joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140083c80
Capabilities:
Set current directory

Disassembly:
mov r11, rsp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x60
mov qword [r11 - 0x48], 0xfffffffffffffffe
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rbp
mov esi, r9d
mov ebp, r8d
mov r14, rdx
mov rbx, rcx
mov edi, 1
xor r15d, r15d
mov qword [r11 + 8], r15
mov qword [r11 - 0x40], rcx
mov rax, qword [rcx + 8]
mov qword [r11 - 0x38], rax
mov r10d, r15d
mov dword [r11 - 0x30], r15d
mov eax, dword [rcx + 0x10]
mov dword [rsp + 0x5c], eax
lea rcx, [r11 - 0x40]
mov qword [rbx + 8], rcx
test eax, eax
jle 0x140083e15
lea r12, [0x140101bd0]
nop dword [rax + rax]
cmp r10d, esi
jl 0x140083dad
mov r8, qword [0x1400fda58]
mov rcx, r8
mov rax, r12
mov edx, 2
nop dword [rax + rax]
movups xmm0, xmmword [rax]
movups xmmword [rcx], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rcx + 0x10], xmm1
movups xmm0, xmmword [rax + 0x20]
movups xmmword [rcx + 0x20], xmm0
movups xmm1, xmmword [rax + 0x30]
movups xmmword [rcx + 0x30], xmm1
movups xmm0, xmmword [rax + 0x40]
movups xmmword [rcx + 0x40], xmm0
movups xmm1, xmmword [rax + 0x50]
movups xmmword [rcx + 0x50], xmm1
movups xmm0, xmmword [rax + 0x60]
movups xmmword [rcx + 0x60], xmm0
lea rcx, [rcx + 0x80]
movups xmm1, xmmword [rax + 0x70]
movups xmmword [rcx - 0x10], xmm1
lea rax, [rax + 0x80]
sub rdx, 1
jne 0x140083d10
movups xmm0, xmmword [rax]
movups xmmword [rcx], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rcx + 0x10], xmm1
movups xmm0, xmmword [rax + 0x20]
movups xmmword [rcx + 0x20], xmm0
movups xmm1, xmmword [rax + 0x30]
movups xmmword [rcx + 0x30], xmm1
movups xmm0, xmmword [rax + 0x40]
movups xmmword [rcx + 0x40], xmm0
mov dword [r8 + 0x3c], r15d
mov qword [0x1401050a0], r15
cmp dword [0x140101f64], edx
je 0x140083da8
lea rcx, [0x140101d30]
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
mov r10d, dword [rsp + 0x58]
movsxd rcx, r10d
add rcx, rcx
mov rax, qword [rbx]
mov rcx, qword [rax + rcx*8]
mov dword [rsp + 0x30], r15d
lea rax, [rsp + 0x90]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], ebp
mov r9, r14
lea r8, [0x1400ccfc8]
mov rdx, rcx
call fcn.140080030
test eax, eax
je 0x140083e12
cmp qword [rsp + 0x90], 0
jne 0x140083e0b
mov r10d, dword [rsp + 0x58]
inc r10d
mov dword [rsp + 0x58], r10d
cmp r10d, dword [rsp + 0x5c]
jl 0x140083cf0
jmp 0x140083e15
mov edi, 3
jmp 0x140083e15
mov edi, r15d
mov rdx, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x48]
mov qword [rcx + 8], rdx
mov eax, edi
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
Function at 0x140085250
Capabilities:
Read .ini file

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 8], rcx
push rdi
mov eax, 0x20240
call fcn.1400be170
sub rsp, rax
mov rbx, qword [rsp + 0x20270]
mov rsi, r9
mov rdi, r8
mov rax, rdx
test rbx, rbx
je 0x140085289
cmp word [rbx], 0
jne 0x140085290
lea rbx, str.ERROR
xor ecx, ecx
lea r9, [rsp + 0x20270]
mov word [rsp + 0x240], cx
lea r8, [rsp + 0x30]
mov word [rsp + 0x20250], cx
mov edx, 0x104
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFullPathNameW]
cmp word [rsi], 0
je 0x14008532e
cmp word [rdi], 0
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea rcx, [rsp + 0x20250]
cmovne rcx, rdi
mov dword [rsp + 0x20], 0xffff
lea r9, [rsp + 0x240]
mov r8, rbx
mov rdx, rsi
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
mov rcx, qword [0x140104270]
lea rdx, [rsp + 0x240]
xor r9d, r9d
mov byte [rsp + 0x20], 1
or r8, 0xffffffffffffffff
call fcn.14008c590
lea r11, [rsp + 0x20240]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
cmp word [rdi], 0
je 0x140085352
lea r9, [rsp + 0x30]
mov r8d, 0xffff
lea rdx, [rsp + 0x240]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileSectionW]
jmp 0x14008536a
lea r8, [rsp + 0x30]
mov edx, 0xffff
lea rcx, [rsp + 0x240]
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileSectionNamesW]
test eax, eax
je 0x1400852f9
lea rax, [rsp + 0x240]
mov ecx, 0xa
nop dword [rax + rax]
cmp word [rax], 0
jne 0x140085394
cmp word [rax + 2], 0
je 0x1400852f9
mov word [rax], cx
add rax, 2
jmp 0x140085380

Function at 0x1400853a0
Capabilities:
Write file on windows

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x40
mov rdi, rdx
mov rsi, rcx
xor edx, edx
mov ebx, 1
call fcn.14008a020
test al, al
jne 0x1400854ba
mov qword [rsp + 0x78], r15
xor r9d, r9d
xor r15d, r15d
xor r8d, r8d
mov qword [rsp + 0x30], r15
mov edx, 0x40000000
mov dword [rsp + 0x28], r15d
mov rcx, rsi
mov dword [rsp + 0x20], ebx
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rsi, rax
cmp rax, 0xffffffffffffffff
je 0x1400854ab
mov qword [rsp + 0x60], rbp
or rcx, 0xffffffffffffffff
mov qword [rsp + 0x68], r14
nop word [rax + rax]
inc rcx
cmp word [rdi + rcx*2], r15w
jne 0x140085410
mov eax, ecx
lea ebp, [rcx*2 + 2]
lea r14, [rdi + rax*2]
mov qword [rsp + 0x20], r15
mov eax, 0x5d
lea r9, [rsp + 0x70]
lea rdx, [0x1400eade8]
mov word [r14], ax
mov rcx, rsi
lea r8d, [rax - 0x59]
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x14008547c
cmp dword [rsp + 0x70], 4
jne 0x14008547c
lea r9, [rsp + 0x70]
mov qword [rsp + 0x20], r15
mov r8d, ebp
mov rdx, rdi
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x14008547c
cmp dword [rsp + 0x70], ebp
je 0x14008547f
mov ebx, r15d
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbp, qword [rsp + 0x60]
test eax, eax
mov word [r14], r15w
mov r14, qword [rsp + 0x68]
cmove ebx, r15d
mov r15, qword [rsp + 0x78]
mov eax, ebx
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret
mov eax, ebx
mov r15, qword [rsp + 0x78]
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret
mov eax, ebx
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret
Function at 0x140085e70
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
mov r11, rsp
push rbx
push rsi
push rdi
sub rsp, 0x240
xor esi, esi
mov dword [r11 + 0x10], 0xff
lea rax, [r11 + 0x20]
xor edx, edx
mov qword [rsp + 0x38], rax
lea r9, [r11 + 0x10]
mov qword [rsp + 0x30], rsi
lea r8, [rsp + 0x40]
mov qword [rsp + 0x28], rsi
mov rdi, rcx
mov qword [rsp + 0x20], rsi
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
cmp eax, 0x103
je 0x140085f7c
nop
mov rax, qword [0x1400fda58]
lea rdx, [rsp + 0x40]
xor r8d, r8d
mov rcx, rdi
mov r9d, dword [rax + 0x110]
lea rax, [rsp + 0x270]
or r9d, 0x20019
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ebx, eax
test eax, eax
jne 0x140085f89
mov rcx, qword [rsp + 0x270]
call fcn.140085e70
mov rcx, qword [rsp + 0x270]
mov ebx, eax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
jne 0x140085f89
lea rdx, [rsp + 0x40]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov ebx, eax
test eax, eax
jne 0x140085f89
lea rax, [rsp + 0x278]
mov dword [rsp + 0x268], 0xff
mov qword [rsp + 0x38], rax
lea r9, [rsp + 0x268]
mov qword [rsp + 0x30], rsi
lea r8, [rsp + 0x40]
mov qword [rsp + 0x28], rsi
xor edx, edx
mov rcx, rdi
mov qword [rsp + 0x20], rsi
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
cmp eax, 0x103
jne 0x140085ec0
xor eax, eax
add rsp, 0x240
pop rdi
pop rsi
pop rbx
ret
mov eax, ebx
add rsp, 0x240
pop rdi
pop rsi
pop rbx
ret
Function at 0x140085fa0
Capabilities:
Delete registry key
Delete registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x30
mov rsi, r9
mov rdi, r8
mov rbp, rdx
mov r14, rcx
test rdx, rdx
je 0x140086100
test r8, r8
je 0x140085fd3
cmp word [r8], 0
jne 0x140085fdc
test rsi, rsi
je 0x140086100
mov rax, qword [0x1400fda58]
xor r8d, r8d
mov rdx, rdi
mov rcx, rbp
mov r9d, dword [rax + 0x110]
lea rax, [rsp + 0x58]
or r9d, 0x2001f
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ebx, eax
test eax, eax
jne 0x1400860f1
mov rcx, qword [rsp + 0x58]
test rsi, rsi
jne 0x1400860db
call fcn.140085e70
mov rcx, qword [rsp + 0x58]
mov ebx, eax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
jne 0x1400860f1
mov rax, qword gs:[0x58]
mov edx, 4
mov rcx, qword [rax]
mov eax, dword [rdx + rcx]
cmp dword [0x140106f30], eax
jle 0x14008609d
lea rcx, [0x140106f30]
call fcn.1400a506c
cmp dword [0x140106f30], 0xffffffff
jne 0x14008609d
lea rcx, str.advapi32
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, str.RegDeleteKeyExW
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rcx, [0x140106f30]
mov qword [0x140106f38], rax
call fcn.1400a500c
mov rax, qword [0x1400fda58]
mov r8d, dword [rax + 0x110]
test r8d, r8d
je 0x1400860cb
mov rax, qword [0x140106f38]
test rax, rax
je 0x1400860cb
xor r9d, r9d
mov rdx, rdi
mov rcx, rbp
call rax
mov ebx, eax
jmp 0x1400860f1
mov rdx, rdi
mov rcx, rbp
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov ebx, eax
jmp 0x1400860f1
mov rdx, rsi
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov rcx, qword [rsp + 0x58]
mov ebx, eax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp ebx, 0xffffffff
jne 0x140086105
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
jmp 0x140086107
mov ebx, 0x57
mov ecx, ebx
mov rax, qword [0x1400fda58]
test ebx, ebx
setne dl
mov dword [rax + 0x40], ecx
mov rcx, r14
call fcn.1400369c0
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x60]
add rsp, 0x30
pop r14
pop rdi
pop rsi
ret
Function at 0x1400868f0
Capabilities:
Clear file content

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rsi, rdx
xor edi, edi
mov rdx, qword [rcx + 0x30]
mov rbx, rcx
test rdx, rdx
je 0x14008692c
sub rdx, qword [rcx + 0x38]
lea r8d, [rdi + 1]
mov eax, dword [rcx + 0xc]
mov r9, qword [rcx]
sub rdx, rax
call qword [r9 + 0x28]
mov qword [rbx + 0x30], rdi
mov dword [rbx + 0xc], edi
mov r8d, dword [rbx + 0xc]
test r8d, r8d
je 0x14008694b
cmp qword [rbx + 0x30], rdi
jne 0x14008694b
mov rax, qword [rbx]
mov rcx, rbx
mov rdx, qword [rbx + 0x38]
call qword [rax + 0x20]
mov dword [rbx + 0xc], edi
mov rax, qword [rbx]
mov rcx, rbx
mov word [rbx + 0x2c], di
call qword [rax + 0x30]
mov r9, qword [rbx]
xor r8d, r8d
mov rdx, rsi
mov rcx, rbx
mov rdi, rax
call qword [r9 + 0x28]
test al, al
je 0x1400869ac
mov rcx, qword [rbx + 0x40]
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
je 0x1400869ac
mov rax, qword [rbx]
cmp rsi, rdi
mov rcx, rbx
cmovl rdi, rsi
xor r8d, r8d
mov rdx, rdi
call qword [rax + 0x28]
mov rax, qword [rbx]
mov rcx, rbx
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp qword [rax + gethostname]
mov rbx, qword [rsp + 0x30]
or rax, 0xffffffffffffffff
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret

Function at 0x140087570
Capabilities:
Read file on windows

Disassembly:
sub rsp, 0x38
mov rcx, qword [rcx + 0x40]
lea r9, [rsp + 0x40]
xor eax, eax
mov dword [rsp + 0x40], eax
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [rsp + 0x40]
add rsp, 0x38
ret
Function at 0x14008a020
Capabilities:
Get file attributes

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x270
mov rdi, rdx
mov rbx, rcx
test rcx, rcx
je 0x14008a106
cmp word [rcx], 0
je 0x14008a106
mov r8d, 4
lea rdx, [0x1400eb0d8]
call fcn.1400b1130
mov r8, rbx
test eax, eax
jne 0x14008a063
lea r8, [rbx + 8]
test r8, r8
je 0x14008a0a0
movzx edx, word [r8]
test dx, dx
je 0x14008a0a0
lea rcx, [0x1400e7be8]
mov eax, 0x3f
nop dword [rax]
cmp dx, ax
je 0x14008a0cb
movzx eax, word [rcx + 2]
add rcx, 2
test ax, ax
jne 0x14008a080
movzx edx, word [r8 + 2]
add r8, 2
test dx, dx
jne 0x14008a071
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ecx, eax
test rdi, rdi
je 0x14008a0b2
mov dword [rdi], eax
xor eax, eax
cmp ecx, 0xffffffff
setne al
mov rbx, qword [rsp + 0x280]
add rsp, 0x270
pop rdi
ret
lea rdx, [rsp + 0x20]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp rax, 0xffffffffffffffff
je 0x14008a106
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_FindClose]
test rdi, rdi
je 0x14008a0f3
mov eax, dword [rsp + 0x20]
mov dword [rdi], eax
mov al, 1
mov rbx, qword [rsp + 0x280]
add rsp, 0x270
pop rdi
ret
xor al, al
mov rbx, qword [rsp + 0x280]
add rsp, 0x270
pop rdi
ret

Function at 0x14008a800
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
push rdi
mov eax, 0x10020
call fcn.1400be170
sub rsp, rax
mov rdi, rdx
mov r8d, 0x7fff
lea rdx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov ebx, eax
test eax, eax
je 0x14008a854
lea r8d, [rax + 1]
mov rcx, rdi
add r8, r8
lea rdx, [rsp + 0x20]
call fcn.1400a7020
mov eax, ebx
mov rbx, qword [rsp + 0x10030]
add rsp, 0x10020
pop rdi
ret
xor eax, eax
mov word [rdi], ax
mov eax, ebx
mov rbx, qword [rsp + 0x10030]
add rsp, 0x10020
pop rdi
ret
Function at 0x14008b0b0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
push r13
push r15
sub rsp, 0x50
xor ebx, ebx
mov esi, r9d
mov r15d, r8d
mov ebp, edx
mov r13, rcx
mov r12d, ebx
test rcx, rcx
je 0x14008b0ec
xor edx, edx
lea r8d, [rbx + 2]
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rdi, rax
jmp 0x14008b0f3
mov rdi, qword [0x140101fd0]
test rdi, rdi
je 0x14008b2ab
mov qword [rsp + 0x80], r14
lea r14, [0x1401043f0]
test ebp, ebp
jns 0x14008b11a
movzx eax, bp
neg ax
movzx edx, ax
jmp 0x14008b150
test ebp, ebp
mov dword [rsp + 0x44], ebx
mov eax, 1
mov qword [rsp + 0x48], r14
cmovne eax, ebp
lea r9, [rsp + 0x40]
lea r8, [0x14008b090]
mov dword [rsp + 0x40], eax
mov edx, SafeArrayGetElemsize
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_EnumResourceNamesW]
mov rdx, qword [rsp + 0x48]
cmp rdx, r14
je 0x14008b274
mov r8d, SafeArrayGetElemsize
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindResourceW]
test rax, rax
je 0x14008b274
mov rdx, rax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
je 0x14008b274
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov r14, rax
test rax, rax
je 0x14008b274
cmp r15d, 0xffffffff
cmovne esi, r15d
test esi, esi
jne 0x14008b1b2
lea ecx, [rsi + 0xb]
call qword [sym.imp.USER32.dll_GetSystemMetrics]
mov esi, eax
movzx eax, word [r14 + 4]
lea rcx, [r14 + 6]
cmp eax, 1
jbe 0x14008b205
lea r8, [rcx + 0xe]
dec eax
mov r9, r8
mov r10d, eax
nop dword [rax]
movzx eax, byte [r8]
movzx edx, byte [rcx]
cmp al, dl
jbe 0x14008b1e7
movzx eax, dl
mov edx, ebx
cmp eax, esi
setl dl
jmp 0x14008b1f1
movzx eax, al
mov edx, ebx
cmp eax, esi
setge dl
test edx, edx
cmovne rcx, r9
add r9, 0xe
add r8, 0xe
sub r10, 1
jne 0x14008b1d0
movzx edx, word [rcx + 0xc]
mov r8d, 3
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rsi, rax
test rax, rax
je 0x14008b274
mov rdx, rax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
je 0x14008b274
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov r14, rax
test rax, rax
je 0x14008b274
mov rdx, rsi
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [rsp + 0x30], ebx
mov r9d, 0x30000
mov edx, eax
mov dword [rsp + 0x28], ebx
mov r8d, 1
mov dword [rsp + 0x20], ebx
mov rcx, r14
call qword [sym.imp.USER32.dll_CreateIconFromResourceEx]
mov r12, rax
mov rcx, qword [rsp + 0xa0]
mov r14, qword [rsp + 0x80]
test rcx, rcx
je 0x14008b293
test r12, r12
je 0x14008b293
mov qword [rcx], rdi
jmp 0x14008b2a1
test r13, r13
je 0x14008b2a1
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
test r12, r12
je 0x14008b2ab
mov rax, r12
jmp 0x14008b2c8
test ebp, ebp
jle 0x14008b2b4
lea ebx, [rbp - 1]
jmp 0x14008b2ba
cmp ebp, 0xffffffff
cmovl ebx, ebp
mov r8d, ebx
mov rdx, r13
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ExtractIconW]
lea r11, [rsp + 0x50]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r13
pop r12
pop rdi
pop rsi
ret
Function at 0x14008bca0
Capabilities:
Write clipboard data

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x30
cmp byte [rdx + 0x23], 0
mov rbx, rdx
mov rdi, rcx
jne 0x14008bcba
mov rbx, qword [rdx + 0x10]
cmp byte [rcx + 0x23], 0
jne 0x14008bcc4
mov rdi, qword [rcx + 0x10]
movzx eax, byte [rbx + 0x21]
test al, 0x10
je 0x14008bd46
test al, 8
jne 0x14008bd41
mov rdx, qword [rbx + 8]
mov r8, qword [rbx + 0x10]
shr r8, 1
movzx eax, word [rdx]
movzx ecx, word [rdx + r8*2 - 2]
cmp eax, 0x20
je 0x14008bd02
cmp eax, 9
je 0x14008bd02
cmp ecx, 0x20
je 0x14008bd02
cmp ecx, 9
je 0x14008bd02
cmp eax, 0x30
je 0x14008bd02
cmp eax, 0x2b
jne 0x14008bd41
xor r9d, r9d
mov byte [rsp + 0x20], 1
mov rcx, rdi
call fcn.14008c590
test eax, eax
jne 0x14008bd23
xor eax, eax
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
mov r8b, reloc.OLEAUT32.dll_SafeArrayGetDim
mov rdx, qword [rbx]
mov rcx, rdi
call fcn.1400012a0
mov eax, 1
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
mov r8b, reloc.OLEAUT32.dll_SafeArrayGetElement
jmp 0x14008bd26
test al, 0x20
je 0x14008bd98
mov rcx, rdi
test al, 8
jne 0x14008bd84
mov r8, qword [rbx + 0x10]
xor r9d, r9d
mov rdx, qword [rbx + 8]
shr r8, 1
mov byte [rsp + 0x20], 1
call fcn.14008c590
test eax, eax
je 0x14008bd16
movsd xmm0, qword [rbx]
mov r8b, 0x20
movsd qword [rsp + 0x40], xmm0
mov rcx, rdi
mov rdx, qword [rsp + 0x40]
jmp 0x14008bd2c
movsd xmm0, qword [rbx]
mov r8b, 0x28
movsd qword [rsp + 0x40], xmm0
mov rdx, qword [rsp + 0x40]
jmp 0x14008bd2c
test al, 1
je 0x14008bdb1
mov rdx, rbx
mov rcx, rdi
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
jmp fcn.14008c2c0
test al, 2
je 0x14008bdd6
mov rbx, qword [rbx]
mov rcx, rbx
mov rax, qword [rbx]
call qword [rax + VariantCopy]
mov rdx, rbx
mov rcx, rdi
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
jmp fcn.14008c910
cmp byte [rbx + 0x23], 0
jne 0x14008bde2
mov rax, qword [rbx + 0x10]
jmp 0x14008bde5
mov rax, rbx
test byte [rax + 0x21], 4
je 0x14008bdf3
mov rdx, rbx
call fcn.140037a70
mov r8, qword [rbx + 0x10]
xor r9d, r9d
mov rdx, qword [rbx + 8]
mov rcx, rdi
shr r8, 1
mov byte [rsp + 0x20], 1
call fcn.14008c590
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
Function at 0x14008be20
Capabilities:
Write clipboard data

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov r8d, dword [rdx + 0x10]
mov rbx, rdx
mov rdi, rcx
sub r8d, 1
je 0x14008bf05
sub r8d, 1
je 0x14008bef1
sub r8d, 2
je 0x14008bedf
sub r8d, 1
je 0x14008be7f
cmp r8d, 1
jne 0x14008bec0
mov rbx, qword [rdx]
mov rcx, rbx
mov rax, qword [rbx]
call qword [rax + VariantCopy]
mov rdx, rbx
mov rcx, rdi
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
jmp fcn.14008c910
mov rdx, qword [rdx + 8]
test rdx, rdx
je 0x14008bec0
mov rax, qword [rbx]
cmp word [rax], 0x30
jne 0x14008bf05
xor r9d, r9d
mov byte [rsp + 0x20], 1
or r8, 0xffffffffffffffff
mov rdx, rax
call fcn.14008c590
test eax, eax
jne 0x14008beb4
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
mov rdx, qword [rbx + 8]
mov r8b, reloc.OLEAUT32.dll_SafeArrayGetDim
mov rcx, rdi
jmp 0x14008bf08
mov rdx, qword [rbx]
xor r9d, r9d
or r8, 0xffffffffffffffff
mov byte [rsp + 0x20], 1
call fcn.14008c590
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
mov rdx, qword [rdx]
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
jmp fcn.14008bca0
movsd xmm0, qword [rdx]
mov r8b, 0x28
movsd qword [rsp + 0x48], xmm0
mov rdx, qword [rsp + 0x48]
jmp 0x14008bf0b
mov r8b, reloc.OLEAUT32.dll_SafeArrayGetElement
mov rdx, qword [rdx]
call fcn.1400012a0
mov rbx, qword [rsp + 0x40]
mov eax, 1
add rsp, 0x30
pop rdi
ret

Function at 0x14008c2c0
Capabilities:
Write clipboard data

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
cmp byte [rcx + 0x23], 0
mov rdi, rdx
mov rbx, rcx
jne 0x14008c2e0
mov rbx, qword [rbx + 0x10]
cmp byte [rbx + 0x23], 0
je 0x14008c2d6
cmp byte [rdx + 0x23], 0
jne 0x14008c2ea
mov rdi, qword [rdx + 0x10]
mov rcx, rdi
call fcn.140001340
cmp byte [rbx + 0x23], 1
jne 0x14008c357
cmp rbx, rdi
je 0x14008c347
mov rax, qword [rdi + 0x10]
mov r9b, 1
mov r8, rax
mov byte [rsp + 0x20], 0
shr r8, 1
and eax, 1
add r8, rax
xor edx, edx
mov rcx, rbx
call fcn.14008c590
test eax, eax
jne 0x14008c32e
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
mov r8, qword [rdi + 0x10]
mov rdx, qword [rdi + 8]
add r8, 2
mov rcx, qword [rbx + 8]
call fcn.1400a7020
or byte [rbx + 0x21], 1
mov eax, 1
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
mov rdx, qword [rdi + 0x10]
mov rcx, qword [rdi + 8]
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
jmp fcn.14008c370
Function at 0x14008c370
Capabilities:
Write clipboard data

Disassembly:
push rbx
push rsi
sub rsp, 0x28
mov rsi, rcx
mov rbx, rdx
lea rcx, [0x140105138]
call fcn.140005310
test eax, eax
jne 0x14008c3ad
lea r8, [0x1400ccf5c]
lea rdx, str.Cant_open_clipboard_for_writing.
lea rcx, [0x1401044f0]
add rsp, 0x28
pop rsi
pop rbx
jmp fcn.140036f00
mov qword [rsp + 0x40], rbp
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x50], r12
mov qword [rsp + 0x58], r14
mov qword [rsp + 0x20], r15
call qword [sym.imp.USER32.dll_EmptyClipboard]
lea r14, [rsi + rbx]
xor r12d, r12d
lea rbx, [rsi + 4]
cmp rbx, r14
ja 0x14008c472
mov r15d, dword [rsi]
test r15d, r15d
je 0x14008c472
mov rax, rbx
add rbx, 8
cmp rbx, r14
ja 0x14008c472
mov edi, dword [rax]
mov rsi, rbx
add rbx, rdi
cmp rbx, r14
ja 0x14008c472
mov rdx, r12
test rdi, rdi
mov ecx, 0x42
sete dl
add rdx, rdi
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov rbp, rax
test rax, rax
je 0x14008c530
test rdi, rdi
je 0x14008c459
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GlobalLock]
test rax, rax
je 0x14008c4d1
mov r8d, edi
mov rdx, rsi
mov rcx, rax
call fcn.1400a7020
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov rsi, rbx
mov rdx, rbp
mov ecx, r15d
call qword [sym.imp.USER32.dll_SetClipboardData]
lea rbx, [rsi + 4]
cmp rbx, r14
jbe 0x14008c3e0
cmp dword [0x140105164], r12d
je 0x14008c4ac
cmp qword [0x140105148], r12
je 0x14008c498
mov rcx, qword [0x140105138]
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov qword [0x140105148], r12
call qword [sym.imp.USER32.dll_CloseClipboard]
mov dword [0x140105164], r12d
mov qword [0x140105138], r12
mov eax, 1
mov r14, qword [rsp + 0x58]
mov r12, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x40]
mov r15, qword [rsp + 0x20]
add rsp, 0x28
pop rsi
pop rbx
ret
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_GlobalFree]
cmp dword [0x140105164], r12d
je 0x14008c514
cmp qword [0x140105148], r12
je 0x14008c500
mov rcx, qword [0x140105138]
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov qword [0x140105148], r12
call qword [sym.imp.USER32.dll_CloseClipboard]
mov dword [0x140105164], r12d
mov qword [0x140105138], r12
lea r8, [0x1400ccf5c]
lea rdx, [0x1400cd298]
lea rcx, [0x1401044f0]
call fcn.140036f00
jmp 0x14008c4b1
cmp dword [0x140105164], r12d
je 0x14008c56a
cmp qword [0x140105148], r12
je 0x14008c556
mov rcx, qword [0x140105138]
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov qword [0x140105148], r12
call qword [sym.imp.USER32.dll_CloseClipboard]
mov dword [0x140105164], r12d
mov qword [0x140105138], r12
lea r8, [0x1400ccf5c]
lea rdx, str.Out_of_memory.
lea rcx, [0x1401044f0]
call fcn.140036f00
jmp 0x14008c4b1