joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400fe394
Capabilities:
Get thread local storage value

Disassembly:
mov rcx, qword [rcx + 0x40]
jmp 0x1401161f4
mov rax, rsp
mov qword [rax + 0x10], rdx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
mov qword [rax - 0x48], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
mov r13, r9
mov r12, r8
mov rbx, rcx
mov rcx, qword [rcx + 0x10]
mov qword [rax + 8], rcx
call fcn.14010cfc8
nop
mov edi, dword [rbx + 4]
mov esi, dword [rbx + 4]
dec esi
mov eax, dword [rbx]
cmp esi, eax
jl 0x1401161ce
lea ebp, [rsi + 1]
movsxd r15, esi
movsxd rcx, dword [rbx + 8]
and rcx, r15
mov rax, qword [rbx + 0x20]
mov r14, qword [rax + rcx*8]
test r14, r14
je 0x1401161c4
mov rdx, r12
mov rcx, r14
call qword [rsp + 0x78]
test al, al
je 0x1401161c4
mov rdx, r12
mov rcx, r14
call r13
test al, al
je 0x1401161c4
cmp ebp, edi
jne 0x1401161b4
dec edi
jmp 0x1401161c4
movsxd rcx, dword [rbx + 8]
and rcx, r15
mov rax, qword [rbx + 0x20]
and qword [rax + rcx*8], 0
dec esi
dec ebp
mov eax, dword [rbx]
cmp esi, eax
jge 0x14011617a
xchg dword [rbx + 4], edi
mov rcx, qword [rsp + 0x70]
mov rbx, qword [rsp + 0x80]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
jmp fcn.14010d010
add rcx, 0xb0
jmp 0x140116130

Function at 0x1401081a4
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x28
test dword [0x140002790], 0x80000000
je 0x1401081c7
mov ecx, dword [0x14016fa84]
call sub.KERNEL32.dll_TlsGetValue
mov rcx, rax
test rax, rax
jne 0x1401081cf
call fcn.14010e3e4
mov rcx, rax
mov rax, qword [rcx]
add rsp, 0x28
jmp qword [rax + 0x38]

Function at 0x140115ff8
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rcx + 0x98], rdx
mov r9, qword [rdx + 0x1a8]
mov r8, rcx
mov r9, qword [r9 + 8]
lea rdx, [0x1401160b4]
add rcx, 0x40
jmp fcn.14010fc84

Function at 0x14011608c
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rcx + 0x98], rdx
mov r9, qword [rdx + 0x1a8]
mov r8, rcx
mov r9, qword [r9 + 8]
lea rdx, [0x1401160c4]
add rcx, 0x40
jmp fcn.14010fc84
Function at 0x140142f40
Capabilities:
Check if file exists

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1d8]
sub rsp, 0x2d8
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov rax, qword [0x140001640]
xor rax, rsp
mov qword [rbp + 0x1c0], rax
mov r13, r9
mov rax, r8
mov r12, rdx
mov rsi, rcx
mov r14, qword [rbp + 0x240]
mov r15, qword [rbp + 0x248]
mov qword [rsp + 0x40], 7
xor edi, edi
mov qword [rsp + 0x38], rdi
mov word [rsp + 0x28], di
or rbx, 0xffffffffffffffff
mov r9, rbx
xor r8d, r8d
mov rdx, rax
lea rcx, [rsp + 0x28]
call fcn.14002bf60
nop
mov r8, qword [rsp + 0x38]
test r8, r8
je 0x14014301c
lea rax, [rsp + 0x28]
mov rcx, qword [rsp + 0x28]
mov rdx, qword [rsp + 0x40]
cmp rdx, 8
cmovae rax, rcx
cmp word [rax + r8*2 - 2], 0x5c
je 0x140143013
lea rax, [rsp + 0x28]
cmp rdx, 8
cmovae rax, rcx
cmp word [rax + r8*2 - 2], 0x2f
je 0x140143013
lea rax, [rsp + 0x28]
cmp rdx, 8
cmovae rax, rcx
cmp word [rax + r8*2 - 2], 0x3a
jne 0x14014301c
lea rdx, [0x140193e60]
jmp 0x140143023
lea rdx, [0x140193e58]
mov r8, rbx
nop word [rax + rax]
inc r8
cmp word [rdx + r8*2], 0
jne 0x140143030
lea rcx, [rsp + 0x28]
call fcn.140043c20
lea rcx, [rsp + 0x28]
cmp qword [rsp + 0x40], 8
cmovae rcx, qword [rsp + 0x28]
lea rdx, [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov qword [r12], rax
cmp rax, 0xffffffffffffffff
jne 0x140143099
mov qword [r12], rdi
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x14014308d
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x12
je 0x14014308d
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
call fcn.140146e40
mov dword [rsi], edi
jmp 0x140143170
cmp word [rbp - 0x64], 0
jne 0x1401430a5
mov r8, rdi
jmp 0x1401430bb
lea rax, [rbp - 0x64]
mov r8, rbx
nop dword [rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x1401430b0
lea rdx, [rbp - 0x64]
mov rcx, r13
call fcn.14003ca90
mov eax, dword [rsp + 0x70]
bt eax, 0xa
jae 0x1401430dc
mov dword [r14], edi
mov dword [r15], edi
jmp 0x140143169
test al, 0x10
je 0x1401430f0
mov dword [r14], 3
mov dword [r15], 3
jmp 0x1401430fe
mov dword [r14], 2
mov dword [r15], 2
mov qword [rsp + 0x60], 7
mov qword [rsp + 0x58], rdi
mov word [rsp + 0x48], di
cmp word [rbp - 0x64], 0
jne 0x14014311d
mov rbx, rdi
jmp 0x14014312b
lea rax, [rbp - 0x64]
inc rbx
cmp word [rax + rbx*2], 0
jne 0x140143121
mov r8, rbx
lea rdx, [rbp - 0x64]
lea rcx, [rsp + 0x48]
call fcn.14003ca90
nop
mov edx, dword [rsp + 0x70]
lea rcx, [rsp + 0x48]
call fcn.140143ab0
mov dword [r14 + 4], eax
cmp qword [rsp + 0x60], 8
jb 0x140143161
mov rcx, qword [rsp + 0x48]
call fcn.1400ed78c
mov eax, dword [r14 + 4]
mov dword [r15 + 4], eax
mov dword [rsi], edi
call fcn.140146e40
mov qword [rsi + 8], rax
cmp qword [rsp + 0x40], 8
jb 0x140143186
mov rcx, qword [rsp + 0x28]
call fcn.1400ed78c
mov rax, rsi
mov rcx, qword [rbp + 0x1c0]
xor rcx, rsp
call fcn.1400efba0
add rsp, 0x2d8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
Function at 0x140143ff0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x80
mov qword [rsp + 0x48], 0xfffffffffffffffe
mov qword [rsp + 0xc8], rbx
mov rax, qword [0x140001640]
xor rax, rsp
mov qword [rsp + 0x70], rax
mov r14, r8
mov rdi, rdx
mov rsi, rcx
cmp qword [rdx + 0x18], 8
jb 0x140144034
mov rcx, qword [rdx]
jmp 0x140144037
mov rcx, rdx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ebp, eax
cmp eax, 0xffffffff
jne 0x140144057
mov r8, r14
mov rdx, rdi
mov rcx, rsi
call fcn.140143da0
jmp 0x140144198
xor r15d, r15d
bt eax, 0xa
jae 0x140144158
cmp qword [rdi + 0x18], 8
jb 0x140144070
mov rdx, qword [rdi]
jmp 0x140144073
mov rdx, rdi
mov qword [rsp + 0x68], 7
mov qword [rsp + 0x60], r15
mov word [rsp + 0x50], r15w
cmp word [rdx], r15w
jne 0x140144092
mov r8, r15
jmp 0x1401440a0
or r8, 0xffffffffffffffff
inc r8
cmp word [rdx + r8*2], r15w
jne 0x140144096
lea rcx, [rsp + 0x50]
call fcn.14003ca90
nop
lea rcx, [rsp + 0x50]
cmp qword [rsp + 0x68], 8
cmovae rcx, qword [rsp + 0x50]
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], 0x2000000
mov dword [rsp + 0x20], 3
xor r9d, r9d
xor edx, edx
lea r8d, [r9 + 7]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbx, rax
mov qword [rsp + 0x40], rax
cmp qword [rsp + 0x68], 8
jb 0x1401440fa
mov rcx, qword [rsp + 0x50]
call fcn.1400ed78c
mov qword [rsp + 0x68], 7
mov qword [rsp + 0x60], r15
mov word [rsp + 0x50], r15w
cmp rbx, 0xffffffffffffffff
jne 0x140144125
mov r8, r14
mov rdx, rdi
mov rcx, rsi
call fcn.140143da0
nop
jmp 0x140144198
mov rcx, rdi
call fcn.1401439e0
test al, al
jne 0x14014414f
mov edx, ebp
mov rcx, rdi
call fcn.140143ab0
mov dword [rsi], 9
mov dword [rsi + 4], eax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x140144198
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test r14, r14
je 0x140144169
mov dword [r14], r15d
call fcn.140146e40
mov qword [r14 + 8], rax
mov edx, ebp
mov rcx, rdi
test bpl, 0x10
mov dword [rsp + 0x40], 3
jne 0x140144184
mov dword [rsp + 0x40], 2
call fcn.140143ab0
mov dword [rsp + 0x44], eax
lea rax, [rsp + 0x40]
mov rax, qword [rax]
mov qword [rsi], rax
mov rax, rsi
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.1400efba0
mov rbx, qword [rsp + 0xc8]
add rsp, 0x80
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x140148910
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
jmp 0x140148af0
push rdi
push r14
push r15
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x68], rsi
mov ecx, dword [0x140002d90]
cmp ecx, 0xffffffff
jne 0x140148b1d
xor r14d, r14d
jmp 0x140148b26
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov r14, rax
mov qword [rsp + 0x50], r14
test r14, r14
je 0x140148c58
mov rdi, qword [r14 + 0x18]
cmp qword [r14 + 0x28], 0
jne 0x140148b4a
test rdi, rdi
je 0x140148c31
jmp 0x140148b50
test rdi, rdi
je 0x140148ba4
nop
mov rax, qword [rdi + 8]
mov qword [r14 + 0x18], rax
mov rcx, qword [rdi]
test rcx, rcx
je 0x140148b87
mov rax, qword [rcx]
call qword [rax + ioctlsocket]
mov rbx, qword [rdi]
mov rax, qword [rbx]
xor edx, edx
mov rcx, rbx
call qword [rax]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, rax
mov r8, rbx
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, rax
mov r8, rdi
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rdi, qword [r14 + 0x18]
test rdi, rdi
jne 0x140148b50
mov rsi, qword [r14 + 0x20]
mov rbx, qword [rsi]
cmp rbx, rsi
je 0x140148b34
mov rdi, rbx
cmp byte [rbx + 0x19], 0
jne 0x140148bfe
mov rax, qword [rbx + 0x10]
cmp byte [rax + 0x19], 0
jne 0x140148bde
mov rbx, rax
mov rax, qword [rax]
cmp byte [rax + 0x19], 0
jne 0x140148bfe
nop
mov rbx, rax
mov rax, qword [rax]
cmp byte [rax + 0x19], 0
je 0x140148bd0
jmp 0x140148bfe
mov rax, qword [rbx + 8]
cmp byte [rax + 0x19], 0
jne 0x140148bfb
cmp rbx, qword [rax + 0x10]
jne 0x140148bfb
mov rbx, rax
mov rax, qword [rax + 8]
cmp byte [rax + 0x19], 0
je 0x140148be8
mov rbx, rax
mov rcx, qword [rdi + 0x28]
test rcx, rcx
je 0x140148c16
mov rdx, qword [rdi + 0x38]
test rdx, rdx
je 0x140148c16
mov rax, qword [rcx]
call qword [rax + ioctlsocket]
mov r8, rdi
lea rdx, [rsp + 0x58]
lea rcx, [r14 + 0x20]
call fcn.140148410
cmp rbx, rsi
jne 0x140148bb0
jmp 0x140148b34
lea rdx, [0x1401483f0]
lea rcx, [0x1401707e0]
call fcn.140148010
mov ecx, dword [0x140002d90]
cmp ecx, 0xffffffff
je 0x140148c58
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
nop
test r14, r14
je 0x140148c82
lock dec dword [r14 + 8]
jne 0x140148c82
mov rax, qword [r14]
xor edx, edx
mov rcx, r14
call qword [rax]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, rax
mov r8, r14
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x30
pop r15
pop r14
pop rdi
ret
Function at 0x140148af0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
jmp 0x140148af0
push rdi
push r14
push r15
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x68], rsi
mov ecx, dword [0x140002d90]
cmp ecx, 0xffffffff
jne 0x140148b1d
xor r14d, r14d
jmp 0x140148b26
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov r14, rax
mov qword [rsp + 0x50], r14
test r14, r14
je 0x140148c58
mov rdi, qword [r14 + 0x18]
cmp qword [r14 + 0x28], 0
jne 0x140148b4a
test rdi, rdi
je 0x140148c31
jmp 0x140148b50
test rdi, rdi
je 0x140148ba4
nop
mov rax, qword [rdi + 8]
mov qword [r14 + 0x18], rax
mov rcx, qword [rdi]
test rcx, rcx
je 0x140148b87
mov rax, qword [rcx]
call qword [rax + ioctlsocket]
mov rbx, qword [rdi]
mov rax, qword [rbx]
xor edx, edx
mov rcx, rbx
call qword [rax]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, rax
mov r8, rbx
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, rax
mov r8, rdi
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rdi, qword [r14 + 0x18]
test rdi, rdi
jne 0x140148b50
mov rsi, qword [r14 + 0x20]
mov rbx, qword [rsi]
cmp rbx, rsi
je 0x140148b34
mov rdi, rbx
cmp byte [rbx + 0x19], 0
jne 0x140148bfe
mov rax, qword [rbx + 0x10]
cmp byte [rax + 0x19], 0
jne 0x140148bde
mov rbx, rax
mov rax, qword [rax]
cmp byte [rax + 0x19], 0
jne 0x140148bfe
nop
mov rbx, rax
mov rax, qword [rax]
cmp byte [rax + 0x19], 0
je 0x140148bd0
jmp 0x140148bfe
mov rax, qword [rbx + 8]
cmp byte [rax + 0x19], 0
jne 0x140148bfb
cmp rbx, qword [rax + 0x10]
jne 0x140148bfb
mov rbx, rax
mov rax, qword [rax + 8]
cmp byte [rax + 0x19], 0
je 0x140148be8
mov rbx, rax
mov rcx, qword [rdi + 0x28]
test rcx, rcx
je 0x140148c16
mov rdx, qword [rdi + 0x38]
test rdx, rdx
je 0x140148c16
mov rax, qword [rcx]
call qword [rax + ioctlsocket]
mov r8, rdi
lea rdx, [rsp + 0x58]
lea rcx, [r14 + 0x20]
call fcn.140148410
cmp rbx, rsi
jne 0x140148bb0
jmp 0x140148b34
lea rdx, [0x1401483f0]
lea rcx, [0x1401707e0]
call fcn.140148010
mov ecx, dword [0x140002d90]
cmp ecx, 0xffffffff
je 0x140148c58
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
nop
test r14, r14
je 0x140148c82
lock dec dword [r14 + 8]
jne 0x140148c82
mov rax, qword [r14]
xor edx, edx
mov rcx, r14
call qword [rax]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, rax
mov r8, r14
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x30
pop r15
pop r14
pop rdi
ret
Function at 0x140008404
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x140008200
Function at 0x14000d0ec
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor ebp, ebp
mov rbx, rax
test rax, rax
je 0x14000d173
mov rsi, rbx
cmp word [rax], bp
je 0x14000d132
or rax, 0xffffffffffffffff
inc rax
cmp word [rsi + rax*2], bp
jne 0x14000d11c
lea rsi, [rsi + rax*2]
add rsi, 2
cmp word [rsi], bp
jne 0x14000d118
sub rsi, rbx
add rsi, 2
sar rsi, 1
add rsi, rsi
mov rcx, rsi
call fcn.140009e70
mov rdi, rax
test rax, rax
je 0x14000d160
mov r8, rsi
mov rdx, rbx
mov rcx, rax
call fcn.140002f90
mov rbp, rdi
xor ecx, ecx
call fcn.14000923c
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rbp
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x1400115d8
Capabilities:
Get file size

Disassembly:
push rbx
sub rsp, 0x20
mov edx, dword [rcx + 0x14]
nop
shr edx, 3
test dl, 1
je 0x1400115ee
mov al, 1
jmp 0x14001164e
mov eax, dword [rcx + 0x14]
nop
test al, 0xc0
je 0x1400115ff
mov rax, qword [rcx + 8]
cmp qword [rcx], rax
je 0x14001164c
mov ecx, dword [rcx + 0x18]
nop
call fcn.14000d9ac
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x14001164c
mov r9d, 1
lea r8, [rsp + 0x38]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x14001164c
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x14001164c
mov rax, qword [rsp + 0x30]
cmp qword [rsp + 0x38], rax
sete al
jmp 0x14001164e
xor al, al
add rsp, 0x20
pop rbx
ret
Function at 0x140006de8
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r14
push r15
mov rbp, rsp
sub rsp, 0x60
mov rax, qword [0x140103040]
xor rax, rsp
mov qword [rbp - 0x10], rax
xor esi, esi
cmp byte [0x140104735], sil
je 0x140006ee3
lea ecx, [rsi + 0x20]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
mov rcx, qword [0x140104780]
movzx edi, ax
test rcx, rcx
je 0x140006e4a
mov edx, dword [0x140103188]
lea r8, [rbp - 0x40]
add rdx, rcx
call fcn.140012e4c
mov bl, byte [rbp - 0x40]
lea rdx, [rbp - 0x38]
mov r14d, 1
mov qword [rbp - 0x28], rsi
mov ecx, r14d
mov qword [rbp - 0x38], r14
and bl, r14b
mov qword [rbp - 0x18], rsi
mov dword [rbp - 0x30], 0x87
mov r15d, 0x87
lea r8d, [r14 + 0x27]
mov qword [rbp - 0x20], rsi
mov dword [rbp - 0x2c], 2
call qword [sym.imp.USER32.dll_SendInput]
test di, di
je 0x140006ea7
test bl, bl
je 0x140006eb5
lea rcx, [rbp - 0x40]
mov qword [rbp - 0x40], r14
call fcn.140012c60
mov qword [rbp - 0x30], r15
jmp 0x140006ec0
mov ecx, r15d
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jne 0x140006ee3
mov dword [rbp - 0x2c], 2
mov dword [rbp - 0x30], r15d
mov r8d, 0x28
mov qword [rbp - 0x38], r14
lea rdx, [rbp - 0x38]
mov qword [rbp - 0x28], rsi
mov ecx, r14d
mov qword [rbp - 0x18], rsi
mov qword [rbp - 0x20], rsi
call qword [sym.imp.USER32.dll_SendInput]
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.140064820
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
Function at 0x140008538
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rbx, rcx
xor ecx, ecx
call qword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x1400085cb
call qword [sym.imp.USER32.dll_EmptyClipboard]
lea rsi, [rbx + 0x10]
mov ecx, 2
mov rdx, qword [rsi]
inc rdx
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov rdi, rax
test rax, rax
je 0x1400085c5
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GlobalLock]
test rax, rax
jne 0x140008592
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GlobalFree]
jmp 0x1400085c5
cmp qword [rbx + 0x18], 0xf
jbe 0x14000859c
mov rbx, qword [rbx]
mov rdx, qword [rsi]
mov r8, rbx
inc rdx
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strcpy_s]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov rdx, rdi
mov ecx, 1
call qword [sym.imp.USER32.dll_SetClipboardData]
call qword [sym.imp.USER32.dll_CloseClipboard]
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x140010ae8
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r14
push r15
sub rsp, 0x20
cmp qword [rcx + 0x68], 0
mov rbx, r8
mov r15, rdx
mov rdi, rcx
je 0x140010b18
call qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const____ptr64__long_long___int64_____ptr64]
jmp 0x140010b91
mov rax, qword [rcx + 0x40]
mov rsi, rbx
mov r9, qword [rax]
test r9, r9
je 0x140010b2f
mov rax, qword [rcx + 0x58]
mov ecx, dword [rax]
jmp 0x140010b31
xor ecx, ecx
movsxd rbp, ecx
test rbx, rbx
jle 0x140010b8b
test ecx, ecx
jle 0x140010b6b
cmp rbx, rbp
mov rcx, r9
cmovl rbp, rbx
mov r8, rbp
call qword [sym.imp.VCRUNTIME140.dll_memcpy]
mov rax, qword [rdi + 0x58]
add r15, rbp
sub rbx, rbp
sub dword [rax], ebp
mov rcx, qword [rdi + 0x40]
movsxd rax, ebp
add qword [rcx], rax
test rbx, rbx
jle 0x140010b8b
mov r9, qword [rdi + 0x80]
test r9, r9
je 0x140010b8b
mov r8, rbx
mov edx, 1
mov rcx, r15
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
sub rbx, rax
sub rsi, rbx
mov rax, rsi
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x58]
add rsp, 0x20
pop r15
pop r14
pop rdi
ret

Function at 0x140010bac
Capabilities:
Read file on windows

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
sub rsp, 0x20
mov rbp, r8
mov r14, rdx
mov rsi, rcx
test r8, r8
jg 0x140010bcc
xor eax, eax
jmp 0x140010cb6
cmp qword [rcx + 0x68], 0
je 0x140010bde
call qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char____ptr64__long_long___int64_____ptr64]
jmp 0x140010cb6
mov rax, qword [rcx + 0x38]
mov rdi, rbp
mov rdx, qword [rax]
test rdx, rdx
je 0x140010bf5
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x140010bf7
xor ecx, ecx
movsxd rax, ecx
test ecx, ecx
je 0x140010c2a
cmp rax, rbp
mov rbx, rbp
mov rcx, r14
cmovb rbx, rax
mov r8, rbx
call qword [sym.imp.VCRUNTIME140.dll_memcpy]
mov rax, qword [rsi + 0x50]
add r14, rbx
sub rdi, rbx
sub dword [rax], ebx
mov rcx, qword [rsi + 0x38]
movsxd rax, ebx
add qword [rcx], rax
cmp qword [rsi + 0x80], 0
je 0x140010cb0
mov r8, qword [rsi + 0x18]
lea rax, [rsi + 0x70]
cmp qword [r8], rax
jne 0x140010c61
mov rcx, qword [rsi + 0x88]
mov rdx, qword [rsi + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rsi + 0x38]
mov qword [rax], rcx
mov rax, qword [rsi + 0x50]
mov dword [rax], edx
mov ebx, 0xfff
jmp 0x140010c8b
mov r9, qword [rsi + 0x80]
mov r8, rbx
mov edx, 1
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
add r14, rax
sub rdi, rax
cmp rax, rbx
jne 0x140010cb0
cmp rdi, rbx
ja 0x140010c68
test rdi, rdi
je 0x140010cb0
mov r9, qword [rsi + 0x80]
mov r8, rdi
mov edx, 1
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
sub rdi, rax
sub rbp, rdi
mov rax, rbp
add rsp, 0x20
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x14001108c
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rbp
push rdi
push r14
mov rbp, rsp
sub rsp, 0x80
mov rax, qword [0x140103040]
xor rax, rsp
mov qword [rbp - 8], rax
or edi, 0xffffffff
mov esi, edx
mov rbx, rcx
cmp edx, edi
jne 0x1400110c5
xor eax, eax
jmp 0x1400111e5
mov rax, qword [rcx + 0x40]
cmp qword [rax], 0
je 0x1400110ff
mov rdx, qword [rcx + 0x58]
movsxd r8, dword [rdx]
mov rcx, r8
add rcx, qword [rax]
cmp qword [rax], rcx
jae 0x1400110ff
lea ecx, [r8 - 1]
mov eax, esi
mov dword [rdx], ecx
mov rdx, qword [rbx + 0x40]
mov r8, qword [rdx]
lea rcx, [r8 + 1]
mov qword [rdx], rcx
mov byte [r8], sil
jmp 0x1400111e5
cmp qword [rbx + 0x80], 0
je 0x1400111e3
mov r8, qword [rbx + 0x18]
lea rax, [rbx + 0x70]
cmp qword [r8], rax
jne 0x14001113a
mov rcx, qword [rbx + 0x88]
mov rdx, qword [rbx + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
mov rcx, qword [rbx + 0x68]
test rcx, rcx
jne 0x14001115b
movsx ecx, sil
mov rdx, qword [rbx + 0x80]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
cmp eax, edi
jmp 0x1400111e0
lea rax, [rbp - 0x40]
mov byte [rbp - 0x30], sil
mov qword [rsp + 0x38], rax
lea rdx, [rbx + 0x74]
lea rax, [rbp - 8]
mov qword [rsp + 0x30], rax
lea r9, [rbp - 0x2f]
lea rax, [rbp - 0x28]
mov qword [rsp + 0x28], rax
lea r8, [rbp - 0x30]
lea rax, [rbp - 0x38]
mov qword [rsp + 0x20], rax
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet____ptr64__char_const____ptr64__char_const____ptr64__char_const____ptr64____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x1400111a9
sub eax, 1
je 0x1400111a9
cmp eax, 2
jne 0x1400111e3
movsx ecx, byte [rbp - 0x30]
jmp 0x140011147
mov r14, qword [rbp - 0x40]
lea rax, [rbp - 0x28]
sub r14, rax
je 0x1400111d4
mov r9, qword [rbx + 0x80]
lea rcx, [rbp - 0x28]
mov r8, r14
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp r14, rax
jne 0x1400111e3
lea rax, [rbp - 0x30]
mov byte [rbx + 0x71], 1
cmp qword [rbp - 0x38], rax
cmovne edi, esi
mov eax, edi
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.140064820
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
Function at 0x140012288
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x60
mov rax, qword [0x140103040]
xor rax, rsp
mov qword [rsp + 0x58], rax
cmp qword [rcx + 0x68], 0
mov rbx, rcx
je 0x1400122f7
cmp byte [rcx + 0x71], 0
je 0x1400122f7
mov rax, qword [rcx]
or edx, 0xffffffff
call qword [rax + 0x18]
cmp eax, 0xffffffff
je 0x14001234c
mov rcx, qword [rbx + 0x68]
lea rax, [rsp + 0x30]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x38]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x140012311
sub eax, 1
je 0x140012315
cmp eax, 2
jne 0x14001234c
mov byte [rbx + 0x71], 0
mov al, 1
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140064820
mov rbx, qword [rsp + 0x78]
add rsp, 0x60
pop rdi
ret
mov byte [rbx + 0x71], 0
mov rdi, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
sub rdi, rax
je 0x140012343
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x38]
mov r8, rdi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rdi, rax
jne 0x14001234c
cmp byte [rbx + 0x71], 0
sete al
jmp 0x1400122f9
xor al, al
jmp 0x1400122f9