joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14000bfe0
Capabilities:
Hash data with md5

Disassembly:
push rsi
sub rsp, 0xf0
mov rax, qword [0x1402a6808]
xor rax, rsp
mov qword [rsp + 0xe0], rax
cmp dword [rcx + 0x30], 1
mov rsi, rcx
ja 0x14000c1d2
mov rcx, qword [rcx + 0x18]
mov edx, 0x78b
call qword [sym.imp.USER32.dll_GetDlgItem]
xor r9d, r9d
xor r8d, r8d
mov rcx, rax
lea edx, [r9 + 0xe]
call qword [sym.imp.USER32.dll_SendMessageW]
test eax, eax
je 0x14000c1bc
mov qword [rsp + 0x108], rbx
mov rbx, 0xffffffffffffffff
mov qword [rsp + 0x110], rbp
mov qword [rsp + 0x118], rdi
lea edi, [rax + 1]
movsxd rcx, edi
mov eax, 2
mul rcx
cmovo rax, rbx
mov rcx, rax
call fcn.14017f5ec
mov rcx, qword [rsi + 0x18]
mov r9d, edi
mov r8, rax
mov edx, 0x78b
mov rbp, rax
call qword [sym.imp.USER32.dll_GetDlgItemTextW]
call fcn.14000ca10
xor edi, edi
mov r9d, ebx
mov r8d, 0xfde9
mov qword [rsp + 0x20], rdi
mov rdx, rbp
mov rcx, rax
call fcn.14002c080
mov ecx, dword [rsi + 0x30]
test ecx, ecx
jne 0x14000c10f
mov qword [rsp + 0x40], rdi
mov dword [rsp + 0x30], 0x67452301
mov dword [rsp + 0x34], 0xefcdab89
mov dword [rsp + 0x38], 0x98badcfe
mov dword [rsp + 0x3c], 0x10325476
nop
inc rbx
cmp byte [rax + rbx], dil
jne 0x14000c0d0
mov r8, rbx
lea rcx, [rsp + 0x30]
mov rdx, rax
call fcn.14000b650
lea rcx, [rsp + 0x30]
call fcn.14000aaf0
mov rcx, qword [rsi + 0x18]
lea r8, [rsp + 0x98]
mov edx, 0x78d
call qword [sym.imp.USER32.dll_SetDlgItemTextA]
jmp 0x14000c19a
cmp ecx, 1
jne 0x14000c19a
nop dword [rax + rax]
inc rbx
cmp byte [rax + rbx], dil
jne 0x14000c120
mov r8, rbx
lea rcx, [rsp + 0xc0]
mov rdx, rax
call fcn.14000d790
xor edx, edx
lea rcx, [rsp + 0x30]
mov r8d, 0x82
call fcn.14019e060
lea rbx, [rsp + 0x30]
nop dword [rax]
nop word [rax + rax]
movzx r8d, byte [rsp + rdi + 0xc0]
lea rdx, [0x1401e25b8]
mov rcx, rbx
call qword [sym.imp.USER32.dll_wsprintfW]
inc rdi
add rbx, 4
cmp rdi, 0x20
jb 0x14000c160
mov rcx, qword [rsi + 0x18]
lea r8, [rsp + 0x30]
mov edx, 0x78d
call qword [sym.imp.USER32.dll_SetDlgItemTextW]
mov rcx, rbp
call fcn.14017f5e4
mov rdi, qword [rsp + 0x118]
mov rbp, qword [rsp + 0x110]
mov rbx, qword [rsp + 0x108]
jmp 0x14000c1d2
mov rcx, qword [rsi + 0x18]
lea r8, [0x1401e1e40]
mov edx, 0x78d
call qword [sym.imp.USER32.dll_SetDlgItemTextA]
mov rcx, qword [rsp + 0xe0]
xor rcx, rsp
call fcn.14017f700
add rsp, 0xf0
pop rsi
ret
Function at 0x140017e70
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x220
mov rax, qword [0x1402a6808]
xor rax, rsp
mov qword [rsp + 0x210], rax
mov rdi, rcx
mov rbx, rdx
lea rcx, [rsp + 0x40]
call qword [sym.imp.USER32.dll_GetKeyboardState]
sar rbx, 0x10
lea r9, [rsp + 0x30]
xor esi, esi
movzx edx, bl
lea r8, [rsp + 0x40]
mov dword [rsp + 0x20], esi
mov ecx, edi
call qword [sym.imp.USER32.dll_ToAscii]
movzx edi, word [rsp + 0x30]
lea rdx, str.return_value___d
mov r8d, edi
lea rcx, [rsp + 0x140]
mov ebx, eax
call qword [sym.imp.USER32.dll_wsprintfW]
cmp ebx, 1
cmovne edi, esi
movzx eax, di
mov rcx, qword [rsp + 0x210]
xor rcx, rsp
call fcn.14017f700
lea r11, [rsp + 0x220]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x14001dce0
Capabilities:
Check if file exists

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x50
mov rax, qword [0x1402a6808]
xor rax, rsp
mov qword [rsp + 0x48], rax
cmp dword [rcx + 0xa0], 2
mov rbx, rcx
je 0x14001df34
cmp byte [rcx + 0x110], 0
jne 0x14001df34
xor bpl, bpl
call fcn.14000c980
lea rdi, [rbx + 0xb0]
mov r14, rax
cmp qword [rdi + 0x18], 8
mov rcx, rdi
jb 0x14001dd3d
mov rcx, qword [rdi]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x14001dd54
xor edx, edx
mov rcx, r14
call fcn.1400e92a0
mov bpl, 1
xor sil, sil
cmp dword [rbx + 0xa0], 4
je 0x14001ddd7
cmp qword [rdi + 0x18], 8
mov rcx, rdi
jb 0x14001dd6d
mov rcx, qword [rdi]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x14001ddca
xor edi, edi
mov dword [rbx + 0xa0], 4
mov byte [rbx + 0xac], al
mov byte [rbx + 0x48], 1
mov qword [rbx + 0xa4], rdi
cmp byte [rbx + 8], dil
je 0x14001ddac
mov rcx, qword [rbx]
lea r8d, [rax + 0x70]
mov rdx, rbx
mov rcx, qword [rcx]
call fcn.140094370
mov sil, 1
test bpl, bpl
je 0x14001ddc1
mov edx, 1
mov rcx, r14
call fcn.1400e92a0
movzx eax, sil
jmp 0x14001df36
cmp dword [rbx + 0xa0], 4
jne 0x14001de81
cmp qword [rdi + 0x18], 8
mov rcx, rdi
jb 0x14001dde4
mov rcx, qword [rdi]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x14001de81
cmp qword [rdi + 0x18], 8
jb 0x14001ddfc
mov rdi, qword [rdi]
lea r8, [rsp + 0x20]
xor edx, edx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesExW]
test eax, eax
je 0x14001ddaf
movzx eax, byte [rsp + 0x20]
lea rcx, [rbx + 0x150]
and al, 1
mov dword [rbx + 0xa0], 8
mov byte [rbx + 0xac], al
mov rax, qword [rsp + 0x34]
mov qword [rbx + 0xa4], rax
call fcn.1400211d0
test al, al
je 0x14001ddac
cmp byte [rbx + 8], 0
je 0x14001de61
mov rcx, qword [rbx]
mov r8d, 0x70
mov rdx, rbx
mov rcx, qword [rcx]
call fcn.140094370
lea rcx, [rbx + 0x150]
call fcn.14015e5b0
test eax, eax
je 0x14001ddac
mov ecx, eax
call fcn.14015e6bc
jmp 0x14001ddac
cmp qword [rdi + 0x18], 8
jb 0x14001de8b
mov rdi, qword [rdi]
lea r8, [rsp + 0x20]
xor edx, edx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesExW]
test eax, eax
je 0x14001ddaf
movzx eax, byte [rsp + 0x20]
xor edi, edi
and al, 1
cmp al, byte [rbx + 0xac]
je 0x14001debf
mov byte [rbx + 0xac], al
mov edi, InitCommonControls
lea rdx, [rsp + 0x34]
lea rcx, [rbx + 0xa4]
call qword [sym.imp.KERNEL32.dll_CompareFileTime]
test eax, eax
je 0x14001deee
mov rax, qword [rsp + 0x34]
or edi, 0x60
mov qword [rbx + 0xa4], rax
mov dword [rbx + 0xa0], 8
test edi, edi
je 0x14001df34
lea rcx, [rbx + 0x150]
call fcn.1400211d0
test al, al
je 0x14001df34
cmp byte [rbx + 8], 0
je 0x14001df19
mov rcx, qword [rbx]
mov r8d, edi
mov rdx, rbx
mov rcx, qword [rcx]
call fcn.140094370
lea rcx, [rbx + 0x150]
call fcn.14015e5b0
test eax, eax
je 0x14001df30
mov ecx, eax
call fcn.14015e6bc
mov al, 1
jmp 0x14001df36
xor al, al
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.14017f700
mov rbx, qword [rsp + 0x78]
mov rbp, qword [rsp + 0x80]
add rsp, 0x50
pop r14
pop rdi
pop rsi
ret
Function at 0x14001e3d0
Capabilities:
Delete file

Disassembly:
mov r11, rsp
push rdi
sub rsp, 0x80
mov qword [r11 - 0x60], 0xfffffffffffffffe
mov qword [r11 + 8], rbx
mov qword [r11 + 0x18], rsi
mov rax, qword [0x1402a6808]
xor rax, rsp
mov qword [rsp + 0x70], rax
mov rbx, rdx
xor esi, esi
mov dil, 1
lea rdx, [r11 - 0x58]
mov rcx, rbx
call fcn.14001ee60
nop
cmp qword [rsp + 0x40], rsi
je 0x14001e4c7
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x60], xmm0
movdqa xmm1, xmmword [0x1401e3030]
movdqu xmmword [rsp + 0x60], xmm1
mov word [rsp + 0x50], si
lea rcx, [rbx + 0xe0]
lea rax, [rsp + 0x50]
cmp rcx, rax
je 0x14001e455
xor r8d, r8d
lea rdx, [rsp + 0x50]
call fcn.140006d60
nop
mov rdx, qword [rsp + 0x68]
cmp rdx, 8
jb 0x14001e497
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001e492
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001e544
call fcn.14017f5e4
movdqa xmm0, xmmword [0x1401e3030]
movdqu xmmword [rsp + 0x60], xmm0
mov word [rsp + 0x50], si
lea rcx, [rsp + 0x30]
cmp qword [rsp + 0x48], 8
cmovae rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
setne dil
mov rdx, qword [rsp + 0x48]
cmp rdx, 8
jb 0x14001e505
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001e500
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001e53e
call fcn.14017f5e4
mov qword [rsp + 0x40], rsi
mov qword [rsp + 0x48], 7
mov word [rsp + 0x30], si
movzx eax, dil
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.14017f700
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
call fcn.1401a10ac
nop
call fcn.1401a10ac
nop
int3
Function at 0x14001e550
Capabilities:
Check if file exists
Delete file

Disassembly:
mov rax, rsp
push rbp
lea rbp, [rax - 0x5f]
sub rsp, 0x90
mov qword [rbp + 0x1f], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rdi
mov rax, qword [0x1402a6808]
xor rax, rsp
mov qword [rbp + 0x47], rax
add rdx, 0xb0
cmp qword [rdx + 0x18], 8
jb 0x14001e58e
mov rdx, qword [rdx]
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x37], xmm0
movdqa xmm1, xmmword [0x1401e3030]
movdqu xmmword [rbp + 0x37], xmm1
xor edi, edi
mov word [rbp + 0x27], di
mov r8, 0xffffffffffffffff
inc r8
cmp word [rdx + r8*2], di
jne 0x14001e5b0
lea rcx, [rbp + 0x27]
call fcn.140006d60
nop
xor r8d, r8d
lea edx, [r8 + 1]
lea rcx, [rbp + 0x27]
call fcn.14001d120
lea rcx, [rbp + 0x27]
cmp qword [rbp + 0x3f], 8
cmovae rcx, qword [rbp + 0x27]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x14001e5f0
xor bl, bl
jmp 0x14001e631
mov qword [rbp - 0x11], 3
mov qword [rbp + 7], 0x40
mov qword [rbp - 0x19], rdi
lea rax, [rbp + 0x27]
cmp qword [rbp + 0x3f], 8
cmovae rax, qword [rbp + 0x27]
mov qword [rbp - 9], rax
mov qword [rbp - 1], rdi
xorps xmm0, xmm0
movdqu xmmword [rbp + 0xf], xmm0
lea rcx, [rbp - 0x19]
call qword [sym.imp.SHELL32.dll_SHFileOperationW]
test eax, eax
sete bl
mov rdx, qword [rbp + 0x3f]
cmp rdx, 8
jb 0x14001e66d
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x27]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001e668
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001e6a2
call fcn.14017f5e4
movdqa xmm0, xmmword [0x1401e3030]
movdqu xmmword [rbp + 0x37], xmm0
mov word [rbp + 0x27], di
movzx eax, bl
mov rcx, qword [rbp + 0x47]
xor rcx, rsp
call fcn.14017f700
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret
call fcn.1401a10ac
int3
Function at 0x14001ff00
Capabilities:
Move file

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
lea rcx, [rdx + 0xb0]
mov rbx, r8
cmp qword [rcx + 0x18], 8
mov rdi, rdx
jb 0x14001ff21
mov rcx, qword [rcx]
mov r8d, 0xb
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
jne 0x14001ff3f
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
xor r8d, r8d
mov rdx, rbx
mov rcx, rdi
call fcn.140020ba0
mov rbx, qword [rsp + 0x30]
mov al, 1
add rsp, 0x20
pop rdi
ret
Function at 0x1400296c0
Capabilities:
Check if file exists
Read file on windows

Disassembly:
push rbp
push rsi
push rdi
push r14
push r15
lea rbp, [rsp - 0x380]
sub rsp, 0x480
mov qword [rsp + 0x38], 0xfffffffffffffffe
mov qword [rsp + 0x4c0], rbx
mov rax, qword [0x1402a6808]
xor rax, rsp
mov qword [rbp + 0x370], rax
mov rbx, rdx
mov rsi, rcx
mov qword [rsp + 0x40], rcx
xor r15d, r15d
mov dword [rsp + 0x30], r15d
mov rcx, rdx
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
xor r8d, r8d
lea rdx, [0x1401e1e40]
test eax, eax
jne 0x140029748
mov qword [rsi + 0x10], r15
mov qword [rsi + 0x18], InitCommonControls
mov byte [rsi], r15b
mov rcx, rsi
call fcn.140006c10
nop
mov dword [rsp + 0x30], 1
jmp 0x14002984e
mov qword [rsp + 0x58], r15
mov qword [rsp + 0x60], r15
mov qword [rsp + 0x58], r15
mov qword [rsp + 0x60], InitCommonControls
mov byte [rsp + 0x48], r15b
lea rcx, [rsp + 0x48]
call fcn.140006c10
nop
lea rdx, [0x1401e559c]
mov rcx, rbx
call fcn.1401a5dd0
mov r14, rax
mov r9, r14
mov edx, 1
mov r8d, 0x400
lea rcx, [rsp + 0x70]
call fcn.1401a6078
mov rbx, rax
test rax, rax
je 0x140029807
mov rcx, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
mov rax, rdx
sub rax, rcx
cmp rbx, rax
ja 0x1400297e8
lea rax, [rcx + rbx]
mov qword [rsp + 0x58], rax
lea rdi, [rsp + 0x48]
cmp rdx, 0x10
cmovae rdi, qword [rsp + 0x48]
add rdi, rcx
mov r8, rbx
lea rdx, [rsp + 0x70]
mov rcx, rdi
call fcn.14019dbf0
mov byte [rdi + rbx], 0
jmp 0x140029782
mov qword [rsp + 0x20], rbx
lea r9, [rsp + 0x70]
xor r8d, r8d
mov rdx, rbx
lea rcx, [rsp + 0x48]
call fcn.1400022a0
jmp 0x140029782
mov rcx, r14
call fcn.1401a5bdc
movups xmm0, xmmword [rsp + 0x48]
movups xmmword [rsi], xmm0
movups xmm1, xmmword [rsp + 0x58]
movups xmmword [rsi + 0x10], xmm1
mov qword [rsp + 0x58], r15
mov qword [rsp + 0x60], InitCommonControls
mov byte [rsp + 0x48], 0
mov dword [rsp + 0x30], 1
mov qword [rsp + 0x58], r15
mov qword [rsp + 0x60], InitCommonControls
mov byte [rsp + 0x48], 0
mov rax, rsi
mov rcx, qword [rbp + 0x370]
xor rcx, rsp
call fcn.14017f700
mov rbx, qword [rsp + 0x4c0]
add rsp, 0x480
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x14002a380
Capabilities:
Check if file exists

Disassembly:
push rbx
sub rsp, 0x260
mov rax, qword [0x1402a6808]
xor rax, rsp
mov qword [rsp + 0x250], rax
mov rbx, rcx
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x14002a415
mov rcx, rbx
call qword [sym.imp.SHLWAPI.dll_PathFindExtensionW]
xor edx, edx
lea rcx, [rsp + 0x40]
mov r8d, 0x208
mov rbx, rax
call fcn.14019e060
xor r9d, r9d
mov dword [rsp + 0x30], 0x104
lea rax, [rsp + 0x30]
mov r8, rbx
mov qword [rsp + 0x28], rax
mov ecx, 0x440
lea rax, [rsp + 0x40]
lea edx, [r9 + 1]
mov qword [rsp + 0x20], rax
call qword [sym.imp.SHLWAPI.dll_AssocQueryStringW]
test eax, eax
jne 0x14002a415
lea rdx, [0x1401f0bb8]
lea rcx, [rsp + 0x40]
call fcn.14019e5e8
test rax, rax
jne 0x14002a415
mov al, 1
jmp 0x14002a417
xor al, al
mov rcx, qword [rsp + 0x250]
xor rcx, rsp
call fcn.14017f700
add rsp, 0x260
pop rbx
ret

Function at 0x14002a950
Capabilities:
Get common file path

Disassembly:
mov rax, rsp
push rdi
sub rsp, 0x470
mov qword [rsp + 0x28], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
mov qword [rax + 0x20], rsi
mov rax, qword [0x1402a6808]
xor rax, rsp
mov qword [rsp + 0x460], rax
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x30], rcx
xor eax, eax
mov dword [rsp + 0x20], eax
mov qword [rcx + 0x10], rax
mov qword [rcx + 0x18], 7
mov word [rcx], ax
mov dword [rsp + 0x20], 1
mov rcx, rdx
call qword [sym.imp.SHLWAPI.dll_PathIsRelativeW]
test eax, eax
je 0x14002a9e7
xor r9d, r9d
lea r8, [rsp + 0x40]
mov edx, 0x104
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFullPathNameW]
lea rax, [rsp + 0x40]
mov r8, 0xffffffffffffffff
inc r8
cmp word [rax + r8*2], 0
jne 0x14002a9d5
lea rdx, [rsp + 0x40]
jmp 0x14002aa5e
movzx eax, word [rbx]
cmp ax, 0x5c
jne 0x14002a9f8
cmp word [rbx + 2], ax
jne 0x14002a9fe
jmp 0x14002aa43
cmp ax, 0x2f
jne 0x14002aa43
xor sil, sil
lea rdx, [rsp + 0x250]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
lea rcx, [rsp + 0x250]
call qword [sym.imp.SHLWAPI.dll_PathGetDriveNumberW]
cmp eax, 0xffffffff
je 0x14002aa2a
lea esi, [rax + 0x41]
movsx edx, sil
mov rcx, rdi
call fcn.14002a7f0
mov edx, 0x3a
mov rcx, rdi
call fcn.14002a7f0
mov r8, 0xffffffffffffffff
nop word [rax + rax]
inc r8
cmp word [rbx + r8*2], 0
jne 0x14002aa50
mov rdx, rbx
mov rcx, rdi
call fcn.140006a90
mov rax, rdi
mov rcx, qword [rsp + 0x460]
xor rcx, rsp
call fcn.14017f700
lea r11, [rsp + 0x470]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x14002ae90
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rax, qword [rcx + 0x10]
mov rbp, rdx
mov rdi, rcx
mov ecx, 2
lea rsi, [rax*2 + 2]
mov rdx, rsi
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov rbx, rax
test rax, rax
je 0x14002af09
mov rcx, rbp
call qword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x14002aefa
call qword [sym.imp.USER32.dll_EmptyClipboard]
test eax, eax
je 0x14002aefa
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GlobalLock]
test rax, rax
jne 0x14002af20
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GlobalFree]
call qword [sym.imp.USER32.dll_CloseClipboard]
xor al, al
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
cmp qword [rdi + 0x18], 8
jb 0x14002af2a
mov rdi, qword [rdi]
shr rsi, 1
mov r8, rdi
mov rdx, rsi
mov rcx, rax
call fcn.1401a66e0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov rdx, rbx
mov ecx, InitCommonControls
call qword [sym.imp.USER32.dll_SetClipboardData]
test rax, rax
je 0x14002aefa
call qword [sym.imp.USER32.dll_CloseClipboard]
test eax, eax
je 0x14002af09
mov al, 1
jmp 0x14002af0b

Function at 0x14002c320
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, rdx
lea rdx, [0x1401f0b50]
call fcn.1401a5dd0
mov rdi, rax
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rbx + r8], 0
jne 0x14002c343
mov r9, rdi
mov edx, 1
mov rcx, rbx
call fcn.1401b0144
mov rcx, rdi
call fcn.1401aa24c
mov rcx, rdi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp fcn.1401a5bdc
Function at 0x14002e0a0
Capabilities:
Get common file path
Set current directory

Disassembly:
push rbp
push rsi
push rdi
sub rsp, 0x270
mov qword [rsp + 0x40], 0xfffffffffffffffe
mov qword [rsp + 0x2a0], rbx
mov rax, qword [0x1402a6808]
xor rax, rsp
mov qword [rsp + 0x260], rax
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x48], rdx
xor ebp, ebp
mov dword [rsp + 0x20], ebp
movups xmm0, xmmword [0x140236fa0]
movaps xmmword [rsp + 0x30], xmm0
lea rdx, [rsp + 0x30]
mov rcx, qword [rcx]
call fcn.14002f260
test al, al
jne 0x14002e114
mov qword [rbx], rbp
mov qword [rbx + 8], rbp
mov qword [rbx + 0x10], rbp
mov dword [rsp + 0x20], 1
jmp 0x14002e212
lea rdx, [rsp + 0x50]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
nop
call fcn.14000c980
lea rcx, [rax + 0x33210]
cmp qword [rcx + 0x18], 8
jb 0x14002e13b
mov rcx, qword [rcx]
mov rax, qword [rdi]
mov rsi, qword [rax + 0x58]
mov qword [rsp + 0x30], rbp
lea r9, [rsp + 0x30]
lea r8, [0x140236fc0]
xor edx, edx
call qword [sym.imp.SHELL32.dll_SHCreateItemFromParsingName]
test eax, eax
js 0x14002e16d
mov rax, qword [rsi]
mov rdx, qword [rsp + 0x30]
mov rcx, rsi
call qword [rax + 0x60]
mov rsi, qword [rdi]
mov dword [rsp + 0x30], ebp
mov rcx, qword [rsi + 0x58]
test rcx, rcx
je 0x14002e243
mov rax, qword [rcx]
lea rdx, [rsp + 0x30]
call qword [rax + 0x50]
test eax, eax
js 0x14002e1ad
mov rcx, qword [rsi + 0x58]
test rcx, rcx
je 0x14002e238
mov rax, qword [rcx]
mov edx, dword [rsp + 0x30]
or edx, 0x1a40
call qword [rax + 0x48]
mov rcx, qword [rdi]
call fcn.140030550
test al, al
je 0x14002e1c6
mov rdx, rbx
mov rcx, qword [rdi]
call fcn.14002ed80
jmp 0x14002e1d1
mov qword [rbx], rbp
mov qword [rbx + 8], rbp
mov qword [rbx + 0x10], rbp
mov dword [rsp + 0x20], 1
call fcn.14000c980
cmp dword [rax + 0x3fc], 1
mov rdi, rax
jne 0x14002e207
lea rdx, [rsp + 0x50]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
lea rdx, [rsp + 0x50]
mov rcx, rdi
call fcn.1400e9710
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
mov rax, rbx
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.14017f700
mov rbx, qword [rsp + 0x2a0]
add rsp, 0x270
pop rdi
pop rsi
pop rbp
ret
mov ecx, 0x80004003
call fcn.140180a20
int3
mov ecx, 0x80004003
call fcn.140180a20
int3
Function at 0x1400338a2
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
movsxd rax, dword [rcx + 0x3c]
mov esi, edx
xor edx, edx
mov r8d, dword [rax + rcx + 0x88]
mov r9, rcx
add r8, rcx
mov r10d, dword [r8 + 0x20]
mov r11d, dword [r8 + 0x1c]
mov ebx, dword [r8 + 0x24]
mov edi, dword [r8 + 0x18]
add r10, rcx
add r11, rcx
add rbx, rcx
test edi, edi
je 0x140033913
mov ecx, dword [r10]
add rcx, r9
xor r8d, r8d
jmp 0x1400338fe
movzx eax, al
inc rcx
or eax, 0x60
add r8d, eax
add r8d, r8d
mov al, byte [rcx]
test al, al
jne 0x1400338ef
cmp r8d, esi
je 0x140033925
inc edx
add r10, 4
cmp edx, edi
jb 0x1400338e4
xor eax, eax
mov rbx, qword [rsp + 8]
mov rsi, qword [rsp + 0x10]
mov rdi, qword [rsp + 0x18]
ret
movzx ecx, word [rbx + rdx*2]
mov eax, dword [r11 + rcx*4]
add rax, r9
jmp 0x140033915
Function at 0x140037e70
Capabilities:
Check if file exists

Disassembly:
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x60
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0xa8], rbx
mov rax, qword [0x1402a6808]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov rsi, r8
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x28], rcx
xor ebp, ebp
mov qword [rcx + 0x10], rbp
mov qword [rcx + 0x18], 7
mov word [rcx], bp
mov qword [rcx + 0x30], rbp
mov qword [rcx + 0x38], 7
mov word [rcx + 0x20], bp
lea r14, [rcx + 0x40]
mov qword [r14 + 0x10], rbp
mov qword [r14 + 0x18], 7
mov word [r14], bp
mov qword [rcx + 0x60], rbp
mov qword [rcx + 0x68], rbp
mov qword [rcx + 0x80], rbp
mov qword [rcx + 0x88], 7
mov word [rcx + 0x70], bp
mov qword [rcx + 0xa0], rbp
mov qword [rcx + 0xa8], 7
mov word [rcx + 0x90], bp
mov qword [rcx + 0xc0], rbp
mov qword [rcx + 0xc8], 7
mov word [rcx + 0xb0], bp
mov qword [rcx + 0xe0], rbp
mov qword [rcx + 0xe8], 7
mov word [rcx + 0xd0], bp
mov qword [rcx + 0x100], rbp
mov qword [rcx + 0x108], 7
mov word [rcx + 0xf0], bp
mov qword [rcx + 0x120], rbp
mov qword [rcx + 0x128], 7
mov word [rcx + 0x110], bp
mov byte [rcx + 0x130], 1
mov rcx, rdx
cmp qword [rdx + 0x18], 8
jb 0x140037f8e
mov rcx, qword [rdx]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x14003808b
cmp rdi, rbx
je 0x140037fba
mov rdx, rbx
cmp qword [rbx + 0x18], 8
jb 0x140037fae
mov rdx, qword [rbx]
mov r8, qword [rbx + 0x10]
mov rcx, rdi
call fcn.140006d60
cmp r14, rsi
je 0x140037fd8
mov rdx, rsi
cmp qword [rsi + 0x18], 8
jb 0x140037fcc
mov rdx, qword [rsi]
mov r8, qword [rsi + 0x10]
mov rcx, r14
call fcn.140006d60
mov rdx, rbx
cmp qword [rbx + 0x18], 8
jb 0x140037fe5
mov rdx, qword [rbx]
lea rcx, [rsp + 0x30]
call fcn.1400296c0
nop
cmp qword [rsp + 0x40], 0
jne 0x140038032
mov rdx, qword [rsp + 0x48]
cmp rdx, 0x10
jb 0x140038078
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140038073
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400380b5
jmp 0x140038073
mov rdx, rbx
lea rcx, [rdi + 0x60]
call fcn.140043330
nop
mov rdx, qword [rsp + 0x48]
cmp rdx, 0x10
jb 0x140038078
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140038073
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400380af
call fcn.14017f5e4
mov byte [rsp + 0x30], 0
mov qword [rsp + 0x48], InitCommonControls
mov qword [rsp + 0x40], rbp
mov rax, rdi
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.14017f700
mov rbx, qword [rsp + 0xa8]
add rsp, 0x60
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
call fcn.1401a10ac
nop
call fcn.1401a10ac
int3