joyce8/EMBER2024-capa huggingface dataset:
Function at 0x61c5f850
Capabilities:
Create thread
Resume thread

Disassembly:
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x40
mov rdi, rcx
mov rsi, rdx
mov rbx, r8
mov rbp, r9
call fcn.61c5df10
mov r12, rax
test rax, rax
je 0x61c5fac0
test rdi, rdi
je 0x61c5f88a
mov rax, qword [rax + 0x1d8]
mov qword [rdi], rax
mov r13, qword [sym.imp.KERNEL32.dll_Sleep]
mov qword [r12 + 8], rbp
mov dword [r12 + 0x44], 1
mov rbp, qword [sym.imp.KERNEL32.dll_CreateEventA]
mov dword [r12 + 0xbc], 0
mov r14, r13
mov qword [r12 + 0x28], 0xffffffffffffffff
mov qword [r12 + 0x10], rbx
xor ebx, ebx
xor r9d, r9d
xor r8d, r8d
mov edx, 1
xor ecx, ecx
call rbp
mov qword [r12 + 0x30], rax
test rax, rax
jne 0x61c5f900
test ebx, ebx
je 0x61c5f8f8
mov ecx, 0x14
call r14
cmp ebx, 4
je 0x61c5f900
add ebx, 1
jmp 0x61c5f8c5
xor ecx, ecx
call r13
jmp 0x61c5f8ef
mov qword [r12 + 0x38], 0xffffffffffffffff
lea r14, [r12 + 0x68]
mov rcx, r14
call fcn.61c5e070
cmp qword [r12 + 0x30], 0
mov dword [r12], 0xbab1f00d
mov dword [r12 + 0xc0], 0
mov dword [r12 + 0xb8], 0
je 0x61c5fa6c
xor edx, edx
test rsi, rsi
je 0x61c5f966
mov eax, dword [rsi]
mov edx, dword [rsi + 0x10]
mov dword [r12 + 0x44], eax
test al, 8
jne 0x61c5fa98
mov eax, dword [rsi + 0x18]
mov dword [r12 + 0xc0], eax
lea r8, [0x61c5e5e0]
mov r9, r12
xor ecx, ecx
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 4
call qword [sym.imp.msvcrt.dll__beginthreadex]
mov r13, rax
lea rax, [rax - 1]
cmp rax, 0xfffffffffffffffd
ja 0x61c5fa38
mov eax, dword [r12 + 0xc0]
mov edx, 0xfffffff1
cmp eax, 0xfffffff2
jge 0x61c5fa10
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov rcx, qword [r12 + 0x30]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
test byte [r12 + 0x44], 4
jne 0x61c5f9f0
mov qword [r12 + 0x28], r13
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_ResumeThread]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_Sleep]
xor eax, eax
add rsp, 0x40
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
mov qword [r12 + 0x28], 0
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x61c5f9d6
mov edx, 0xfffffffe
cmp eax, 0xffffffff
jl 0x61c5f9ac
mov edx, 0xf
cmp eax, 0xe
jg 0x61c5f9ac
cmp eax, 2
mov edx, 2
cmovle edx, eax
jmp 0x61c5f9ac
mov rcx, qword [r12 + 0x30]
test rcx, rcx
je 0x61c5fa48
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [r12 + 0x38]
call fcn.61c5d750
mov rcx, r14
call fcn.61c5e070
mov qword [r12 + 0x30], 0
mov qword [r12 + 0x28], 0
test rdi, rdi
je 0x61c5fa78
mov qword [rdi], 0
mov rcx, r12
call fcn.61c5dc60
mov eax, 0xb
add rsp, 0x40
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
mov dword [rsp + 0x3c], edx
call fcn.61c5e130
mov edx, dword [rsp + 0x3c]
mov eax, dword [rax + 0xc0]
mov dword [r12 + 0xc0], eax
jmp 0x61c5f966
mov eax, 0xb
add rsp, 0x40
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
Function at 0x61c71d50
Capabilities:
Query environment variable

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x1d0
mov rbx, rcx
lea rcx, str.FREETYPE_PROPERTIES
call sub.msvcrt.dll_getenv
test rax, rax
je 0x61c71ebf
movzx edx, byte [rax]
test dl, dl
je 0x61c71ebf
lea rbp, [rsp + 0x140]
lea rdi, [rsp + 0xb0]
lea rsi, [rsp + 0x20]
nop dword [rax]
cmp dl, 0x20
je 0x61c71ed0
cmp dl, 9
je 0x61c71ed0
mov r10, rax
xor edx, edx
jmp 0x61c71dd5
cmp cl, 0x3a
je 0x61c71de0
mov byte [rdx + rsi], cl
add rdx, 1
add r10, 1
cmp rdx, 0x80
je 0x61c71ed8
movzx ecx, byte [r10]
movsxd r8, edx
test cl, cl
jne 0x61c71db8
mov byte [rsp + r8 + 0x20], 0
cmp byte [r10], 0x3a
jne 0x61c71ebf
cmp r10, rax
je 0x61c71ebf
add r10, 1
xor eax, eax
mov rcx, r10
jmp 0x61c71e24
cmp dl, 0x3d
je 0x61c71e2e
mov byte [rax + rdi], dl
add rax, 1
add rcx, 1
cmp rax, 0x80
je 0x61c71ee3
movzx edx, byte [rcx]
movsxd r8, eax
test dl, dl
jne 0x61c71e08
mov byte [rsp + r8 + 0xb0], 0
cmp byte [rcx], 0x3d
jne 0x61c71ebf
cmp rcx, r10
je 0x61c71ebf
add rcx, 1
xor eax, eax
mov r12, rcx
jmp 0x61c71e6c
cmp dl, 9
je 0x61c71e79
mov byte [rax + rbp], dl
add rax, 1
add r12, 1
cmp rax, 0x80
je 0x61c71eee
movzx edx, byte [r12]
movsxd r8, eax
test dl, 0xdf
jne 0x61c71e50
mov byte [rsp + r8 + 0x140], 0
movzx eax, byte [r12]
test al, 0xdf
je 0x61c71e8f
cmp al, 9
jne 0x61c71ebf
cmp r12, rcx
je 0x61c71ebf
mov r9, rbp
mov r8, rdi
mov rdx, rsi
mov rcx, rbx
call fcn.61d817d0
cmp byte [r12], 0
je 0x61c71ebf
movzx edx, byte [r12 + 1]
lea rax, [r12 + 1]
test dl, dl
jne 0x61c71d98
add rsp, 0x1d0
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov r12, rax
jmp 0x61c71eac
mov r8d, pe_nt_image_headers64
jmp 0x61c71de0
mov r8d, pe_nt_image_headers64
jmp 0x61c71e2e
mov r8d, pe_nt_image_headers64
jmp 0x61c71e79
Function at 0x61c73230
Capabilities:
Get file size
Read file on windows
Read file via mapping

Disassembly:
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x50
mov rbx, rcx
mov rsi, rdx
test rcx, rcx
je 0x61c73390
mov qword [rsp + 0x30], 0
xor r9d, r9d
mov r8d, 1
mov rcx, rsi
mov dword [rsp + 0x28], pe_nt_image_headers64
mov edx, 0x80000000
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov r12, rax
mov eax, 1
cmp r12, 0xffffffffffffffff
je 0x61c73351
lea rdx, [rsp + 0x48]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x61c73360
mov rax, qword [rsp + 0x48]
cmp rax, 0x7fffffff
jg 0x61c73360
test rax, rax
je 0x61c73360
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor edx, edx
mov rcx, r12
mov qword [rsp + 0x28], 0
mov r8d, 2
call qword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov r13, rax
test rax, rax
je 0x61c73360
mov eax, dword [rsp + 0x48]
xor r9d, r9d
xor r8d, r8d
mov edx, 4
mov rcx, r13
mov dword [rbx + 0xc], 0
mov dword [rbx + 8], eax
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov rdi, qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, r13
mov qword [rbx], rax
call rdi
cmp qword [rbx], 0
je 0x61c733a8
lea rax, [0x61d7e100]
mov qword [rbx + 0x28], rax
mov rcx, r12
call rdi
mov rax, qword [rbx]
mov qword [rbx + 0x18], rsi
mov qword [rbx + 0x20], 0
mov qword [rbx + 0x10], rax
xor eax, eax
add rsp, 0x50
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
mov rdi, qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, r12
call rdi
mov eax, 0x51
mov qword [rbx], 0
mov qword [rbx + 8], 0
add rsp, 0x50
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
mov eax, 0x28
add rsp, 0x50
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
mov rax, qword [rbx + 0x30]
movsxd r8, dword [rbx + 8]
xor edx, edx
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov qword [rbx], rax
test rax, rax
je 0x61c73367
mov r8d, dword [rbx + 8]
mov r13, qword [sym.imp.KERNEL32.dll_ReadFile]
xor ebp, ebp
lea r14, [rsp + 0x44]
jmp 0x61c733f0
mov r8d, dword [rbx + 8]
add ebp, dword [rsp + 0x44]
cmp r8d, ebp
je 0x61c73428
mov rax, qword [rbx]
mov edx, ebp
sub r8d, ebp
mov r9, r14
mov rcx, r12
mov qword [rsp + 0x20], 0
add rdx, rax
call r13
test eax, eax
jne 0x61c733e0
mov rax, qword [rbx + 0x30]
mov r8, qword [rbx]
xor edx, edx
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x61c73367
lea rax, [0x61d7e0c0]
mov qword [rbx + 0x28], rax
jmp 0x61c73337

