joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140101f20
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
mov qword [rsp + 0x10], rdx
push rdi
sub rsp, 0x50
mov rbp, r9
mov esi, r8d
mov rdi, rdx
mov dword [rsp + 0x30], 0
mov rcx, rdx
call qword [sym.imp.mfc140u.dll_Ordinal_296]
mov dword [rsp + 0x30], 1
mov edx, reloc.WS2_32.dll_inet_addr
lea rcx, [rsp + 0x40]
call fcn.14016bf30
nop
lea rcx, [rsp + 0x38]
call qword [sym.imp.mfc140u.dll_Ordinal_296]
nop
mov r9d, esi
mov r8, qword [rsp + 0x40]
lea rdx, str._sditto_compare__d.txt
lea rcx, [rsp + 0x38]
call qword [sym.imp.mfc140u.dll_CMFCZoomKernel::Filter]
lea rcx, [rsp + 0x38]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___3]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x140101fef
xor ebx, ebx
nop dword [rax]
mov r9d, esi
mov r8, qword [rsp + 0x40]
lea rdx, str._sditto_compare__d.txt
lea rcx, [rsp + 0x38]
call qword [sym.imp.mfc140u.dll_CMFCZoomKernel::Filter]
lea rcx, [rsp + 0x38]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___3]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x140101fef
inc ebx
cmp ebx, 0x3e8
jl 0x140101fb0
jmp 0x140101ffe
lea rdx, [rsp + 0x38]
mov rcx, rdi
call qword [sym.imp.mfc140u.dll_Ordinal_1501]
nop
lea rdx, [0x1402ac320]
mov rcx, rdi
call qword [sym.imp.mfc140u.dll_Ordinal_2903]
nop
test eax, eax
je 0x14010204c
test rbp, rbp
je 0x14010204c
mov rdx, rdi
lea rcx, [rsp + 0x48]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__8]
movzx r9d, byte [rsp + 0x88]
movzx r8d, byte [rsp + 0x80]
mov dword [rsp + 0x20], 0
mov rdx, rax
mov rcx, rbp
call fcn.140101290
nop
lea rcx, [rsp + 0x38]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
mov rax, rdi
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x50
pop rdi
ret
Function at 0x1401029b0
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rcx, qword [0x1403c4508]
mov rsi, r8
mov rdi, rdx
xor bl, bl
call qword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x140102aa3
call qword [sym.imp.USER32.dll_EmptyClipboard]
mov rcx, rdi
call qword [sym.imp.mfc140u.dll_CMFCRibbonBar::HitTest]
test al, al
jne 0x140102a35
mov rcx, rdi
call qword [sym.imp.mfc140u.dll_CMFCRibbonBaseElement::GetHighlighted]
mov edx, eax
lea ecx, [rax + 1]
movsxd rbx, ecx
mov rcx, rdi
call qword [sym.imp.mfc140u.dll_CWnd::get_accFocus]
mov rcx, rax
mov rdx, rbx
call fcn.14015ab40
mov edx, 0xffffffff
mov rcx, rdi
mov rbx, rax
call qword [sym.imp.mfc140u.dll_CFrameImpl::ProcessMouseClick]
mov rdx, rbx
mov ecx, 1
call qword [sym.imp.USER32.dll_SetClipboardData]
mov bl, 1
mov rcx, rsi
call qword [sym.imp.mfc140u.dll_CMFCPropertyGridProperty::HitTest]
test al, al
jne 0x140102a8a
mov rcx, rsi
call qword [sym.imp.mfc140u.dll_CMFCPropertyGridProperty::GetHierarchyLevel]
mov edx, eax
mov rcx, rsi
add edx, edx
lea eax, [rdx + 1]
movsxd rbx, eax
call qword [sym.imp.mfc140u.dll_Ordinal_4946]
mov rcx, rax
mov rdx, rbx
call fcn.14015ab40
mov edx, 0xffffffff
mov rcx, rsi
mov rbx, rax
call qword [sym.imp.mfc140u.dll_CDialogImpl::ProcessMouseClick]
mov rdx, rbx
mov ecx, reloc.WS2_32.dll_listen
call qword [sym.imp.USER32.dll_SetClipboardData]
mov bl, 1
call qword [sym.imp.USER32.dll_CloseClipboard]
movzx eax, bl
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
lea rdx, str.C:UsersScottBrAppDataLocalTempDitto_BuildClip_ImportExport.cpp
lea rcx, [rsp + 0x48]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__14]
mov r9d, 0xa9
lea rcx, str.Error_opening_clipboard
mov r8, rax
xor edx, edx
call fcn.14015b6c0
mov rsi, qword [rsp + 0x38]
movzx eax, bl
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x140102ae0
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x20
mov r14, rcx
xor bl, bl
mov rcx, qword [0x1403c4508]
call qword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x140102b9d
call qword [sym.imp.USER32.dll_EmptyClipboard]
mov r12, qword [r14 + 0x20]
xor edi, edi
test r12, r12
jle 0x140102b93
mov ebp, edi
mov ebx, edi
test rbx, rbx
js 0x140102be0
cmp rbp, qword [r14 + 0x20]
jge 0x140102be0
mov rsi, qword [r14 + 0x18]
add rsi, rbx
mov rcx, qword [rsi + 0x10]
call qword [sym.imp.KERNEL32.dll_GlobalLock]
mov r15, rax
test rax, rax
je 0x140102b82
mov rcx, qword [rsi + 0x10]
call qword [sym.imp.KERNEL32.dll_GlobalSize]
mov rdx, rax
mov rcx, r15
call fcn.14015ab40
test rax, rax
je 0x140102b78
movzx ecx, word [rsi + 8]
mov rdx, rax
call qword [sym.imp.USER32.dll_SetClipboardData]
mov rcx, qword [rsi + 0x10]
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
inc edi
inc rbp
movsxd rax, edi
add rbx, 0x28
cmp rax, r12
jl 0x140102b25
call qword [sym.imp.USER32.dll_CloseClipboard]
mov bl, 1
jmp 0x140102bc6
lea rdx, str.C:UsersScottBrAppDataLocalTempDitto_BuildClip_ImportExport.cpp
lea rcx, [rsp + 0x58]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__14]
mov r9d, 0xcf
lea rcx, str.PlaceFormatsOnclipboard::Error_opening_clipboard
mov r8, rax
xor edx, edx
call fcn.14015b6c0
mov rbp, qword [rsp + 0x60]
movzx eax, bl
mov rbx, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
call sub.mfc140u.dll_AfxRegDeleteKey
int3
Function at 0x140102c30
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x20
mov r14, rcx
mov rcx, qword [0x1403c4508]
call qword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x140102cff
call qword [sym.imp.USER32.dll_EmptyClipboard]
mov edx, 7
lea rcx, str.Ignore
call fcn.14015ab40
movzx ecx, word [0x1403c475c]
mov rdx, rax
call qword [sym.imp.USER32.dll_SetClipboardData]
mov r15, qword [r14 + 0x10]
xor r12d, r12d
mov ebp, r12d
test r15, r15
jle 0x140102ce7
mov esi, r12d
mov rcx, r15
mov ebx, r12d
nop dword [rax]
test rbx, rbx
js 0x140102d52
cmp rsi, rcx
jge 0x140102d52
mov rdi, qword [r14 + 8]
add rdi, rbx
je 0x140102cd6
mov rdx, qword [rdi + 0x10]
test rdx, rdx
je 0x140102cd6
movzx ecx, word [rdi + 8]
call qword [sym.imp.USER32.dll_SetClipboardData]
mov qword [rdi + 0x10], r12
mov rcx, qword [r14 + 0x10]
inc ebp
inc rsi
movsxd rax, ebp
add rbx, 0x28
cmp rax, r15
jl 0x140102ca0
mov bl, 1
call qword [sym.imp.USER32.dll_CloseClipboard]
xor edx, edx
mov rcx, r14
lea r8, [rdx - 1]
call fcn.1400fa3d0
jmp 0x140102d38
xor edx, edx
mov rcx, r14
lea r8, [rdx - 1]
call fcn.1400fa3d0
lea rdx, str.C:UsersScottBrAppDataLocalTempDitto_BuildClipboardSaveRestore.cpp
lea rcx, [rsp + 0x58]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__14]
mov r9d, 0x57
lea rcx, str.CClipboardSaveRestore::Restore_failed_to_restore_clipboard
mov r8, rax
xor edx, edx
call fcn.14015b6c0
xor bl, bl
mov rbp, qword [rsp + 0x60]
movzx eax, bl
mov rbx, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
call sub.mfc140u.dll_AfxRegDeleteKey
int3
Function at 0x140103040
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x60
mov ebp, edx
mov r14, rcx
xor edx, edx
lea r8, [rdx - 1]
call fcn.1400fa3d0
xor bl, bl
lea rcx, [rsp + 0x20]
call sub.mfc140u.dll_COleCmdUI::COleCmdUI
nop
xor edx, edx
lea r9d, [rdx - 1]
xor r8d, r8d
lea rcx, [rsp + 0x38]
call fcn.1400fa8d0
nop
mov rcx, qword [0x1403c4508]
call qword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x140103143
xor ecx, ecx
call qword [sym.imp.USER32.dll_EnumClipboardFormats]
mov ebx, eax
test eax, eax
je 0x14010313b
mov r15d, 0xa002
xor r12d, r12d
nop
test ebp, ebp
je 0x1401030cf
cmp ebx, 0xf
ja 0x14010312d
bt r15d, ebx
jae 0x14010312d
mov ecx, ebx
call qword [sym.imp.USER32.dll_GetClipboardData]
mov rdi, rax
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GlobalLock]
mov rsi, rax
test rax, rax
je 0x14010312d
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GlobalSize]
test rax, rax
jle 0x140103124
mov rdx, rax
mov rcx, rsi
call fcn.14015ab40
mov qword [rsp + 0x48], rax
mov word [rsp + 0x40], bx
lea r8, [rsp + 0x38]
mov rdx, qword [r14 + 0x10]
mov rcx, r14
call fcn.1400fa350
mov qword [rsp + 0x48], r12
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov ecx, ebx
call qword [sym.imp.USER32.dll_EnumClipboardFormats]
mov ebx, eax
test eax, eax
jne 0x1401030c0
call qword [sym.imp.USER32.dll_CloseClipboard]
mov bl, 1
lea rcx, [rsp + 0x38]
call fcn.1400fa950
nop
lea rcx, [rsp + 0x20]
call sub.mfc140u.dll_CMFCRibbonRichEditCtrl::ProcessClipboardAccelerators
nop
movzx eax, bl
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop r12
ret
Function at 0x1401035e0
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push rbx
sub rsp, 0x20
mov qword [rsp + 0x38], rbp
mov rbx, rcx
movzx ebp, dl
mov qword [rsp + 0x48], rdi
lea rdx, str.C:UsersScottBrAppDataLocalTempDitto_BuildClipboardViewer.cpp
lea rcx, [rsp + 0x30]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__14]
mov r9d, WSACleanup
lea rcx, str.Disconnect_From_Clipboard
mov r8, rax
xor edx, edx
call fcn.14015b6c0
mov rcx, qword [rbx + 0x40]
mov edx, 6
call qword [sym.imp.USER32.dll_KillTimer]
call fcn.14015a920
test eax, eax
je 0x14010369c
lea rcx, [0x1402ae200]
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
test rax, rax
je 0x14010369c
lea rdx, str.RemoveClipboardFormatListener
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rdi, rax
test rax, rax
je 0x14010369c
lea rdx, str.C:UsersScottBrAppDataLocalTempDitto_BuildClipboardViewer.cpp
lea rcx, [rsp + 0x30]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__14]
mov r9d, 0x80
lea rcx, str.Disconnecting_from_clipboard_with_function_RemoveClipboardFormatListener
mov r8, rax
xor edx, edx
call fcn.14015b6c0
mov rcx, qword [rbx + 0x40]
call rdi
lea rdi, [rbx + 0xe8]
jmp 0x140103760
lea rdx, str.C:UsersScottBrAppDataLocalTempDitto_BuildClipboardViewer.cpp
mov qword [rsp + 0x40], rsi
lea rcx, [rsp + 0x30]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__14]
mov r9d, 0x89
lea rcx, str.Disconnecting_from_clipboard_with_function_ChangeClipboardChain
mov r8, rax
xor edx, edx
call fcn.14015b6c0
mov rdx, qword [rbx + 0xe8]
lea rdi, [rbx + 0xe8]
mov rcx, qword [rbx + 0x40]
call qword [sym.imp.USER32.dll_ChangeClipboardChain]
test eax, eax
jne 0x14010375b
lea rdx, str.C:UsersScottBrAppDataLocalTempDitto_BuildClipboardViewer.cpp
lea rcx, [rsp + 0x30]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__14]
mov r9d, 0x8e
lea rcx, str.Error_disconnecting_from_clipboard
mov r8, rax
xor edx, edx
call fcn.14015b6c0
mov rdx, qword [rbx + 0xe8]
lea rdi, [rbx + 0xe8]
mov rcx, qword [rbx + 0x40]
call qword [sym.imp.USER32.dll_ChangeClipboardChain]
test eax, eax
jne 0x14010375b
lea rdx, str.C:UsersScottBrAppDataLocalTempDitto_BuildClipboardViewer.cpp
lea rcx, [rsp + 0x30]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__14]
mov r9d, __WSAFDIsSet
lea rcx, str.Error_disconnecting_from_clipboard2
mov r8, rax
xor edx, edx
call fcn.14015b6c0
lea rdi, [rbx + 0xe8]
mov rsi, qword [rsp + 0x40]
mov qword [rdi], 0
test bpl, bpl
mov rdi, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x38]
mov word [rbx + 0xf2], 0
je 0x14010378c
mov rcx, rbx
add rsp, 0x20
pop rbx
jmp fcn.140103db0
add rsp, 0x20
pop rbx
ret
Function at 0x140103db0
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push rbx
sub rsp, 0x20
cmp dword [0x1403c53b4], 0
mov rbx, rcx
je 0x140103e3c
mov rcx, qword [rcx + 0x40]
call qword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x140103e3c
mov edx, reloc.WS2_32.dll_inet_addr
mov byte [rbx + 0xf1], 1
lea rcx, str.Ditto_Ping
call fcn.14015ab40
movzx ecx, word [0x1403c4760]
mov rdx, rax
call qword [sym.imp.USER32.dll_SetClipboardData]
mov edx, 7
lea rcx, str.Ignore
call fcn.14015ab40
movzx ecx, word [0x1403c475c]
mov rdx, rax
call qword [sym.imp.USER32.dll_SetClipboardData]
mov rcx, qword [rbx + 0x40]
xor r9d, r9d
mov r8d, 0x7d0
lea edx, [r9 + 8]
call qword [sym.imp.USER32.dll_SetTimer]
add rsp, 0x20
pop rbx
jmp qword [sym.imp.USER32.dll_CloseClipboard]
add rsp, 0x20
pop rbx
ret

Function at 0x140103eb0
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
mov byte [rcx + 0xf2], dl
test dl, dl
je 0x140103ecc
cmp byte [rcx + 0xf3], 0
je fcn.140103440
jmp fcn.140103db0
mov dl, 1
jmp fcn.1401035e0
Function at 0x140104900
Capabilities:
Reference sql statements

Disassembly:
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x10], rdx
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x90
mov edi, r9d
mov r15d, r8d
mov r13, rcx
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_Ordinal_296]
nop
mov r12, qword [r13 + 0x10]
xor sil, sil
mov byte [rsp + 0xd0], sil
xor r14d, r14d
movsxd rbx, r14d
cmp rbx, r12
jge 0x140104ae9
test edi, edi
je 0x14010495d
mov rax, r12
sub rax, rbx
lea rbx, [rax - 1]
lea rdx, [0x1402ac320]
lea rcx, [rsp + 0x38]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__15]
nop
cmp byte [rsp + 0xf0], 0
je 0x140104980
cmp r15d, 0xd
je 0x140104986
cmp r15d, 1
jne 0x1401049b7
mov edx, reloc.OLEAUT32.dll_SafeArrayDestroy
lea rcx, [rsp + 0x48]
call fcn.140159bf0
nop
mov r8, qword [rax]
lea rdx, str.OR_Data.strClipBoardFormat___s
lea rcx, [rsp + 0x38]
call qword [sym.imp.mfc140u.dll_CMFCZoomKernel::Filter]
nop
lea rcx, [rsp + 0x48]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
test rbx, rbx
js 0x140104b15
cmp rbx, qword [r13 + 0x10]
jge 0x140104b15
mov rax, qword [r13 + 8]
mov edi, dword [rax + rbx*4]
mov rbx, qword [rsp + 0x38]
movzx edx, r15w
lea rcx, [rsp + 0x50]
call fcn.140159bf0
nop
mov dword [rsp + 0x20], edi
mov r9, rbx
mov r8, qword [rax]
lea rdx, str.SELECT__FROM_Data_INNER_JOIN_Main_ON_Main.lID__Data.lParentID_WHERE__Data.strClipBoardFormat___s__s__AND_Main.lID___d
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_CMFCZoomKernel::Filter]
nop
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___3]
mov r8, rax
lea rdx, [rsp + 0x58]
lea rcx, [0x1403c44c8]
call fcn.140143c00
nop
lea rcx, [rsp + 0x58]
call fcn.1401437b0
test al, al
jne 0x140104ac4
mov dword [rsp + 0x30], 0
lea r8, [rsp + 0x30]
lea rdx, str.ooData
lea rcx, [rsp + 0x58]
call fcn.140144480
mov rbx, rax
test rax, rax
je 0x140104ac4
mov rax, qword [rsp + 0xd8]
mov rax, qword [rax]
mov rdi, qword [rax]
lea r8, [0x1402ac320]
lea rdx, str.strClipBoardFormat
lea rcx, [rsp + 0x58]
call fcn.1401446b0
mov rcx, rax
call fcn.140159640
movzx eax, ax
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], r12d
mov r9d, r14d
mov r8d, dword [rsp + 0x30]
mov rdx, rbx
mov rcx, qword [rsp + 0xd8]
call rdi
test al, al
je 0x140104ac4
or sil, 1
mov byte [rsp + 0xd0], sil
lea rcx, [rsp + 0x58]
call fcn.140143000
nop
lea rcx, [rsp + 0x38]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
inc r14d
mov edi, dword [rsp + 0xe8]
jmp 0x140104943
jmp 0x140104af3
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
movzx eax, sil
add rsp, 0x90
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret
call sub.mfc140u.dll_AfxRegDeleteKey
nop
int3
Function at 0x1401053b0
Capabilities:
Check if file exists
Delete file
Get file attributes

Disassembly:
mov qword [rsp + 0x10], rdx
push rbx
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x118
mov r15, rdx
mov r14, rcx
mov r12, qword [rcx + 0x10]
test r12, r12
jne 0x1401053f3
mov rcx, rdx
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
lea eax, [r12 + 1]
add rsp, 0x118
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbx
ret
xor ebx, ebx
mov dword [rsp + 0x150], ebx
mov rcx, r15
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___3]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1401054ba
mov rcx, r15
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___3]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x1401054ba
lea rax, [rsp + 0x150]
mov qword [rsp + 0x168], rax
lea rdx, str.C:UsersScottBrAppDataLocalTempDitto_BuildClipIds.cpp
lea rcx, [rsp + 0x150]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__14]
mov rbx, rax
mov r8, qword [r15]
lea rdx, str.Export::Error_deleting_the_file__s
lea rcx, [rsp + 0x160]
call fcn.14015b330
nop
mov rcx, rax
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___3]
nop
mov r9d, CDC::CDC
mov r8, rbx
xor edx, edx
mov rcx, rax
call fcn.14015b6c0
nop
lea rcx, [rsp + 0x160]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
mov rcx, r15
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
xor eax, eax
add rsp, 0x118
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbx
ret
lea rcx, [rsp + 0x20]
call fcn.140142e00
nop
mov rcx, r15
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___3]
mov rdx, rax
lea rcx, [rsp + 0x20]
call fcn.1401447c0
lea rdx, [rsp + 0x20]
mov rcx, r14
call fcn.140104c70
test eax, eax
jne 0x140105507
lea rcx, [rsp + 0x20]
call fcn.140142fe0
nop
mov rcx, r15
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
xor eax, eax
jmp 0x1401055bd
mov edi, ebx
nop dword [rax]
movsxd rcx, edi
cmp rcx, r12
jge 0x14010558b
test edi, edi
js 0x1401055ce
cmp rcx, qword [r14 + 0x10]
jge 0x1401055ce
mov rax, qword [r14 + 8]
mov esi, dword [rax + rcx*4]
lea rcx, [rsp + 0x50]
call fcn.1401021b0
nop
mov edx, esi
lea rcx, [rsp + 0x50]
call fcn.1400ff490
test eax, eax
je 0x14010557d
xor r9d, r9d
xor r8d, r8d
mov edx, esi
lea rcx, [rsp + 0x50]
call fcn.1400fdae0
test al, al
je 0x14010557d
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x50]
call fcn.140102310
mov ebx, 1
mov dword [rsp + 0x150], ebx
lea rcx, [rsp + 0x50]
call fcn.1401021e0
inc edi
jmp 0x140105510
lea rcx, [rsp + 0x20]
call fcn.140143670
nop
lea rcx, [rsp + 0x20]
call fcn.140142fe0
nop
jmp 0x1401055b2
mov rcx, r15
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
mov eax, ebx
add rsp, 0x118
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbx
ret
call sub.mfc140u.dll_AfxRegDeleteKey
nop
int3
Function at 0x14010a500
Capabilities:
Check for time delay via gettickcount
Reference sql statements

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 8], rcx
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x70
mov r15d, r9d
mov r12d, r8d
mov esi, edx
mov rbx, rcx
xor edi, edi
mov dword [rsp + 0xa8], edi
cmp dword [rcx + 0x3bc], edx
jne 0x14010a53a
lea eax, [rdi + 1]
jmp 0x14010a712
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov r14d, eax
mov dword [rsp + 0x20], eax
test r12d, r12d
je 0x14010a554
mov rcx, rbx
call fcn.14010a400
test r15d, r15d
je 0x14010a561
mov rcx, rbx
call fcn.14010c1e0
cmp dword [rbx + 0x3c0], esi
jne 0x14010a579
mov eax, dword [rbx + 0x3bc]
test eax, eax
jle 0x14010a579
mov dword [rbx + 0x3e0], eax
cmp esi, 0xffffffff
je 0x14010a63f
mov r9d, esi
lea r8, str.SELECT_lParentID__mText__bIsGroup_FROM_Main_WHERE_lID___d
lea rdx, [rsp + 0x48]
lea rcx, [0x1403c44c8]
call fcn.140143da0
nop
lea rcx, [rsp + 0x48]
call fcn.1401437b0
test al, al
jne 0x14010a618
xor r8d, r8d
lea rdx, str.bIsGroup
lea rcx, [rsp + 0x48]
call fcn.140144630
test eax, eax
jle 0x14010a618
mov dword [rbx + 0x3bc], esi
xor r8d, r8d
lea rdx, str.lParentID
lea rcx, [rsp + 0x48]
call fcn.140144630
mov dword [rbx + 0x3c0], eax
lea r8, [0x1402ac320]
lea rdx, str.mText
lea rcx, [rsp + 0x48]
call fcn.1401446b0
lea rcx, [rbx + 0x3c8]
mov rdx, rax
call qword [sym.imp.mfc140u.dll_CMFCControlRendererInfo::CMFCControlRendererInfo]
mov edi, 1
mov dword [rsp + 0xa8], edi
lea rcx, [rsp + 0x48]
call fcn.140143000
nop
jmp 0x14010a639
test edi, edi
je 0x14010a69a
jmp 0x14010a66d
mov dword [rbx + 0x3e0], 0xffffffff
mov qword [rbx + 0x3bc], 0xffffffffffffffff
lea rcx, [rbx + 0x3c8]
lea rdx, str.History
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XPanel::XPanel]
mov edi, 1
xor edx, edx
lea rcx, [0x1403c4350]
call fcn.14010c130
mov rcx, rbx
call fcn.14010c060
test rax, rax
je 0x14010a69a
mov rcx, rbx
call fcn.14010c060
mov dl, 1
mov rcx, rax
call fcn.1401905b0
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov esi, eax
sub esi, r14d
cmp esi, 0x96
jbe 0x14010a710
lea rax, [rsp + 0xa0]
mov qword [rsp + 0x38], rax
lea rdx, str.C:UsersScottBrAppDataLocalTempDitto_BuildCP_Main.cpp
lea rcx, [rsp + 0xa0]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__14]
mov rbx, rax
mov r8d, esi
lea rdx, str.Paste_Timing_EnterParentId:__d
lea rcx, [rsp + 0x30]
call fcn.14015b330
nop
mov rcx, rax
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___3]
nop
mov r9d, COleDataObject::COleDataObject
mov r8, rbx
xor edx, edx
mov rcx, rax
call fcn.14015b6c0
nop
lea rcx, [rsp + 0x30]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
mov eax, edi
mov rbx, qword [rsp + 0xb0]
add rsp, 0x70
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
Function at 0x14010a870
Capabilities:
Reference sql statements

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x70
mov rsi, r8
mov edi, edx
xor ebx, ebx
mov dword [rsp + 0x98], ebx
movzx edx, word [r8 + 8]
lea rcx, [rsp + 0x30]
call fcn.140159bf0
nop
mov rax, qword [rax]
mov qword [rsp + 0x20], rax
mov r9d, edi
lea r8, str.SELECT_ooData_FROM_Data_WHERE_lParentID___d_AND_strClipboardFormat___s
lea rdx, [rsp + 0x48]
lea rcx, [0x1403c44c8]
call fcn.140143da0
nop
lea rcx, [rsp + 0x30]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
lea rcx, [rsp + 0x48]
call fcn.1401437b0
test al, al
jne 0x14010a932
mov dword [rsp + 0x90], ebx
lea r8, [rsp + 0x90]
lea rdx, str.ooData
lea rcx, [rsp + 0x48]
call fcn.140144480
mov rdi, rax
test rax, rax
je 0x14010a932
movsxd rcx, dword [rsp + 0x90]
call fcn.14015aaf0
mov qword [rsi + 0x10], rax
movsxd r8, dword [rsp + 0x90]
mov rdx, rdi
mov rcx, rax
call fcn.140158410
mov ebx, 1
mov dword [rsp + 0x98], ebx
lea rcx, [rsp + 0x48]
call fcn.140143000
nop
mov eax, ebx
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret