joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14007e6f0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
mov eax, 0x8a40
call fcn.1400a7800
sub rsp, rax
mov rbp, rcx
movsxd rsi, r8d
mov rbx, rdx
lea rcx, [rsp + 0x242]
xor edx, edx
mov r8d, 0x1fc
mov edi, r9d
mov word [rsp + 0x240], 0
call sub.msvcrt.dll_memset
lea rcx, [rsp + 0x642]
xor edx, edx
mov r8d, 0x1fc
mov word [rsp + 0x640], 0
call sub.msvcrt.dll_memset
lea rcx, [rsp + 0x442]
xor edx, edx
mov r8d, 0x1fc
mov word [rsp + 0x440], 0
call sub.msvcrt.dll_memset
cmp edi, 0xffffffff
je 0x14007e7d9
mov eax, edi
lea r8, str._2.2X_2.2X_2.2X
movzx r9d, dil
shr eax, 0x10
movzx edx, al
movzx eax, di
mov dword [rsp + 0x28], edx
shr ax, 8
mov edx, 0xff
movzx ecx, al
mov dword [rsp + 0x20], ecx
lea rcx, [rsp + 0x840]
call sub.msvcrt.dll__snwprintf
lea r9, [rsp + 0x840]
lea r8, str._bgcolor__s_
lea rcx, [rsp + 0x240]
mov edx, 0xff
call sub.msvcrt.dll__snwprintf
mov edi, dword [rsp + 0x8a70]
xor r12d, r12d
cmp edi, 0xffffffff
je 0x14007e865
mov eax, edi
lea r8, str._2.2X_2.2X_2.2X
movzx r9d, dil
shr eax, 0x10
movzx edx, al
movzx eax, di
mov dword [rsp + 0x28], edx
shr ax, 8
mov edx, 0xff
movzx ecx, al
mov dword [rsp + 0x20], ecx
lea rcx, [rsp + 0x840]
call sub.msvcrt.dll__snwprintf
lea r9, [rsp + 0x840]
lea r8, str._font_color__s__
lea rcx, [rsp + 0x640]
mov edx, 0xff
call sub.msvcrt.dll__snwprintf
mov rdx, r12
lea rcx, str.__font_
nop
nop
movzx eax, word [rdx + rcx]
add rdx, 2
test ax, ax
mov word [rsp + rdx + 0x43e], ax
jne 0x14007e850
lea r9, [rsp + 0x240]
lea r8, str._table_border_1__cellpadding_5___tr_s__r_n
lea rcx, [rsp + 0xa40]
mov edx, 0x3fff
call sub.msvcrt.dll__snwprintf
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [rsp + 0xa40]
lea r9, [rsp + 0x8a70]
lea rdx, [rsp + 0xa40]
repne scasw ax, word [rdi]
mov qword [rsp + 0x20], r12
not rcx
lea r8d, [rcx + rcx - 2]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_WriteFile]
test rsi, rsi
jle 0x14007e995
add rbx, 8
nop
nop
lea rcx, [rsp + 0x42]
xor edx, edx
mov r8d, 0x1fc
mov word [rsp + 0x40], r12w
call sub.msvcrt.dll_memset
mov r9, qword [rbx]
cmp word [r9], r12w
je 0x14007e909
lea r8, str._width__s_
lea rcx, [rsp + 0x40]
mov edx, 0xff
call sub.msvcrt.dll__snwprintf
jmp 0x14007e90f
mov word [rsp + 0x40], r12w
lea rax, [rsp + 0x440]
lea r9, [rsp + 0x40]
lea r8, str._th_s__s_s_s_r_n
mov qword [rsp + 0x30], rax
mov rax, qword [rbx - 8]
lea rcx, [rsp + 0xa40]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x640]
mov edx, 0x3fff
mov qword [rsp + 0x20], rax
call sub.msvcrt.dll__snwprintf
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [rsp + 0xa40]
lea r9, [rsp + 0x8a70]
repne scasw ax, word [rdi]
lea rdx, [rsp + 0xa40]
mov qword [rsp + 0x20], r12
not rcx
lea r8d, [rcx + rcx - 2]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_WriteFile]
add rbx, 0x10
sub rsi, 1
jne 0x14007e8d0
lea r11, [rsp + 0x8a40]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop r12
ret
Function at 0x14007ec90
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
mov eax, 0x80e0
call fcn.1400a7800
sub rsp, rax
mov rdi, rdx
mov rbp, rcx
mov rsi, r8
lea rcx, [rsp + 0x50]
lea rdx, str._html__head__s_title__s__title___head__r_n_body__r_n_s__h3__s__h3__r_n
mov r8d, 0x82
mov rbx, r9
call sub.msvcrt.dll_memcpy
mov qword [rsp + 0x30], rdi
lea r8, [rsp + 0x50]
lea rcx, [rsp + 0xe0]
mov r9, rsi
mov edx, 0x2000
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rdi
call sub.msvcrt.dll__snwprintf
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [rsp + 0xe0]
lea r9, [rsp + 0x40]
lea rdx, [rsp + 0xe0]
repne scasw ax, word [rdi]
mov qword [rsp + 0x20], rax
not rcx
lea r8d, [rcx + rcx - 2]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_WriteFile]
lea r11, [rsp + 0x80e0]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret

Function at 0x14007f070
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x820
mov rsi, rcx
lea rcx, [rsp + 0x22]
xor ebx, ebx
xor edx, edx
mov r8d, 0x7fe
mov word [rsp + 0x20], bx
call sub.msvcrt.dll_memset
cmp word [0x1400c55d0], bx
lea rdi, [0x1400c55d0]
jne 0x14007f0c2
mov edx, 0x104
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov dword [0x1400c57dc], eax
mov rcx, rbx
nop
nop
nop
movzx eax, word [rcx + rdi]
add rcx, 2
test ax, ax
mov word [rsp + rcx + 0x1e], ax
jne 0x14007f0d0
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [rsp + 0x20]
repne scasw ax, word [rdi]
not rcx
sub rcx, 1
test ecx, ecx
jle 0x14007f11d
movsxd rax, ecx
cmp word [rsp + rax*2 + 0x1e], 0x5c
je 0x14007f11d
xor eax, eax
lea rdi, [rsp + 0x20]
or rcx, 0xffffffffffffffff
repne scasw ax, word [rdi]
mov eax, dword [0x1400a9734]
mov dword [rdi - 2], eax
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rsp + 0x20]
repne scasw ax, word [rdi]
mov rax, qword [str.shlwapi.dll]
lea rcx, [rsp + 0x20]
mov qword [rdi - 2], rax
mov rax, qword [0x1400aa580]
mov qword [rdi + 6], rax
mov rax, qword [0x1400aa588]
mov qword [rdi + 0xe], rax
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
test rax, rax
mov rdi, rax
jne 0x14007f16f
lea rcx, str.shlwapi.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rdi, rax
lea rdx, str.SHAutoComplete
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14007f190
mov edx, 0x10000001
mov rcx, rsi
call rax
mov ebx, eax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
lea r11, [rsp + 0x820]
mov eax, ebx
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret
Function at 0x14007f1c0
Capabilities:
Get common file path

Disassembly:
sub rsp, 0x828
cmp qword [0x1400c4fc0], 0
jne 0x14007f2e4
lea rcx, [rsp + 0x22]
xor edx, edx
mov r8d, 0x7fe
mov qword [rsp + 0x820], rdi
mov word [rsp + 0x20], 0
call sub.msvcrt.dll_memset
cmp word [0x1400c55d0], 0
lea rdi, [0x1400c55d0]
jne 0x14007f21b
mov edx, 0x104
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov dword [0x1400c57dc], eax
xor ecx, ecx
nop
movzx eax, word [rcx + rdi]
add rcx, 2
test ax, ax
mov word [rsp + rcx + 0x1e], ax
jne 0x14007f220
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [rsp + 0x20]
repne scasw ax, word [rdi]
not rcx
sub rcx, 1
test ecx, ecx
jle 0x14007f26d
movsxd rax, ecx
cmp word [rsp + rax*2 + 0x1e], 0x5c
je 0x14007f26d
xor eax, eax
lea rdi, [rsp + 0x20]
or rcx, 0xffffffffffffffff
repne scasw ax, word [rdi]
mov eax, dword [0x1400a9734]
mov dword [rdi - 2], eax
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rsp + 0x20]
repne scasw ax, word [rdi]
mov rax, qword [str.shell32.dll]
lea rcx, [rsp + 0x20]
mov qword [rdi - 2], rax
mov rax, qword [0x1400aa3c0]
mov qword [rdi + 6], rax
mov rax, qword [0x1400aa3c8]
mov qword [rdi + 0xe], rax
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rdi, qword [rsp + 0x820]
test rax, rax
jne 0x14007f2c1
lea rcx, str.shell32.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
test rax, rax
mov qword [0x1400c4fc0], rax
je 0x14007f2e4
lea rdx, str.SHGetSpecialFolderPathW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1400c4fb8], rax
add rsp, 0x828
ret

Function at 0x14007fee0
Capabilities:
Read .ini file

Disassembly:
mov qword [rsp + 0x10], rsi
push rdi
mov eax, 0x20030
call fcn.1400a7800
sub rsp, rax
test ecx, ecx
mov r10, r9
mov rdi, r8
mov rsi, rdx
je 0x14007ff95
mov qword [rsp + 0x20040], rbx
mov rbx, qword [rsp + 0x20060]
test rbx, rbx
je 0x14007ff7c
mov dx, 0x22
mov rcx, rbx
call sub.msvcrt.dll_wcschr
test rax, rax
je 0x14007ff7c
lea r8, str.__s_
lea rcx, [rsp + 0x30]
mov r9, rbx
mov edx, 0xfffe
mov word [rsp + 0x30], 0
call sub.msvcrt.dll__snwprintf
mov r9, qword [rsp + 0x20070]
lea r8, [rsp + 0x30]
mov rdx, rdi
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
mov rbx, qword [rsp + 0x20040]
mov rsi, qword [rsp + 0x20048]
add rsp, 0x20030
pop rdi
ret
mov r9, qword [rsp + 0x20070]
mov r8, rbx
mov rdx, rdi
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
jmp 0x14007ff63
mov rax, qword [rsp + 0x20070]
mov r9, qword [rsp + 0x20060]
mov r8, r10
mov qword [rsp + 0x28], rax
mov eax, dword [rsp + 0x20068]
mov rdx, rdi
mov rcx, rsi
mov dword [rsp + 0x20], eax
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
mov rsi, qword [rsp + 0x20048]
add rsp, 0x20030
pop rdi
ret
Function at 0x140080440
Capabilities:
Read .ini file

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
mov eax, 0x4060
call fcn.1400a7800
sub rsp, rax
mov r15, rdx
xor edx, edx
mov r14, r8
test ecx, ecx
mov rbp, r9
lea r8d, [rax - 0x60]
lea rcx, [rsp + 0x52]
je 0x14008053e
call sub.msvcrt.dll_memset
mov rcx, qword [rsp + 0x40b0]
mov word [rsp + 0x50], 0
mov r13d, dword [rcx]
test r13d, r13d
je 0x140080520
xor esi, esi
test r13d, r13d
mov edi, esi
je 0x140080516
mov ebx, esi
lea r12, [rsp + 0x50]
movzx r9d, byte [rbp]
xor eax, eax
lea r8, str._2.2X
lea rcx, [rsp + 0x38]
lea edx, [rax + 0xa]
mov word [rsp + 0x38], 0
mov qword [rsp + 0x3a], rax
mov qword [rsp + 0x42], rax
mov word [rsp + 0x4a], ax
call sub.msvcrt.dll__snwprintf
lea rcx, [rsp + 0x38]
mov esi, ebx
mov eax, dword [rcx]
mov dword [r12], eax
movzx eax, word [rcx + 4]
mov word [r12 + 4], ax
lea eax, [rbx + 3]
cmp eax, 0x2000
jae 0x140080516
add edi, 1
add ebx, 3
add rbp, 1
add r12, 6
cmp edi, r13d
jb 0x1400804b1
lea eax, [rsi + 2]
mov word [rsp + rax*2 + 0x50], 0
mov r9, qword [rsp + 0x40b8]
lea r8, [rsp + 0x50]
mov rdx, r14
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
jmp 0x140080624
mov word [rsp + 0x50], 0
call sub.msvcrt.dll_memset
mov rdx, qword [rsp + 0x40b8]
mov qword [rsp + 0x28], rdx
lea r9, [rsp + 0x50]
lea r8, [0x1400a89b8]
mov rdx, r14
mov rcx, r15
mov dword [rsp + 0x20], 0x2000
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
xor esi, esi
lea rdi, [rsp + 0x50]
test eax, eax
mov r13d, esi
setne r13b
or rcx, 0xffffffffffffffff
xor eax, eax
repne scasw ax, word [rdi]
not rcx
sub rcx, 1
test ecx, ecx
je 0x140080621
mov r15, qword [rsp + 0x40b0]
mov rdi, rsi
movsxd r12, ecx
mov r14d, dword [r15]
jle 0x140080621
lea rbx, [rsp + 0x52]
nop
nop
nop
movzx eax, word [rsp + rdi*2 + 0x50]
cmp ax, 0x20
jne 0x1400805d5
add rdi, 1
add rbx, 2
jmp 0x140080610
cmp esi, r14d
mov word [rsp + 0x30], ax
movzx eax, word [rbx]
mov word [rsp + 0x32], ax
mov word [rsp + 0x34], 0
jae 0x140080615
xor edx, edx
lea rcx, [rsp + 0x30]
lea r8d, [rdx + 0x10]
call sub.msvcrt.dll_wcstoul
add rbp, 1
add esi, 1
mov byte [rbp - 1], al
add rdi, 2
add rbx, 4
cmp rdi, r12
jl 0x1400805c0
test esi, esi
mov eax, r13d
je 0x140080624
mov dword [r15], esi
jmp 0x140080624
mov eax, r13d
lea r11, [rsp + 0x4060]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x140080f90
Capabilities:
Link many functions at runtime

Disassembly:
sub rsp, 0x28
cmp dword [0x1400c4fb0], 0
jne 0x140081066
lea rcx, str.kernel32.dll
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
mov rbx, rax
je 0x140081061
lea rdx, str.CreateToolhelp32Snapshot
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
mov qword [0x1400c1e88], rax
je 0x140081061
lea rdx, str.Module32First
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
mov qword [0x1400c1e78], rax
je 0x140081061
lea rdx, str.Module32Next
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
mov qword [0x1400c1e70], rax
je 0x140081061
lea rdx, str.Process32First
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
mov qword [0x1400c1c48], rax
je 0x140081061
lea rdx, str.Process32Next
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [0x1400c4fb0]
mov edx, 1
test rax, rax
mov qword [0x1400c1e60], rax
cmovne ecx, edx
mov dword [0x1400c4fb0], ecx
mov rbx, qword [rsp + 0x20]
add rsp, 0x28
ret
Function at 0x140081080
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
sub rsp, 0x230
cmp word [rdx + 2], 0x3a
mov rbx, rdx
mov rbp, rcx
jne 0x1400810b6
sub rcx, rdx
nop
movzx eax, word [rbx]
add rbx, 2
test ax, ax
mov word [rcx + rbx - 2], ax
jne 0x1400810a0
jmp 0x1400812e9
lea rcx, [rdx + 4]
mov dx, 0x3a
call sub.msvcrt.dll_wcschr
test rax, rax
je 0x1400810f6
lea rcx, [rax - 2]
mov rdx, rbp
sub rdx, rcx
nop
nop
nop
nop
movzx eax, word [rcx]
add rcx, 2
test ax, ax
mov word [rdx + rcx - 2], ax
jne 0x1400810e0
jmp 0x1400812e9
or rcx, 0xffffffffffffffff
mov qword [rsp + 0x240], rsi
mov qword [rsp + 0x248], rdi
xor eax, eax
xor esi, esi
mov rdi, rbx
repne scasw ax, word [rdi]
mov qword [rsp + 0x250], r12
mov r12d, esi
not rcx
sub rcx, 1
cmp ecx, 0xb
mov rdi, rcx
jl 0x14008115e
nop
movsxd rax, r12d
lea rdx, str._systemroot
mov r8d, 0x16
lea rcx, [rbx + rax*2]
call sub.msvcrt.dll__memicmp
test eax, eax
je 0x1400811f7
add r12d, 1
lea eax, [r12 + 0xb]
cmp eax, edi
jle 0x140081130
cmp word [rbx], 0x5c
jne 0x1400812b5
lea rcx, [rsp + 0x22]
xor edx, edx
mov r8d, 0x208
mov word [rsp + 0x20], si
call sub.msvcrt.dll_memset
cmp word [0x1400c53c0], si
lea rdi, [0x1400c53c0]
jne 0x1400811b0
mov edx, 0x104
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
mov dword [0x1400c55cc], eax
nop
nop
nop
nop
movzx eax, word [rsi + rdi]
add rsi, 2
test ax, ax
mov word [rsp + rsi + 0x1e], ax
jne 0x1400811b0
mov eax, dword [rsp + 0x20]
or rcx, 0xffffffffffffffff
mov rdi, rbp
mov dword [rbp], eax
xor eax, eax
mov word [rbp + 4], 0
repne scasw ax, word [rdi]
xor ecx, ecx
nop
movzx eax, word [rbx + rcx]
add rcx, 2
test ax, ax
mov word [rdi + rcx - 4], ax
jne 0x1400811e0
jmp 0x1400812d1
test r12d, r12d
js 0x14008115e
lea rcx, [rsp + 0x22]
xor edx, edx
mov r8d, 0x208
mov word [rsp + 0x20], si
call sub.msvcrt.dll_memset
cmp word [0x1400c53c0], si
lea rdi, [0x1400c53c0]
jne 0x140081240
mov edx, 0x104
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
mov dword [0x1400c55cc], eax
nop
nop
movzx eax, word [rsi + rdi]
add rsi, 2
test ax, ax
mov word [rsp + rsi + 0x1e], ax
jne 0x140081240
lea rax, [rsp + 0x20]
mov rcx, rbp
lea rdx, [rsp + 0x20]
sub rcx, rax
nop
nop
nop
nop
movzx eax, word [rdx]
add rdx, 2
test ax, ax
mov word [rcx + rdx - 2], ax
jne 0x140081270
lea eax, [r12 + 0xb]
or rcx, 0xffffffffffffffff
mov rdi, rbp
movsxd rdx, eax
xor eax, eax
repne scasw ax, word [rdi]
xor ecx, ecx
lea r8, [rbx + rdx*2]
nop
nop
movzx eax, word [r8 + rcx]
add rcx, 2
test ax, ax
mov word [rdi + rcx - 4], ax
jne 0x1400812a0
jmp 0x1400812d1
mov rcx, rbp
sub rcx, rbx
nop
nop
movzx eax, word [rbx]
add rbx, 2
test ax, ax
mov word [rcx + rbx - 2], ax
jne 0x1400812c0
mov rdi, qword [rsp + 0x248]
mov rsi, qword [rsp + 0x240]
mov r12, qword [rsp + 0x250]
mov rax, rbp
mov rbx, qword [rsp + 0x258]
add rsp, 0x230
pop rbp
ret
Function at 0x140081310
Capabilities:
Get common file path
Link many functions at runtime

Disassembly:
sub rsp, 0x828
cmp dword [0x1400c4fb4], 0
jne 0x1400814da
lea rcx, [rsp + 0x22]
xor edx, edx
mov r8d, 0x7fe
mov qword [rsp + 0x820], rdi
mov word [rsp + 0x20], 0
call sub.msvcrt.dll_memset
cmp word [0x1400c55d0], 0
lea rdi, [0x1400c55d0]
jne 0x14008136a
mov edx, 0x104
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov dword [0x1400c57dc], eax
xor ecx, ecx
nop
movzx eax, word [rcx + rdi]
add rcx, 2
test ax, ax
mov word [rsp + rcx + 0x1e], ax
jne 0x140081370
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [rsp + 0x20]
repne scasw ax, word [rdi]
not rcx
sub rcx, 1
test ecx, ecx
jle 0x1400813bd
movsxd rax, ecx
cmp word [rsp + rax*2 + 0x1e], 0x5c
je 0x1400813bd
xor eax, eax
lea rdi, [rsp + 0x20]
or rcx, 0xffffffffffffffff
repne scasw ax, word [rdi]
mov eax, dword [0x1400a9734]
mov dword [rdi - 2], eax
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rsp + 0x20]
repne scasw ax, word [rdi]
mov rax, qword [str.psapi.dll]
lea rcx, [rsp + 0x20]
mov qword [rdi - 2], rax
mov rax, qword [0x1400aa250]
mov qword [rdi + 6], rax
mov eax, dword [0x1400aa258]
mov dword [rdi + 0xe], eax
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
test rax, rax
mov rdi, rax
jne 0x140081416
lea rcx, str.psapi.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
test rax, rax
mov rdi, rax
je 0x1400814d2
lea rdx, str.GetModuleBaseNameW
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
mov qword [0x1400c1ea0], rax
je 0x1400814c0
lea rdx, str.EnumProcessModules
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
mov qword [0x1400c1e90], rax
je 0x1400814c0
lea rdx, str.GetModuleFileNameExW
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
mov qword [0x1400c1e80], rax
je 0x1400814c0
lea rdx, str.EnumProcesses
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
mov qword [0x1400c1ea8], rax
je 0x1400814c0
lea rdx, str.GetModuleInformation
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
mov qword [0x1400c1e98], rax
je 0x1400814c0
mov dword [0x1400c4fb4], 1
mov rdi, qword [rsp + 0x820]
add rsp, 0x828
ret
cmp dword [0x1400c4fb4], 0
jne 0x1400814d2
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rdi, qword [rsp + 0x820]
add rsp, 0x828
ret
Function at 0x1400825e0
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
mov qword [rsp + 0x10], rbx
push rsi
mov eax, 0x4060
call fcn.1400a7800
sub rsp, rax
mov rsi, qword [rcx + 0x6d8]
mov rbx, rcx
xor ecx, ecx
mov eax, dword [rbx + 0x764]
mov dword [rsp + 0x30], ecx
mov dword [rsp + 0x28], ecx
mov rcx, qword [rsi + 0x310]
lea r9, [rsp + 0x20]
xor r8d, r8d
mov edx, 0x104b
mov dword [rsp + 0x20], 4
mov dword [rsp + 0x24], eax
call qword [sym.imp.USER32.dll_SendMessageW]
test eax, eax
je 0x1400826fc
mov rax, qword [rsi]
mov rcx, rsi
mov qword [rsp + 0x4070], rdi
mov rdi, qword [rsp + 0x48]
call qword [rax]
lea r8, [rsp + 0x60]
mov rdx, qword [rax]
mov eax, dword [rsi + 8]
mov word [rsp + 0x60], 0
imul eax, edi
movsxd rcx, eax
add rcx, rdx
mov edx, dword [rbx + 0x768]
mov rax, qword [rcx]
call qword [rax]
test rax, rax
mov rsi, rax
je 0x1400826f4
mov rcx, qword [rbx + 0x210]
call qword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x1400826f4
call qword [sym.imp.USER32.dll_EmptyClipboard]
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, rsi
repne scasw ax, word [rdi]
not rcx
movsxd rbx, ecx
mov ecx, 0x2000
add rbx, rbx
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
test rax, rax
mov rdi, rax
je 0x1400826ee
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GlobalLock]
mov r8, rbx
mov rdx, rsi
mov rcx, rax
call sub.msvcrt.dll_memcpy
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov rdx, rdi
mov ecx, InitCommonControls
call qword [sym.imp.USER32.dll_SetClipboardData]
call qword [sym.imp.USER32.dll_CloseClipboard]
mov rdi, qword [rsp + 0x4070]
mov rbx, qword [rsp + 0x4078]
add rsp, 0x4060
pop rsi
ret
Function at 0x140085530
Capabilities:
Hide graphical window

Disassembly:
push rbx
sub rsp, 0x20
mov rax, qword [rcx + 0x6d0]
mov rdx, qword [0x1400c4850]
mov rbx, rcx
xor dword [rax + 0xa50], 1
cmp dword [rdx + 0xa50], 0
je 0x14008556a
mov rcx, qword [rcx + 0x6d8]
add rdx, 0xa64
call fcn.14009e4c0
mov edx, 0x7f02
xor ecx, ecx
call qword [sym.imp.USER32.dll_LoadCursorW]
mov rcx, rax
call qword [sym.imp.USER32.dll_SetCursor]
mov rcx, qword [rbx + 0x6d8]
xor r9d, r9d
mov rcx, qword [rcx + 0x310]
lea edx, [r9 + 0xb]
xor r8d, r8d
mov qword [0x1400c16d0], rax
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, qword [rbx + 0x6d8]
mov rax, qword [rcx]
xor edx, edx
call qword [rax + 0xf8]
mov rcx, rbx
call fcn.1400832d0
mov rcx, qword [rbx + 0x6d8]
xor r9d, r9d
mov rcx, qword [rcx + 0x310]
lea edx, [r9 + 0xb]
lea r8d, [r9 + 1]
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, qword [0x1400c16d0]
call qword [sym.imp.USER32.dll_SetCursor]
xor edx, edx
mov rcx, rbx
call fcn.140083480
mov rax, qword [rbx + 0x6d0]
mov ecx, dword [rax + 0xa50]
neg ecx
mov rcx, qword [rbx + 0x790]
sbb edx, edx
and edx, 5
call qword [sym.imp.USER32.dll_ShowWindow]
mov rcx, rbx
call fcn.140082810
mov r11, qword [rbx + 0x6d0]
cmp dword [r11 + 0xa50], 0
je 0x14008564a
mov rcx, qword [rbx + 0x790]
mov edx, 0x40b
call qword [sym.imp.USER32.dll_GetDlgItem]
mov rcx, rax
call qword [sym.imp.USER32.dll_SetFocus]
add rsp, 0x20
pop rbx
ret
Function at 0x140085660
Capabilities:
Delete file
Get common file path
Get file size
Open clipboard
Read file on windows
Write clipboard data

Disassembly:
push rdi
sub rsp, 0x480
mov rdi, rcx
lea rdx, [rsp + 0x250]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
jne 0x140085696
lea rcx, [rsp + 0x250]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
lea r9, [rsp + 0x40]
lea rdx, [0x1400a9dbc]
lea rcx, [rsp + 0x250]
xor r8d, r8d
mov word [rsp + 0x40], 0
call qword [sym.imp.KERNEL32.dll_GetTempFileNameW]
mov rax, qword [rdi + 0x6d0]
mov rcx, qword [rdi + 0x6d8]
mov edx, dword [rax + 0xa54]
mov r9d, 1
mov dword [rsp + 0x20], 1
mov dword [rcx + 0x3b4], edx
lea rdx, [rsp + 0x40]
lea r8d, [r9 + 1]
call fcn.14008e140
test eax, eax
jne 0x14008570b
mov rcx, qword [rdi + 0x210]
xor edx, edx
call fcn.140094af0
add rsp, 0x480
pop rdi
ret
mov rcx, qword [rdi + 0x210]
mov qword [rsp + 0x498], rbx
xor ebx, ebx
call qword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x140085862
mov qword [rsp + 0x478], rsi
call qword [sym.imp.USER32.dll_EmptyClipboard]
mov qword [rsp + 0x30], rbx
lea r8d, [rbx + 3]
lea rcx, [rsp + 0x40]
xor r9d, r9d
mov edx, 0x80000000
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
cmp rax, 0xffffffffffffffff
mov rsi, rax
je 0x14008584a
mov qword [rsp + 0x4a0], rbp
mov qword [rsp + 0x470], r12
xor edx, edx
mov rcx, rax
mov qword [rsp + 0x468], r13
mov qword [rsp + 0x460], r14
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov ecx, 0x2000
mov r13d, eax
mov ebp, eax
lea rdx, [r13 + 2]
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
test rax, rax
mov r12, rax
je 0x140085809
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GlobalLock]
lea r9, [rsp + 0x490]
mov r8d, r13d
mov rcx, rsi
mov rdx, rax
mov qword [rsp + 0x20], rbx
mov r14, rax
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1400857ff
shr rbp, 1
mov rcx, r12
mov word [r14 + rbp*2], bx
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
lea ecx, [rbx + 0xd]
mov rdx, r12
call qword [sym.imp.USER32.dll_SetClipboardData]
jmp 0x140085811
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
jmp 0x140085811
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r14, qword [rsp + 0x460]
mov r13, qword [rsp + 0x468]
mov r12, qword [rsp + 0x470]
mov rbp, qword [rsp + 0x4a0]
call qword [sym.imp.USER32.dll_CloseClipboard]
mov rsi, qword [rsp + 0x478]
jmp 0x14008586a
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
call qword [sym.imp.USER32.dll_CloseClipboard]
mov rsi, qword [rsp + 0x478]
jmp 0x14008586a
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
test ebx, ebx
je 0x14008587c
mov rcx, qword [rdi + 0x210]
mov edx, ebx
call fcn.140094af0
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov rbx, qword [rsp + 0x498]
add rsp, 0x480
pop rdi
ret
Function at 0x140088e80
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rdi
mov eax, 0x2040
call fcn.1400a7800
sub rsp, rax
mov rbx, rcx
mov rdi, rdx
lea r8d, [rax - 0x41]
lea rcx, [rsp + 0x41]
xor edx, edx
mov byte [rsp + 0x40], 0
call sub.msvcrt.dll_memset
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x40]
mov qword [rsp + 0x30], 0
or r9d, 0xffffffff
mov r8, rdi
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x28], 0x1fff
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [rsp + 0x40]
lea r9, [rsp + 0x2060]
repne scasb al, byte [rdi]
lea rdx, [rsp + 0x40]
mov qword [rsp + 0x20], rax
not rcx
lea r8, [rcx - 1]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rbx, qword [rsp + 0x2050]
add rsp, 0x2040
pop rdi
ret