rsp + 0xb8]
lea r8, [0x140216184]
mov edx, reloc.WS2_32.dll_recv
lea rcx, [rsp + 0x80]
call fcn.140151c10
mov rcx, qword [rsp + 0xb0]
call fcn.140016800
lea r9, [rsp + 0x48]
lea r8, [rsp + 0x50]
lea rdx, [rsp + 0x80]
mov rcx, rax
call qword [sym.imp.WS2_32.dll_getaddrinfo]
mov dword [rsp + 0x30], eax
cmp dword [rsp + 0x30], 0
je 0x14015476f
mov ecx, dword [rsp + 0x30]
call fcn.140155310
mov qword [rsp + 0x38], rax
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov qword [rsp + 0x40], rax
mov r8, qword [rsp + 0x38]
lea rdx, str.getaddrinfo:__s_n
mov rcx, qword [rsp + 0x40]
call fcn.140099e80
mov eax, 1
jmp 0x140154809
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x20], rax
jmp 0x140154789
mov rax, qword [rsp + 0x20]
mov rax, qword [rax + 0x28]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
je 0x1401547f9
mov rax, qword [rsp + 0x20]
mov r8d, dword [rax + 0xc]
mov rax, qword [rsp + 0x20]
mov edx, dword [rax + 8]
mov rax, qword [rsp + 0x20]
mov ecx, dword [rax + 4]
call qword [sym.imp.WS2_32.dll_socket]
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0xffffffffffffffff
jne 0x1401547bf
jmp 0x14015477b
mov rax, qword [rsp + 0x20]
mov r8d, dword [rax + 0x10]
mov rax, qword [rsp + 0x20]
mov rdx, qword [rax + 0x20]
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
je 0x1401547e3
jmp 0x1401547f9
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.WS2_32.dll_closesocket]
mov qword [rsp + 0x28], 0xffffffffffffffff
jmp 0x14015477b
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.WS2_32.dll_freeaddrinfo]
mov rax, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x90]
xor rcx, rsp
call fcn.1401dae20
add rsp, 0xa8
ret
Function at 0x1401558a0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x58
mov rax, qword [0x140298e80]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov rcx, qword [rsp + 0x68]
call sub.api_ms_win_crt_string_l1_1_0.dll_strlen
mov dword [rsp + 0x30], eax
mov rax, qword [rsp + 0x60]
mov rax, qword [rax + 8]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x40]
mov r8d, dword [rsp + 0x30]
mov rdx, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x140155907
mov eax, 0xffffffff
jmp 0x14015590c
mov eax, 1
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1401dae20
add rsp, 0x58
ret
Function at 0x140156800
Capabilities:
Log keystrokes via polling

Disassembly:
cmp dword [0x1402b8a60], 0
jne 0x140156815
xor edx, edx
mov ecx, 0x10001
jmp fcn.1401559f0
jmp 0x140158b50
push rbx
sub rsp, 0xa0
mov rax, qword [0x140298e80]
xor rax, rsp
mov qword [rsp + 0x80], rax
xor r9d, r9d
mov dword [rsp + 0x20], 1
xor r8d, r8d
lea rcx, [rsp + 0x30]
xor edx, edx
call qword [sym.imp.USER32.dll_PeekMessageW]
test eax, eax
je 0x140158bea
nop word [rax + rax]
cmp dword [rsp + 0x38], 0x12
jne 0x140158bb5
mov rbx, qword [0x1402b8e50]
test rbx, rbx
je 0x140158bcb
mov rcx, rbx
call fcn.140155fa0
mov rbx, qword [rbx]
test rbx, rbx
jne 0x140158ba3
jmp 0x140158bcb
lea rcx, [rsp + 0x30]
call qword [sym.imp.USER32.dll_TranslateMessage]
lea rcx, [rsp + 0x30]
call qword [sym.imp.USER32.dll_DispatchMessageW]
xor r9d, r9d
mov dword [rsp + 0x20], 1
xor r8d, r8d
lea rcx, [rsp + 0x30]
xor edx, edx
call qword [sym.imp.USER32.dll_PeekMessageW]
test eax, eax
jne 0x140158b90
call qword [sym.imp.USER32.dll_GetActiveWindow]
test rax, rax
je 0x140158ce7
lea rdx, str.GLFW
mov qword [rsp + 0xc0], rdi
mov rcx, rax
call qword [sym.imp.USER32.dll_GetPropW]
mov rdi, rax
test rax, rax
je 0x140158cdf
movdqa xmm0, xmmword [0x14022f720]
xor ebx, ebx
movdqa xmm1, xmmword [0x14022f730]
mov qword [rsp + 0xb0], rbp
mov qword [rsp + 0xb8], rsi
mov qword [rsp + 0xc8], r12
mov qword [rsp + 0x98], r14
mov qword [rsp + 0x90], r15
lea r15, [0x1402ba538]
movdqu xmmword [rsp + 0x60], xmm0
movdqu xmmword [rsp + 0x70], xmm1
nop word [rax + rax]
movsxd rbp, dword [rsp + rbx*8 + 0x64]
mov ecx, dword [rsp + rbx*8 + 0x60]
movsx r14d, word [r15 + rbp*2]
call qword [sym.imp.USER32.dll_GetKeyState]
bt ax, 0xf
jb 0x140158cae
cmp byte [rbp + rdi + 0x88], 1
jne 0x140158cae
call fcn.14015a130
xor r9d, r9d
mov dword [rsp + 0x20], eax
mov r8d, r14d
mov edx, ebp
mov rcx, rdi
call fcn.1401570c0
inc rbx
cmp rbx, 4
jl 0x140158c70
mov r15, qword [rsp + 0x90]
mov r14, qword [rsp + 0x98]
mov r12, qword [rsp + 0xc8]
mov rsi, qword [rsp + 0xb8]
mov rbp, qword [rsp + 0xb0]
mov rdi, qword [rsp + 0xc0]
mov rbx, qword [0x1402baed8]
test rbx, rbx
je 0x140158d6c
mov rcx, qword [rbx + 0x350]
lea rdx, [rsp + 0x60]
call qword [sym.imp.USER32.dll_GetClientRect]
mov eax, dword [rsp + 0x68]
mov r8d, dword [rsp + 0x6c]
cdq
sub eax, edx
sar eax, 1
mov r9d, eax
cmp dword [rbx + 0x388], eax
jne 0x140158d2e
mov eax, r8d
cdq
sub eax, edx
sar eax, 1
cmp dword [rbx + 0x38c], eax
je 0x140158d6c
mov rcx, qword [rbx + 0x350]
mov eax, r8d
cdq
mov dword [rsp + 0x60], r9d
sub eax, edx
mov dword [rbx + 0x388], r9d
sar eax, 1
lea rdx, [rsp + 0x60]
mov dword [rsp + 0x64], eax
mov dword [rbx + 0x38c], eax
call qword [sym.imp.USER32.dll_ClientToScreen]
mov edx, dword [rsp + 0x64]
mov ecx, dword [rsp + 0x60]
call qword [sym.imp.USER32.dll_SetCursorPos]
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.1401dae20
add rsp, 0xa0
pop rbx
ret
Function at 0x140156820
Capabilities:
Resolve function by parsing pe exports

Disassembly:
cmp dword [0x1402b8a60], 0
mov r10d, r9d
mov r11d, r8d
jne 0x14015683b
xor edx, edx
mov ecx, 0x10001
jmp fcn.1401559f0
mov r8d, dword [rsp + 0x28]
mov r9d, dword [rsp + 0x30]
test r8d, r8d
jle 0x140156890
test r9d, r9d
jle 0x140156890
mov eax, dword [rsp + 0x38]
cmp eax, 0xfffffffe
jg 0x14015686c
mov r8d, eax
lea rdx, str.Invalid_refresh_rate__i
mov ecx, 0x10004
jmp fcn.1401559f0
mov dword [rsp + 0x38], eax
mov dword [rsp + 0x30], r9d
mov dword [rsp + 0x28], r8d
mov dword [rcx + 0x2c], r8d
mov r8d, r11d
mov dword [rcx + 0x30], r9d
mov r9d, r10d
mov dword [rcx + 0x40], eax
jmp fcn.140159070
lea rdx, str.Invalid_window_size__ix_i
mov ecx, 0x10004
jmp fcn.1401559f0

Function at 0x140157470
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
sub rsp, 0x28
cmp dword [0x1402b8a60], 0
jne 0x140157490
xor edx, edx
mov ecx, 0x10001
call fcn.1401559f0
xor eax, eax
add rsp, 0x28
ret
add rsp, 0x28
jmp 0x1401587c0
sub rsp, 0x28
mov rcx, qword [0x1402ba118]
call qword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
jne 0x1401587ed
lea rdx, str.Win32:_Failed_to_open_clipboard
mov ecx, 0x10008
call fcn.14015cc00
xor eax, eax
add rsp, 0x28
ret
mov ecx, reloc.WS2_32.dll_listen
mov qword [rsp + 0x30], rbx
call qword [sym.imp.USER32.dll_GetClipboardData]
mov rbx, rax
test rax, rax
jne 0x140158828
lea rdx, str.Win32:_Failed_to_convert_clipboard_to_string
mov ecx, 0x10009
call fcn.14015cc00
call qword [sym.imp.USER32.dll_CloseClipboard]
mov rbx, qword [rsp + 0x30]
xor eax, eax
add rsp, 0x28
ret
mov rcx, rbx
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_GlobalLock]
mov rdi, rax
test rax, rax
jne 0x140158866
lea rdx, str.Win32:_Failed_to_lock_global_handle
mov ecx, 0x10008
call fcn.14015cc00
call qword [sym.imp.USER32.dll_CloseClipboard]
mov rdi, qword [rsp + 0x20]
xor eax, eax
mov rbx, qword [rsp + 0x30]
add rsp, 0x28
ret
mov rcx, qword [0x1402ba130]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rcx, rdi
call fcn.14015ca50
mov rcx, rbx
mov qword [0x1402ba130], rax
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
call qword [sym.imp.USER32.dll_CloseClipboard]
mov rax, qword [0x1402ba130]
mov rdi, qword [rsp + 0x20]
mov rbx, qword [rsp + 0x30]
add rsp, 0x28
ret
Function at 0x140157850
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
cmp dword [0x1402b8a60], 0
jne 0x140157865
xor edx, edx
mov ecx, 0x10001
jmp fcn.1401559f0
mov rcx, rdx
jmp 0x140158da0
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
xor eax, eax
mov rsi, rcx
mov r8, rcx
mov dword [rsp + 0x28], eax
xor edx, edx
mov qword [rsp + 0x20], rax
mov ecx, 0xfde9
lea r9d, [rax - 1]
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
movsxd rdi, eax
test eax, eax
je 0x140158eae
mov rdx, rdi
mov qword [rsp + 0x40], rbx
add rdx, rdx
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov rbx, rax
test rax, rax
jne 0x140158e15
lea rdx, str.Win32:_Failed_to_allocate_global_handle_for_clipboard
mov ecx, 0x10008
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
jmp fcn.14015cc00
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GlobalLock]
test rax, rax
jne 0x140158e2c
lea rdx, str.Win32:_Failed_to_lock_global_handle
jmp 0x140158e6c
mov dword [rsp + 0x28], edi
mov r9d, 0xffffffff
mov r8, rsi
mov qword [rsp + 0x20], rax
xor edx, edx
mov ecx, 0xfde9
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov rcx, qword [0x1402ba118]
call qword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
jne 0x140158e8f
lea rdx, str.Win32:_Failed_to_open_clipboard
mov ecx, 0x10008
call fcn.14015cc00
mov rcx, rbx
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
jmp qword [sym.imp.KERNEL32.dll_GlobalFree]
call qword [sym.imp.USER32.dll_EmptyClipboard]
mov rdx, rbx
mov ecx, reloc.WS2_32.dll_listen
call qword [sym.imp.USER32.dll_SetClipboardData]
call qword [sym.imp.USER32.dll_CloseClipboard]
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
Function at 0x1401584d0
Capabilities:
Hide graphical window

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rdi, r8
mov rbp, r9
mov r8, r9
mov rsi, rdx
mov rbx, rcx
call fcn.140159980
test eax, eax
je 0x140158623
cmp dword [rdi], 0
je 0x140158591
mov eax, dword [rdi + 4]
cmp eax, 0x36001
jne 0x140158530
call fcn.1401602e0
test eax, eax
je 0x140158623
mov r8, rbp
mov rdx, rdi
mov rcx, rbx
call fcn.14015fe60
jmp 0x140158576
cmp eax, 0x36002
jne 0x140158554
call fcn.1401616e0
test eax, eax
je 0x140158623
mov r8, rbp
mov rdx, rdi
mov rcx, rbx
call fcn.1401611d0
jmp 0x140158576
cmp eax, 0x36003
jne 0x14015857e
call fcn.140162520
test eax, eax
je 0x140158623
mov r8, rbp
mov rdx, rdi
mov rcx, rbx
call fcn.1401622e0
test eax, eax
je 0x140158623
mov rdx, rdi
mov rcx, rbx
call fcn.14015c0f0
test eax, eax
je 0x140158623
cmp qword [rbx + 0x48], 0
je 0x1401585f6
mov rcx, qword [rbx + 0x350]
mov edx, 8
call qword [sym.imp.USER32.dll_ShowWindow]
mov rcx, qword [rbx + 0x350]
call qword [sym.imp.USER32.dll_BringWindowToTop]
mov rcx, qword [rbx + 0x350]
call qword [sym.imp.USER32.dll_SetForegroundWindow]
mov rcx, qword [rbx + 0x350]
call qword [sym.imp.USER32.dll_SetFocus]
mov rcx, rbx
call fcn.140159740
mov rcx, rbx
call fcn.14015a090
cmp dword [rsi + 0x2c], 0
je 0x14015861c
mov rcx, rbx
call fcn.140156db0
mov eax, 1
jmp 0x140158625
cmp dword [rsi + 0x14], 0
je 0x14015861c
mov rcx, qword [rbx + 0x350]
mov edx, 8
call qword [sym.imp.USER32.dll_ShowWindow]
cmp dword [rsi + 0x1c], 0
je 0x14015861c
mov rcx, rbx
call fcn.140158700
mov eax, 1
jmp 0x140158625
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x1401587c0
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
sub rsp, 0x28
cmp dword [0x1402b8a60], 0
jne 0x140157490
xor edx, edx
mov ecx, 0x10001
call fcn.1401559f0
xor eax, eax
add rsp, 0x28
ret
add rsp, 0x28
jmp 0x1401587c0
sub rsp, 0x28
mov rcx, qword [0x1402ba118]
call qword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
jne 0x1401587ed
lea rdx, str.Win32:_Failed_to_open_clipboard
mov ecx, 0x10008
call fcn.14015cc00
xor eax, eax
add rsp, 0x28
ret
mov ecx, reloc.WS2_32.dll_listen
mov qword [rsp + 0x30], rbx
call qword [sym.imp.USER32.dll_GetClipboardData]
mov rbx, rax
test rax, rax
jne 0x140158828
lea rdx, str.Win32:_Failed_to_convert_clipboard_to_string
mov ecx, 0x10009
call fcn.14015cc00
call qword [sym.imp.USER32.dll_CloseClipboard]
mov rbx, qword [rsp + 0x30]
xor eax, eax
add rsp, 0x28
ret
mov rcx, rbx
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_GlobalLock]
mov rdi, rax
test rax, rax
jne 0x140158866
lea rdx, str.Win32:_Failed_to_lock_global_handle
mov ecx, 0x10008
call fcn.14015cc00
call qword [sym.imp.USER32.dll_CloseClipboard]
mov rdi, qword [rsp + 0x20]
xor eax, eax
mov rbx, qword [rsp + 0x30]
add rsp, 0x28
ret
mov rcx, qword [0x1402ba130]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rcx, rdi
call fcn.14015ca50
mov rcx, rbx
mov qword [0x1402ba130], rax
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
call qword [sym.imp.USER32.dll_CloseClipboard]
mov rax, qword [0x1402ba130]
mov rdi, qword [rsp + 0x20]
mov rbx, qword [rsp + 0x30]
add rsp, 0x28
ret
Function at 0x140158b50
Capabilities:
Log keystrokes via polling

Disassembly:
cmp dword [0x1402b8a60], 0
jne 0x140156815
xor edx, edx
mov ecx, 0x10001
jmp fcn.1401559f0
jmp 0x140158b50
push rbx
sub rsp, 0xa0
mov rax, qword [0x140298e80]
xor rax, rsp
mov qword [rsp + 0x80], rax
xor r9d, r9d
mov dword [rsp + 0x20], 1
xor r8d, r8d
lea rcx, [rsp + 0x30]
xor edx, edx
call qword [sym.imp.USER32.dll_PeekMessageW]
test eax, eax
je 0x140158bea
nop word [rax + rax]
cmp dword [rsp + 0x38], 0x12
jne 0x140158bb5
mov rbx, qword [0x1402b8e50]
test rbx, rbx
je 0x140158bcb
mov rcx, rbx
call fcn.140155fa0
mov rbx, qword [rbx]
test rbx, rbx
jne 0x140158ba3
jmp 0x140158bcb
lea rcx, [rsp + 0x30]
call qword [sym.imp.USER32.dll_TranslateMessage]
lea rcx, [rsp + 0x30]
call qword [sym.imp.USER32.dll_DispatchMessageW]
xor r9d, r9d
mov dword [rsp + 0x20], 1
xor r8d, r8d
lea rcx, [rsp + 0x30]
xor edx, edx
call qword [sym.imp.USER32.dll_PeekMessageW]
test eax, eax
jne 0x140158b90
call qword [sym.imp.USER32.dll_GetActiveWindow]
test rax, rax
je 0x140158ce7
lea rdx, str.GLFW
mov qword [rsp + 0xc0], rdi
mov rcx, rax
call qword [sym.imp.USER32.dll_GetPropW]
mov rdi, rax
test rax, rax
je 0x140158cdf
movdqa xmm0, xmmword [0x14022f720]
xor ebx, ebx
movdqa xmm1, xmmword [0x14022f730]
mov qword [rsp + 0xb0], rbp
mov qword [rsp + 0xb8], rsi
mov qword [rsp + 0xc8], r12
mov qword [rsp + 0x98], r14
mov qword [rsp + 0x90], r15
lea r15, [0x1402ba538]
movdqu xmmword [rsp + 0x60], xmm0
movdqu xmmword [rsp + 0x70], xmm1
nop word [rax + rax]
movsxd rbp, dword [rsp + rbx*8 + 0x64]
mov ecx, dword [rsp + rbx*8 + 0x60]
movsx r14d, word [r15 + rbp*2]
call qword [sym.imp.USER32.dll_GetKeyState]
bt ax, 0xf
jb 0x140158cae
cmp byte [rbp + rdi + 0x88], 1
jne 0x140158cae
call fcn.14015a130
xor r9d, r9d
mov dword [rsp + 0x20], eax
mov r8d, r14d
mov edx, ebp
mov rcx, rdi
call fcn.1401570c0
inc rbx
cmp rbx, 4
jl 0x140158c70
mov r15, qword [rsp + 0x90]
mov r14, qword [rsp + 0x98]
mov r12, qword [rsp + 0xc8]
mov rsi, qword [rsp + 0xb8]
mov rbp, qword [rsp + 0xb0]
mov rdi, qword [rsp + 0xc0]
mov rbx, qword [0x1402baed8]
test rbx, rbx
je 0x140158d6c
mov rcx, qword [rbx + 0x350]
lea rdx, [rsp + 0x60]
call qword [sym.imp.USER32.dll_GetClientRect]
mov eax, dword [rsp + 0x68]
mov r8d, dword [rsp + 0x6c]
cdq
sub eax, edx
sar eax, 1
mov r9d, eax
cmp dword [rbx + 0x388], eax
jne 0x140158d2e
mov eax, r8d
cdq
sub eax, edx
sar eax, 1
cmp dword [rbx + 0x38c], eax
je 0x140158d6c
mov rcx, qword [rbx + 0x350]
mov eax, r8d
cdq
mov dword [rsp + 0x60], r9d
sub eax, edx
mov dword [rbx + 0x388], r9d
sar eax, 1
lea rdx, [rsp + 0x60]
mov dword [rsp + 0x64], eax
mov dword [rbx + 0x38c], eax
call qword [sym.imp.USER32.dll_ClientToScreen]
mov edx, dword [rsp + 0x64]
mov ecx, dword [rsp + 0x60]
call qword [sym.imp.USER32.dll_SetCursorPos]
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.1401dae20
add rsp, 0xa0
pop rbx
ret
Function at 0x140158da0
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
cmp dword [0x1402b8a60], 0
jne 0x140157865
xor edx, edx
mov ecx, 0x10001
jmp fcn.1401559f0
mov rcx, rdx
jmp 0x140158da0
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
xor eax, eax
mov rsi, rcx
mov r8, rcx
mov dword [rsp + 0x28], eax
xor edx, edx
mov qword [rsp + 0x20], rax
mov ecx, 0xfde9
lea r9d, [rax - 1]
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
movsxd rdi, eax
test eax, eax
je 0x140158eae
mov rdx, rdi
mov qword [rsp + 0x40], rbx
add rdx, rdx
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov rbx, rax
test rax, rax
jne 0x140158e15
lea rdx, str.Win32:_Failed_to_allocate_global_handle_for_clipboard
mov ecx, 0x10008
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
jmp fcn.14015cc00
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GlobalLock]
test rax, rax
jne 0x140158e2c
lea rdx, str.Win32:_Failed_to_lock_global_handle
jmp 0x140158e6c
mov dword [rsp + 0x28], edi
mov r9d, 0xffffffff
mov r8, rsi
mov qword [rsp + 0x20], rax
xor edx, edx
mov ecx, 0xfde9
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov rcx, qword [0x1402ba118]
call qword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
jne 0x140158e8f
lea rdx, str.Win32:_Failed_to_open_clipboard
mov ecx, 0x10008
call fcn.14015cc00
mov rcx, rbx
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
jmp qword [sym.imp.KERNEL32.dll_GlobalFree]
call qword [sym.imp.USER32.dll_EmptyClipboard]
mov rdx, rbx
mov ecx, reloc.WS2_32.dll_listen
call qword [sym.imp.USER32.dll_SetClipboardData]
call qword [sym.imp.USER32.dll_CloseClipboard]
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
Function at 0x140159e80
Capabilities:
Register raw input devices

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x30
mov rbx, rcx
mov qword [0x1402baed8], rcx
lea rdi, [rcx + 0x350]
lea rcx, [rsp + 0x40]
call qword [sym.imp.USER32.dll_GetCursorPos]
test eax, eax
je 0x140159edc
mov rcx, qword [rdi]
lea rdx, [rsp + 0x40]
call qword [sym.imp.USER32.dll_ScreenToClient]
movd xmm0, dword [rsp + 0x40]
movd xmm1, dword [rsp + 0x44]
cvtdq2pd xmm0, xmm0
cvtdq2pd xmm1, xmm1
movsd qword [0x1402baec8], xmm0
movsd qword [0x1402baed0], xmm1
cmp dword [rbx + 0x7c], 0x34001
jne 0x140159f20
mov rcx, qword [rbx + 0x50]
test rcx, rcx
je 0x140159f01
mov rcx, qword [rcx + 8]
call qword [sym.imp.USER32.dll_SetCursor]
lea rdi, [rbx + 0x350]
jmp 0x140159f28
mov edx, 0x7f00
xor ecx, ecx
call qword [sym.imp.USER32.dll_LoadCursorW]
mov rcx, rax
call qword [sym.imp.USER32.dll_SetCursor]
lea rdi, [rbx + 0x350]
jmp 0x140159f28
xor ecx, ecx
call qword [sym.imp.USER32.dll_SetCursor]
mov rcx, rbx
call fcn.140156db0
mov rcx, rbx
call fcn.14015a2d0
cmp dword [rbx + 0x1f8], 0
je 0x140159f7b
mov rax, qword [rdi]
lea rcx, [rsp + 0x20]
mov edx, 1
mov qword [rsp + 0x20], 0x20001
mov qword [rsp + 0x28], rax
lea r8d, [rdx + 0xf]
call qword [sym.imp.USER32.dll_RegisterRawInputDevices]
test eax, eax
jne 0x140159f7b
lea rdx, str.Win32:_Failed_to_register_raw_input_device
mov ecx, 0x10008
call fcn.14015cc00
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret

Function at 0x140159f90
Capabilities:
Register raw input devices

Disassembly:
push rbx
sub rsp, 0x30
cmp dword [rcx + 0x1f8], 0
mov rbx, rcx
je 0x140159fe0
mov edx, 1
mov dword [rsp + 0x20], 0x20001
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x24], edx
mov qword [rsp + 0x28], 0
lea r8d, [rdx + 0xf]
call qword [sym.imp.USER32.dll_RegisterRawInputDevices]
test eax, eax
jne 0x140159fe0
lea rdx, str.Win32:_Failed_to_remove_raw_input_device
mov ecx, 0x10008
call fcn.14015cc00
xor ecx, ecx
mov qword [0x1402baed8], 0
call fcn.14015a2d0
cvttsd2si ecx, qword [0x1402baec8]
lea rdx, [rsp + 0x40]
cvttsd2si eax, qword [0x1402baed0]
mov dword [rsp + 0x40], ecx
mov dword [rbx + 0x388], ecx
mov rcx, qword [rbx + 0x350]
mov dword [rsp + 0x44], eax
mov dword [rbx + 0x38c], eax
call qword [sym.imp.USER32.dll_ClientToScreen]
mov edx, dword [rsp + 0x44]
mov ecx, dword [rsp + 0x40]
call qword [sym.imp.USER32.dll_SetCursorPos]
cmp dword [rbx + 0x7c], 0x34001
jne 0x14015a074
mov rcx, qword [rbx + 0x50]
test rcx, rcx
je 0x14015a058
mov rcx, qword [rcx + 8]
add rsp, 0x30
pop rbx
jmp qword [sym.imp.USER32.dll_SetCursor]
mov edx, 0x7f00
xor ecx, ecx
call qword [sym.imp.USER32.dll_LoadCursorW]
mov rcx, rax
add rsp, 0x30
pop rbx
jmp qword [sym.imp.USER32.dll_SetCursor]
xor ecx, ecx
add rsp, 0x30
pop rbx
jmp qword [sym.imp.USER32.dll_SetCursor]