joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14000d9c4
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov ecx, 1
call qword [sym.imp.USER32.dll_GetKeyState]
movzx ebx, ax
mov ecx, 2
shr ebx, 0xf
call qword [sym.imp.USER32.dll_GetKeyState]
mov edi, ebx
mov ecx, 4
or edi, 2
bt ax, 0xf
cmovae edi, ebx
call qword [sym.imp.USER32.dll_GetKeyState]
mov rbx, qword [rsp + 0x30]
movzx ecx, ax
mov rsi, qword [rsp + 0x38]
mov eax, edi
or eax, 4
bt cx, 0xf
cmovae eax, edi
add rsp, 0x20
pop rdi
ret

Function at 0x14000da28
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
mov r12d, r9d
mov ebp, r8d
mov r13, rdx
mov rdi, rcx
call qword [sym.imp.USER32.dll_GetMessagePos]
mov rcx, qword [rdi]
mov edx, 0xfffffff4
mov ebx, eax
call qword [sym.imp.USER32.dll_GetWindowLongPtrW]
mov rcx, qword [rdi]
mov r15, rax
call fcn.14005f46c
mov rcx, rax
call fcn.14001dcbc
mov rcx, qword [0x1402272d8]
mov r14, rax
call fcn.14002de88
movsx ecx, bx
lea rdx, [rsp + 0x60]
mov dword [rsp + 0x60], ecx
mov rsi, rax
shr ebx, 0x10
movsx ecx, bx
mov dword [rsp + 0x64], ecx
mov rcx, qword [rdi]
call qword [sym.imp.USER32.dll_ScreenToClient]
mov ecx, reloc.WS2_32.dll_recv
call qword [sym.imp.USER32.dll_GetKeyState]
movzx ebx, ax
mov ecx, reloc.WS2_32.dll_select
shr ebx, 0xf
call qword [sym.imp.USER32.dll_GetKeyState]
mov edi, ebx
mov ecx, reloc.WS2_32.dll_recvfrom
or edi, 2
bt ax, 0xf
cmovae edi, ebx
call qword [sym.imp.USER32.dll_GetKeyState]
mov ecx, dword [rsp + 0x60]
movzx ebx, ax
mov eax, 0x8000
mov dword [rsi], ecx
mov ecx, dword [rsp + 0x64]
and bx, ax
mov dword [rsi + 4], ecx
call fcn.14000d9c4
mov dword [rsi + 8], eax
mov ecx, edi
movzx eax, word [rsp + 0x80]
or ecx, 4
test bx, bx
mov dword [rsi + 0x18], eax
lea rax, [0x14000d9b4]
mov dword [rsi + 0xc], ebp
cmove ecx, edi
mov qword [rsp + 0x28], rax
mov dword [rsi + 0x10], ecx
mov r9, r13
mov ecx, 0x332c
mov dword [rsi + 0x14], r12d
mov r8, r14
mov qword [rsp + 0x20], rsi
mov rdx, r15
call fcn.14005f944
mov rbx, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x14000f2b8
Capabilities:
Get graphical window text

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x20
mov rsi, rcx
xor r9d, r9d
mov rcx, qword [rcx]
xor r8d, r8d
mov edx, 0x147
call qword [sym.imp.USER32.dll_SendMessageW]
or r15, 0xffffffffffffffff
mov rbp, rax
cmp rax, r15
je 0x14000f378
mov rcx, qword [rsi]
lea edx, [r15 - 0xf]
call qword [sym.imp.USER32.dll_GetWindowLongPtrW]
test al, 1
jne 0x14000f378
xor r14d, r14d
cmp qword [rsi + 0x30], r14
jne 0x14000f378
mov rcx, qword [rsi]
call qword [sym.imp.USER32.dll_GetWindowTextLengthW]
mov rcx, qword [0x140224818]
xor edx, edx
movsxd rbx, eax
lea r8, [rbx*2 + 2]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
lea r8d, [rbx + 1]
mov rdx, rax
mov rdi, rax
mov word [rax], r14w
mov rcx, qword [rsi]
call qword [sym.imp.USER32.dll_GetWindowTextW]
mov rcx, qword [rsi]
mov r9, rdi
mov r8, r15
mov edx, 0x158
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, qword [0x140224818]
mov r8, rdi
cmp rax, r15
cmove rbp, r15
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rbx, qword [rsp + 0x40]
mov rax, rbp
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop rdi
ret
Function at 0x140013e80
Capabilities:
Get graphical window text

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov ebx, edx
mov rdx, rcx
mov rcx, qword [0x140228308]
call fcn.14002da6c
xor ebp, ebp
mov rsi, rax
test rax, rax
je 0x140013f00
mov rcx, qword [rax + 8]
mov rax, qword [rcx + 0x28]
test rax, rax
je 0x140013ec5
mov edx, ebx
mov rcx, rsi
call rax
jmp 0x140013f00
mov rcx, qword [rsi]
call qword [sym.imp.USER32.dll_GetWindowTextLengthW]
mov ecx, eax
mov edx, ebx
mov edi, eax
call fcn.1400383e0
lea r8d, [rdi + 1]
mov rdx, rax
mov rbx, rax
mov word [rax], bp
mov rcx, qword [rsi]
call qword [sym.imp.USER32.dll_GetWindowTextW]
mov rcx, rbx
call fcn.140037f38
sub edi, eax
mov ecx, edi
call fcn.140039560
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x14001d870
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
sub rsp, 0x28
cmp qword [0x140229688], 0
jne 0x14001d8d6
lea rcx, [0x140229688]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
test eax, eax
je 0x14001d8c2
movabs rax, 0x20c49ba5e353f7cf
lea rcx, [0x140229690]
imul qword [0x140229688]
sar rdx, 7
mov rax, rdx
shr rax, 0x3f
add rdx, rax
mov qword [0x140229688], rdx
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
cmp qword [0x140229688], 0
jne 0x14001d8d6
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov eax, eax
jmp 0x14001d8fc
and qword [rsp + 0x30], 0
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rax, qword [rsp + 0x30]
sub rax, qword [0x140229690]
cqo
idiv qword [0x140229688]
add rsp, 0x28
ret

Function at 0x14001df1c
Capabilities:
Get graphical window text

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov esi, edx
xor ebp, ebp
mov rdx, rcx
mov ebx, ebp
mov rcx, qword [0x14022a270]
call fcn.14002da6c
mov rdi, rax
test rax, rax
je 0x14001df58
mov rcx, qword [rax]
call qword [sym.imp.USER32.dll_GetWindowTextLengthW]
mov ebx, eax
mov edx, esi
mov ecx, ebx
call fcn.1400383e0
test ebx, ebx
je 0x14001df77
mov rcx, qword [rdi]
lea r8d, [rbx + 1]
mov rdx, rax
call qword [sym.imp.USER32.dll_GetWindowTextW]
jmp 0x14001df7a
mov word [rax], bp
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x1400213d8
Capabilities:
Copy file

Disassembly:
sub rsp, 0x28
test rcx, rcx
je 0x1400213f3
test rdx, rdx
je 0x1400213f3
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_CopyFileW]
cdqe
jmp 0x1400213f5
xor eax, eax
add rsp, 0x28
ret

Function at 0x1400213fc
Capabilities:
Create directory

Disassembly:
push rbx
sub rsp, 0x230
xor ebx, ebx
test rcx, rcx
je 0x140021486
mov rdx, rcx
mov r8d, 0x104
lea rcx, [rsp + 0x20]
call fcn.14003950c
lea rcx, [rsp + 0x20]
mov word [rsp + 0x228], bx
call fcn.140037f38
lea rcx, [rsp + 0x20]
lea rcx, [rcx + rax*2]
lea rax, [rsp + 0x20]
cmp rcx, rax
jbe 0x140021472
lea rdx, [rcx - 2]
movzx eax, word [rdx]
sub ax, 0x20
cmp ax, 0x3c
ja 0x140021472
movabs r8, 0x1000000000008001
bt r8, rax
jae 0x140021472
lea rax, [rsp + 0x20]
mov rcx, rdx
cmp rdx, rax
ja 0x140021444
mov word [rcx], bx
xor edx, edx
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
cdqe
jmp 0x140021488
xor eax, eax
add rsp, 0x230
pop rbx
ret
Function at 0x140021804
Capabilities:
Delete file

Disassembly:
sub rsp, 0x28
xor eax, eax
test rcx, rcx
je 0x140021817
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
cdqe
add rsp, 0x28
ret

Function at 0x140021938
Capabilities:
Check if file exists

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
mov rax, qword [0x140229830]
xor r13d, r13d
mov rbp, r8
mov r14, rdx
mov rdi, rcx
mov esi, r13d
test rax, rax
jne 0x14002198a
lea r8, [fcn.1400218f4]
mov ecx, 0x260
lea edx, [rax + 0x10]
call fcn.14002dbbc
mov qword [0x140229830], rax
mov rdx, rdi
mov rcx, rax
call fcn.14002d99c
mov rbx, rax
test rax, rax
je 0x140021a8d
test r14, r14
lea r15, [0x14013841c]
cmovne r15, r14
test rbp, rbp
je 0x1400219bb
cmp word [rbp], r13w
jne 0x1400219c2
lea rbp, [0x140147018]
mov rcx, r15
call fcn.140037f38
mov rcx, rbp
mov r12, rax
call fcn.140037f38
mov rcx, qword [0x140224818]
add eax, 2
add eax, r12d
xor edx, edx
movsxd r8, eax
add r8, r8
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov r14, rax
test rax, rax
je 0x140021a76
mov rdx, r15
mov rcx, rax
call fcn.14003838c
test r12d, r12d
je 0x140021a23
movsxd rax, r12d
cmp word [r15 + rax*2 - 2], 0x5c
je 0x140021a23
lea rdx, [0x140138348]
mov rcx, r14
call fcn.1400394e0
mov rdx, rbp
mov rcx, r14
call fcn.1400394e0
lea rdx, [rbx + 0xc]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov qword [rbx], rax
cmp rax, 0xffffffffffffffff
je 0x140021a4a
mov dword [rbx + 8], r13d
jmp 0x140021a5c
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
jne 0x140021a5f
mov dword [rbx + 8], 1
mov rsi, rbx
mov rcx, qword [0x140224818]
mov r8, r14
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
test rsi, rsi
jne 0x140021a8d
mov rcx, qword [0x140229830]
cmp rdi, 0xffffffffffffffff
cmove rdi, rbx
mov rdx, rdi
call fcn.14002db50
mov rbx, qword [rsp + 0x50]
mov rax, rsi
mov rsi, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x58]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x140021b0c
Capabilities:
Check if file exists
Get disk information
Get file attributes

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
lea rbp, [rsp - 0x380]
sub rsp, 0x480
or rbx, 0xffffffffffffffff
xor edi, edi
test rcx, rcx
je 0x140021c7d
cmp word [rcx], di
je 0x140021c7d
mov rdx, rcx
mov r8d, 0x104
lea rcx, [rsp + 0x20]
call fcn.14003950c
lea rcx, [rsp + 0x20]
mov word [rbp + 0x128], di
call fcn.140037f38
mov rdx, rax
cdqe
lea rcx, [rsp + rax*2 + 0x1e]
lea eax, [rdx - 2]
cmp eax, 1
ja 0x140021bb2
cmp word [rsp + 0x22], 0x3a
jne 0x140021bb2
cmp edx, 2
jne 0x140021b92
lea rdx, [0x140138348]
lea rcx, [rsp + 0x20]
call fcn.1400394e0
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 1
jbe 0x140021c7d
mov rbx, 0xfffffffffffffffe
jmp 0x140021c7d
cmp word [rcx], 0x5c
je 0x140021bbe
cmp word [rcx], 0x2f
jne 0x140021bc7
mov word [rcx], di
sub rcx, 2
jmp 0x140021bb2
lea rdx, [rbp + 0x130]
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov rcx, rax
cmp rax, rbx
je 0x140021c0e
test byte [rbp + 0x130], 0x10
je 0x140021bf3
mov rbx, 0xfffffffffffffffe
jmp 0x140021c06
mov ebx, dword [rbp + 0x14c]
mov eax, dword [rbp + 0x150]
shl rbx, 0x20
or rbx, rax
call qword [sym.imp.KERNEL32.dll_FindClose]
jmp 0x140021c7d
movzx ecx, word [rsp + 0x20]
movzx eax, word [rsp + 0x22]
cmp cx, 0x5c
jne 0x140021c23
cmp ax, cx
je 0x140021c39
cmp cx, 0x2f
jne 0x140021c2e
cmp ax, cx
je 0x140021c39
cmp cx, 0x2e
jne 0x140021c7d
cmp ax, cx
jne 0x140021c7d
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x140021c5e
not eax
mov rbx, 0xfffffffffffffffe
shr rax, 4
and eax, 1
or rbx, rax
jmp 0x140021c7d
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetDriveTypeW]
mov rcx, rbx
mov rbx, 0xfffffffffffffffe
cmp eax, 1
cmova rcx, rbx
mov rbx, rcx
lea r11, [rsp + 0x480]
mov rax, rbx
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov rsp, r11
pop rbp
ret

Function at 0x140021f88
Capabilities:
Move file

Disassembly:
sub rsp, 0x28
test rcx, rcx
je 0x140021fa0
test rdx, rdx
je 0x140021fa0
call qword [sym.imp.KERNEL32.dll_MoveFileW]
cdqe
jmp 0x140021fa2
xor eax, eax
add rsp, 0x28
ret

Function at 0x140021fa8
Capabilities:
Set current directory

Disassembly:
sub rsp, 0x28
test rcx, rcx
je 0x140021fbb
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
cdqe
jmp 0x140021fbd
xor eax, eax
add rsp, 0x28
ret

Function at 0x140021fd0
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x30
xor eax, eax
mov rbx, rcx
mov dword [rsp + 0x40], eax
cmp dword [rcx + 0x1c], eax
jne 0x140022014
mov r8d, dword [rcx + 0x10]
lea r9, [rsp + 0x40]
sub r8d, dword [rcx + 0x14]
mov rdx, qword [rcx + 8]
mov rcx, qword [rcx]
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [rbx + 0x10]
mov dword [rbx + 0x14], eax
movsxd rax, dword [rsp + 0x40]
add rsp, 0x30
pop rbx
ret
cdqe
add rsp, 0x30
pop rbx
ret
Function at 0x140022020
Capabilities:
Write file on windows

Disassembly:
push rdi
sub rsp, 0x30
mov rdi, rcx
cmp rcx, 0xffffffffffffffff
mov rcx, qword [0x140229838]
jne 0x140022040
add rsp, 0x30
pop rdi
jmp fcn.14002e22c
mov rdx, rdi
mov qword [rsp + 0x48], rbx
call fcn.14002da6c
mov rbx, rax
test rax, rax
je 0x1400220b5
mov rdx, qword [rax + 8]
test rdx, rdx
je 0x14002209d
xor eax, eax
mov dword [rsp + 0x40], eax
cmp dword [rbx + 0x1c], eax
jne 0x14002208a
mov r8d, dword [rbx + 0x10]
lea r9, [rsp + 0x40]
sub r8d, dword [rbx + 0x14]
mov rcx, qword [rbx]
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [rbx + 0x10]
mov dword [rbx + 0x14], eax
mov r8, qword [rbx + 8]
xor edx, edx
mov rcx, qword [0x140224818]
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rcx, qword [rbx]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [0x140229838]
mov rdx, rdi
call fcn.14002db50
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret

Function at 0x140022420
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov rdx, rcx
xor edi, edi
mov rcx, qword [0x140229838]
mov dword [rsp + 0x50], edi
call fcn.14002da6c
mov rbx, rax
test rax, rax
je 0x1400224c5
cmp qword [rax + 8], rdi
je 0x140022487
lea r8d, [rdi + 1]
mov rcx, rax
lea rdx, [rsp + 0x50]
call fcn.1400669e0
test rax, rax
je 0x140022474
inc dword [rbx + 0x14]
movsxd rax, edi
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
mov edi, 1
movsxd rax, edi
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
mov rcx, qword [rax]
lea r9, [rsp + 0x58]
mov r8d, 1
mov qword [rsp + 0x20], rdi
lea rdx, [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1400224d5
cmp dword [rsp + 0x58], edi
je 0x1400224d5
mov rcx, qword [rbx]
mov r9d, 1
xor r8d, r8d
lea edx, [r9 - 2]
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
movsxd rax, dword [rsp + 0x50]
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
mov rbx, qword [rsp + 0x40]
mov eax, 0xffffffff
cdqe
add rsp, 0x30
pop rdi
ret

Function at 0x1400225e0
Capabilities:
Get file size

Disassembly:
push rbx
sub rsp, 0x20
mov rdx, rcx
mov rcx, qword [0x140229838]
call fcn.14002da6c
mov rbx, rax
test rax, rax
je 0x140022633
cmp qword [rax + 8], 0
je 0x140022612
cmp dword [rax + 0x1c], 0
jne 0x140022612
mov rcx, rax
call fcn.140021fd0
mov rcx, qword [rbx]
lea rdx, [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov ecx, dword [rsp + 0x38]
shl rcx, 0x20
mov eax, eax
or rax, rcx
add rsp, 0x20
pop rbx
ret
mov rax, 0xffffffffffffffff
add rsp, 0x20
pop rbx
ret

Function at 0x140022640
Capabilities:
Read file on windows

Disassembly:
sub rsp, 0x38
mov rdx, rcx
mov byte [rsp + 0x48], 0
mov rcx, qword [0x140229838]
call fcn.14002da6c
test rax, rax
je 0x14002269f
cmp qword [rax + 8], 0
lea rdx, [rsp + 0x48]
je 0x140022682
mov r8d, 1
mov rcx, rax
call fcn.1400669e0
movsx rax, byte [rsp + 0x48]
add rsp, 0x38
ret
mov rcx, qword [rax]
lea r9, [rsp + 0x50]
mov r8d, 1
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_ReadFile]
movsx rax, byte [rsp + 0x48]
add rsp, 0x38
ret
Function at 0x1400226b0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov rdi, rdx
mov dword [rsp + 0x58], 0
mov rdx, rcx
mov rbx, r8
mov rcx, qword [0x140229838]
call fcn.14002da6c
test rax, rax
je 0x140022718
cmp qword [rax + 8], 0
mov rdx, rdi
je 0x1400226fe
mov r8, rbx
mov rcx, rax
call fcn.1400669e0
cdqe
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
mov rcx, qword [rax]
lea r9, [rsp + 0x58]
mov r8d, ebx
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_ReadFile]
movsxd rax, dword [rsp + 0x58]
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret

Function at 0x140022730
Capabilities:
Read file on windows

Disassembly:
sub rsp, 0x38
mov rdx, rcx
mov dword [rsp + 0x48], 0
mov rcx, qword [0x140229838]
call fcn.14002da6c
test rax, rax
je 0x140022791
cmp qword [rax + 8], 0
lea rdx, [rsp + 0x48]
je 0x140022774
mov r8d, 4
mov rcx, rax
call fcn.1400669e0
movsxd rax, dword [rsp + 0x48]
add rsp, 0x38
ret
mov rcx, qword [rax]
lea r9, [rsp + 0x50]
mov r8d, 4
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_ReadFile]
movsxd rax, dword [rsp + 0x48]
add rsp, 0x38
ret

Function at 0x140022890
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rsi
sub rsp, 0x30
mov rbx, rcx
mov dword [rsp + 0x48], 0
mov rdx, rcx
mov rcx, qword [0x140229838]
call fcn.14002da6c
mov rsi, rax
test rax, rax
je 0x140022a18
mov rcx, rbx
mov qword [rsp + 0x40], rdi
call fcn.140022550
cmp qword [rsi + 8], 0
lea rdx, [rsp + 0x50]
mov rdi, rax
je 0x1400228f3
mov r8d, 4
mov rcx, rsi
call fcn.1400669e0
mov rcx, rax
mov dword [rsp + 0x48], eax
jmp 0x140022914
mov rcx, qword [rsi]
lea r9, [rsp + 0x48]
mov r8d, 4
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov ecx, dword [rsp + 0x48]
mov eax, dword [rsp + 0x50]
cmp ecx, 2
jl 0x140022944
cmp ax, 0xfeff
jne 0x140022944
lea rdx, [rdi + 2]
mov rcx, rbx
call fcn.1400224f0
mov rdi, qword [rsp + 0x40]
mov eax, 0x19
mov rbx, qword [rsp + 0x58]
add rsp, 0x30
pop rsi
ret
cmp ecx, 3
jl 0x140022977
cmp ax, 0xbbef
jne 0x140022977
cmp byte [rsp + 0x52], 0xbf
jne 0x140022977
lea rdx, [rdi + 3]
mov rcx, rbx
call fcn.1400224f0
mov rdi, qword [rsp + 0x40]
mov eax, 2
mov rbx, qword [rsp + 0x58]
add rsp, 0x30
pop rsi
ret
cmp ecx, 2
jl 0x1400229a3
cmp ax, 0xfffe
jne 0x1400229a3
lea rdx, [rdi + 2]
mov rcx, rbx
call fcn.1400224f0
mov rdi, qword [rsp + 0x40]
mov eax, 4
mov rbx, qword [rsp + 0x58]
add rsp, 0x30
pop rsi
ret
cmp ecx, 4
jl 0x1400229f8
cmp eax, 0xfeff
jne 0x1400229d0
lea rdx, [rdi + 4]
mov rcx, rbx
call fcn.1400224f0
mov rdi, qword [rsp + 0x40]
mov eax, 5
mov rbx, qword [rsp + 0x58]
add rsp, 0x30
pop rsi
ret
cmp eax, 0xfffe0000
jne 0x1400229f8
lea rdx, [rdi + 4]
mov rcx, rbx
call fcn.1400224f0
mov rdi, qword [rsp + 0x40]
mov eax, 6
mov rbx, qword [rsp + 0x58]
add rsp, 0x30
pop rsi
ret
mov rdx, rdi
mov rcx, rbx
call fcn.1400224f0
mov rdi, qword [rsp + 0x40]
mov eax, 0x18
mov rbx, qword [rsp + 0x58]
add rsp, 0x30
pop rsi
ret
mov rbx, qword [rsp + 0x58]
mov eax, 0x18
add rsp, 0x30
pop rsi
ret
Function at 0x140022a30
Capabilities:
Read file on windows

Disassembly:
push rbx
sub rsp, 0x30
mov rdx, rcx
xor ebx, ebx
mov rcx, qword [0x140229838]
mov word [rsp + 0x48], bx
call fcn.14002da6c
test rax, rax
je 0x140022a8c
lea rdx, [rsp + 0x48]
cmp qword [rax + 8], rbx
je 0x140022a73
lea r8d, [rbx + 2]
mov rcx, rax
call fcn.1400669e0
movzx eax, word [rsp + 0x48]
add rsp, 0x30
pop rbx
ret
mov rcx, qword [rax]
lea r9, [rsp + 0x50]
mov r8d, 2
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_ReadFile]
movzx eax, word [rsp + 0x48]
add rsp, 0x30
pop rbx
ret

Function at 0x140022aa0
Capabilities:
Read file on windows

Disassembly:
push rbx
sub rsp, 0x30
mov rdx, rcx
xor ebx, ebx
mov rcx, qword [0x140229838]
mov word [rsp + 0x48], bx
call fcn.14002da6c
test rax, rax
je 0x140022afd
lea rdx, [rsp + 0x48]
cmp qword [rax + 8], rbx
je 0x140022ae4
lea r8d, [rbx + 2]
mov rcx, rax
call fcn.1400669e0
movsx rax, word [rsp + 0x48]
add rsp, 0x30
pop rbx
ret
mov rcx, qword [rax]
lea r9, [rsp + 0x50]
mov r8d, 2
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_ReadFile]
movsx rax, word [rsp + 0x48]
add rsp, 0x30
pop rbx
ret

Function at 0x140022b10
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
xor ebx, ebx
mov edi, r8d
mov dword [rsp + 0x48], ebx
mov rsi, rdx
test rdx, rdx
je 0x140022b88
test r8d, r8d
je 0x140022b88
mov rdx, rcx
mov rcx, qword [0x140229838]
call fcn.14002da6c
test rax, rax
je 0x140022b84
mov r8d, edi
mov rdx, rsi
cmp qword [rax + 8], rbx
je 0x140022b71
mov rcx, rax
call fcn.140067110
mov ebx, eax
cdqe
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
mov rcx, qword [rax]
lea r9, [rsp + 0x48]
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov ebx, dword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
movsxd rax, ebx
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret

Function at 0x140022ba0
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x30
mov ebx, edx
mov rdx, rcx
mov rcx, qword [0x140229838]
call fcn.14002da6c
test rax, rax
je 0x140022c4c
sub ebx, 2
je 0x140022c13
sub ebx, 2
je 0x140022c04
sub ebx, 1
je 0x140022bf5
sub ebx, 1
je 0x140022be6
cmp ebx, 0x13
jne 0x140022c4c
lea r8d, [rbx - 0x11]
lea rdx, [0x14013786c]
jmp 0x140022c20
mov r8d, 4
lea rdx, [0x140137860]
jmp 0x140022c20
mov r8d, 4
lea rdx, [0x1401380ec]
jmp 0x140022c20
mov r8d, 2
lea rdx, [0x140137868]
jmp 0x140022c20
mov r8d, 3
lea rdx, [0x140137870]
cmp qword [rax + 8], 0
je 0x140022c35
mov rcx, rax
call fcn.140067110
add rsp, 0x30
pop rbx
ret
mov rcx, qword [rax]
lea r9, [rsp + 0x50]
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_WriteFile]
add rsp, 0x30
pop rbx
ret
Function at 0x140022c60
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rdx
mov rdx, rcx
mov rcx, qword [0x140229838]
call fcn.14002da6c
mov rbx, rax
test rax, rax
je 0x140022cb0
mov r8d, dword [rax + 0x20]
mov rdx, rdi
mov rcx, rax
call fcn.140067220
mov r8d, dword [rbx + 0x20]
lea rdx, [0x140138410]
mov rcx, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp fcn.140067220
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x140023a30
Capabilities:
Get thread local storage value

Disassembly:
push rbx
sub rsp, 0x20
mov r8, qword [rcx]
mov rbx, rcx
test r8, r8
je 0x140023a89
mov r8, qword [r8 + 8]
mov rax, 0xffffffffffffffff
nop dword [rax]
inc rax
cmp word [r8 + rax*2], 0
jne 0x140023a50
mov ecx, eax
call fcn.1400383e0
mov rcx, qword [rbx]
mov rcx, qword [rcx + 8]
nop dword [rax]
movzx edx, word [rcx]
lea rcx, [rcx + 2]
mov word [rax], dx
lea rax, [rax + 2]
test dx, dx
jne 0x140023a70
add rsp, 0x20
pop rbx
ret
mov ecx, edx
add rsp, 0x20
pop rbx
jmp fcn.14003a0b0

Function at 0x14002497c
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x20
mov ebp, ecx
xor r14d, r14d
xor ecx, ecx
mov ebx, r14d
mov esi, r14d
call qword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x1400249db
lea ecx, [r14 + 0xd]
call qword [sym.imp.USER32.dll_GetClipboardData]
mov rdi, rax
test rax, rax
je 0x1400249d3
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GlobalLock]
mov rbx, rax
test rax, rax
je 0x1400249d3
mov rcx, rax
call fcn.140037f38
mov rsi, rax
call qword [sym.imp.USER32.dll_CloseClipboard]
jmp 0x1400249e0
mov rdi, qword [rsp + 0x48]
mov edx, ebp
mov ecx, esi
call fcn.1400383e0
test rbx, rbx
je 0x140024a0d
lea ecx, [rsi + 1]
mov rdx, rbx
movsxd r8, ecx
mov rcx, rax
add r8, r8
call fcn.14002ce50
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
jmp 0x140024a11
mov word [rax], r14w
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x50]
add rsp, 0x20
pop r14
pop rdi
pop rsi
ret

Function at 0x140024a24
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rdi, rcx
xor ebx, ebx
xor ecx, ecx
call qword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x140024abd
test rdi, rdi
lea rsi, [0x14013841c]
cmovne rsi, rdi
mov rcx, rsi
call fcn.140037f38
inc eax
mov ecx, 0x2002
movsxd rbp, eax
add rbp, rbp
mov rdx, rbp
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov rdi, rax
test rax, rax
je 0x140024ab7
call qword [sym.imp.USER32.dll_EmptyClipboard]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GlobalLock]
test rax, rax
je 0x140024ab7
mov r8, rbp
mov rdx, rsi
mov rcx, rax
call fcn.14002ce50
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov rdx, rdi
lea ecx, [rbx + 0xd]
call qword [sym.imp.USER32.dll_SetClipboardData]
mov rbx, rax
call qword [sym.imp.USER32.dll_CloseClipboard]
mov rbp, qword [rsp + 0x38]
mov rax, rbx
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret