joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140013f7b
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
sub rsp, 0x48
movdqa xmmword [rsp + 0x30], xmm9
movdqa xmmword [rsp + 0x20], xmm8
movdqa xmmword [rsp + 0x10], xmm7
movdqa xmmword [rsp], xmm6
cmp r8, 0x80
jb 0x14001417d
movdqu xmm4, xmmword [rdx]
movdqu xmm3, xmmword [rdx + 0x10]
movdqu xmm2, xmmword [rdx + 0x20]
movdqu xmm1, xmmword [rdx + 0x30]
not ecx
movd xmm0, ecx
pxor xmm0, xmm4
add rdx, 0x40
add r8, 0xffffffffffffffc0
movabs rax, 0x154442bd4
movq xmm4, rax
movdqa xmm5, xmmword [0x1400f0090]
movdqa xmm6, xmm0
pclmulqdq xmm6, xmm4, 0
movdqa xmm7, xmm0
pclmulqdq xmm7, xmm5, 0x11
movdqu xmm0, xmmword [rdx]
pxor xmm0, xmm6
pxor xmm0, xmm7
movdqu xmm6, xmmword [rdx + 0x10]
movdqu xmm7, xmmword [rdx + 0x20]
movdqu xmm8, xmmword [rdx + 0x30]
movdqa xmm9, xmm3
pclmulqdq xmm9, xmm4, 0
pxor xmm9, xmm6
pclmulqdq xmm3, xmm5, 0x11
pxor xmm3, xmm9
movdqa xmm6, xmm2
pclmulqdq xmm6, xmm4, 0
pxor xmm6, xmm7
pclmulqdq xmm2, xmm5, 0x11
pxor xmm2, xmm6
movdqa xmm6, xmm1
pclmulqdq xmm6, xmm4, 0
pxor xmm6, xmm8
pclmulqdq xmm1, xmm5, 0x11
pxor xmm1, xmm6
add rdx, 0x40
add r8, 0xffffffffffffffc0
cmp r8, 0x3f
ja 0x140013fe1
movabs rax, 0x1751997d0
movq xmm4, rax
movdqa xmm6, xmm0
pclmulqdq xmm6, xmm4, 0
movdqa xmm5, xmmword [0x1400f00a0]
pclmulqdq xmm0, xmm5, 0x11
pxor xmm0, xmm6
pxor xmm0, xmm3
movdqa xmm3, xmm0
pclmulqdq xmm3, xmm4, 0
pclmulqdq xmm0, xmm5, 0x11
pxor xmm0, xmm3
pxor xmm0, xmm2
movdqa xmm2, xmm0
pclmulqdq xmm2, xmm4, 0
pclmulqdq xmm0, xmm5, 0x11
pxor xmm0, xmm2
pxor xmm0, xmm1
cmp r8, 0x10
jb 0x1400140ff
movdqu xmm1, xmmword [rdx]
add r8, 0xfffffffffffffff0
add rdx, 0x10
movdqa xmm2, xmm0
pclmulqdq xmm2, xmm4, 0
pxor xmm2, xmm1
pclmulqdq xmm0, xmm5, 0x11
pxor xmm0, xmm2
cmp r8, 0xf
ja 0x1400140d5
movdqa xmm1, xmmword [0x1400f00a0]
pclmulqdq xmm1, xmm0, 1
psrldq xmm0, 8
pxor xmm0, xmm1
pxor xmm1, xmm1
pxor xmm2, xmm2
movss xmm2, xmm0
movabs rax, 0x163cd6124
movq xmm3, rax
pclmulqdq xmm3, xmm2, 0
psrldq xmm0, 4
pxor xmm0, xmm3
xorps xmm2, xmm2
movss xmm2, xmm0
pclmulqdq xmm2, xmmword [0x1400f00b0], 0x10
pblendw xmm2, xmm1, 0xfc
movabs rax, 0x1db710641
movq xmm1, rax
pclmulqdq xmm1, xmm2, 0
pxor xmm1, xmm0
pextrd ecx, xmm1, 1
not ecx
test r8, r8
je 0x14001419b
movaps xmm6, xmmword [rsp]
movaps xmm7, xmmword [rsp + 0x10]
movaps xmm8, xmmword [rsp + 0x20]
movaps xmm9, xmmword [rsp + 0x30]
add rsp, 0x48
jmp fcn.140013e01
mov eax, ecx
movaps xmm6, xmmword [rsp]
movaps xmm7, xmmword [rsp + 0x10]
movaps xmm8, xmmword [rsp + 0x20]
movaps xmm9, xmmword [rsp + 0x30]
add rsp, 0x48
ret

Function at 0x14001fbdb
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x68
mov qword [rsp + 0x58], r9
mov ebx, ecx
mov r9, qword [rsp + 0xf0]
mov r12, qword [rsp + 0xe8]
movzx eax, r8b
mov qword [rsp + 0x50], rax
test dl, dl
jne 0x14001fd38
mov r15d, r9d
and r15d, 0x1f
mov rax, r9
and rax, 0xffffffffffffffe0
mov qword [rsp + 0x60], rax
lea r13, [r12 + rax]
mov rsi, 0xffffffffffffffff
xor ebx, ebx
mov rdi, 0xffffffffffffffff
xor r14d, r14d
Function at 0x140023f70
Capabilities:
Encode data using xor

Disassembly:
push rbp
mov rbp, rsp
mov rax, rdx
sub rdx, rcx
cmp rdx, 0x20
jae 0x140023f95
cmp rax, rcx
je 0x140023f9b
cmp rdx, 4
jae 0x140023fa2
xor eax, eax
xor r8d, r8d
jmp 0x140024040
pop rbp
jmp fcn.14000fe00
xor eax, eax
jmp 0x140024057
mov r8d, edx
and r8d, 0x1c
pxor xmm0, xmm0
xor eax, eax
movdqa xmm2, xmmword [0x1400f0010]
movdqa xmm3, xmmword [0x1400f0020]
pxor xmm1, xmm1
nop word cs:[rax + rax]
movzx r9d, word [rcx + rax]
movd xmm4, r9d
movzx r9d, word [rcx + rax + 2]
movd xmm5, r9d
pcmpgtb xmm4, xmm2
punpcklbw xmm4, xmm4
pshuflw xmm4, xmm4, 0xd4
pshufd xmm4, xmm4, 0xd4
pand xmm4, xmm3
paddq xmm0, xmm4
pcmpgtb xmm5, xmm2
punpcklbw xmm5, xmm5
pshuflw xmm4, xmm5, 0xd4
pshufd xmm4, xmm4, 0xd4
pand xmm4, xmm3
paddq xmm1, xmm4
add rax, 4
cmp r8, rax
jne 0x140023fd0
paddq xmm1, xmm0
pshufd xmm0, xmm1, 0xee
paddq xmm0, xmm1
movq rax, xmm0
cmp r8, rdx
je 0x140024057
nop dword [rax]
xor r9d, r9d
cmp byte [rcx + r8], 0xc0
setge r9b
add rax, r9
inc r8
cmp rdx, r8
jne 0x140024040
pop rbp
ret
Function at 0x14002a9a0
Capabilities:
Get common file path

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x478
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x3f0], 0xfffffffffffffffe
mov qword [rbp + 0x3d0], rcx
mov qword [rbp + 0x3d8], 0
mov qword [rbp + 0x3e0], 2
mov qword [rbp + 0x3e8], 0
mov r8d, 0x200
mov eax, 2
mov qword [rbp + 0x3c8], rax
xor esi, esi
xor edi, edi
xor ebx, ebx
cmp r8, 0x201
jae 0x14002aa40
jmp 0x14002aa2f
jae 0x14002aaff
cmp r8, 0x201
jae 0x14002aa40
mov r14d, 0x200
lea r15, [rbp - 0x58]
mov r12, r8
jmp 0x14002aa97
sub r8, rbx
sub rdi, rbx
cmp rdi, r8
jae 0x14002aa6f
lea rcx, [rbp + 0x3d8]
mov rdx, rbx
call fcn.1400ee260
mov rsi, qword [rbp + 0x3d8]
mov rax, qword [rbp + 0x3e0]
mov qword [rbp + 0x3c8], rax
mov eax, 0xffffffff
cmp rsi, rax
mov ebx, 0xffffffff
cmovb rbx, rsi
mov qword [rbp + 0x3e8], rbx
mov rdi, rsi
mov r14, rbx
mov r15, qword [rbp + 0x3c8]
mov r12, rbx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov ecx, r12d
mov rdx, r15
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov r13d, eax
test eax, eax
jne 0x14002aac0
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x14002ab68
mov r8d, r13d
cmp r12, r8
jne 0x14002aa20
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x14002ab9a
add r12, r12
mov eax, 0xffffffff
cmp r12, rax
cmovae r12, rax
mov r8, r12
cmp r8, 0x201
jb 0x14002aa2f
jmp 0x14002aa40
cmp r14, r8
jb 0x14002abb4
lea rcx, [rbp + 0x3a8]
mov rdx, r15
call fcn.14002b3e0
movups xmm0, xmmword [rbp + 0x3a8]
movups xmm1, xmmword [rbp + 0x3b8]
mov rax, qword [rbp + 0x3d0]
movups xmmword [rax + 0x10], xmm1
movups xmmword [rax], xmm0
cmp qword [rbp + 0x3d8], 0
je 0x14002ab53
mov r8, qword [rbp + 0x3e0]
mov rcx, qword [0x140131de8]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
nop
add rsp, 0x478
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
shl rax, 0x20
or rax, 2
mov rcx, qword [rbp + 0x3d0]
mov qword [rcx + 8], rax
movabs rax, 0x8000000000000000
mov qword [rcx], rax
cmp qword [rbp + 0x3d8], 0
jne 0x14002ab3d
jmp 0x14002ab53
lea rcx, str.internal_error:_entered_unreachable_code
lea r8, str.library_std_src_syspalwindowsmod.rsstrings_passed_to_WinAPI_cannot_contain_NULs
mov edx, 0x28
call fcn.1400ec000
jmp 0x14002abc9
lea rax, str.library_std_src_syspalwindowsmod.rsstrings_passed_to_WinAPI_cannot_contain_NULs
mov rcx, r8
mov rdx, r14
mov r8, rax
call fcn.1400ebff0
ud2
Function at 0x1400382f0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rbp
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x68
lea rbp, [rsp + 0x60]
mov rsi, rcx
lea rcx, [rbp - 0x28]
call fcn.14002d000
mov rcx, qword [rbp - 0x28]
mov rax, qword [rbp - 0x20]
movabs rbx, 0x8000000000000000
cmp rcx, rbx
jne 0x14003832e
mov qword [rbp - 8], rax
mov qword [rbp - 0x10], rbx
jmp 0x140038354
mov rdx, qword [rbp - 0x18]
mov qword [rbp - 0x40], rcx
mov qword [rbp - 0x38], rax
mov qword [rbp - 0x30], rdx
lea rcx, [rbp - 0x10]
lea rdx, [rbp - 0x40]
call fcn.140038210
mov r14, qword [rbp - 0x10]
cmp r14, rbx
jne 0x14003836d
lea rcx, [rbp - 8]
call fcn.140027f80
mov qword [rsi], rbx
add rsp, 0x68
pop rbx
pop rdi
pop rsi
pop r14
pop r15
pop rbp
ret
mov rdi, qword [rbp - 8]
mov r15, qword [rbp]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x140038390
mov qword [rsi], r14
mov qword [rsi + 8], rdi
mov qword [rsi + 0x10], r15
jmp 0x140038360
mov qword [rsi], rbx
test r14, r14
je 0x140038360
mov rcx, qword [0x140131de8]
xor edx, edx
mov r8, rdi
add rsp, 0x68
pop rbx
pop rdi
pop rsi
pop r14
pop r15
pop rbp
jmp qword [sym.imp.KERNEL32.dll_HeapFree]
Function at 0x14003b3b0
Capabilities:
Create thread

Disassembly:
push rbp
push r14
push rsi
push rdi
push rbx
sub rsp, 0x50
lea rbp, [rsp + 0x50]
mov qword [rbp - 8], 0xfffffffffffffffe
mov rdi, r8
mov r14, rdx
mov rsi, rcx
movzx eax, byte [0x140131e68]
mov edx, select
xor ecx, ecx
call fcn.14003dd50
test rax, rax
je 0x14003b4a3
mov rbx, rax
mov qword [rax], r14
mov qword [rax + 8], rdi
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0x10000
lea r8, [0x14003b5c0]
xor edi, edi
xor ecx, ecx
mov rdx, rsi
mov r9, rax
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rdx, rax
test rax, rax
jne 0x14003b495
mov rcx, qword [rbx]
mov qword [rbp - 0x20], rbx
mov rax, qword [rbx + 8]
mov qword [rbp - 0x10], rcx
mov qword [rbp - 0x18], rax
call qword [rax]
mov rax, qword [rbp - 0x18]
cmp qword [rax + 8], 0
mov rsi, qword [rbp - 0x20]
je 0x14003b46e
cmp qword [rax + 0x10], 0x11
jae 0x14003b457
mov r8, qword [rbp - 0x10]
jmp 0x14003b45f
mov r8, qword [rbp - 0x10]
mov r8, qword [r8 - 8]
mov rcx, qword [0x140131de8]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rcx, qword [0x140131de8]
xor edx, edx
mov r8, rsi
call qword [sym.imp.KERNEL32.dll_HeapFree]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
shl rdx, 0x20
or rdx, 2
mov edi, 1
mov rax, rdi
add rsp, 0x50
pop rbx
pop rdi
pop rsi
pop r14
pop rbp
ret
mov qword [rbp - 0x20], r14
mov qword [rbp - 0x18], rdi
mov ecx, 8
mov edx, select
call fcn.1400ebe70
ud2

Function at 0x1400468e0
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov ecx, 2
mov rbx, r8
mov rdi, rdx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov r8, rbx
mov rdx, rdi
mov rcx, rax
call fcn.140047120
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov rdx, rax
mov ecx, 0xa
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fflush]
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
Function at 0x140058970
Capabilities:
Open clipboard

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
xor ecx, ecx
mov rbx, rdx
xor edi, edi
call qword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
jne 0x140058996
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
mov r8, qword [0x140105858]
mov rax, rbx
sub r8, rbx
movzx edx, byte [rax]
movzx ecx, byte [rax + r8]
sub edx, ecx
jne 0x1400589b6
inc rax
test ecx, ecx
jne 0x1400589a3
test edx, edx
je 0x140058a1c
cmp byte [rbx], dil
je 0x140058a1c
mov rdx, qword [str.image]
sub rdx, rbx
nop dword [rax]
movzx ecx, byte [rbx]
movzx eax, byte [rbx + rdx]
sub ecx, eax
jne 0x1400589e2
inc rbx
test eax, eax
jne 0x1400589d0
test ecx, ecx
jne 0x140058a29
mov ecx, 8
call qword [sym.imp.USER32.dll_IsClipboardFormatAvailable]
test eax, eax
jne 0x140058a04
mov ecx, select
call qword [sym.imp.USER32.dll_IsClipboardFormatAvailable]
test eax, eax
je 0x140058a29
mov edi, 1
call qword [sym.imp.USER32.dll_CloseClipboard]
mov eax, edi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
mov ecx, 0xd
call qword [sym.imp.USER32.dll_IsClipboardFormatAvailable]
mov edi, eax
call qword [sym.imp.USER32.dll_CloseClipboard]
mov rbx, qword [rsp + 0x30]
mov eax, edi
add rsp, 0x20
pop rdi
ret
Function at 0x140058ad0
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
test rdx, rdx
je 0x140058d2b
push rbx
push rsi
sub rsp, 0x38
mov esi, r8d
mov rbx, rdx
test r8d, r8d
js 0x140058d25
mov qword [rsp + 0x50], rbp
cmp r9d, 2
mov qword [rsp + 0x58], rdi
mov rax, rdx
mov qword [rsp + 0x60], r12
mov ecx, r8d
mov qword [rsp + 0x30], r13
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], r15
mov r15d, 1
mov r13d, r15d
cmovl r13d, r9d
xor r12d, r12d
mov edi, r12d
test r8d, r8d
jle 0x140058bc2
movzx edx, byte [rax]
cmp dl, 0xd
jne 0x140058b50
cmp byte [rax + 1], 0xa
jne 0x140058b50
cmp ecx, 2
jb 0x140058b50
add rax, 2
add edi, 2
dec ecx
jmp 0x140058b5f
inc rax
cmp dl, 0xa
jne 0x140058b5d
add edi, 2
jmp 0x140058b5f
inc edi
dec ecx
test ecx, ecx
jg 0x140058b32
lea r15d, [rdi + 1]
movsxd rcx, r15d
call sub.api_ms_win_crt_heap_l1_1_0.dll_malloc
mov rbp, rax
movzx ecx, byte [rbx]
cmp cl, 0xd
jne 0x140058b9e
cmp byte [rbx + 1], 0xa
lea rdx, [rbx + 1]
jne 0x140058b9e
cmp esi, 2
jb 0x140058b9e
mov byte [rax], cl
mov rbx, rdx
movzx ecx, byte [rdx]
mov byte [rax + 1], cl
add rax, 2
dec esi
jmp 0x140058bb7
cmp cl, 0xa
jne 0x140058bb2
mov byte [rax], 0xd
movzx ecx, byte [rbx]
mov byte [rax + 1], cl
add rax, 2
jmp 0x140058bb7
mov byte [rax], cl
inc rax
dec esi
inc rbx
test esi, esi
jg 0x140058b74
jmp 0x140058bcd
mov rcx, r15
call sub.api_ms_win_crt_heap_l1_1_0.dll_malloc
mov rbp, rax
movsxd r14, r13d
mov byte [rax], r12b
lea rax, [0x140000000]
cmp r15d, dword [rax + r14*4 + 0x132598]
lea rsi, [r14*8]
lea r15, [0x140000000]
jle 0x140058c1b
mov rcx, qword [rsi + r15 + 0x132580]
call fcn.1400466d0
lea ebx, [rdi + 0x64]
movsxd rcx, ebx
call sub.api_ms_win_crt_heap_l1_1_0.dll_malloc
mov qword [rsi + r15 + 0x132580], rax
mov dword [r15 + r14*4 + 0x132598], ebx
mov rcx, qword [rsi + r15 + 0x132580]
mov rdx, rbp
movsxd rbx, edi
mov r8, rbx
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rsi + r15 + 0x132580]
test r13d, r13d
mov r13, qword [rsp + 0x30]
mov byte [rbx + rax], r12b
mov dword [r15 + r14*4 + 0x132590], edi
mov byte [r14 + r15 + 0x1325a0], 1
mov r15, qword [rsp + 0x20]
mov r14, qword [rsp + 0x28]
je 0x140058d0e
call fcn.1400506f0
test rax, rax
je 0x140058d0e
mov rax, qword [rax + 0xc8]
test rax, rax
je 0x140058c83
mov r12, qword [rax]
mov rcx, r12
call qword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x140058d0e
call qword [sym.imp.USER32.dll_EmptyClipboard]
mov edx, dword [0x140132594]
xor r9d, r9d
mov rcx, qword [0x140132588]
xor r8d, r8d
call fcn.1400811f0
mov ebx, eax
lea ecx, [rax*2 + 2]
movsxd rdx, ecx
mov ecx, 0x42
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov rcx, rax
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GlobalLock]
mov edx, dword [0x140132594]
lea r9d, [rbx + 1]
mov rcx, qword [0x140132588]
mov r8, rax
call fcn.1400811f0
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov rdx, rdi
mov ecx, 0xd
call qword [sym.imp.USER32.dll_SetClipboardData]
call qword [sym.imp.USER32.dll_CloseClipboard]
mov byte [0x1401325a1], 1
mov rcx, rbp
call fcn.1400466d0
mov r12, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x50]
add rsp, 0x38
pop rsi
pop rbx
ret
Function at 0x140059af0
Capabilities:
Get geographical location
Get keyboard layout

Disassembly:
sub rsp, 0x38
mov rax, qword [0x140131048]
xor rax, rsp
mov qword [rsp + 0x28], rax
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetKeyboardLayout]
movzx ecx, ax
mov r9d, 6
lea r8, [rsp + 0x20]
mov edx, 0x1004
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
lea rcx, [rsp + 0x20]
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_atol]
mov dword [0x1401355a8], eax
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.1400ea730
add rsp, 0x38
ret

Function at 0x140059bf0
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
sub rsp, 0x28
call fcn.1400506f0
test rax, rax
je 0x140059cb1
mov rcx, qword [rax + 0xc8]
test rcx, rcx
je 0x140059c11
mov rcx, qword [rcx]
call qword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x140059cb1
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x20], rdi
call qword [sym.imp.USER32.dll_EmptyClipboard]
mov edx, dword [0x140132594]
xor r9d, r9d
mov rcx, qword [0x140132588]
xor r8d, r8d
call fcn.1400811f0
mov ebx, eax
lea ecx, [rax*2 + 2]
movsxd rdx, ecx
mov ecx, 0x42
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov rcx, rax
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GlobalLock]
mov edx, dword [0x140132594]
lea r9d, [rbx + 1]
mov rcx, qword [0x140132588]
mov r8, rax
call fcn.1400811f0
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov rdx, rdi
mov ecx, 0xd
call qword [sym.imp.USER32.dll_SetClipboardData]
call qword [sym.imp.USER32.dll_CloseClipboard]
mov rdi, qword [rsp + 0x20]
mov rbx, qword [rsp + 0x30]
mov byte [0x1401325a1], 1
add rsp, 0x28
ret
Function at 0x14005b0f0
Capabilities:
Link many functions at runtime

Disassembly:
sub rsp, 0x28
cmp byte [0x140132c98], 0
jne 0x14005b278
lea rcx, str.Shcore.DLL
mov byte [0x140132c98], 1
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
lea rdx, str.GetProcessDpiAwareness
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14005b14e
lea rdx, [rsp + 0x38]
xor ecx, ecx
call rax
test eax, eax
jne 0x14005b14e
mov eax, dword [rsp + 0x38]
cmp eax, 2
je 0x14005b1c6
test eax, eax
jne 0x14005b1cd
jmp 0x14005b156
mov dword [rsp + 0x38], 0
lea rcx, str.User32.DLL
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
lea rdx, str.SetProcessDpiAwarenessContext
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14005b18e
mov rcx, 0xfffffffffffffffc
call rax
test eax, eax
setne al
mov byte [0x1401325f1], al
jmp 0x14005b195
movzx eax, byte [0x1401325f1]
test al, al
jne 0x14005b1cd
lea rcx, str.Shcore.DLL
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
lea rdx, str.SetProcessDpiAwareness
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14005b1cd
mov ecx, 2
call rax
test eax, eax
jne 0x14005b1cd
mov byte [0x1401325f1], 1
xor ecx, ecx
call qword [sym.imp.ole32.dll_OleInitialize]
lea rcx, str.IMM32.DLL
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov qword [0x140132610], rax
test rax, rax
jne 0x14005b202
lea rcx, str.FLTK_Lib_Error:_IMM32.DLL_file_not_found__n_nPlease_check_your_input_method_manager_library_accessibility.
call qword [case.0x140083a43.1]
mov rax, qword [0x140132610]
lea rdx, str.ImmAssociateContextEx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x140132610]
lea rdx, str.ImmGetContext
mov qword [0x140132618], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x140132610]
lea rdx, str.ImmSetCompositionWindow
mov qword [0x140132620], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x140132610]
lea rdx, str.ImmReleaseContext
mov qword [0x140132628], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
xor edx, edx
lea rcx, [0x140058f20]
mov qword [0x140132630], rax
call fcn.140050170
add rsp, 0x28
ret
Function at 0x14005bab0
Capabilities:
Get socket status

Disassembly:
sub rsp, 0x678
mov rax, qword [0x140131048]
xor rax, rsp
mov qword [rsp + 0x660], rax
xor r9d, r9d
mov dword [rsp + 0x20], 0
xor r8d, r8d
lea rcx, [0x1401325b8]
xor edx, edx
call qword [sym.imp.USER32.dll_PeekMessageA]
test eax, eax
je 0x14005bb07
mov eax, 1
mov rcx, qword [rsp + 0x660]
xor rcx, rsp
call fcn.1400ea730
add rsp, 0x678
ret
cmp dword [0x140132644], 0
jne 0x14005bb2a
xor eax, eax
mov rcx, qword [rsp + 0x660]
xor rcx, rsp
call fcn.1400ea730
add rsp, 0x678
ret
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x30], 0
lea rdx, [0x140132650]
mov r8d, 0x618
call sub.VCRUNTIME140.dll_memcpy
lea rax, [rsp + 0x30]
xor ecx, ecx
lea r9, [rsp + 0x450]
mov qword [rsp + 0x20], rax
lea r8, [rsp + 0x248]
lea rdx, [rsp + 0x40]
call qword [sym.imp.WS2_32.dll_select]
mov rcx, qword [rsp + 0x660]
xor rcx, rsp
call fcn.1400ea730
add rsp, 0x678
ret
Function at 0x1400669f0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x20
movzx edi, r9w
mov rsi, r8
mov rbp, rdx
mov rbx, rcx
call fcn.140065320
lea rax, vtable.Fl_Anim_GIF_Image.0
mov word [rbx + 0x58], di
mov qword [rbx], rax
xor r14d, r14d
movabs rax, 0x3ff0000000000000
mov qword [rbx + 0x50], r14
mov ecx, 0x90
mov qword [rbx + 0x70], rax
mov qword [rbx + 0x60], rsi
mov word [rbx + 0x68], r14w
mov dword [rbx + 0x6c], 0xffffffff
call sub.api_ms_win_crt_heap_l1_1_0.dll_malloc
mov rdx, rax
test rax, rax
je 0x140066ae8
mov qword [rax], rbx
mov byte [rax + 8], r14b
mov dword [rax + 0xc], r14d
mov qword [rax + 0x10], r14
mov qword [rax + 0x18], 1
mov dword [rax + 0x20], 0xffffffff
mov dword [rax + 0x24], 0xff000000
mov qword [rax + 0x28], r14
mov qword [rax + 0x30], r14
mov dword [rax + 0x38], 0x38
mov dword [rax + 0x3c], 0xbf800000
mov byte [rax + 0x40], r14b
mov qword [rax + 0x42], r14
mov qword [rax + 0x50], r14
mov dword [rax + 0x58], r14d
mov dword [rax + 0x5c], 0xffffffff
mov dword [rax + 0x60], 0xff000000
mov qword [rax + 0x68], r14
mov byte [rax + 0x70], r14b
mov dword [rax + 0x74], 0x38
mov dword [rax + 0x78], 0xbf800000
mov qword [rax + 0x7c], r14
mov byte [rax + 0x84], r14b
mov qword [rax + 0x88], r14
jmp 0x140066aeb
mov rdx, r14
movzx ecx, word [rbx + 0x58]
xor r9d, r9d
mov eax, ecx
mov qword [rbx + 0x78], rdx
shr ecx, 6
xor r8d, r8d
and ecx, 1
shr eax, 7
and eax, 1
lea eax, [rcx + rax*2]
mov dword [rdx + 0x80], eax
mov rdx, rbp
movzx ecx, byte [rbx + 0x58]
mov rax, qword [rbx + 0x78]
shr cl, 3
and cl, 1
mov byte [rax + 0x84], cl
mov rcx, rbx
call fcn.140067760
mov byte [rbx + 0x69], al
mov rax, qword [rbx + 0x78]
mov ecx, dword [rax + 0x68]
test ecx, ecx
je 0x140066b5e
cmp dword [rax + 0x6c], r14d
je 0x140066b5e
cmp dword [rbx + 8], r14d
jne 0x140066b5e
cmp dword [rbx + 0xc], r14d
jne 0x140066b5e
mov dword [rbx + 8], ecx
mov dword [rbx + 0x1c], ecx
mov eax, dword [rax + 0x6c]
mov dword [rbx + 0xc], eax
mov dword [rbx + 0x20], eax
movzx r8d, di
mov rdx, rsi
mov rcx, rbx
call fcn.140066d60
test dil, 1
jne 0x140066b96
mov rdx, rbx
lea rcx, [0x140066e60]
call fcn.140052040
mov rax, qword [rbx + 0x78]
cmp dword [rax + 0xc], r14d
je 0x140066b9a
mov rcx, rbx
call fcn.1400678e0
jmp 0x140066b9a
mov dword [rbx + 0x6c], r14d
mov rbp, qword [rsp + 0x38]
mov rax, rbx
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret