joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400ed360
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
sub rsp, 0x20
movsxd rdi, r9d
mov r12, rcx
mov rsi, r8
lea rcx, str.write_reply__d__u_n
mov r8d, edi
mov ebx, edx
call fcn.1400b3fe0
mov ecx, 0x20
call fcn.1400cf700
lea r10d, [rdi + 8]
mov ecx, r10d
mov rbp, rax
mov dword [rax + 0x18], r10d
call fcn.1400cf700
mov ecx, dword [rbp + 0x18]
mov r8, rdi
mov qword [rbp + 8], rax
mov qword [rbp + 0x10], rax
mov dword [rax], ecx
lea rcx, [rax + 8]
mov rdx, rsi
mov dword [rax + 4], ebx
call fcn.1401a8ef0
cmp qword [r12 + 0x80], 0
je 0x1400ed3e8
mov rax, qword [r12 + 0x88]
mov qword [rax], rbp
jmp 0x1400ed3f0
mov qword [r12 + 0x80], rbp
mov qword [rbp], 0
mov rcx, r12
mov qword [r12 + 0x88], rbp
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r12
jmp fcn.1400ed1c0

Function at 0x1400ed430
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rsi, rcx
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.last_error__u_n
mov edx, eax
mov ebx, eax
call fcn.1400b3fe0
mov edx, 5
lea rcx, str.write_reply__d__u_n
lea r8d, [rdx - 1]
call fcn.1400b3fe0
mov ecx, 0x20
call fcn.1400cf700
mov ecx, listen
mov dword [rax + 0x18], listen
mov rdi, rax
call fcn.1400cf700
mov ecx, dword [rdi + 0x18]
mov qword [rdi + 8], rax
mov qword [rdi + 0x10], rax
mov dword [rax], ecx
mov dword [rax + 4], 5
mov dword [rax + 8], ebx
cmp qword [rsi + 0x80], 0
je 0x1400ed4b8
mov rax, qword [rsi + 0x88]
mov qword [rax], rdi
jmp 0x1400ed4bf
mov qword [rsi + 0x80], rdi
mov qword [rdi], 0
mov rcx, rsi
mov qword [rsi + 0x88], rdi
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp fcn.1400ed1c0

Function at 0x1400ed670
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rbx, rdx
mov edx, dword [rdx + 0x84]
mov rsi, rcx
lea rcx, str.data_available_on_ntfs_monitor__d_n
call fcn.1400b3fe0
mov dword [rbx + 0x80], 3
mov dword [rbx + 0x50], 0x3e8
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov edx, 1
lea rcx, str.write_reply__d__u_n
lea r8d, [rdx + 3]
mov dword [rbx + 0x54], eax
call fcn.1400b3fe0
mov ecx, 0x20
call fcn.1400cf700
mov ecx, listen
mov dword [rax + 0x18], listen
mov rdi, rax
call fcn.1400cf700
mov ecx, dword [rdi + 0x18]
mov qword [rdi + 8], rax
mov qword [rdi + 0x10], rax
mov dword [rax], ecx
mov dword [rax + 4], 1
mov ecx, dword [rbx + 0x84]
mov dword [rax + 8], ecx
cmp qword [rsi + 0x80], 0
je 0x1400ed717
mov rax, qword [rsi + 0x88]
mov qword [rax], rdi
jmp 0x1400ed71e
mov qword [rsi + 0x80], rdi
mov qword [rdi], 0
mov rcx, rsi
mov qword [rsi + 0x88], rdi
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp fcn.1400ed1c0
Function at 0x1400ef060
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x30
xor edi, edi
mov rbx, rcx
cmp dword [rcx + 0x60], edi
je 0x1400ef110
nop
nop
cmp dword [rbx + 0x7c], edi
mov rcx, qword [rbx + 0x50]
je 0x1400ef0b3
lea rdx, [rbx + 0x10]
lea r8, [rsp + 0x40]
xor r9d, r9d
mov dword [rbx + 0x7c], edi
call qword [sym.imp.KERNEL32.dll_GetOverlappedResult]
test eax, eax
je 0x1400ef152
mov ecx, dword [rsp + 0x40]
add qword [rbx + 0x68], rcx
sub dword [rbx + 0x60], ecx
jmp 0x1400ef107
mov r8d, dword [rbx + 0x60]
mov rdx, qword [rbx + 0x68]
lea rax, [rbx + 0x10]
lea r9, [rsp + 0x40]
mov qword [rsp + 0x20], rax
mov dword [rbx + 0x20], edi
mov dword [rbx + 0x24], edi
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1400ef171
mov rdx, qword [rbx + 0x68]
mov r9d, dword [rsp + 0x40]
mov r8d, dword [rbx + 0x60]
sub rdx, qword [rbx + 0x70]
lea rcx, str.read_total:_p__remaining:__u__numread:__u_n
call fcn.1400b3fe0
mov r11d, dword [rsp + 0x40]
add qword [rbx + 0x68], r11
sub dword [rbx + 0x60], r11d
cmp dword [rbx + 0x60], edi
jne 0x1400ef080
cmp dword [rbx + 0x78], edi
je 0x1400ef190
mov rcx, rbx
call fcn.1400edfb0
mov rcx, qword [rbx + 0x70]
test rcx, rcx
je 0x1400ef12b
call fcn.1400cf780
mov ecx, 4
call fcn.1400cf700
mov dword [rbx + 0x60], 4
mov dword [rbx + 0x78], edi
mov qword [rbx + 0x70], rax
mov qword [rbx + 0x68], rax
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e4
jne 0x1400ef1d7
mov dword [rbx + 0x7c], 1
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e5
jne 0x1400ef1d7
mov dword [rbx + 0x7c], 1
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
mov rcx, qword [rbx + 0x70]
mov edi, dword [rcx]
lea eax, [rdi - 8]
cmp eax, 0x7ffff8
ja 0x1400ef1d7
call fcn.1400cf780
mov rcx, rdi
call fcn.1400cf700
mov qword [rbx + 0x70], rax
mov dword [rax], edi
mov rax, qword [rbx + 0x70]
mov dword [rbx + 0x78], 1
add rax, 4
mov qword [rbx + 0x68], rax
lea eax, [rdi - 4]
mov dword [rbx + 0x60], eax
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
mov dword [rbx + 0x5c], 1
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
Function at 0x1400f4580
Capabilities:
Log keystrokes

Disassembly:
push rbx
sub rsp, 0x20
cmp ecx, 0x9c47
jg 0x1400f4601
je 0x1400f4637
sub ecx, 0x9c41
je 0x1400f4641
sub ecx, 3
je 0x1400f45f5
sub ecx, 1
je 0x1400f45e2
cmp ecx, 1
jne 0x1400f4670
call fcn.140127520
test eax, eax
je 0x1400f4670
call fcn.1400f3400
test eax, eax
je 0x1400f4670
xor ecx, ecx
mov byte [0x14020df99], 1
add rsp, 0x20
pop rbx
jmp qword [sym.imp.USER32.dll_PostQuitMessage]
movsx edx, byte [0x14020ddd2]
xor ecx, ecx
add rsp, 0x20
pop rbx
jmp fcn.14015d160
xor ecx, ecx
add rsp, 0x20
pop rbx
jmp fcn.140120140
sub ecx, 0x9c48
je 0x1400f462e
sub ecx, 0x69c
je 0x1400f4622
cmp ecx, 1
jne 0x1400f4670
xor ecx, ecx
add rsp, 0x20
pop rbx
jmp fcn.140108680
xor ecx, ecx
add rsp, 0x20
pop rbx
jmp fcn.14012bb30
call fcn.140103a40
test eax, eax
jne 0x1400f4670
call fcn.1401039d0
test rax, rax
jne 0x1400f4670
mov rcx, qword [0x14020de20]
mov r8d, 1
xor edx, edx
call fcn.1400067a0
mov r8d, 1
xor ecx, ecx
mov rdx, rax
mov rbx, rax
call fcn.1401067a0
mov rcx, rbx
call fcn.140005df0
add rsp, 0x20
pop rbx
ret
Function at 0x1400f7640
Capabilities:
Open clipboard

Disassembly:
push rbx
sub rsp, 0x40
mov rbx, rcx
call fcn.1401315e0
test eax, eax
jne 0x1400f7664
cmp qword [rbx + 0x440], 0
je 0x1400f766f
mov rcx, rbx
call fcn.140130d60
mov eax, 1
add rsp, 0x40
pop rbx
ret
call qword [sym.imp.USER32.dll_GetCapture]
mov rcx, qword [rbx + 0x78]
mov rdx, rax
call fcn.1400d90c0
test eax, eax
je 0x1400f7696
call qword [sym.imp.USER32.dll_ReleaseCapture]
mov eax, 1
add rsp, 0x40
pop rbx
ret
cmp dword [rbx + 0x3bc], 0
je 0x1400f76ce
mov rcx, qword [rbx + 0x78]
call qword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x1400f76b9
call qword [sym.imp.USER32.dll_EmptyClipboard]
call qword [sym.imp.USER32.dll_CloseClipboard]
mov dword [rbx + 0x3bc], 0
mov eax, 1
add rsp, 0x40
pop rbx
ret
mov rcx, rbx
call fcn.14015fcf0
test eax, eax
jne 0x1400f7664
cmp dword [rbx + 0x3b4], eax
je 0x1400f77ee
mov rcx, qword [rbx + 0x78]
mov qword [rsp + 0x50], rbp
mov ebp, dword [rbx + 0x3b0]
mov qword [rsp + 0x58], rsi
call fcn.1400d9b50
mov rcx, qword [rbx + 0x78]
mov edx, 1
call qword [sym.imp.USER32.dll_ShowWindow]
xor eax, eax
cmp dword [rbx + 0x3b4], eax
je 0x1400f778e
mov rdx, qword [rbx + 0x68]
mov rcx, qword [rbx + 0x78]
lea rsi, [rbx + 0x3a0]
mov dword [rbx + 0x3b4], eax
call qword [sym.imp.USER32.dll_SetMenu]
mov rcx, qword [rbx + 0x78]
call fcn.1400d8860
mov rcx, qword [rbx + 0x78]
mov edx, 0xfffffff0
or eax, 0xc40000
mov r8d, eax
call qword [sym.imp.USER32.dll_SetWindowLongW]
test rsi, rsi
mov eax, 0x20
je 0x1400f778e
mov ecx, dword [rsi + 0xc]
mov r9d, dword [rsi + 4]
mov r8d, dword [rsi]
mov eax, dword [rsi + 8]
sub ecx, r9d
mov dword [rsp + 0x30], reloc.WS2_32.dll_gethostbyname
mov dword [rsp + 0x28], ecx
mov rcx, qword [rbx + 0x78]
sub eax, r8d
xor edx, edx
mov dword [rsp + 0x20], eax
call qword [sym.imp.USER32.dll_SetWindowPos]
jmp 0x1400f77b7
mov rcx, qword [rbx + 0x78]
or eax, 0x17
xor r9d, r9d
mov dword [rsp + 0x30], eax
xor r8d, r8d
xor edx, edx
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
call qword [sym.imp.USER32.dll_SetWindowPos]
mov rsi, qword [rsp + 0x58]
test ebp, ebp
mov rbp, qword [rsp + 0x50]
je 0x1400f77d4
mov rcx, qword [rbx + 0x78]
mov edx, 3
call qword [sym.imp.USER32.dll_ShowWindow]
mov rcx, qword [rbx + 0x78]
mov edx, 5
call qword [sym.imp.USER32.dll_ShowWindow]
mov eax, 1
add rsp, 0x40
pop rbx
ret
xor eax, eax
add rsp, 0x40
pop rbx
ret

Function at 0x1400f7e00
Capabilities:
Log keystrokes via polling

Disassembly:
sub rsp, 0x28
test ecx, ecx
js 0x1400f7e2c
cmp ecx, 1
jle 0x1400f7e25
cmp ecx, 3
jne 0x1400f7e2c
mov ecx, reloc.WS2_32.dll_recv
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
xor ecx, ecx
test ax, ax
sets cl
mov eax, ecx
add rsp, 0x28
ret
mov eax, edx
add rsp, 0x28
ret
Function at 0x140101240
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x250
mov rax, qword [0x14020cc58]
xor rax, rsp
mov qword [rsp + 0x240], rax
cmp byte [0x14020e200], 0
mov esi, edx
mov rbx, rcx
jne 0x140101352
cmp dword [0x14020e204], 5
jae 0x140101352
lea rcx, [rsp + 0x20]
call fcn.14017d460
mov r8d, esi
xor edx, edx
mov rcx, rbx
call fcn.1400f8870
lea rcx, [rsp + 0x20]
lea edx, [rax + 1]
mov dword [rsp + 0x20], eax
call fcn.14017d470
mov rdx, qword [rsp + 0x28]
mov r8d, esi
mov rcx, rbx
call fcn.1400f8870
mov edx, dword [rsp + 0x20]
mov rcx, qword [rsp + 0x28]
call fcn.140001000
mov ecx, 2
add eax, 1
movsxd rdx, eax
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
test rax, rax
mov rdi, rax
je 0x140101346
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GlobalLock]
mov r8d, dword [rsp + 0x20]
mov rdx, qword [rsp + 0x28]
mov rcx, rax
call fcn.140001150
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov rcx, qword [rbx + 0x78]
call qword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x14010133d
call qword [sym.imp.USER32.dll_EmptyClipboard]
mov rdx, rdi
mov ecx, 1
call qword [sym.imp.USER32.dll_SetClipboardData]
call qword [sym.imp.USER32.dll_CloseClipboard]
lea rcx, [rsp + 0x20]
call fcn.1400012c0
jmp 0x1401013cb
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GlobalFree]
lea rcx, [rsp + 0x20]
call fcn.1400012c0
jmp 0x1401013cb
mov r8d, edx
xor edx, edx
call fcn.1400f8870
mov ecx, 2
add eax, 1
movsxd rdx, eax
add rdx, rdx
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
test rax, rax
mov rdi, rax
je 0x1401013cb
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GlobalLock]
mov r8d, esi
mov rcx, rbx
mov rdx, rax
call fcn.1400f8870
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov rcx, qword [rbx + 0x78]
call qword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x1401013c2
call qword [sym.imp.USER32.dll_EmptyClipboard]
mov rdx, rdi
mov ecx, reloc.WS2_32.dll_listen
call qword [sym.imp.USER32.dll_SetClipboardData]
call qword [sym.imp.USER32.dll_CloseClipboard]
jmp 0x1401013cb
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GlobalFree]
mov rcx, qword [rbx + 0x228]
call fcn.1400e83e0
mov rcx, rbx
call fcn.140100d30
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.1401a8ec0
lea r11, [rsp + 0x250]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x140101800
Capabilities:
Hide graphical window

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
lea rcx, str.ui_close_n
call fcn.1400b3fe0
mov rcx, rbx
call fcn.1400fcbf0
mov rcx, qword [rbx + 0x78]
xor edx, edx
call qword [sym.imp.USER32.dll_ShowWindow]
mov rcx, rbx
call fcn.1400f8bb0
cmp dword [rbx + 0x5b0], 0
jne 0x1401018be
cmp byte [0x14020de06], 0
je 0x140101851
mov rcx, rbx
call fcn.14015e310
jmp 0x1401018be
cmp qword [0x14020e4c8], rbx
mov rax, qword [rbx + 0x1b0]
mov dword [rbx + 0x5b0], 1
jne 0x140101874
mov qword [0x14020e4c8], rax
jmp 0x140101882
mov rcx, qword [rbx + 0x1b8]
mov qword [rcx + 0x1b0], rax
cmp qword [0x14020e4d0], rbx
mov rax, qword [rbx + 0x1b8]
jne 0x14010189b
mov qword [0x14020e4d0], rax
jmp 0x1401018a9
mov rcx, qword [rbx + 0x1b0]
mov qword [rcx + 0x1b8], rax
mov rax, qword [0x14020e4a0]
mov qword [0x14020e4a0], rbx
mov qword [rbx + 0x1b0], rax
cmp byte [reloc.WS2_32.dll_accept], 0
jne 0x1401018db
cmp qword [0x14020e4c8], 0
jne 0x1401018db
add rsp, 0x20
pop rbx
jmp fcn.1400f3570
call fcn.1400e6d80
xor ecx, ecx
add rsp, 0x20
pop rbx
jmp fcn.14000d3a0

Function at 0x140103710
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push rbx
sub rsp, 0x20
cmp byte [reloc.WS2_32.dll_accept], 0
mov rbx, rcx
je 0x14010387c
call fcn.14015f2e0
test eax, eax
je 0x14010386d
mov rcx, qword [rbx + 0x228]
mov qword [rsp + 0x30], rdi
call fcn.1400e83e0
mov rcx, rbx
call fcn.140100d30
mov r8d, dword [rbx + 0x3c0]
lea rdx, str.CUT_isviewing__d_n
or ecx, 0xffffffff
call fcn.1400b4010
xor edi, edi
cmp dword [rbx + 0x3c0], edi
je 0x140103783
mov rdx, qword [rbx + 0x3c8]
mov rcx, qword [rbx + 0x78]
call qword [sym.imp.USER32.dll_ChangeClipboardChain]
mov dword [rbx + 0x3c0], edi
mov rcx, qword [rbx + 0x78]
call qword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x1401037fb
call qword [sym.imp.USER32.dll_EmptyClipboard]
mov rcx, rbx
call fcn.1400f6750
test rax, rax
je 0x1401037f5
mov rdx, rax
mov ecx, reloc.WS2_32.dll_ntohs
call qword [sym.imp.USER32.dll_SetClipboardData]
mov ecx, 2
call fcn.1400f66e0
test rax, rax
mov rdi, rax
je 0x1401037f0
mov ax, word [0x14020e478]
test ax, ax
jne 0x1401037e4
lea rcx, str.Preferred_DropEffect
call qword [sym.imp.USER32.dll_RegisterClipboardFormatW]
mov word [0x14020e478], ax
movzx ecx, ax
mov rdx, rdi
call qword [sym.imp.USER32.dll_SetClipboardData]
mov edi, 1
call qword [sym.imp.USER32.dll_CloseClipboard]
lea rdx, str.iscut__d_n
mov r8d, edi
or ecx, 0xffffffff
call fcn.1400b4010
test edi, edi
je 0x140103862
lea rdx, str.ghost_selection_n
or ecx, 0xffffffff
call fcn.1400b4010
mov rcx, rbx
call fcn.140133f90
mov r8d, dword [rbx + 0x3c0]
lea rdx, str.viewing__d_n
or ecx, 0xffffffff
call fcn.1400b4010
cmp dword [rbx + 0x3c0], 0
jne 0x140103862
mov rcx, qword [rbx + 0x78]
call qword [sym.imp.USER32.dll_SetClipboardViewer]
mov dword [rbx + 0x3c0], 1
mov qword [rbx + 0x3c8], rax
mov dword [rbx + 0x3bc], edi
mov rdi, qword [rsp + 0x30]
lea rdx, str.is_cut_done_n
or ecx, 0xffffffff
call fcn.1400b4010
add rsp, 0x20
pop rbx
ret
Function at 0x140103890
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push rbx
sub rsp, 0x20
cmp byte [reloc.WS2_32.dll_accept], 0
mov rbx, rcx
je 0x1401039be
call fcn.14015f2e0
test eax, eax
je 0x1401039be
mov rcx, qword [rbx + 0x228]
call fcn.1400e83e0
mov rcx, rbx
call fcn.140100d30
mov rcx, qword [rbx + 0x78]
call qword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x1401039be
call qword [sym.imp.USER32.dll_EmptyClipboard]
mov rcx, rbx
call fcn.1400f6750
test rax, rax
je 0x1401038fa
mov rdx, rax
mov ecx, reloc.WS2_32.dll_ntohs
call qword [sym.imp.USER32.dll_SetClipboardData]
mov rcx, rbx
call fcn.1400f6a90
test rax, rax
mov rbx, rax
je 0x140103936
mov ax, word [0x14020e470]
test ax, ax
jne 0x14010392a
lea rcx, str.Shell_IDList_Array
call qword [sym.imp.USER32.dll_RegisterClipboardFormatW]
mov word [0x14020e470], ax
movzx ecx, ax
mov rdx, rbx
call qword [sym.imp.USER32.dll_SetClipboardData]
mov edx, 4
lea ecx, [rdx - 2]
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
test rax, rax
mov rbx, rax
je 0x1401039b8
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GlobalLock]
test rax, rax
je 0x1401039af
mov rcx, rbx
mov dword [rax], 5
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
test eax, eax
jne 0x1401039af
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x1401039af
mov ax, word [0x14020e478]
test ax, ax
jne 0x140103997
lea rcx, str.Preferred_DropEffect
call qword [sym.imp.USER32.dll_RegisterClipboardFormatW]
mov word [0x14020e478], ax
movzx ecx, ax
mov rdx, rbx
call qword [sym.imp.USER32.dll_SetClipboardData]
add rsp, 0x20
pop rbx
jmp qword [sym.imp.USER32.dll_CloseClipboard]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GlobalFree]
call qword [sym.imp.USER32.dll_CloseClipboard]
add rsp, 0x20
pop rbx
ret

Function at 0x140103aa0
Capabilities:
Enumerate gui resources

Disassembly:
sub rsp, 0x28
lea rdx, [rsp + 0x30]
lea rcx, [0x1400f65d0]
mov qword [rsp + 0x30], 0
call qword [sym.imp.USER32.dll_EnumWindows]
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x140103ad8
call fcn.140101800
mov eax, 1
add rsp, 0x28
ret
xor eax, eax
add rsp, 0x28
ret
Function at 0x14010e8b0
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x250
mov rax, qword [0x14020cc58]
xor rax, rsp
mov qword [rsp + 0x240], rax
mov rbx, rdx
mov rdi, rcx
lea r8, [rsp + 0x30]
mov r9d, 0x104
mov edx, 0x21
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x14010e923
movzx eax, word [rsp + 0x30]
sub eax, 0x30
je 0x14010e90d
cmp eax, 2
jne 0x14010e923
movzx eax, word [rbx + 6]
movzx r8d, word [rbx]
jmp 0x14010e92b
movzx eax, word [rbx]
movzx r9d, word [rbx + 6]
movzx r8d, word [rbx + 2]
lea rdx, str._02d__d__d
jmp 0x14010e937
movzx eax, word [rbx]
movzx r8d, word [rbx + 6]
movzx r9d, word [rbx + 2]
lea rdx, str._d__02d__d
mov rcx, rdi
mov dword [rsp + 0x20], eax
call fcn.140178b10
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.1401a8ec0
mov rbx, qword [rsp + 0x270]
add rsp, 0x250
pop rdi
ret
Function at 0x14010e970
Capabilities:
Get geographical location

Disassembly:
push rbx
push rbp
push rsi
push rdi
sub rsp, 0x278
mov rax, qword [0x14020cc58]
xor rax, rsp
mov qword [rsp + 0x260], rax
mov rbx, rcx
mov rcx, qword [rcx + 0x10]
mov rsi, r8
mov rdi, rdx
lea r8, [rsp + 0x30]
mov edx, r9d
call fcn.1400dbd80
mov edx, dword [rsp + 0x2c0]
mov rcx, qword [rbx + 0x10]
lea r8, [rsp + 0x40]
mov ebp, eax
call fcn.1400dbd80
test ebp, ebp
mov ebx, eax
jne 0x14010e9cd
test eax, eax
je 0x14010ebce
mov rcx, qword [rdi + 8]
cmp byte [rcx], 0
je 0x14010e9e0
mov dl, 0x20
mov rcx, rdi
call fcn.1401773c0
test rsi, rsi
je 0x14010e9f0
mov rdx, rsi
mov rcx, rdi
call fcn.140177470
test ebp, ebp
je 0x14010eb9e
test ebx, ebx
je 0x14010eb21
movzx eax, word [rsp + 0x46]
cmp word [rsp + 0x36], ax
jne 0x14010ea36
movzx eax, word [rsp + 0x42]
cmp word [rsp + 0x32], ax
jne 0x14010ea36
movzx eax, word [rsp + 0x40]
cmp word [rsp + 0x30], ax
jne 0x14010ea36
lea rdx, [rsp + 0x30]
mov rcx, rdi
call fcn.14010e8b0
jmp 0x14010ebce
lea r8, [rsp + 0x50]
mov r9d, 0x104
mov edx, 0x21
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x14010ea8b
movzx eax, word [rsp + 0x50]
sub eax, 0x30
je 0x14010ea71
cmp eax, 2
jne 0x14010ea8b
movzx eax, word [rsp + 0x36]
movzx r8d, word [rsp + 0x30]
jmp 0x14010ea96
movzx eax, word [rsp + 0x30]
movzx r9d, word [rsp + 0x36]
movzx r8d, word [rsp + 0x32]
lea rdx, str._02d__d__d
jmp 0x14010eaa3
movzx eax, word [rsp + 0x30]
movzx r8d, word [rsp + 0x36]
movzx r9d, word [rsp + 0x32]
lea rdx, str._d__02d__d
mov rcx, rdi
mov dword [rsp + 0x20], eax
call fcn.140178b10
lea rdx, [0x1401b7eb0]
mov rcx, rdi
call fcn.140177470
lea r8, [rsp + 0x50]
mov r9d, 0x104
mov edx, 0x21
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x14010ebaa
movzx eax, word [rsp + 0x50]
sub eax, 0x30
je 0x14010eb04
cmp eax, 2
jne 0x14010ebaa
movzx eax, word [rsp + 0x46]
movzx r8d, word [rsp + 0x40]
jmp 0x14010ebb5
movzx eax, word [rsp + 0x40]
movzx r9d, word [rsp + 0x46]
movzx r8d, word [rsp + 0x42]
lea rdx, str._02d__d__d
jmp 0x14010ebc2
lea rdx, [0x1401d2c70]
mov rcx, rdi
call fcn.140177470
lea r8, [rsp + 0x50]
mov r9d, 0x104
mov edx, 0x21
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x14010eb8b
movzx eax, word [rsp + 0x50]
sub eax, 0x30
je 0x14010eb71
cmp eax, 2
jne 0x14010eb8b
movzx eax, word [rsp + 0x36]
movzx r9d, word [rsp + 0x32]
movzx r8d, word [rsp + 0x30]
jmp 0x14010ebbb
movzx eax, word [rsp + 0x30]
movzx r9d, word [rsp + 0x36]
movzx r8d, word [rsp + 0x32]
lea rdx, str._02d__d__d
jmp 0x14010ebc2
movzx eax, word [rsp + 0x30]
movzx r9d, word [rsp + 0x32]
movzx r8d, word [rsp + 0x36]
jmp 0x14010ebbb
lea rdx, [0x1401d2c6c]
jmp 0x14010eab6
movzx r8d, word [rsp + 0x46]
movzx eax, word [rsp + 0x40]
movzx r9d, word [rsp + 0x42]
lea rdx, str._d__02d__d
mov rcx, rdi
mov dword [rsp + 0x20], eax
call fcn.140178b10
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.1401a8ec0
add rsp, 0x278
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x140110450
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x240
mov rax, qword [0x14020cc58]
xor rax, rsp
mov qword [rsp + 0x230], rax
xor eax, eax
mov rbx, rdx
mov rsi, rcx
mov qword [rdx], rax
mov qword [rdx + 8], rax
lea r8, [rsp + 0x20]
lea edx, [rax + 0x21]
mov r9d, 0x104
mov ecx, 0x400
lea edi, [rax + 1]
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x1401104ab
movzx edi, word [rsp + 0x20]
sub edi, 0x30
mov rdx, qword [rsi]
movzx eax, byte [rdx]
cmp al, 0x30
jb 0x1401105c8
cmp al, 0x39
ja 0x1401105c8
xor r11d, r11d
test al, al
mov r10, r11
je 0x1401104f4
nop
nop
cmp al, 0x30
jb 0x1401104f4
cmp al, 0x39
ja 0x1401104f4
movzx eax, al
add rdx, 1
sub eax, 0x30
movsxd rcx, eax
lea rax, [r10 + r10*4]
lea r10, [rcx + rax*2]
movzx eax, byte [rdx]
test al, al
jne 0x1401104d0
lea r8, str._.:t
mov qword [rsi], rdx
mov al, 0x2f
mov rcx, r8
sub rcx, rdx
cmp byte [rdx], al
jne 0x1401105c8
movzx eax, byte [rcx + rdx + 1]
add rdx, 1
test al, al
jne 0x140110506
mov qword [rsi], rdx
movzx eax, byte [rdx]
cmp al, 0x30
jb 0x1401105c8
cmp al, 0x39
ja 0x1401105c8
test al, al
je 0x140110558
cmp al, 0x30
jb 0x140110558
cmp al, 0x39
ja 0x140110558
movzx eax, al
add rdx, 1
sub eax, 0x30
movsxd rcx, eax
lea rax, [r11 + r11*4]
lea r11, [rcx + rax*2]
mov al, byte [rdx]
test al, al
jne 0x140110535
mov qword [rsi], rdx
mov al, 0x2f
sub r8, rdx
cmp byte [rdx], al
jne 0x1401105c8
movzx eax, byte [r8 + rdx + 1]
add rdx, 1
test al, al
jne 0x140110560
mov qword [rsi], rdx
movzx eax, byte [rdx]
cmp al, 0x30
jb 0x1401105c8
cmp al, 0x39
ja 0x1401105c8
mov rcx, rsi
call fcn.140175d40
test edi, edi
je 0x1401105b4
cmp edi, 2
mov word [rbx + 2], r11w
je 0x1401105a5
mov word [rbx], ax
mov word [rbx + 6], r10w
mov eax, 1
jmp 0x1401105ca
mov word [rbx + 6], ax
mov word [rbx], r10w
mov eax, 1
jmp 0x1401105ca
mov word [rbx], ax
mov word [rbx + 2], r10w
mov word [rbx + 6], r11w
mov eax, 1
jmp 0x1401105ca
xor eax, eax
mov rcx, qword [rsp + 0x230]
xor rcx, rsp
call fcn.1401a8ec0
lea r11, [rsp + 0x240]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret