joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140045e2c
Capabilities:
Read file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov dword [rax + 0x20], r9d
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
mov rax, qword [0x1400b94f0]
xor r12d, r12d
mov rbp, rdx
mov r14, rcx
mov esi, r12d
movsx r9, word [rax]
test r9, r9
jle 0x140045e85
mov edx, r12d
add rax, 0xa
cmp word [rax], r12w
je 0x140045ea7
inc esi
inc rdx
add rax, 0xda
cmp rdx, r9
jl 0x140045e6f
mov eax, 2
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
test esi, esi
js 0x140045e85
or r13, 0xffffffffffffffff
mov dword [r8], esi
mov ebx, 2
test r14, r14
je 0x140045ed2
mov edx, ebx
call fcn.14007d020
mov rbp, rax
cmp rax, r13
jne 0x140045ed2
mov eax, 0x2713
jmp 0x140045e8a
xor r9d, r9d
movsxd r15, esi
xor r8d, r8d
xor edx, edx
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
jne 0x140045ef5
mov ebx, 0x2713
jmp 0x140045ffc
mov rdx, qword [0x1400b94f0]
lea r9, [rsp + 0x78]
add rdx, rbx
mov qword [rsp + 0x20], r12
imul rdi, r15, 0xda
mov r8d, 0xda
mov rcx, rbp
add rdx, rdi
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x140045eeb
mov rdx, qword [0x1400b94f0]
cmp word [rdi + rdx + 2], bx
je 0x140045f3e
mov ebx, 7
jmp 0x140045ffc
cmp dword [rdi + rdx + 6], r12d
je 0x140045f4f
mov ebx, 6
jmp 0x140045ffc
cmp word [rdi + rdx + 4], r13w
jne 0x140045f34
movsx ecx, word [rdi + rdx + 4]
mov r13d, 0xfffffffc
mov rax, qword [rsp + 0x80]
mov r8d, r13d
mov dword [rax], ecx
lea rcx, [rdx + 0x42]
movzx eax, word [rdi + rdx + 0xa]
add rcx, rdi
and ax, 4
or ax, 8
mov word [rdi + rdx + 0xa], ax
mov qword [rdi + rdx + 0xc], rbp
mov qword [rdi + rdx + 0x4c], r12
mov qword [rdi + rdx + 0x28], r12
mov qword [rdi + rdx + 0x3a], r12
mov edx, esi
call fcn.14004528c
mov ebx, eax
test eax, eax
jne 0x140045fc3
mov rcx, qword [0x1400b94f0]
mov r8d, r13d
add rcx, 0x1e
mov edx, esi
add rcx, rdi
call fcn.14004528c
mov ebx, eax
test ebx, ebx
je 0x14004601e
mov rax, qword [0x1400b94f0]
imul rdi, r15, 0xda
mov rcx, qword [rdi + rax + 0x4c]
test rcx, rcx
je 0x140045fe5
call qword [sym.imp.KERNEL32.dll_GlobalFree]
mov rax, qword [0x1400b94f0]
mov rcx, qword [rdi + rax + 0x28]
test rcx, rcx
je 0x140045ffc
call qword [sym.imp.KERNEL32.dll_GlobalFree]
test r14, r14
je 0x14004600a
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, qword [0x1400b94f0]
imul rcx, r15, 0xda
mov word [rcx + rax + 0xa], r12w
mov eax, ebx
jmp 0x140045e8a

Function at 0x140046028
Capabilities:
Delete file

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov edx, 0x1002
mov rsi, rcx
call fcn.14007d020
mov rdi, rax
cmp rax, 0xffffffffffffffff
jne 0x140046054
mov eax, 0x2713
jmp 0x140046076
mov rcx, rdi
call fcn.140045b4c
mov rcx, rdi
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test ebx, ebx
je 0x140046074
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
mov eax, ebx
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x140046d18
Capabilities:
Get file size
Write file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
push rdi
push r12
push r14
sub rsp, 0x30
and dword [rax + 8], 0
mov rdi, rcx
test rcx, rcx
je 0x140046e56
call qword [sym.imp.KERNEL32.dll_GlobalFlags]
mov ecx, 0x4000
test cx, ax
jne 0x140046e56
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GlobalSize]
mov esi, eax
mov r12d, 1
cmp rsi, rax
je 0x140046d7e
xor r9d, r9d
xor r8d, r8d
mov edx, r12d
mov ecx, 0xc0000095
call qword [sym.imp.KERNEL32.dll_RaiseException]
test esi, esi
je 0x140046e56
cmp esi, 0x10
jae 0x140046d95
mov eax, InitCommonControls
jmp 0x140046e5a
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GlobalLock]
mov rbx, rax
test byte [rax + 0xe], r12b
je 0x140046e4d
movsx ecx, word [rax + 4]
call fcn.140046bf4
mov dword [rsp + 0x50], eax
test eax, eax
jne 0x140046e4d
movsx rcx, word [rbx + 4]
xor r9d, r9d
mov rax, qword [0x1400b94f0]
xor r8d, r8d
imul rdx, rcx, 0xda
mov r14, qword [rdx + rax + 0xc]
mov edx, dword [rdx + rax + 6]
mov rcx, r14
add edx, dword [rbx + 6]
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
je 0x140046e45
mov ebp, dword [rbx + 0xa]
cmp ebp, esi
jbe 0x140046e04
mov dword [rsp + 0x50], 0x19
jmp 0x140046e4d
xor edx, edx
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_GetFileSize]
and qword [rsp + 0x20], 0
lea r9, [rsp + 0x50]
mov r8d, ebp
mov rdx, rbx
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x140046e45
and dword [rsp + 0x50], 0
movzx eax, word [rbx + 0xe]
test r12b, al
je 0x140046e4d
xor ax, r12w
mov word [rbx + 0xe], ax
jmp 0x140046e4d
mov dword [rsp + 0x50], 0x2713
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov eax, dword [rsp + 0x50]
mov rbx, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x30
pop r14
pop r12
pop rdi
ret
Function at 0x140051c48
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
cmp qword [0x140096ef8], 0
mov rbp, r8
mov rdi, rdx
mov rsi, rcx
je 0x140051d2f
movsxd rbx, dword [0x140096ef4]
lea rax, [rdx + rbx]
cmp rax, 0xfffe
jbe 0x140051ce7
mov edx, dword [0x140096ef0]
xor r9d, r9d
add edx, ebx
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov edx, dword [0x140096ef4]
mov ebx, eax
add edx, dword [0x140096ef0]
cmp eax, edx
jne 0x140051d69
mov rdx, qword [0x140096f00]
lea r9, [rsp + 0x58]
and qword [rsp + 0x20], 0
mov r8d, 0xfffe
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x140051d69
mov dword [0x140096ef0], ebx
xor ebx, ebx
mov dword [0x140096ef4], ebx
movsxd rdx, ebx
mov r8, rdi
add rdx, qword [0x140096f00]
mov rcx, rbp
call sub.VCRUNTIME140.dll_memmove
movsxd rsi, edi
test edi, edi
js 0x140051d08
cmp rsi, rdi
je 0x140051d23
xor r9d, r9d
xor r8d, r8d
mov ecx, 0xc0000095
lea edx, [r9 + 1]
call qword [sym.imp.KERNEL32.dll_RaiseException]
add ebx, esi
mov dword [0x140096ef4], ebx
xor eax, eax
jmp 0x140051d7c
mov ebx, edi
cmp rbx, rdi
je 0x140051d4b
xor r9d, r9d
xor r8d, r8d
mov ecx, 0xc0000095
lea edx, [r9 + 1]
call qword [sym.imp.KERNEL32.dll_RaiseException]
and qword [rsp + 0x20], 0
lea r9, [rsp + 0x58]
mov r8d, ebx
mov rdx, rbp
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x140051d70
mov eax, 0x2713
jmp 0x140051d7c
mov eax, dword [rsp + 0x58]
sub rax, rdi
neg rax
sbb eax, eax
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
Function at 0x140053938
Capabilities:
Get file size

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r14
sub rsp, 0x40
mov r9d, 1
xor r8d, r8d
xor edx, edx
mov rbx, rcx
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
or r14d, 0xffffffff
mov ebp, eax
cmp eax, r14d
je 0x140053a43
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
cmp eax, r14d
je 0x140053a43
sub esi, 0xe
mov dword [rsp + 0x30], 0xa
xor edi, edi
mov dword [rsp + 0x36], esi
xor r9d, r9d
mov word [rsp + 0x34], di
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, r14d
jne 0x1400539b6
mov ecx, 0x2713
jmp 0x1400539dc
lea rax, [0x1400a77a0]
mov edx, esi
lea r9, [rsp + 0x34]
mov qword [rsp + 0x20], rax
lea r8, [rsp + 0x32]
mov rcx, rbx
call fcn.140041934
mov ecx, eax
test eax, eax
je 0x1400539e0
mov eax, ecx
jmp 0x140053a48
lea r8, [rsp + 0x70]
mov rcx, rbx
lea rdx, [rsp + 0x68]
call fcn.140051bac
test eax, eax
jne 0x140053a48
cmp dword [rsp + 0x68], 0xfff
jne 0x140053a3c
movzx eax, word [rsp + 0x32]
cmp word [0x1400a77a2], ax
jne 0x140053a3c
movzx ecx, word [rsp + 0x34]
cmp word [0x1400a77a4], cx
jne 0x140053a3c
xor r9d, r9d
xor r8d, r8d
mov edx, ebp
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, r14d
mov ecx, 0x2713
cmove edi, ecx
mov eax, edi
jmp 0x140053a48
mov eax, 0x5ef
jmp 0x140053a48
mov eax, 0x2713
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x78]
add rsp, 0x40
pop r14
pop rdi
pop rsi
ret
Function at 0x140060fd8
Capabilities:
Get disk information

Disassembly:
push rbx
sub rsp, 0x4a0
mov rax, qword [0x140096008]
xor rax, rsp
mov qword [rsp + 0x490], rax
mov ebx, 0x106
lea rax, [rsp + 0x160]
mov qword [rsp + 0x40], rbx
lea r9, [rsp + 0x380]
mov qword [rsp + 0x38], rax
lea rdx, [rsp + 0x50]
lea rax, [rsp + 0x270]
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x28], rax
mov r8d, ebx
mov qword [rsp + 0x20], rbx
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__splitpath_s]
lea r8, [0x14008e1f8]
mov edx, ebx
lea rcx, [rsp + 0x50]
call fcn.1400205fc
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_GetDriveTypeA]
xor ecx, ecx
add eax, 0xfffffffd
cmp eax, 1
setbe cl
mov eax, ecx
mov rcx, qword [rsp + 0x490]
xor rcx, rsp
call fcn.14008a940
add rsp, 0x4a0
pop rbx
ret
Function at 0x1400615e8
Capabilities:
Get file size
Read file on windows
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x50
xor eax, eax
mov rsi, rdx
xor edx, edx
mov dword [rsp + 0x30], eax
xor r12d, r12d
mov dword [rsp + 0x90], edx
mov r13, r9
test r8d, r8d
jne 0x14006163f
call fcn.14007d020
mov rsi, rax
cmp rax, 0xffffffffffffffff
jne 0x140061639
mov eax, 0x2713
jmp 0x1400617a9
mov r12d, 1
xor edx, edx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetFileSize]
xor ebx, ebx
or r15d, 0xffffffff
cmp eax, r15d
mov edi, 0x2713
mov ebp, eax
cmove ebx, edi
je 0x140061799
mov edx, eax
mov rcx, r13
call fcn.14007ce28
mov ebx, eax
test eax, eax
jne 0x140061799
mov ecx, 0x7530
mov eax, ebp
cmp ebp, ecx
cmovg eax, ecx
lea ecx, [rbx + 2]
movsxd rdx, eax
mov dword [rsp + 0x34], eax
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov r14, rax
lea eax, [rdi + 1]
test r14, r14
cmove ebx, eax
test ebx, ebx
jne 0x140061799
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_GlobalLock]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x40], rax
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, r15d
jne 0x1400616d2
mov ebx, edi
jmp 0x140061790
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, r15d
je 0x1400616cb
mov r15d, dword [rsp + 0xa0]
test r15d, r15d
je 0x140061713
mov eax, ebp
mov dword [rsp + 0x20], 1
cdq
xor r9d, r9d
idiv dword [rsp + 0x34]
mov edx, r15d
lea r8d, [rax + 1]
call fcn.140078108
test ebp, ebp
jle 0x140061787
mov r8d, dword [rsp + 0x34]
lea r9, [rsp + 0x38]
mov rdx, qword [rsp + 0x40]
mov rcx, rsi
inc dword [rsp + 0x90]
and qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1400616cb
mov r8d, dword [rsp + 0x38]
lea r9, [rsp + 0x38]
mov rdx, qword [rsp + 0x40]
mov rcx, r13
add dword [rsp + 0x30], r8d
and qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x1400616cb
test r15d, r15d
je 0x140061781
mov edx, dword [rsp + 0x90]
mov ecx, 2
call fcn.140078068
cmp dword [rsp + 0x30], ebp
jl 0x140061717
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_GlobalFree]
test r12d, r12d
je 0x1400617a7
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, ebx
lea r11, [rsp + 0x50]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x1400656d8
Capabilities:
Get graphical window text

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x660
mov rax, qword [0x140096008]
xor rax, rsp
mov qword [rsp + 0x650], rax
mov edi, edx
mov rsi, rcx
mov edx, 5
call qword [sym.imp.USER32.dll_GetWindow]
xor ebp, ebp
mov rbx, rax
test rax, rax
je 0x14006580d
mov rcx, rax
call fcn.140063e90
test eax, eax
je 0x14006580d
mov rcx, rbx
call fcn.140071be8
cmp eax, 1
je 0x140065744
cmp dword [0x140097020], ebp
je 0x140065749
mov edi, 1
test edi, edi
je 0x140065757
mov ebx, 6
jmp 0x1400657f7
mov ebx, 0x105
lea rdx, [rsp + 0x440]
mov r8d, ebx
mov rcx, rsi
call qword [sym.imp.USER32.dll_GetWindowTextW]
mov rcx, qword [0x1400b8300]
lea r8, [rsp + 0x230]
mov r9d, ebx
mov edx, 0x1ff
call qword [sym.imp.USER32.dll_LoadStringW]
test eax, eax
jne 0x140065798
mov word [rsp + 0x20], bp
jmp 0x1400657b2
lea r8, [rsp + 0x230]
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x440]
call fcn.14007cb7c
mov rcx, qword [0x1400970d8]
mov qword [0x140097108], 1
call qword [sym.imp.USER32.dll_SetForegroundWindow]
mov rcx, qword [0x1400970d8]
lea r8, [0x140096080]
mov r9d, 0x23
lea rdx, [rsp + 0x20]
call qword [sym.imp.USER32.dll_MessageBoxW]
mov qword [0x140097108], rbp
mov ebx, eax
cmp eax, 6
jne 0x140065809
mov rcx, rsi
call fcn.1400654ec
test eax, eax
mov ecx, 2
cmovne ebx, ecx
mov eax, ebx
jmp 0x140065812
mov eax, 7
mov rcx, qword [rsp + 0x650]
xor rcx, rsp
call fcn.14008a940
lea r11, [rsp + 0x660]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x140065a38
Capabilities:
Delete file

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
xor edx, edx
mov rdi, rcx
call qword [sym.imp.USER32.dll_GetWindowLongPtrA]
mov rsi, rax
test rax, rax
je 0x140065ab3
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GlobalLock]
mov rbx, rax
cmp dword [rax], 0
je 0x140065a7f
mov ecx, dword [0x140096fa8]
cmp dword [rax], ecx
jne 0x140065a92
dec ecx
mov dword [0x140096fa8], ecx
jmp 0x140065a92
mov rcx, qword [rax + 0x210]
cmp rcx, 0xffffffffffffffff
je 0x140065a92
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [rbx + 0x220]
call fcn.1400461a8
lea rcx, [rbx + 0x10a]
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
xor edx, edx
mov rcx, rdi
call qword [sym.imp.USER32.dll_GetWindowLongPtrA]
test rax, rax
je 0x140065acc
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GlobalFree]
xor r8d, r8d
xor edx, edx
mov rcx, rdi
call qword [sym.imp.USER32.dll_SetWindowLongPtrA]
mov edx, 2
mov rcx, rdi
call qword [sym.imp.USER32.dll_GetWindow]
test rax, rax
jne 0x140065b3e
lea edx, [rax + 3]
mov rcx, rdi
call qword [sym.imp.USER32.dll_GetWindow]
test rax, rax
jne 0x140065b3e
lea ecx, [rax + 1]
call fcn.140057554
cmp dword [0x140096f3c], 0
je 0x140065b3e
cmp dword [0x1400b88ec], 0
jne 0x140065b3e
mov rcx, qword [0x1400970d8]
xor edx, edx
call qword [sym.imp.USER32.dll_ShowWindow]
mov rcx, qword [0x1400970d8]
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 0x10]
call qword [sym.imp.USER32.dll_PostMessageA]
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x14006a404
Capabilities:
Get common file path

Disassembly:
push rbx
sub rsp, 0x180
mov rax, qword [0x140096008]
xor rax, rsp
mov qword [rsp + 0x170], rax
mov rbx, rcx
mov qword [rsp + 0x20], rcx
xor ecx, ecx
xor r9d, r9d
xor r8d, r8d
mov edx, 0x801c
call qword [sym.imp.SHELL32.dll_SHGetFolderPathA]
test eax, eax
js 0x14006a482
lea r8, str.MicrosoftOffice
mov edx, 0x106
mov rcx, rbx
call fcn.1400205fc
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp rax, 0xffffffffffffffff
je 0x14006a482
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_FindClose]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_lstrlenA]
movsxd rcx, eax
mov byte [rcx + rbx - 1], 0
jmp 0x14006a490
mov rdx, rbx
mov ecx, 0x106
call qword [sym.imp.KERNEL32.dll_GetTempPathA]
lea r8, str.OrgChartPref.dat
mov edx, 0x106
mov rcx, rbx
call fcn.1400205fc
mov rcx, qword [rsp + 0x170]
xor rcx, rsp
call fcn.14008a940
add rsp, 0x180
pop rbx
ret
Function at 0x14006a4c0
Capabilities:
Delete file

Disassembly:
push rbx
sub rsp, 0x160
mov rax, qword [0x140096008]
xor rax, rsp
mov qword [rsp + 0x150], rax
lea rcx, [rsp + 0x40]
call fcn.14006a404
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
lea rcx, [rsp + 0x40]
call fcn.140046028
test eax, eax
je 0x14006a505
xor eax, eax
jmp 0x14006a6a0
lea rax, [rsp + 0x30]
xor edx, edx
lea r8, [0x140096280]
mov qword [rsp + 0x20], rax
lea rcx, [rsp + 0x40]
call fcn.140045e2c
mov ebx, eax
test eax, eax
jne 0x14006a68c
mov ecx, dword [0x140096280]
lea edx, [rax + 0x64]
call fcn.1400445ec
mov ebx, eax
test eax, eax
jne 0x14006a681
mov ecx, dword [0x140096280]
lea edx, [rax + 0x67]
call fcn.1400445ec
mov ebx, eax
test eax, eax
jne 0x14006a681
mov ecx, dword [0x140096280]
lea edx, [rax + 0x68]
call fcn.1400445ec
mov ebx, eax
test eax, eax
jne 0x14006a681
mov ecx, dword [0x140096280]
lea edx, [rax + 0x65]
call fcn.1400445ec
mov ebx, eax
test eax, eax
jne 0x14006a681
mov ecx, dword [0x140096280]
lea edx, [rax + 0x66]
call fcn.1400445ec
mov ebx, eax
test eax, eax
jne 0x14006a681
mov ecx, dword [0x140096280]
lea edx, [rax + 0x6f]
call fcn.1400445ec
mov ebx, eax
test eax, eax
jne 0x14006a681
mov ecx, dword [0x140096280]
lea rax, [rsp + 0x30]
lea edx, [rbx + 0x64]
mov qword [rsp + 0x20], rax
mov r9d, 0x820
lea r8d, [rbx + 1]
call fcn.140044694
mov ebx, eax
test eax, eax
jne 0x14006a681
mov ecx, dword [0x140096280]
lea rax, [rsp + 0x38]
lea edx, [rbx + 0x64]
mov qword [rsp + 0x20], rax
mov r9d, 0x532
lea r8d, [rbx + 0x70]
call fcn.140044694
mov ebx, eax
test eax, eax
jne 0x14006a681
mov rbx, qword [rsp + 0x38]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GlobalLock]
mov edx, 4
and dword [rax + 0x10], 0
add rax, 0x11a
mov byte [rax], 0
lea rax, [rax + 0x106]
sub rdx, 1
jne 0x14006a62d
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov rcx, rbx
call fcn.14004708c
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GlobalLock]
mov rcx, rax
call fcn.140069dd4
mov rcx, qword [rsp + 0x30]
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
test ebx, ebx
jne 0x14006a681
mov ecx, dword [0x140096280]
xor edx, edx
call fcn.1400460c8
jmp 0x14006a69e
mov ecx, dword [0x140096280]
call fcn.1400461a8
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
or dword [0x140096280], 0xffffffff
mov eax, ebx
mov rcx, qword [rsp + 0x150]
xor rcx, rsp
call fcn.14008a940
add rsp, 0x160
pop rbx
ret
Function at 0x14006add4
Capabilities:
Delete file
Get common file path

Disassembly:
sub rsp, 0x148
mov rax, qword [0x140096008]
xor rax, rsp
mov qword [rsp + 0x130], rax
mov rcx, qword [0x1400b8a28]
call qword [sym.imp.USER32.dll_SetCursor]
cmp dword [0x1400b8b48], 0
mov dword [0x140096f20], 1
je 0x14006aea3
mov ecx, dword [0x1400b8b40]
call fcn.1400469b0
mov ecx, dword [0x1400b8b40]
call fcn.1400461a8
movzx ecx, word [0x140096f14]
and dword [0x1400b8b48], 0
call qword [sym.imp.USER32.dll_IsClipboardFormatAvailable]
test eax, eax
jne 0x14006aea3
movzx ecx, word [0x140096f1c]
call qword [sym.imp.USER32.dll_IsClipboardFormatAvailable]
test eax, eax
jne 0x14006aea3
movzx ecx, word [0x140096f18]
call qword [sym.imp.USER32.dll_IsClipboardFormatAvailable]
test eax, eax
jne 0x14006aea3
movzx ecx, word [0x140096f10]
call qword [sym.imp.USER32.dll_IsClipboardFormatAvailable]
test eax, eax
jne 0x14006aea3
lea rdx, [rsp + 0x20]
mov ecx, 0x106
call qword [sym.imp.KERNEL32.dll_GetTempPathA]
lea r8, str.OrgChartClip.dat
mov edx, 0x106
lea rcx, [rsp + 0x20]
call fcn.1400205fc
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
mov rcx, qword [rsp + 0x130]
xor rcx, rsp
call fcn.14008a940
add rsp, 0x148
ret
Function at 0x14006c278
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
mov rsi, rcx
xor ebp, ebp
mov rbx, rdx
xor r12d, r12d
lea ecx, [rbp + 0x10]
call qword [sym.imp.USER32.dll_GetKeyState]
shr rax, 8
lea ecx, [rbp + 0x11]
movzx r15d, al
call qword [sym.imp.USER32.dll_GetKeyState]
lea edx, [rbp + 8]
mov rcx, rsi
movzx r14d, ax
shr r14, 8
call qword [sym.imp.USER32.dll_GetWindowLongPtrA]
mov r13, rax
test rsi, rsi
jne 0x14006c2dc
xor eax, eax
jmp 0x14006c4d3
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_GlobalLock]
mov rdi, rax
mov rcx, qword [rax + 0xfe]
test rcx, rcx
je 0x14006c329
movzx edx, bx
call fcn.140042d2c
mov r12d, eax
test eax, eax
jne 0x14006c4c7
mov rcx, qword [rdi + 0xfe]
call qword [sym.imp.KERNEL32.dll_GlobalLock]
mov rcx, qword [rdi + 0xfe]
cmp dword [rax + 0x64], 2
sete bpl
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
cmp dword [rdi + 0x32], 0
mov edx, 1
jne 0x14006c3d7
test ebp, ebp
jne 0x14006c3f1
mov rcx, qword [rdi + 0x1fa]
call qword [sym.imp.KERNEL32.dll_GlobalLock]
cmp dword [rax + 0x6c], ebp
je 0x14006c373
cmp rbx, 8
je 0x14006c35e
cmp rbx, 0x2e
jne 0x14006c373
mov rdx, qword [rdi + 0x1fa]
mov r9d, 0xd3
mov rcx, rsi
call fcn.14002eaa8
mov rcx, qword [rdi + 0x1fa]
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov edx, 1
sub rbx, 0x21
je 0x14006c4a9
sub rbx, 1
je 0x14006c488
sub rbx, 1
je 0x14006c472
cmp rbx, 1
jne 0x14006c4c7
mov ebx, dword [rdi + 0x42]
mov r9d, edx
mov dword [rsp + 0x28], edx
xor r8d, r8d
mov dword [rdi + 0x42], edx
mov rcx, rsi
mov dword [rsp + 0x20], edx
mov edx, dword [rdi + 0xf6]
call fcn.140025254
mov dword [rdi + 0x42], ebx
jmp 0x14006c4c7
cmp rbx, 8
je 0x14006c4bf
cmp rbx, 0xd
je 0x14006c412
cmp rbx, 0x2e
je 0x14006c4bf
lea rax, [rbx - 0x25]
cmp rax, 3
ja 0x14006c385
movzx r9d, r15w
mov r8, rbx
mov rdx, rdi
mov rcx, rsi
call fcn.14006cd08
jmp 0x14006c4c7
cmp dword [rdi + 0x32], edx
jne 0x14006c3f1
cmp dword [rdi + 0x42], 0
jl 0x14006c452
cmp dword [rdi + 0x46], 0
jl 0x14006c452
movzx r8d, word [rdi + 0x42]
xor r9d, r9d
movzx eax, word [rdi + 0x46]
mov edx, 0x459
and dword [rsp + 0x28], 0
mov rcx, rsi
and dword [rsp + 0x20], 0
shl r8d, 0x10
or r8d, eax
call fcn.140026250
mov edx, 1
mov rcx, qword [rdi + 0xfe]
test rcx, rcx
je 0x14006c4c7
and dword [rsp + 0x20], 0
mov r9d, edx
mov r8d, edx
xor edx, edx
call fcn.1400426a4
jmp 0x14006c4c7
mov ebx, dword [rdi + 0x42]
mov rcx, rsi
mov dword [rdi + 0x42], edx
mov rdx, rdi
call fcn.14006c8b0
jmp 0x14006c3cf
xor r9d, r9d
mov rcx, rsi
mov edx, 0x114
lea r8d, [r9 + 3]
test r14b, r14b
jne 0x14006c4a1
mov edx, 0x115
call qword [sym.imp.USER32.dll_SendMessageA]
jmp 0x14006c4c7
xor r9d, r9d
mov rcx, rsi
lea r8d, [r9 + 2]
test r14b, r14b
je 0x14006c49c
mov edx, 0x114
jmp 0x14006c4a1
mov rcx, rsi
call fcn.140088ad0
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov eax, r12d
lea r11, [rsp + 0x40]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret