joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140071b90
Capabilities:
Get geographical location

Disassembly:
push rbp
push r12
push r13
push r14
push r15
sub rsp, 0x40
lea rbp, [rsp + 0x30]
mov qword [rbp + 0x40], rbx
mov qword [rbp + 0x48], rsi
mov qword [rbp + 0x50], rdi
mov rax, qword [0x1400a5de0]
xor rax, rbp
mov qword [rbp], rax
mov eax, dword [0x1400adb3c]
mov r15, r9
mov r13d, r8d
test eax, eax
mov r14d, edx
mov rbx, rcx
jne 0x140071c11
lea edx, [rax + 1]
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x140071bf4
mov dword [0x1400adb3c], 1
jmp 0x140071c16
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x78
jne 0x140071c0b
mov dword [0x1400adb3c], 2
jmp 0x140071c3b
mov eax, dword [0x1400adb3c]
cmp eax, 1
jne 0x140071c2e
mov r9d, dword [rbp + 0x60]
mov r8, r15
mov edx, r13d
mov ecx, r14d
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
jmp 0x140071d42
cmp eax, 2
je 0x140071c3b
test eax, eax
jne 0x140071d40
mov esi, dword [rbp + 0x68]
xor edi, edi
test esi, esi
jne 0x140071c4a
mov rax, qword [rbx]
mov esi, dword [rax + 4]
xor r9d, r9d
xor r8d, r8d
mov edx, r13d
mov ecx, r14d
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
test eax, eax
movsxd r12, eax
je 0x140071d40
jle 0x140071d40
xor edx, edx
mov rax, 0xffffffffffffffe0
mov rcx, r12
div r12
cmp rax, 1
jb 0x140071d40
add rcx, 0x10
cmp rcx, 0x400
ja 0x140071cc8
lea rax, [rcx + 0xf]
cmp rax, rcx
ja 0x140071ca6
movabs rax, 0xffffffffffffff0
and rax, 0xfffffffffffffff0
call fcn.14007a110
sub rsp, rax
lea rbx, [rsp + 0x30]
test rbx, rbx
je 0x140071d40
mov dword [rbx], 0xcccc
jmp 0x140071cdb
call fcn.140054c70
test rax, rax
mov rbx, rax
je 0x140071cdf
mov dword [rax], 0xdddd
add rbx, 0x10
test rbx, rbx
je 0x140071d40
mov r9d, r12d
mov r8, rbx
mov edx, r13d
mov ecx, r14d
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
test eax, eax
je 0x140071d2a
mov eax, dword [rbp + 0x60]
or r9d, 0xffffffff
mov r8, rbx
test eax, eax
lea edx, [r9 + 2]
mov ecx, esi
jne 0x140071d19
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rdi
jmp 0x140071d22
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], r15
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov edi, eax
cmp dword [rbx - 0x10], 0xdddd
lea rcx, [rbx - 0x10]
jne 0x140071d3c
call fcn.140054d40
mov eax, edi
jmp 0x140071d42
xor eax, eax
mov rcx, qword [rbp]
xor rcx, rbp
call fcn.1400524a0
mov rbx, qword [rbp + 0x40]
mov rsi, qword [rbp + 0x48]
mov rdi, qword [rbp + 0x50]
lea rsp, [rbp + 0x10]
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
Function at 0x140071ea0
Capabilities:
Get geographical location

Disassembly:
push rbp
push r12
push r13
push r14
push r15
sub rsp, 0x50
lea rbp, [rsp + 0x40]
mov qword [rbp + 0x40], rbx
mov qword [rbp + 0x48], rsi
mov qword [rbp + 0x50], rdi
mov rax, qword [0x1400a5de0]
xor rax, rbp
mov qword [rbp], rax
mov eax, dword [0x1400adb40]
mov r15, r9
mov r13d, r8d
test eax, eax
mov r14d, edx
mov rbx, rcx
jne 0x140071f58
lea edx, [rax + 1]
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x140071f04
mov dword [0x1400adb40], 1
jmp 0x140071f66
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x78
jne 0x140071f52
mov dword [0x1400adb40], 2
mov r9d, dword [rbp + 0x60]
mov r8, r15
mov edx, r13d
mov ecx, r14d
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
mov rcx, qword [rbp]
xor rcx, rbp
call fcn.1400524a0
mov rbx, qword [rbp + 0x40]
mov rsi, qword [rbp + 0x48]
mov rdi, qword [rbp + 0x50]
lea rsp, [rbp + 0x10]
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
mov eax, dword [0x1400adb40]
cmp eax, 2
je 0x140071f19
test eax, eax
je 0x140071f19
cmp eax, 1
jne 0x140071f8e
mov esi, dword [rbp + 0x68]
xor edi, edi
test esi, esi
jne 0x140071f75
mov rax, qword [rbx]
mov esi, dword [rax + 4]
xor r9d, r9d
xor r8d, r8d
mov edx, r13d
mov ecx, r14d
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
movsxd r12, eax
jne 0x140071f92
xor eax, eax
jmp 0x140071f2c
jle 0x140071f8e
xor edx, edx
mov rax, 0xffffffffffffffe0
div r12
cmp rax, 2
jb 0x140071f8e
lea rcx, [r12 + r12 + 0x10]
cmp rcx, 0x400
ja 0x140071fe5
lea rax, [rcx + 0xf]
cmp rax, rcx
ja 0x140071fc7
movabs rax, 0xffffffffffffff0
and rax, 0xfffffffffffffff0
call fcn.14007a110
sub rsp, rax
lea rbx, [rsp + 0x40]
test rbx, rbx
je 0x140071f8e
mov dword [rbx], 0xcccc
jmp 0x140071ff8
call fcn.140054c70
test rax, rax
mov rbx, rax
je 0x140071ffc
mov dword [rax], 0xdddd
add rbx, 0x10
test rbx, rbx
je 0x140071f8e
mov r9d, r12d
mov r8, rbx
mov edx, r13d
mov ecx, r14d
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x14007204f
mov eax, dword [rbp + 0x60]
or r9d, 0xffffffff
xor edx, edx
test eax, eax
mov qword [rsp + 0x38], rdi
mov r8, rbx
mov ecx, esi
mov qword [rsp + 0x30], rdi
jne 0x14007203e
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rdi
jmp 0x140072047
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], r15
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov edi, eax
cmp dword [rbx - 0x10], 0xdddd
lea rcx, [rbx - 0x10]
jne 0x140072061
call fcn.140054d40
mov eax, edi
jmp 0x140071f2c
Function at 0x140073260
Capabilities:
Clear file content

Disassembly:
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r13
sub rsp, 0x20
mov rbp, rdx
xor edi, edi
xor edx, edx
lea r8d, [rdi + 1]
mov esi, ecx
call fcn.14006acf0
cmp rax, 0xffffffffffffffff
mov r13, rax
je 0x140073404
lea r8d, [rdi + 2]
xor edx, edx
mov ecx, esi
call fcn.14006acf0
cmp rax, 0xffffffffffffffff
je 0x140073404
mov qword [rsp + 0x40], rbx
mov rbx, rbp
mov qword [rsp + 0x50], r14
sub rbx, rax
test rbx, rbx
jle 0x140073383
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r14d, 0x1000
lea edx, [rdi + 8]
mov rcx, rax
mov r8, r14
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
test rax, rax
mov rbp, rax
jne 0x140073309
call fcn.140054ec0
mov dword [rax], reloc.OLEAUT32.dll_VariantTimeToDosDateTime
call fcn.140054ec0
mov eax, dword [rax]
mov rbx, qword [rsp + 0x40]
mov r14, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
add rsp, 0x20
pop r13
pop rdi
pop rsi
ret
mov edx, 0x8000
mov ecx, esi
mov qword [rsp + 0x48], r12
call fcn.1400734d0
mov r12d, eax
nop
mov r8d, ebx
cmp rbx, r14
mov rdx, rbp
cmovge r8d, r14d
mov ecx, esi
call fcn.14006aef0
cmp eax, 0xffffffff
je 0x140073345
cdqe
sub rbx, rax
test rbx, rbx
jg 0x140073320
jmp 0x14007335e
call fcn.140054ef0
cmp dword [rax], 5
jne 0x14007335a
call fcn.140054ec0
mov dword [rax], SafeArrayGetDim
or rdi, 0xffffffffffffffff
mov edx, r12d
mov ecx, esi
call fcn.1400734d0
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rbp
mov rcx, rax
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov r12, qword [rsp + 0x48]
jmp 0x1400733dc
test rbx, rbx
jns 0x1400733e6
xor r8d, r8d
mov rdx, rbp
mov ecx, esi
call fcn.14006acf0
cmp rax, 0xffffffffffffffff
je 0x1400732ea
mov ecx, esi
call fcn.14006ffd0
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
neg eax
sbb rdi, rdi
neg rdi
sub rdi, 1
cmp rdi, 0xffffffffffffffff
jne 0x1400733e6
call fcn.140054ec0
mov dword [rax], SafeArrayGetDim
call fcn.140054ef0
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rbx], eax
cmp rdi, 0xffffffffffffffff
je 0x1400732ea
xor r8d, r8d
mov rdx, r13
mov ecx, esi
call fcn.14006acf0
cmp rax, 0xffffffffffffffff
je 0x1400732ea
xor eax, eax
jmp 0x1400732f1
call fcn.140054ec0
mov rbp, qword [rsp + 0x58]
mov eax, dword [rax]
add rsp, 0x20
pop r13
pop rdi
pop rsi
ret
Function at 0x14007982c
Capabilities:
Check os version

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0xd0
mov rax, qword [0x1400a5de0]
xor rax, rsp
mov qword [rsp + 0xc0], rax
xor edx, edx
mov rbx, rcx
lea r8d, [rdx + 0x28]
add rcx, r8
call fcn.140057420
and qword [rbx + 0x50], 0
and dword [rbx + 0x58], 0
and dword [rbx + 0x5c], 0
lea rax, [0x140000000]
mov esi, 0x94
lea rcx, [rsp + 0x20]
mov r8, rsi
xor edx, edx
mov qword [rbx + 0x10], rax
mov qword [rbx + 8], rax
mov dword [rbx], 0x60
mov byte [rbx + 0x18], 0
call fcn.140057420
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x20], esi
call qword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [rsp + 0x30], 2
mov esi, 1
jne 0x1400798bf
cmp dword [rsp + 0x24], 5
jb 0x1400798d9
jmp 0x1400798d5
cmp dword [rsp + 0x30], esi
jne 0x1400798d9
cmp dword [rsp + 0x24], 4
ja 0x1400798d5
jne 0x1400798d9
cmp dword [rsp + 0x28], 0
jbe 0x1400798d9
mov byte [rbx + 0x18], sil
lea rax, [0x1400864e0]
lea rcx, [rbx + 0x28]
mov dword [rbx + 0x1c], 0x800
mov qword [rbx + 0x20], rax
call fcn.1400796ec
movzx ecx, byte [0x1400ae1f0]
test eax, eax
mov rax, rbx
cmovs ecx, esi
mov byte [0x1400ae1f0], cl
mov rcx, qword [rsp + 0xc0]
xor rcx, rsp
call fcn.1400524a0
lea r11, [rsp + 0xd0]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x140070ef0
Capabilities:
Terminate process

Disassembly:
cld
pop r11
jmp 0x140070efd
inc rsi
mov byte [rdi], dl
inc rdi
mov dl, byte [rsi]
add ebx, ebx
jne 0x140070f0d
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jb 0x140070ef5
lea eax, [rcx + 1]
jmp 0x140070f1b
dec eax
call r11
adc eax, eax
call r11
adc eax, eax
add ebx, ebx
jne 0x140070f2e
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jae 0x140070f14
sub eax, 3
jb 0x140070f4e
shl eax, 8
movzx edx, dl
or eax, edx
inc rsi
xor eax, 0xffffffff
je 0x140070f9d
sar eax, 1
movsxd rbp, eax
jb 0x140070f84
jmp 0x140070f5c
add ebx, ebx
jne 0x140070f5a
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x140070f84
inc ecx
add ebx, ebx
jne 0x140070f6a
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x140070f84
call r11
adc ecx, ecx
add ebx, ebx
jne 0x140070f7d
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jae 0x140070f6c
add ecx, 2
jmp 0x140070f89
call r11
adc ecx, ecx
cmp rbp, 0xfffffffffffffb00
adc ecx, 2
call fcn.140070eb2
jmp 0x140070efd
pop rsi
mov rdi, rsi
push rsi
mov rdi, rsi
mov rsi, 0x28800
mov dl, 0x11
push rbx
push rdi
lea rcx, [rdi + rsi - 3]
pop rsi
push rsi
pop rbx
jmp 0x140070fe9
cmp rsi, rcx
jae 0x140070ff1
push rsi
pop rsi
lodsb al, byte [rsi]
cmp al, 0x80
jb 0x140070fd0
cmp al, 0x8f
ja 0x140070fd0
cmp byte [rsi - 2], 0xf
je 0x140070fd6
sub al, 0xe8
cmp al, 1
ja 0x140070fba
cmp rsi, rcx
jae 0x140070ff1
push rsi
lodsd eax, dword [rsi]
sub al, dl
jne 0x140070fc0
pop rdi
bswap eax
sub eax, edi
add eax, ebx
stosd dword [rdi], eax
cmp rsi, rcx
jae 0x140070ff1
lodsb al, byte [rsi]
jmp 0x140070fd0
pop rbx
pop rsi
sub rsp, 0x28
lea rdi, [rsi + 0x6e000]
mov eax, dword [rdi]
or eax, eax
je 0x14007105a
mov ebx, dword [rdi + 4]
lea rcx, [rax + rsi + 0x8c9c0]
add rbx, rsi
add rdi, 8
call qword [sym.imp.KERNEL32.DLL_LoadLibraryA]
xchg rbp, rax
mov al, byte [rdi]
inc rdi
or al, al
je 0x140070ffe
jns 0x140071033
movzx rdx, word [rdi]
add rdi, 2
jmp 0x14007103d
mov rcx, rdi
mov rdx, rdi
dec eax
repne scasb al, byte [rdi]
mov rcx, rbp
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
or rax, rax
je 0x140071054
mov qword [rbx], rax
add rbx, 8
jmp 0x14007101e
jmp qword [sym.imp.KERNEL32.DLL_ExitProcess]
add rsp, 0x28
add rdi, 4
lea rbx, [rsi - 4]
xor eax, eax
mov al, byte [rdi]
inc rdi
or eax, eax
je 0x140071094
cmp al, 0xef
ja 0x140071086
add rbx, rax
mov rax, qword [rbx]
bswap rax
add rax, rsi
mov qword [rbx], rax
jmp 0x140071066
and al, 0xf
shl eax, 0x10
mov ax, word [rdi]
add rdi, 2
jmp 0x140071075
mov rbp, qword [sym.imp.KERNEL32.DLL_VirtualProtect]
lea rdi, [rsi - 0x1000]
mov ebx, 0x1000
push rax
mov r9, rsp
mov r8d, 4
mov rdx, rbx
mov rcx, rdi
sub rsp, 0x20
call rbp
lea rax, [rdi + 0x227]
and byte [rax], 0x7f
and byte [rax + 0x28], 0x7f
lea r9, [rsp + 0x20]
mov r8, qword [r9]
mov rdx, rbx
mov rcx, rdi
call rbp
add rsp, 0x28
pop rbp
pop rdi
pop rsi
pop rbx
lea rax, [rsp - 0x80]
push 0
cmp rsp, rax
jne 0x1400710e8
sub rsp, 0xffffffffffffff80
jmp 0x14000b310
Function at 0x140004770
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x60
xor r12d, r12d
lea r15, [0x14014b398]
mov esi, r12d
lea r14, [0x14014a1a0]
cmp byte [r15], r12b
je 0x140004844
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], reloc.WSOCK32.dll_gethostbyname
mov ecx, esi
mov dword [rsp + 0x24], 0x80
call qword [sym.imp.WINMM.dll_joyGetPosEx]
test eax, eax
jne 0x140004844
mov eax, dword [rsp + 0x40]
mov ebp, eax
xor ebp, dword [r14]
mov dword [r14], eax
and ebp, eax
je 0x140004844
movzx edx, word [0x14014b3c8]
mov ebx, r12d
cmp r12w, dx
jae 0x140004844
mov rdi, r12
nop
mov rax, qword [0x14014b3b8]
mov rax, qword [rdi + rax]
cmp byte [rax + 0x12], 4
jne 0x140004837
movzx ecx, byte [rax + 0x10]
cmp ecx, esi
jne 0x140004837
movzx ecx, word [rax + 8]
sub ecx, 0xc
movzx eax, cl
bt ebp, eax
jae 0x140004837
mov rcx, qword [0x14014a3e0]
xor r9d, r9d
movsxd r8, ebx
mov edx, 0x312
call qword [sym.imp.USER32.dll_PostMessageW]
movzx edx, word [0x14014b3c8]
inc ebx
movzx eax, dx
add rdi, 8
cmp ebx, eax
jl 0x1400047f0
inc esi
inc r15
add r14, 4
cmp esi, 0x10
jl 0x1400047a2
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop r12
ret
Function at 0x1400066c0
Capabilities:
Write clipboard data

Disassembly:
push rbx
sub rsp, 0x20
cmp dword [rcx + 0x2c], 0
mov rbx, rcx
jne 0x1400066ec
call fcn.1400069e0
test eax, eax
jne 0x1400066ec
lea rdx, str.Cant_open_clipboard_for_writing.
mov rcx, rbx
add rsp, 0x20
pop rbx
jmp 0x140006810
mov qword [rsp + 0x38], rdi
call qword [sym.imp.USER32.dll_EmptyClipboard]
test eax, eax
jne 0x14000673a
cmp dword [rbx + 0x2c], eax
je 0x140006721
xor edi, edi
cmp qword [rbx + 0x10], rdi
je 0x140006715
mov rcx, qword [rbx]
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov qword [rbx + 0x10], rdi
call qword [sym.imp.USER32.dll_CloseClipboard]
mov dword [rbx + 0x2c], edi
mov qword [rbx], rdi
lea rdx, [0x14010d858]
mov rcx, rbx
mov rdi, qword [rsp + 0x38]
add rsp, 0x20
pop rbx
jmp 0x140006810
mov rdx, qword [rbx + 8]
xor edi, edi
test rdx, rdx
je 0x140006788
mov rax, qword [rbx + 0x18]
mov qword [rsp + 0x30], rsi
xor sil, sil
test rax, rax
je 0x140006771
cmp word [rax], di
mov rcx, rdx
sete sil
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov rdx, qword [rbx + 8]
mov qword [rbx + 0x18], rdi
mov dword [rbx + 0x28], edi
test sil, sil
mov rsi, qword [rsp + 0x30]
je 0x1400067bc
mov rcx, rdx
call qword [sym.imp.KERNEL32.dll_GlobalFree]
mov qword [rbx + 8], rax
cmp dword [rbx + 0x2c], edi
je 0x1400067ac
cmp qword [rbx + 0x10], rdi
je 0x1400067a0
mov rcx, qword [rbx]
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov qword [rbx + 0x10], rdi
call qword [sym.imp.USER32.dll_CloseClipboard]
mov dword [rbx + 0x2c], edi
mov qword [rbx], rdi
mov rdi, qword [rsp + 0x38]
mov eax, 1
add rsp, 0x20
pop rbx
ret
mov ecx, SafeArrayGetDim
call qword [sym.imp.USER32.dll_SetClipboardData]
test rax, rax
je 0x1400067d2
mov qword [rbx + 8], rdi
jmp 0x140006788
cmp dword [rbx + 0x2c], edi
je 0x1400067f6
cmp qword [rbx + 0x10], rdi
je 0x1400067ea
mov rcx, qword [rbx]
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov qword [rbx + 0x10], rdi
call qword [sym.imp.USER32.dll_CloseClipboard]
mov dword [rbx + 0x2c], edi
mov qword [rbx], rdi
lea rdx, [0x14010d878]
mov rcx, rbx
mov rdi, qword [rsp + 0x38]
add rsp, 0x20
pop rbx
jmp 0x140006810
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
xor esi, esi
mov rdi, rdx
mov rbx, rcx
cmp dword [rcx + 0x2c], esi
je 0x14000684b
cmp qword [rcx + 0x10], rsi
je 0x14000683f
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov qword [rbx + 0x10], rsi
call qword [sym.imp.USER32.dll_CloseClipboard]
mov dword [rbx + 0x2c], esi
mov qword [rbx], rsi
cmp qword [rbx + 0x18], rsi
je 0x140006862
mov rcx, qword [rbx + 8]
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov qword [rbx + 0x18], rsi
mov dword [rbx + 0x28], esi
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x140006875
call qword [sym.imp.KERNEL32.dll_GlobalFree]
mov qword [rbx + 8], rax
cmp word [rdi], si
je 0x14000689f
lea r8, [0x14010d28c]
mov rdx, rdi
lea rcx, [0x14014d8e0]
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp fcn.1400508c0
mov rbx, qword [rsp + 0x30]
mov eax, esi
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x1400068c0
Capabilities:
Read clipboard data

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x230
xor ecx, ecx
mov rbx, r8
mov edi, edx
test r8, r8
je 0x1400068dc
mov dword [r8], ecx
lea eax, [rdx - 0xc000]
cmp eax, 0x3fff
ja 0x1400069bb
mov r8d, 0x104
lea rdx, [rsp + 0x20]
mov ecx, edi
call qword [sym.imp.USER32.dll_GetClipboardFormatNameW]
mov r8d, reloc.WSOCK32.dll_inet_ntoa
lea rdx, str.Link_Source
lea rcx, [rsp + 0x20]
call fcn.1400e5e84
test eax, eax
je 0x1400069a8
lea rdx, str.ObjectLink
lea rcx, [rsp + 0x20]
call fcn.1400e5cc0
test eax, eax
je 0x1400069a8
lea rdx, str.OwnerLink
lea rcx, [rsp + 0x20]
call fcn.1400e5cc0
test eax, eax
je 0x1400069a8
lea rdx, str.Native
lea rcx, [rsp + 0x20]
call fcn.1400e5cc0
test eax, eax
je 0x1400069a8
lea rdx, str.Embed_Source
lea rcx, [rsp + 0x20]
call fcn.1400e5cc0
test eax, eax
je 0x1400069a8
lea rdx, str.MSDEVColumnSelect
lea rcx, [rsp + 0x20]
call fcn.1400e5cc0
test eax, eax
je 0x14000699d
lea rdx, str.MSDEVLineSelect
lea rcx, [rsp + 0x20]
call fcn.1400e5cc0
test eax, eax
jne 0x1400069c0
test rbx, rbx
je 0x1400069a8
mov dword [rbx], 1
xor eax, eax
mov rbx, qword [rsp + 0x240]
add rsp, 0x230
pop rdi
ret
mov word [rsp + 0x20], cx
mov ecx, edi
call qword [sym.imp.USER32.dll_GetClipboardData]
mov rbx, qword [rsp + 0x240]
add rsp, 0x230
pop rdi
ret

Function at 0x1400069e0
Capabilities:
Check for time delay via gettickcount
Open clipboard

Disassembly:
push rbx
sub rsp, 0x20
cmp dword [rcx + 0x2c], 0
mov rbx, rcx
je 0x1400069fa
mov eax, 1
add rsp, 0x20
pop rbx
ret
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x38], rdi
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov rcx, qword [0x14014a3e0]
mov edi, eax
call qword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
jne 0x140006a74
xor esi, esi
nop
mov ecx, dword [0x140145a90]
cmp ecx, 0xffffffff
je 0x140006a44
test ecx, ecx
je 0x140006a90
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov edx, dword [0x140145a90]
add edx, edi
sub edx, eax
cmp edx, 5
jle 0x140006a90
mov edx, 1
mov dword [0x140145a74], esi
mov ecx, 0x8000012f
call fcn.1400018c0
mov rcx, qword [0x14014a3e0]
mov dword [0x140145a74], 1
call qword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x140006a20
mov rsi, qword [rsp + 0x30]
mov eax, 1
mov rdi, qword [rsp + 0x38]
mov dword [rbx + 0x2c], 1
add rsp, 0x20
pop rbx
ret
mov rsi, qword [rsp + 0x30]
xor eax, eax
mov rdi, qword [rsp + 0x38]
add rsp, 0x20
pop rbx
ret
Function at 0x1400070a0
Capabilities:
Resume thread
Suspend thread

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
sub rsp, 0x30
cmp byte [0x14014e4c0], 0
mov rbp, rdx
mov rdi, rcx
je 0x14000717a
mov esi, dword gs:[0x48]
cmp dword [0x14014c878], esi
je 0x1400070dc
mov rcx, qword [0x14014d8c0]
call qword [sym.imp.KERNEL32.dll_SuspendThread]
mov rbx, 0xffffffffffffffff
inc rbx
cmp word [rdi + rbx*2], 0
jne 0x1400070e3
cmp word [rdi], 0
je 0x140007189
lea rax, [rsp + 0x60]
mov r8, rbx
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x68]
mov rdx, rdi
mov dword [rsp + 0x20], 3
lea rcx, [0x14014d8e0]
call fcn.14003df30
test rax, rax
jne 0x14000714e
cmp byte [rsp + 0x60], al
lea rcx, [0x14014d8e0]
mov r9d, dword [rsp + 0x68]
mov r8, rbx
setne al
mov rdx, rdi
inc eax
mov dword [rsp + 0x20], eax
call fcn.14003e460
test rax, rax
je 0x140007189
xor r9d, r9d
mov byte [rsp + 0x20], 1
mov rdx, rbp
mov rcx, rax
lea r8, [r9 - 1]
call fcn.1400c6a70
cmp dword [0x14014c878], esi
je 0x14000717a
mov rcx, qword [0x14014d8c0]
call qword [sym.imp.KERNEL32.dll_ResumeThread]
xor eax, eax
mov rbx, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
pop rsi
pop rbp
ret
cmp dword [0x14014c878], esi
je 0x14000719e
mov rcx, qword [0x14014d8c0]
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov rbx, qword [rsp + 0x50]
mov eax, 0xffffffff
add rsp, 0x30
pop rdi
pop rsi
pop rbp
ret
Function at 0x14000f670
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov qword [rsp + 0x10], rbx
push rsi
mov eax, 0x1040
call fcn.1400fe470
sub rsp, rax
cmp byte [0x14014fed4], 0
mov rbx, rdx
mov rsi, rcx
jne 0x14000f854
cmp dword [0x14014b3d0], 0
jne 0x14000f6ab
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x14014b3d0], eax
inc dword [0x14014fed0]
mov qword [rsp + 0x1050], rdi
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov r9d, dword [0x14014fed0]
mov ecx, eax
sub ecx, dword [0x14014b3d0]
cmp r9d, dword [0x1401474b4]
mov edx, dword [0x1401474b0]
mov dword [0x14014b3cc], eax
jbe 0x14000f7ca
cmp ecx, edx
jae 0x14000f7ca
mov dword [rsp + 0x20], ecx
lea r8, str._u_hotkeys_have_been_received_in_the_last__ums._n_nDo_you_want_to_continue__n_see_MaxHotkeysPerInterval_in_the_help_file_
lea rcx, [rsp + 0x40]
mov edx, 0x800
call fcn.1400c16a0
movzx r9d, word [0x14014b3c8]
xor edi, edi
mov r8d, edi
cmp di, r9w
jae 0x14000f765
mov edx, edi
nop
mov rax, qword [0x14014b3b8]
mov rcx, qword [rdx + rax]
mov rax, qword [rcx + 0x28]
test rax, rax
je 0x14000f755
nop dword [rax]
nop dword [rax + rax]
mov byte [rax + 0x27], dil
mov rax, qword [rax + 0x10]
test rax, rax
jne 0x14000f740
movzx r9d, word [0x14014b3c8]
inc r8d
movzx eax, r9w
add rdx, 8
cmp r8d, eax
jl 0x14000f720
xor r8d, r8d
mov byte [0x14014fed4], 1
xorps xmm3, xmm3
mov dword [0x140145a74], edi
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x20], rdi
lea edx, [r8 + 4]
call fcn.1400c8ff0
cmp eax, 7
jne 0x14000f7a2
xor r8d, r8d
lea edx, [rax - 3]
lea rcx, [0x14014d8e0]
call fcn.14002c770
mov eax, dword [0x14014b3cc]
mov dword [0x14014b3d0], eax
mov dword [0x140145a74], 1
mov byte [0x14014fed4], dil
mov dword [0x14014fed0], edi
jmp 0x14000f84c
xor edi, edi
cmp ecx, edx
jbe 0x14000f7dc
mov dword [0x14014fed0], edi
mov dword [0x14014b3d0], eax
movzx eax, byte [rsi + 0xf]
lea r8, [0x14010d310]
mov byte [0x14014e48e], al
xor r9d, r9d
inc byte [rbx + 0x22]
mov rcx, qword [rbx]
mov dword [rsp + 0x30], edi
mov rdx, rcx
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], edi
call fcn.1400aded0
dec byte [rbx + 0x22]
test eax, eax
jne 0x14000f818
mov byte [rbx + 0x27], dil
jmp 0x14000f84c
cmp byte [rbx + 0x27], dil
je 0x14000f84c
mov byte [rbx + 0x27], dil
call qword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [rbx + 0x18]
cmp eax, 0x3e8
ja 0x14000f84c
movzx r8d, word [rsi + 4]
xor r9d, r9d
mov rcx, qword [0x14014a3e0]
mov edx, 0x312
call qword [sym.imp.USER32.dll_PostMessageW]
mov rdi, qword [rsp + 0x1050]
mov rbx, qword [rsp + 0x1058]
add rsp, 0x1040
pop rsi
ret
Function at 0x140011360
Capabilities:
Check for time delay via gettickcount
Create thread

Disassembly:
movzx r8d, byte [0x14014b24d]
or r8b, 2
cmp qword [0x14014a408], 0
mov byte [0x14014b24d], r8b
jne 0x140011398
movzx edx, word [0x14014b3c8]
movzx r9d, byte [0x14014b24e]
mov rcx, qword [0x14014b3b8]
jmp fcn.14000c530
ret