Function at 0x61c87360
Capabilities:
Query environment variable

Disassembly:
mov r9d, r8d
mov r8, rdx
mov rdx, rcx
lea rcx, [0x61e07a0e]
jmp fcn.61c881f0

Function at 0x61c873a0
Capabilities:
Query environment variable

Disassembly:
lea r8, str.src_Window.cpp
mov r9d, edx
mov rdx, rcx
lea rcx, [0x61e0756d]
jmp fcn.61c87fa0
Function at 0x61c87c90
Capabilities:
Query environment variable

Disassembly:
push r12
push rbx
sub rsp, 0x28
mov r12, rcx
lea rcx, section..rdata
mov rbx, rdx
call sub.msvcrt.dll_getenv
test rax, rax
je 0x61c87cd1
lea rdx, [0x61e0601b]
mov rcx, r12
call sub.msvcrt.dll_fopen
test rax, rax
jne 0x61c87cd4
jmp 0x61c87cd1
mov rax, rbx
add rsp, 0x28
pop rbx
pop r12
ret

Function at 0x61c87ce0
Capabilities:
Query environment variable

Disassembly:
push r12
push rbx
sub rsp, 0x28
mov r12, rcx
lea rcx, [0x61e06530]
mov rbx, rdx
call sub.msvcrt.dll_getenv
test rax, rax
je 0x61c87d21
lea rdx, [0x61e0654b]
mov rcx, r12
call sub.msvcrt.dll_fopen
test rax, rax
jne 0x61c87d24
jmp 0x61c87d21
mov rax, rbx
add rsp, 0x28
pop rbx
pop r12
ret

Function at 0x61c87d30
Capabilities:
Query environment variable

Disassembly:
push r12
push rbx
sub rsp, 0x28
mov r12, rcx
lea rcx, [0x61e07740]
mov rbx, rdx
call sub.msvcrt.dll_getenv
test rax, rax
je 0x61c87d71
lea rdx, [0x61e0775b]
mov rcx, r12
call sub.msvcrt.dll_fopen
test rax, rax
jne 0x61c87d74
jmp 0x61c87d71
mov rax, rbx
add rsp, 0x28
pop rbx
pop r12
ret

Function at 0x61c87fa0
Capabilities:
Query environment variable

Disassembly:
push r12
push rsi
push rbx
sub rsp, 0x40
mov qword [rsp + 0x68], rdx
mov r12, rcx
mov qword [rsp + 0x70], r8
mov qword [rsp + 0x78], r9
mov al, byte [0x61df9340]
test al, al
mov rsi, qword [fcn.61c5bb10]
jne 0x61c88034
lea rcx, [0x61df9340]
call fcn.61cb3c30
test eax, eax
je 0x61c88034
mov ecx, 2
call rsi
lea rcx, [0x61e07510]
mov rbx, rax
call sub.msvcrt.dll_getenv
test rax, rax
je 0x61c88010
lea rdx, [0x61e0752b]
lea rcx, [0x61e0752e]
call sub.msvcrt.dll_fopen
test rax, rax
cmovne rbx, rax
lea rcx, [0x61df9340]
mov qword [0x61df96d0], rbx
call fcn.61cb3d40
jmp 0x61c88034
lea rax, [rsp + 0x68]
mov ecx, 1
mov qword [rsp + 0x38], rax
call rsi
mov r8, qword [rsp + 0x38]
mov rcx, qword [0x61df96d0]
mov qword [rsp + 0x28], r8
cmp rcx, rax
jne 0x61c88084
lea rdx, [0x61e07543]
call fcn.61c872d0
mov r8, qword [rsp + 0x28]
mov rcx, qword [0x61df96d0]
mov rdx, r12
call fcn.61c4e2d0
lea rdx, [0x61e0754f]
jmp 0x61c880ab
lea rdx, [0x61e07555]
call fcn.61c872d0
mov r8, qword [rsp + 0x28]
mov rcx, qword [0x61df96d0]
mov rdx, r12
call fcn.61c4e2d0
lea rdx, [0x61e0755c]
mov rcx, qword [0x61df96d0]
call fcn.61c872d0
mov rcx, qword [0x61df96d0]
call sub.msvcrt.dll_fflush
jmp 0x61c880d3
add rsp, 0x40
pop rbx
pop rsi
pop r12
ret
Function at 0x61c881f0
Capabilities:
Query environment variable

Disassembly:
push r12
push rsi
push rbx
sub rsp, 0x40
mov qword [rsp + 0x68], rdx
mov r12, rcx
mov qword [rsp + 0x70], r8
mov qword [rsp + 0x78], r9
mov al, byte [0x61df9360]
test al, al
mov rsi, qword [fcn.61c5bb10]
jne 0x61c88284
lea rcx, [0x61df9360]
call fcn.61cb3c30
test eax, eax
je 0x61c88284
mov ecx, 2
call rsi
lea rcx, [0x61e079c0]
mov rbx, rax
call sub.msvcrt.dll_getenv
test rax, rax
je 0x61c88260
lea rdx, [0x61e079db]
lea rcx, [0x61e079de]
call sub.msvcrt.dll_fopen
test rax, rax
cmovne rbx, rax
lea rcx, [0x61df9360]
mov qword [0x61df96f0], rbx
call fcn.61cb3d40
jmp 0x61c88284
lea rax, [rsp + 0x68]
mov ecx, 1
mov qword [rsp + 0x38], rax
call rsi
mov r8, qword [rsp + 0x38]
mov rcx, qword [0x61df96f0]
mov qword [rsp + 0x28], r8
cmp rcx, rax
jne 0x61c882d4
lea rdx, [0x61e079f3]
call fcn.61c872d0
mov r8, qword [rsp + 0x28]
mov rcx, qword [0x61df96f0]
mov rdx, r12
call fcn.61c4e2d0
lea rdx, [0x61e079ff]
jmp 0x61c882fb
lea rdx, [0x61e07a05]
call fcn.61c872d0
mov r8, qword [rsp + 0x28]
mov rcx, qword [0x61df96f0]
mov rdx, r12
call fcn.61c4e2d0
lea rdx, [0x61e07a0c]
mov rcx, qword [0x61df96f0]
call fcn.61c872d0
mov rcx, qword [0x61df96f0]
call sub.msvcrt.dll_fflush
jmp 0x61c88323
add rsp, 0x40
pop rbx
pop rsi
pop r12
ret

Function at 0x61c88330
Capabilities:
Query environment variable

Disassembly:
push r12
push rsi
push rbx
sub rsp, 0x40
mov qword [rsp + 0x68], rdx
mov r12, rcx
mov qword [rsp + 0x70], r8
mov qword [rsp + 0x78], r9
mov al, byte [0x61df9370]
test al, al
mov rsi, qword [fcn.61c5bb10]
jne 0x61c883c4
lea rcx, [0x61df9370]
call fcn.61cb3c30
test eax, eax
je 0x61c883c4
mov ecx, 2
call rsi
lea rcx, str.DPF_CAPTURE_CONSOLE_OUTPUT
mov rbx, rax
call sub.msvcrt.dll_getenv
test rax, rax
je 0x61c883a0
lea rdx, [0x61e07ee8]
lea rcx, [0x61e07eeb]
call sub.msvcrt.dll_fopen
test rax, rax
cmovne rbx, rax
lea rcx, [0x61df9370]
mov qword [0x61df9700], rbx
call fcn.61cb3d40
jmp 0x61c883c4
lea rax, [rsp + 0x68]
mov ecx, 1
mov qword [rsp + 0x38], rax
call rsi
mov r8, qword [rsp + 0x38]
mov rcx, qword [0x61df9700]
mov qword [rsp + 0x28], r8
cmp rcx, rax
jne 0x61c88414
lea rdx, [0x61e07f00]
call fcn.61c872d0
mov r8, qword [rsp + 0x28]
mov rcx, qword [0x61df9700]
mov rdx, r12
call fcn.61c4e2d0
lea rdx, [0x61e07f0c]
jmp 0x61c8843b
lea rdx, [0x61e07f12]
call fcn.61c872d0
mov r8, qword [rsp + 0x28]
mov rcx, qword [0x61df9700]
mov rdx, r12
call fcn.61c4e2d0
lea rdx, [0x61e07f19]
mov rcx, qword [0x61df9700]
call fcn.61c872d0
mov rcx, qword [0x61df9700]
call sub.msvcrt.dll_fflush
jmp 0x61c88463
add rsp, 0x40
pop rbx
pop rsi
pop r12
ret
Function at 0x61c88470
Capabilities:
Query environment variable

Disassembly:
push r12
push rsi
push rbx
sub rsp, 0x40
mov qword [rsp + 0x68], rdx
mov r12, rcx
mov qword [rsp + 0x70], r8
mov qword [rsp + 0x78], r9
mov al, byte [0x61df9380]
test al, al
mov rsi, qword [fcn.61c5bb10]
jne 0x61c88504
lea rcx, [0x61df9380]
call fcn.61cb3c30
test eax, eax
je 0x61c88504
mov ecx, 2
call rsi
lea rcx, [0x61e083a0]
mov rbx, rax
call sub.msvcrt.dll_getenv
test rax, rax
je 0x61c884e0
lea rdx, [0x61e083bb]
lea rcx, str._tmp_dpf.stderr2.log
call sub.msvcrt.dll_fopen
test rax, rax
cmovne rbx, rax
lea rcx, [0x61df9380]
mov qword [0x61df9710], rbx
call fcn.61cb3d40
jmp 0x61c88504
lea rax, [rsp + 0x68]
mov ecx, 1
mov qword [rsp + 0x38], rax
call rsi
mov r8, qword [rsp + 0x38]
mov rcx, qword [0x61df9710]
mov qword [rsp + 0x28], r8
cmp rcx, rax
jne 0x61c88554
lea rdx, str.e_31m_dpf_
call fcn.61c872d0
mov r8, qword [rsp + 0x28]
mov rcx, qword [0x61df9710]
mov rdx, r12
call fcn.61c4e2d0
lea rdx, str.e_0m_n
jmp 0x61c8857b
lea rdx, str._dpf_
call fcn.61c872d0
mov r8, qword [rsp + 0x28]
mov rcx, qword [0x61df9710]
mov rdx, r12
call fcn.61c4e2d0
lea rdx, [0x61e083ec]
mov rcx, qword [0x61df9710]
call fcn.61c872d0
mov rcx, qword [0x61df9710]
call sub.msvcrt.dll_fflush
jmp 0x61c885a3
add rsp, 0x40
pop rbx
pop rsi
pop r12
ret

Function at 0x61c88700
Capabilities:
Query environment variable

Disassembly:
push rsi
push rbx
sub rsp, 0x48
mov qword [rsp + 0x68], rdx
mov qword [rsp + 0x70], r8
mov qword [rsp + 0x78], r9
mov al, byte [0x61df9300]
test al, al
mov rsi, qword [fcn.61c5bb10]
jne 0x61c8878f
lea rcx, [0x61df9300]
call fcn.61cb3c30
test eax, eax
je 0x61c8878f
mov ecx, 2
call rsi
lea rcx, [0x61e07160]
mov rbx, rax
call sub.msvcrt.dll_getenv
test rax, rax
je 0x61c8876b
lea rdx, [0x61e0717b]
lea rcx, [0x61e0717e]
call sub.msvcrt.dll_fopen
test rax, rax
cmovne rbx, rax
lea rcx, [0x61df9300]
mov qword [0x61df9690], rbx
call fcn.61cb3d40
jmp 0x61c8878f
lea rax, [rsp + 0x68]
mov ecx, 1
mov qword [rsp + 0x38], rax
call rsi
mov r8, qword [rsp + 0x38]
mov r9, qword [0x61df9690]
mov rcx, rax
mov qword [rsp + 0x28], r8
cmp rax, r9
jne 0x61c887e6
lea rdx, [0x61e07193]
call fcn.61c872d0
mov r8, qword [rsp + 0x28]
mov rcx, qword [0x61df9690]
lea rdx, [0x61e0719f]
call fcn.61c4e2d0
lea rdx, [0x61e071cb]
jmp 0x61c88814
mov rcx, r9
lea rdx, [0x61e071d1]
call fcn.61c872d0
mov r8, qword [rsp + 0x28]
mov rcx, qword [0x61df9690]
lea rdx, [0x61e0719f]
call fcn.61c4e2d0
lea rdx, [0x61e071d8]
mov rcx, qword [0x61df9690]
call fcn.61c872d0
mov rcx, qword [0x61df9690]
call sub.msvcrt.dll_fflush
jmp 0x61c8883c
add rsp, 0x48
pop rbx
pop rsi
ret
Function at 0x61c88850
Capabilities:
Query environment variable

Disassembly:
push rsi
push rbx
sub rsp, 0x48
mov qword [rsp + 0x68], rdx
mov qword [rsp + 0x70], r8
mov qword [rsp + 0x78], r9
mov al, byte [0x61df9310]
test al, al
mov rsi, qword [fcn.61c5bb10]
jne 0x61c888df
lea rcx, [0x61df9310]
call fcn.61cb3c30
test eax, eax
je 0x61c888df
mov ecx, 2
call rsi
lea rcx, [0x61e07280]
mov rbx, rax
call sub.msvcrt.dll_getenv
test rax, rax
je 0x61c888bb
lea rdx, [0x61e0729b]
lea rcx, [0x61e0729e]
call sub.msvcrt.dll_fopen
test rax, rax
cmovne rbx, rax
lea rcx, [0x61df9310]
mov qword [0x61df96a0], rbx
call fcn.61cb3d40
jmp 0x61c888df
lea rax, [rsp + 0x68]
mov ecx, 1
mov qword [rsp + 0x38], rax
call rsi
mov r8, qword [rsp + 0x38]
mov r9, qword [0x61df96a0]
mov rcx, rax
mov qword [rsp + 0x28], r8
cmp rax, r9
jne 0x61c88936
lea rdx, [0x61e072b3]
call fcn.61c872d0
mov r8, qword [rsp + 0x28]
mov rcx, qword [0x61df96a0]
lea rdx, [0x61e072bf]
call fcn.61c4e2d0
lea rdx, [0x61e072eb]
jmp 0x61c88964
mov rcx, r9
lea rdx, [0x61e072f1]
call fcn.61c872d0
mov r8, qword [rsp + 0x28]
mov rcx, qword [0x61df96a0]
lea rdx, [0x61e072bf]
call fcn.61c4e2d0
lea rdx, [0x61e072f8]
mov rcx, qword [0x61df96a0]
call fcn.61c872d0
mov rcx, qword [0x61df96a0]
call sub.msvcrt.dll_fflush
jmp 0x61c8898c
add rsp, 0x48
pop rbx
pop rsi
ret

Function at 0x61c88af0
Capabilities:
Query environment variable

Disassembly:
push rsi
push rbx
sub rsp, 0x48
mov qword [rsp + 0x68], rdx
mov qword [rsp + 0x70], r8
mov qword [rsp + 0x78], r9
mov al, byte [0x61df9330]
test al, al
mov rsi, qword [fcn.61c5bb10]
jne 0x61c88b7f
lea rcx, [0x61df9330]
call fcn.61cb3c30
test eax, eax
je 0x61c88b7f
mov ecx, 2
call rsi
lea rcx, [0x61e07460]
mov rbx, rax
call sub.msvcrt.dll_getenv
test rax, rax
je 0x61c88b5b
lea rdx, [0x61e0747b]
lea rcx, [0x61e0747e]
call sub.msvcrt.dll_fopen
test rax, rax
cmovne rbx, rax
lea rcx, [0x61df9330]
mov qword [0x61df96c0], rbx
call fcn.61cb3d40
jmp 0x61c88b7f
lea rax, [rsp + 0x68]
mov ecx, 1
mov qword [rsp + 0x38], rax
call rsi
mov r8, qword [rsp + 0x38]
mov r9, qword [0x61df96c0]
mov rcx, rax
mov qword [rsp + 0x28], r8
cmp rax, r9
jne 0x61c88bd6
lea rdx, [0x61e07493]
call fcn.61c872d0
mov r8, qword [rsp + 0x28]
mov rcx, qword [0x61df96c0]
lea rdx, [0x61e0749f]
call fcn.61c4e2d0
lea rdx, [0x61e074cb]
jmp 0x61c88c04
mov rcx, r9
lea rdx, [0x61e074d1]
call fcn.61c872d0
mov r8, qword [rsp + 0x28]
mov rcx, qword [0x61df96c0]
lea rdx, [0x61e0749f]
call fcn.61c4e2d0
lea rdx, [0x61e074d8]
mov rcx, qword [0x61df96c0]
call fcn.61c872d0
mov rcx, qword [0x61df96c0]
call sub.msvcrt.dll_fflush
jmp 0x61c88c2c
add rsp, 0x48
pop rbx
pop rsi
ret
Function at 0x61c8a000
Capabilities:
Query environment variable

Disassembly:
mov r8, rdx
test rdx, rdx
je 0x61c8a01f
cmp byte [rdx], 0
je 0x61c8a01f
mov rcx, qword [rcx]
test rcx, rcx
je 0x61c8a03f
mov edx, 1
jmp fcn.61c91750
mov r9d, 0xc0
lea r8, str.src_ApplicationPrivateData.cpp
lea rdx, str.name___nullptr__name_0____0
lea rcx, [0x61e0719f]
jmp fcn.61c88700
ret
mov rcx, qword [rcx + 8]
jmp 0x61c8a000

Function at 0x61c8a060
Capabilities:
Query environment variable

Disassembly:
mov eax, dword [rcx + 0x10]
test eax, eax
jne 0x61c8a087
mov r9d, 0x70
lea r8, str.src_ApplicationPrivateData.cpp
lea rdx, str.visibleWindows___0
lea rcx, [0x61e0719f]
jmp fcn.61c88700
dec eax
mov dword [rcx + 0x10], eax
jne 0x61c8a092
mov byte [rcx + 9], 1
ret

Function at 0x61c8a1b0
Capabilities:
Query environment variable

Disassembly:
push r14
push r13
push r12
push rsi
push rbx
sub rsp, 0x20
cmp dl, 1
mov esi, edx
mov rbx, rcx
sbb edx, edx
lea r13, [rbx + 0x20]
lea r14, [rbx + 0x38]
xor ecx, ecx
inc edx
cmp sil, 1
setb cl
call fcn.61c8b2f0
mov byte [rbx + 8], sil
mov qword [rbx], rax
mov dword [rbx + 9], 0x10000
mov dword [rbx + 0x10], 0
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov rcx, qword [rbx]
mov qword [rbx + 0x28], r13
mov qword [rbx + 0x18], rax
mov qword [rbx + 0x20], r13
mov qword [rbx + 0x30], 0
mov qword [rbx + 0x40], r14
mov qword [rbx + 0x38], r14
mov qword [rbx + 0x48], 0
test rcx, rcx
jne 0x61c8a251
mov r9d, 0x45
lea r8, str.src_ApplicationPrivateData.cpp
lea rdx, str.world___nullptr
lea rcx, [0x61e0719f]
add rsp, 0x20
pop rbx
pop rsi
pop r12
pop r13
pop r14
jmp fcn.61c88700
mov rdx, rbx
call fcn.61c91740
mov rcx, qword [rbx]
lea r8, [0x61e07241]
mov edx, 1
call fcn.61c91750
nop
add rsp, 0x20
pop rbx
pop rsi
pop r12
pop r13
pop r14
ret

Function at 0x61c8a360
Capabilities:
Query environment variable

Disassembly:
mov r8, rdx
test rdx, rdx
je 0x61c8a01f
cmp byte [rdx], 0
je 0x61c8a01f
mov rcx, qword [rcx]
test rcx, rcx
je 0x61c8a03f
mov edx, 1
jmp fcn.61c91750
mov r9d, 0xc0
lea r8, str.src_ApplicationPrivateData.cpp
lea rdx, str.name___nullptr__name_0____0
lea rcx, [0x61e0719f]
jmp fcn.61c88700
ret
mov rcx, qword [rcx + 8]
jmp 0x61c8a000

Function at 0x61c8cac0
Capabilities:
Query environment variable

Disassembly:
mov rax, qword [rcx + 0x10]
mov rcx, qword [rax + 0x10]
jmp fcn.61c9a2a0

Function at 0x61c8ee60
Capabilities:
Query environment variable

Disassembly:
push r13
push r12
push rbx
sub rsp, 0x20
mov r12, rcx
mov rbx, rdx
call fcn.61c89e70
lea r13, [r12 + 0x38]
lea rdx, [rbx + 0x38]
mov rcx, r13
call fcn.61c89e70
mov al, byte [rbx + 0x70]
mov rcx, r13
mov byte [r12 + 0x70], al
mov rax, qword [rbx + 0x78]
mov qword [r12 + 0x78], rax
call fcn.61ca82f0
mov rcx, r12
mov r13, rax
call fcn.61ca82f0
mov rdx, r13
mov rcx, rax
call fcn.61ca68e0
test al, al
jne 0x61c8eeda
mov r8d, 0x36c
lea rdx, str.src_ImageBaseWidgets.cpp
lea rcx, str.imageNormal.getSize____imageDown.getSize__
add rsp, 0x20
pop rbx
pop r12
pop r13
jmp fcn.61c87360
add rsp, 0x20
pop rbx
pop r12
pop r13
ret
Function at 0x61c8ef30
Capabilities:
Query environment variable

Disassembly:
push r13
push r12
push rbx
sub rsp, 0x20
mov r12, rcx
mov rbx, rdx
call fcn.61c89d40
lea r13, [r12 + 0x38]
lea rdx, [rbx + 0x38]
mov rcx, r13
call fcn.61c89d40
mov al, byte [rbx + 0x70]
mov rcx, r13
mov byte [r12 + 0x70], al
mov rax, qword [rbx + 0x78]
mov qword [r12 + 0x78], rax
call fcn.61ca82f0
mov rcx, r12
mov r13, rax
call fcn.61ca82f0
mov rdx, r13
mov rcx, rax
call fcn.61ca68e0
test al, al
jne 0x61c8efbe
mov r8d, 0x363
lea rdx, str.src_ImageBaseWidgets.cpp
lea rcx, str.imageNormal.getSize____imageDown.getSize__
add rsp, 0x20
pop rbx
pop r12
pop r13
jmp fcn.61c87360
add rsp, 0x20
pop rbx
pop r12
pop r13
ret

Function at 0x61c8efd0
Capabilities:
Query environment variable

Disassembly:
push r14
push r13
push r12
sub rsp, 0x20
mov r12, rcx
mov r13, r8
call fcn.61c89d40
lea r14, [r12 + 0x38]
mov rdx, r13
mov rcx, r14
call fcn.61c89d40
mov byte [r12 + 0x70], 0
mov rcx, r14
mov qword [r12 + 0x78], 0
call fcn.61ca82f0
mov rcx, r12
mov r13, rax
call fcn.61ca82f0
mov rdx, r13
mov rcx, rax
call fcn.61ca68e0
test al, al
jne 0x61c8f05d
mov r8d, 0x35a
lea rdx, str.src_ImageBaseWidgets.cpp
lea rcx, str.imageNormal.getSize____imageDown.getSize__
add rsp, 0x20
pop r12
pop r13
pop r14
jmp fcn.61c87360
add rsp, 0x20
pop r12
pop r13
pop r14
ret

Function at 0x61c90860
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x48
mov rbx, qword [rcx + 0x10]
lea rcx, [rbx + 0xc0]
mov rsi, r8
mov r13, rdx
mov r8, r9
mov rdi, r9
mov rdx, rsi
call fcn.61c8a8b0
mov r12d, eax
test eax, eax
jne 0x61c90985
lea rdx, str.text_plain
mov rcx, r13
call sub.msvcrt.dll_strcmp
test eax, eax
jne 0x61c90977
mov rcx, qword [rbx + 0x30]
call qword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x61c9097f
or r9d, 0xffffffff
xor edx, edx
mov r8, rsi
mov ecx, 0xfde9
mov dword [rsp + 0x28], 0
mov r14, qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov qword [rsp + 0x20], 0
call r14
mov ecx, 2
lea ebx, [rax + 1]
mov ebp, eax
movsxd rbx, ebx
add rbx, rbx
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov r15, qword [sym.imp.USER32.dll_CloseClipboard]
test rax, rax
mov r13, rax
je 0x61c9092b
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GlobalLock]
test rax, rax
jne 0x61c90930
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_GlobalFree]
call r15
jmp 0x61c9097f
mov r9d, edi
mov r8, rsi
xor edx, edx
mov dword [rsp + 0x28], ebp
mov qword [rsp + 0x20], rax
mov ecx, 0xfde9
mov qword [rsp + 0x38], rax
call r14
mov r10, qword [rsp + 0x38]
mov rcx, r13
mov word [r10 + rbx - 2], 0
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov rdx, r13
mov ecx, 0xd
call qword [sym.imp.USER32.dll_SetClipboardData]
call r15
jmp 0x61c90985
mov r12d, 0xb
jmp 0x61c90985
mov r12d, 2
mov eax, r12d
add rsp, 0x48
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret