joyce8/EMBER2024-capa huggingface dataset:
Function at 0x2bbeffdf0
Capabilities:
Log keystrokes via polling

Disassembly:
push rsi
push rbx
sub rsp, 0x78
mov eax, dword [rdx]
mov rbx, rdx
cmp eax, 1
je 0x2bbeffe58
cmp eax, 2
jne 0x2bbeffee2
mov rcx, qword [rdx + 8]
test rcx, rcx
je 0x2bbeffee2
lea rdx, [rsp + 0x40]
call qword [sym.imp.USER32.dll_GetClientRect]
mov rsi, qword [rsp + 0xb8]
mov eax, dword [rsp + 0x48]
sub eax, dword [rsp + 0x40]
mov dword [rsi], eax
mov rsi, qword [rsp + 0xc0]
mov eax, dword [rsp + 0x4c]
sub eax, dword [rsp + 0x44]
mov dword [rsi], eax
mov eax, 1
add rsp, 0x78
pop rbx
pop rsi
ret
cmp qword [rdx + 8], 0
je 0x2bbeffef6
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetDC]
mov rdx, qword [rbx + 8]
xor r9d, r9d
xor r8d, r8d
mov rsi, rax
xor eax, eax
mov dword [rsp + 0x40], 0x28
mov word [rsp + 0x4e], ax
lea rax, [rsp + 0x40]
mov rcx, rsi
mov dword [rsp + 0x30], 0
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 0
call qword [sym.imp.GDI32.dll_GetDIBits]
test eax, eax
je 0x2bbefff0a
mov rdx, rsi
xor ecx, ecx
call qword [sym.imp.USER32.dll_ReleaseDC]
mov eax, dword [rsp + 0x44]
mov rbx, qword [rsp + 0xb8]
mov rsi, qword [rsp + 0xc0]
mov dword [rbx], eax
mov eax, dword [rsp + 0x48]
mov dword [rsi], eax
mov eax, 1
add rsp, 0x78
pop rbx
pop rsi
ret
mov rax, qword [0x2bc041fd0]
lea rcx, str.XGetGeometry:_invalid_window
mov rax, qword [rax]
call qword [rax + 0x20]
mov rax, qword [0x2bc041fd0]
lea rcx, str.XGetGeometry:_invalid_pixmap
mov rax, qword [rax]
call qword [rax + 0x20]
mov rax, qword [0x2bc041fd0]
lea rcx, str.XGetGeometry:_unable_to_get_bitmap_size
mov rax, qword [rax]
call qword [rax + 0x20]
nop
nop

Function at 0x2bbefff20
Capabilities:
Log keystrokes via polling

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
mov rsi, qword [sym.imp.USER32.dll_GetKeyState]
mov ecx, 0x10
call rsi
mov ecx, 0x11
movsx ebx, ax
call rsi
shr ebx, 0x1f
mov ecx, 0x12
mov ebp, ebx
or ebp, 4
test ax, ax
cmovns ebp, ebx
call rsi
mov ecx, 0x14
mov edx, eax
mov eax, ebp
or eax, 0x20000
test dx, dx
cmovs ebp, eax
call rsi
mov ecx, 0x90
mov ebx, eax
call rsi
and ebx, 1
mov ecx, 0x91
mov edi, eax
add ebx, ebx
call rsi
and edi, 1
mov ecx, 1
shl edi, 3
or edi, ebx
mov ebx, eax
call rsi
and ebx, 1
or edi, ebp
mov ecx, 4
shl ebx, 5
mov edx, eax
or ebx, edi
mov eax, ebx
or ah, 1
test dx, dx
cmovs ebx, eax
call rsi
mov ecx, 2
mov edx, eax
mov eax, ebx
or ah, 2
test dx, dx
cmovs ebx, eax
call rsi
mov ecx, 5
mov edx, eax
mov eax, ebx
or ah, 4
test dx, dx
cmovs ebx, eax
call rsi
mov ecx, 6
mov edx, eax
mov eax, ebx
or ah, 8
test dx, dx
cmovs ebx, eax
call rsi
mov edx, eax
mov eax, ebx
or ah, 0x10
test dx, dx
cmovs ebx, eax
mov eax, ebx
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
ret
Function at 0x2bbf05420
Capabilities:
Log keystrokes via input method manager

Disassembly:
push rsi
push rbx
sub rsp, 0x28
lea eax, [rdx - 0x46]
mov rbx, r9
cmp eax, 1
jbe 0x2bbf05440
add rsp, 0x28
pop rbx
pop rsi
jmp sym.tcl9tk90.dll_TkWinChildProc
mov rcx, qword [r9]
call sym.tcl9tk90.dll_Tk_HWNDToWindow
mov rsi, rax
test rax, rax
je 0x2bbf0547b
mov eax, dword [rbx + 0x20]
test al, 1
jne 0x2bbf0545f
mov rdx, qword [rbx + 0x18]
mov qword [rsi + 0x78], rdx
test al, 2
je 0x2bbf05488
mov rcx, rsi
call sym.GenerateConfigureNotify
mov rax, qword [0x2bc041fd0]
mov rax, qword [rax]
call qword [rax + 0x6f8]
xor eax, eax
add rsp, 0x28
pop rbx
pop rsi
ret
mov rax, qword [rsi + 0x148]
mov edx, 0x404
mov r9, 0xffffffffffffffff
mov r8, 0xffffffffffffffff
mov rcx, qword [rax + 8]
call qword [sym.imp.USER32.dll_SendMessageW]
mov rdx, qword [rsi + 0x148]
mov ecx, eax
movzx eax, ax
sar ecx, 0x10
mov dword [rsi + 0x70], ecx
mov dword [rdx + 0xd4], ecx
mov dword [rsi + 0x74], eax
mov dword [rdx + 0xd8], eax
jmp 0x2bbf05463
Function at 0x2bbf05de0
Capabilities:
Get graphical window text

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x308
mov r12, qword [rcx + 0x148]
mov rbx, rcx
mov rbp, rdx
mov rsi, r8
mov rdi, r9
cmp r8, 4
jg 0x2bbf05fb0
mov r13, qword [r12 + 8]
test byte [rcx + 0xf5], 1
jne 0x2bbf05f80
cmp rsi, 3
je 0x2bbf05ef0
mov rcx, qword [r12 + 0x10]
mov rbx, qword [0x2bc041fd0]
test rcx, rcx
je 0x2bbf05e3f
mov rax, qword [rbx]
call qword [rax + 0x30]
mov rax, qword [rbx]
lea rdx, [rsp + 0x20]
mov rcx, qword [rdi + 0x18]
call qword [rax + 0x1468]
mov rsi, rax
mov rax, qword [rsp + 0x20]
lea rcx, [rax + 1]
mov rax, qword [rbx]
call qword [rax + 0x28]
mov r8, qword [rsp + 0x20]
mov rdx, rsi
mov qword [r12 + 0x10], rax
mov rcx, rax
add r8, 1
call sym.memcpy
test byte [r12 + 0x158], 1
jne 0x2bbf05ed8
cmp qword [r12 + 8], 0
je 0x2bbf05ed8
mov rax, qword [rbx]
lea rsi, [rsp + 0x100]
mov rcx, rsi
call qword [rax + 0x3e0]
mov rax, qword [rbx]
mov r8, rsi
mov rcx, qword [r12 + 0x10]
mov rdx, 0xffffffffffffffff
call qword [rax + 0xb28]
mov rcx, r13
mov rdx, qword [rsp + 0x100]
call qword [sym.imp.USER32.dll_SetWindowTextW]
mov rax, qword [rbx]
mov rcx, rsi
call qword [rax + 0x3d0]
xor eax, eax
add rsp, 0x308
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
test r13, r13
je 0x2bbf05ff0
lea rdi, [rsp + 0x100]
mov r8d, 0x100
mov rcx, r13
mov rdx, rdi
lea rsi, [rsp + 0x20]
call qword [sym.imp.USER32.dll_GetWindowTextW]
mov rbx, qword [0x2bc041fd0]
mov rcx, rsi
mov rax, qword [rbx]
call qword [rax + 0x3e0]
mov rax, qword [rbx]
mov rcx, rdi
mov r12, qword [rax + 0xb20]
call sym.wcslen
mov r8, rsi
mov rcx, rdi
mov rdx, rax
call r12
mov rax, qword [rbx]
mov rdx, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x20]
mov rdi, qword [rax + 0x768]
call qword [rax + 0x1d0]
mov rcx, rbp
mov rdx, rax
call rdi
mov rax, qword [rbx]
mov rcx, rsi
call qword [rax + 0x3d0]
xor eax, eax
jmp 0x2bbf05eda
mov rcx, r13
xor r9d, r9d
xor r8d, r8d
mov edx, 0x409
call qword [sym.imp.USER32.dll_SendMessageW]
mov r13, rax
cmp rsi, 3
jne 0x2bbf05e28
jmp 0x2bbf05ef0
mov rax, qword [0x2bc041fd0]
mov r8, rdi
mov edx, 2
mov rcx, rbp
lea r9, str.window__newTitle_
mov rax, qword [rax]
call qword [rax + 0x850]
mov eax, 1
add rsp, 0x308
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
mov rax, qword [0x2bc041fd0]
mov rcx, qword [r12 + 0x10]
mov rax, qword [rax]
mov rsi, qword [rax + 0x768]
mov rax, qword [rax + 0x1d0]
test rcx, rcx
je 0x2bbf06030
mov rdx, 0xffffffffffffffff
call rax
mov rcx, rbp
mov rdx, rax
call rsi
xor eax, eax
jmp 0x2bbf05eda
mov rcx, qword [rbx + 0x60]
jmp 0x2bbf06012
Function at 0x2bbf0a220
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push rbx
sub rsp, 0x20
mov rax, qword [rcx + 0x148]
mov rbx, rcx
test byte [rcx + 0xf4], 2
je 0x2bbf0a2a6
mov ecx, dword [rax + 0x158]
mov dword [rax + 0xd4], edx
mov dword [rax + 0xd8], r8d
mov edx, ecx
and edx, 0xfffffff3
or dl, 0x80
mov dword [rax + 0x158], edx
mov edx, dword [rax + 0x88]
test dl, 5
jne 0x2bbf0a26d
or edx, 1
mov dword [rax + 0x88], edx
test cl, 1
jne 0x2bbf0a2a0
and ecx, 2
je 0x2bbf0a291
mov rax, qword [0x2bc041fd0]
mov rdx, rbx
lea rcx, [sym.UpdateGeometryInfo]
mov rax, qword [rax]
call qword [rax + 0x290]
mov rcx, rbx
add rsp, 0x20
pop rbx
jmp sym.UpdateGeometryInfo
add rsp, 0x20
pop rbx
ret
mov rax, qword [0x2bc041fd0]
lea rcx, str.Tk_MoveToplevelWindow_called_with_non_toplevel_window
mov rax, qword [rax]
call qword [rax + 0x20]
nop
nop dword [rax + rax]

Function at 0x2bbf0b1d0
Capabilities:
Enumerate gui resources

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0xc0
mov rdi, qword [0x2bc041fd0]
mov edx, 1
mov rax, qword [rdi]
mov rbx, rcx
lea rsi, [rsp + 0x50]
mov rcx, rsi
call qword [rax + 0x5b8]
mov rdx, qword [rbx]
mov rcx, rbx
mov r8, rsi
call sym.TkWmStackorderToplevelWrapperMap
mov rax, qword [rsp + 0x80]
lea rcx, [rax*8 + 8]
mov rax, qword [rdi]
call qword [rax + 0x28]
mov rbx, rax
mov rax, qword [rsp + 0x80]
test rax, rax
je 0x2bbf0b2b8
cmp rax, 1
jne 0x2bbf0b278
mov rax, qword [rdi]
lea rdx, [rsp + 0x30]
mov rcx, rsi
call qword [rax + 0x498]
mov rax, qword [rax + 0x18]
mov qword [rbx + 8], 0
mov qword [rbx], rax
mov rax, qword [rdi]
mov rcx, rsi
call qword [rax + 0x378]
mov rax, rbx
add rsp, 0xc0
pop rbx
pop rsi
pop rdi
ret
lea rax, [rbx + rax*8]
mov qword [rsp + 0x20], rsi
lea rcx, [sym.TkWmStackorderToplevelEnumProc]
lea rdx, [rax - 8]
mov qword [rsp + 0x28], rdx
lea rdx, [rsp + 0x20]
mov qword [rax], 0
call qword [sym.imp.USER32.dll_EnumWindows]
test eax, eax
jne 0x2bbf0b258
mov rax, qword [rdi]
mov rcx, rbx
xor ebx, ebx
call qword [rax + 0x30]
jmp 0x2bbf0b258
mov qword [rbx], 0
jmp 0x2bbf0b258
Function at 0x2bbf0e4e0
Capabilities:
Check os version
Get geographical location
Get keyboard layout
Query or enumerate registry value

Disassembly:
push rbx
sub rsp, 0x50
mov eax, dword [0x2bc0634c8]
mov rbx, rcx
test eax, eax
je 0x2bbf0e500
add rsp, 0x50
pop rbx
ret
mov rax, qword [0x2bbffbab8]
lea rcx, [rsp + 0x28]
mov dword [0x2bc0634c8], 1
mov qword [rsp + 0x28], rax
call qword [sym.imp.COMCTL32.dll_InitCommonControlsEx]
test eax, eax
je 0x2bbf0e618
lea rax, str.TkChild
mov qword [0x2bc063498], rbx
lea rcx, [0x2bc063480]
mov qword [0x2bc0634c0], rax
lea rax, [sym.tcl9tk90.dll_TkWinChildProc]
mov dword [0x2bc063480], 3
mov qword [0x2bc063490], 0
mov qword [0x2bc0634b0], 0
mov qword [0x2bc0634b8], 0
mov qword [0x2bc063488], rax
mov qword [0x2bc0634a0], 0
mov qword [0x2bc0634a8], 0
call qword [sym.imp.USER32.dll_RegisterClassW]
test ax, ax
je 0x2bbf0e604
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetKeyboardLayout]
mov r9d, 2
lea r8, [rsp + 0x24]
mov edx, 0x20001004
movzx ecx, ax
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
jne 0x2bbf0e5e0
mov rdx, rbx
lea rcx, [sym.tcl9tk90.dll_TkWinXCleanup]
call sym.TkCreateExitHandler
nop
add rsp, 0x50
pop rbx
ret
mov ecx, dword [rsp + 0x24]
lea rdx, [rsp + 0x30]
mov r8d, 2
call qword [sym.imp.GDI32.dll_TranslateCharsetInfo]
test eax, eax
je 0x2bbf0e5c4
mov ecx, dword [rsp + 0x30]
call sym.UpdateInputLanguage
jmp 0x2bbf0e5c4
mov rax, qword [0x2bc041fd0]
lea rcx, str.Unable_to_register_TkChild_class
mov rax, qword [rax]
call qword [rax + 0x20]
mov rax, qword [0x2bc041fd0]
lea rcx, str.Unable_to_load_common_controls__
mov rax, qword [rax]
call qword [rax + 0x20]
nop
nop dword [rax]
Function at 0x2bbf0e630
Capabilities:
Check os version
Query or enumerate registry value

Disassembly:
push rdi
push rbx
sub rsp, 0x2f8
mov eax, dword [0x2bc063478]
test eax, eax
je 0x2bbf0e650
add rsp, 0x2f8
pop rbx
pop rdi
ret
mov dword [rsp + 0x40], 0x114
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [rsp + 0x50], 2
jne 0x2bbf0e75c
cmp dword [rsp + 0x44], 5
je 0x2bbf0e690
jbe 0x2bbf0e698
mov dword [0x2bc063478], 3
mov eax, 3
add rsp, 0x2f8
pop rbx
pop rdi
ret
mov eax, dword [rsp + 0x48]
test eax, eax
jne 0x2bbf0e6b8
mov dword [0x2bc063478], 1
mov eax, 1
add rsp, 0x2f8
pop rbx
pop rdi
ret
xor eax, eax
mov ecx, 0x19
xor r8d, r8d
mov r9d, 0x20019
lea rbx, [rsp + 0x160]
mov dword [rsp + 0x34], 0xc8
lea rdx, str.Control_PanelAppearance
mov rdi, rbx
rep stosq qword [rdi], rax
lea rax, [rsp + 0x38]
mov rcx, 0xffffffff80000001
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x2bbf0e710
mov eax, 2
mov dword [0x2bc063478], eax
jmp 0x2bbf0e643
lea rax, [rsp + 0x34]
xor r9d, r9d
xor r8d, r8d
mov rcx, qword [rsp + 0x38]
lea rdx, str.Current
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rdx, str.Windows_Standard
mov rcx, rbx
call sym.wcscmp
test eax, eax
jne 0x2bbf0e700
mov eax, 1
jmp 0x2bbf0e705
mov rax, qword [0x2bc041fd0]
lea rcx, str.Windows_NT_is_the_only_supported_platform
mov rax, qword [rax]
call qword [rax + 0x20]
nop
nop word cs:[rax + rax]
nop dword [rax]
Function at 0x2bbf0faa0
Capabilities:
Open clipboard

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, qword [rsp + 0x50]
mov qword [rbx], 0
cmp edx, 0x120
ja 0x2bbf0fb20
cmp edx, 0xff
jbe 0x2bbf0fbb0
lea eax, [rdx - 0x100]
cmp eax, 0x20
ja case.0x2bbf0fade.259
lea r10, [0x2bbffba2c]
movsxd rax, dword [r10 + rax*4]
add rax, r10
jmp rax
cmp edx, 0x307
je case.0x2bbf0fade.257
nop dword [rax + rax]
xor eax, eax
add rsp, 0x20
pop rbx
ret
cmp r8, 0xe7
je 0x2bbf0fc70
call sym.GenerateXEvent
mov eax, 1
add rsp, 0x20
pop rbx
ret
cmp edx, 0x305
je 0x2bbf0fc00
ja 0x2bbf0fb60
cmp edx, 0x20d
ja 0x2bbf0fc98
cmp edx, 0x20a
ja 0x2bbf0fb4c
je case.0x2bbf0fade.257
cmp edx, 0x1ff
jbe case.0x2bbf0fade.259
mov r8d, r9d
movsx edx, r9w
sar r8d, 0x10
call sym.TkWinPointerEvent
jmp 0x2bbf0fb12
cmp edx, 0x306
jne 0x2bbf0fae0
mov qword [rsp + 0x30], rcx
call sym.tcl9tk90.dll_Tk_HWNDToWindow
mov rbx, rax
test rax, rax
je 0x2bbf0fb12
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x2bbf0fb12
call qword [sym.imp.USER32.dll_GetClipboardOwner]
mov rcx, qword [rsp + 0x30]
cmp rcx, rax
je 0x2bbf0fca9
call qword [sym.imp.USER32.dll_CloseClipboard]
jmp 0x2bbf0fb12
cmp edx, 0x4e
je 0x2bbf0fc90
mov eax, 0
ja 0x2bbf0faf2
cmp edx, 8
ja 0x2bbf0fc60
cmp edx, 6
ja case.0x2bbf0fade.257
jmp 0x2bbf0faf2
mov edx, 0x120
call sym.GenerateXEvent
mov qword [rbx], 0x10000
jmp 0x2bbf0fb12
mov qword [rsp + 0x40], r8
call sym.tcl9tk90.dll_Tk_HWNDToWindow
test rax, rax
je 0x2bbf0fb12
mov r8, qword [rsp + 0x40]
mov rcx, qword [rax + 8]
mov edx, r8d
call sym.tcl9tk90.dll_TkWinClipboardRender
jmp 0x2bbf0fb12
mov rax, r9
test rax, rax
je case.0x2bbf0fade.259
cmp rax, rcx
je case.0x2bbf0fade.259
mov rcx, rax
call qword [sym.imp.USER32.dll_SendMessageW]
mov qword [rbx], rax
jmp 0x2bbf0fb12
cmp edx, 0x10
je case.0x2bbf0fade.257
jmp 0x2bbf0faf2
mov r8, r9
movzx r9d, r9w
shr r8, 0x10
movzx r8d, r8w
call qword [sym.imp.USER32.dll_PostMessageW]
cdqe
mov qword [rbx], rax
jmp 0x2bbf0fb12
mov rax, qword [r9]
jmp 0x2bbf0fc33
cmp edx, 0x20e
je case.0x2bbf0fade.257
jmp case.0x2bbf0fade.259
mov rcx, qword [rbx + 8]
mov edx, 1
call sym.tcl9tk90.dll_TkWinClipboardRender
jmp 0x2bbf0fba1
Function at 0x2bbf72880
Capabilities:
Read file on windows

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x30
movups xmmword [rsp + 0x20], xmm6
mov rdi, rdx
lea rdx, [0x2bc01d200]
movaps xmm6, xmm2
call sym.fopen
mov rbx, rax
test rax, rax
je 0x2bbf7295a
mov r8d, 2
xor edx, edx
mov rcx, rax
call sym.fseek
mov rcx, rbx
call sym.ftell
xor r8d, r8d
xor edx, edx
mov rcx, rbx
movsxd r12, eax
call sym.fseek
mov rbp, qword [0x2bc041fd0]
lea rcx, [r12 + 1]
mov rax, qword [rbp]
call qword [rax + 0x28]
mov rsi, rax
test rax, rax
je 0x2bbf72960
mov r9, rbx
mov r8, r12
mov edx, 1
mov rcx, rax
call sym.fread
cmp rax, r12
jne 0x2bbf72948
mov byte [rsi + rax], 0
mov rcx, rbx
call sym.fclose
mov rcx, rsi
movaps xmm2, xmm6
mov rdx, rdi
call sym.nsvgParse
mov rcx, rsi
mov rbx, rax
mov rax, qword [rbp]
call qword [rax + 0x30]
nop
movups xmm6, xmmword [rsp + 0x20]
mov rax, rbx
add rsp, 0x30
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov rcx, rbx
call sym.fclose
mov rax, qword [rbp]
mov rcx, rsi
call qword [rax + 0x30]
xor ebx, ebx
jmp 0x2bbf72930
mov rcx, rbx
xor ebx, ebx
call sym.fclose
jmp 0x2bbf72930
Function at 0x2bbf94a60
Capabilities:
Check for time delay via gettickcount

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0xf8
mov rax, qword [0x2bc041fd0]
mov rax, qword [rax]
mov rbx, rcx
mov r12d, edx
mov ebp, r8d
mov edi, r9d
mov edx, 0x28
lea rcx, [0x2bc063bf0]
call qword [rax + 0x998]
mov r13, qword [rax + 0x10]
mov rsi, rax
xor eax, eax
cmp r13, rbx
je 0x2bbf94ba0
mov r14, qword [rsi + 0x18]
test r14, r14
je 0x2bbf94bb8
mov rdx, r14
mov rcx, rbx
call sym.tcl9tk90.dll_TkPositionInTree
mov rcx, r13
mov rdx, r14
mov r15d, eax
call sym.tcl9tk90.dll_TkPositionInTree
mov r13d, eax
cmp r15d, eax
je 0x2bbf94b9a
cmp r15d, 1
je 0x2bbf94aee
cmp eax, 1
jne 0x2bbf94b9a
xor eax, eax
cmp r15d, 1
mov rdx, qword [r14]
movsxd rcx, dword [r14 + 0x10]
setne al
add eax, 7
mov r8, qword [rdx + 0xe0]
mov dword [rsp + 0x30], eax
mov eax, dword [rdx + 0x90]
mov qword [rsp + 0x40], rdx
mov dword [rsp + 0x34], eax
mov rax, rcx
shl rax, 4
mov dword [rsp + 0x38], 0
sub rax, rcx
lea rax, [r8 + rax*8]
mov rax, qword [rax + 0x10]
mov qword [rsp + 0x50], rax
call sym.tcl9tk90.dll_TkpGetMS
cmp r13d, 2
mov dword [rsp + 0x84], edi
lea rdi, [rsp + 0x30]
mov dword [rsp + 0x60], eax
sete al
cmp r15d, 2
mov rcx, rdi
sete dl
mov dword [rsp + 0x6c], r12d
or eax, edx
mov rdx, r14
mov dword [rsp + 0x70], ebp
xor eax, 1
mov dword [rsp + 0x74], 0
mov dword [rsp + 0x80], 0
movzx eax, al
mov dword [rsp + 0x78], eax
call sym.tcl9tk90.dll_TkChangeEventWindow
xor edx, edx
mov rcx, rdi
call sym.tcl9tk90.dll_Tk_QueueWindowEvent
xor eax, eax
mov qword [rsi + 0x10], rbx
add rsp, 0xf8
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
test r13, r13
je 0x2bbf94c80
cmp qword [r13 + 0x28], 0
je 0x2bbf94c80
mov r14, r13
mov rdx, qword [r14]
movsxd rcx, dword [r14 + 0x10]
mov dword [rsp + 0x30], 8
mov eax, dword [rdx + 0x90]
mov qword [rsp + 0x40], rdx
mov dword [rsp + 0x38], 0
mov dword [rsp + 0x34], eax
mov rax, rcx
shl rax, 4
sub rax, rcx
mov rcx, qword [rdx + 0xe0]
lea rax, [rcx + rax*8]
mov rax, qword [rax + 0x10]
mov qword [rsp + 0x50], rax
call sym.tcl9tk90.dll_TkpGetMS
mov dword [rsp + 0x84], edi
lea rdi, [rsp + 0x30]
mov rdx, r14
mov rcx, rdi
mov dword [rsp + 0x60], eax
mov dword [rsp + 0x6c], r12d
mov dword [rsp + 0x70], ebp
mov qword [rsp + 0x74], 0
mov dword [rsp + 0x80], 0
call sym.tcl9tk90.dll_TkChangeEventWindow
mov r8, rbx
mov rdx, r13
mov rcx, rdi
mov dword [rsp + 0x28], 0
mov r9d, 8
mov dword [rsp + 0x20], 7
call sym.tcl9tk90.dll_TkInOutEvents
mov eax, 1
jmp 0x2bbf94b9c
test rbx, rbx
je 0x2bbf94b9a
cmp qword [rbx + 0x28], 0
je 0x2bbf94b9a
mov r14, rbx
jmp 0x2bbf94bcf
Function at 0x2bbf9a170
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
mov r13, qword [rcx + 8]
mov eax, dword [r13 + 0x8f0]
mov rdi, rcx
mov esi, edx
mov rbp, r8
mov r12, r9
test eax, eax
je 0x2bbf9a2a0
mov rcx, rdi
call sym.tcl9tk90.dll_Tk_MakeWindowExist
mov rbx, qword [r13 + 0x8e8]
test rbx, rbx
jne 0x2bbf9a1c1
jmp 0x2bbf9a230
mov rbx, qword [rbx + 0x28]
test rbx, rbx
je 0x2bbf9a230
cmp dword [rbx], esi
jne 0x2bbf9a1b8
mov r13, qword [rbx + 0x18]
test r13, r13
je 0x2bbf9a259
cmp qword [rbx + 8], rdi
je 0x2bbf9a2b0
mov rcx, qword [rdi]
mov r14, qword [rbx + 0x20]
mov qword [rbx + 8], rdi
xor r9d, r9d
mov r8, qword [rdi + 0x28]
mov edx, esi
mov eax, dword [rcx + 0x90]
mov qword [rbx + 0x18], rbp
mov qword [rbx + 0x20], r12
add eax, 1
mov dword [rbx + 0x14], 0
mov dword [rbx + 0x10], eax
call sym.tcl9tk90.dll_XSetSelectionOwner
mov rcx, r14
mov rax, r13
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
jmp rax
mov rax, qword [0x2bc041fd0]
mov ecx, 0x30
mov rax, qword [rax]
call qword [rax + 0x28]
mov dword [rax], esi
mov rbx, rax
mov rax, qword [r13 + 0x8e8]
mov qword [rbx + 0x28], rax
mov qword [r13 + 0x8e8], rbx
mov rcx, qword [rdi]
mov r8, qword [rdi + 0x28]
xor r9d, r9d
mov edx, esi
mov qword [rbx + 8], rdi
mov eax, dword [rcx + 0x90]
mov qword [rbx + 0x18], rbp
mov qword [rbx + 0x20], r12
add eax, 1
mov dword [rbx + 0x14], 0
mov dword [rbx + 0x10], eax
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
jmp sym.tcl9tk90.dll_XSetSelectionOwner
call sym.tcl9tk90.dll_TkSelInit
jmp 0x2bbf9a19c
lea rax, [0x2bbf99820]
cmp r13, rax
jne 0x2bbf9a259
mov rax, qword [0x2bc041fd0]
mov rcx, qword [rbx + 0x20]
mov rax, qword [rax]
call qword [rax + 0x30]
mov esi, dword [rbx]
jmp 0x2bbf9a259

Function at 0x2bbf9a2e0
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
mov rdi, qword [rcx + 8]
mov eax, dword [rdi + 0x8f0]
mov rsi, rcx
mov ebx, edx
test eax, eax
je 0x2bbf9a388
mov rcx, qword [rdi + 0x8e8]
xor edx, edx
jmp 0x2bbf9a31e
mov rax, qword [rcx + 0x28]
cmp dword [rcx], ebx
je 0x2bbf9a340
mov rdx, rcx
mov rcx, rax
test rcx, rcx
jne 0x2bbf9a310
mov rcx, qword [rsi]
xor r9d, r9d
xor r8d, r8d
mov edx, ebx
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
jmp sym.tcl9tk90.dll_XSetSelectionOwner
test rdx, rdx
je 0x2bbf9a398
mov qword [rdx + 0x28], rax
mov rax, qword [0x2bc041fd0]
mov rdi, qword [rcx + 0x18]
mov rbp, qword [rcx + 0x20]
mov rax, qword [rax]
call qword [rax + 0x30]
mov rcx, qword [rsi]
xor r9d, r9d
xor r8d, r8d
mov edx, ebx
call sym.tcl9tk90.dll_XSetSelectionOwner
test rdi, rdi
je 0x2bbf9a3a1
mov rcx, rbp
mov rax, rdi
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
jmp rax
call sym.tcl9tk90.dll_TkSelInit
jmp 0x2bbf9a2ff
mov qword [rdi + 0x8e8], rax
jmp 0x2bbf9a349
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
ret
Function at 0x2bbf9a670
Capabilities:
Get geographical location
Open clipboard
Read clipboard data

Disassembly:
push r15
mov eax, 0x1018
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
call fcn.2bbfee6d0
sub rsp, rax
mov rax, qword [rsp + 0x1088]
mov rbx, qword [rdx + 8]
mov r13, qword [rsp + 0x1080]
mov qword [rsp + 0x38], rax
mov r12, rcx
mov edi, r8d
mov ebp, r9d
mov rax, qword [0x2bc041fd0]
mov qword [rsp + 0x48], rdx
lea rcx, [0x2bc063c00]
mov edx, 8
mov rax, qword [rax]
call qword [rax + 0x998]
mov qword [rsp + 0x40], rax
mov eax, dword [rbx + 0x8f0]
test eax, eax
je 0x2bbf9a858
mov rcx, qword [rbx + 0x8e8]
test rcx, rcx
jne 0x2bbf9a6fd
jmp 0x2bbf9a870
mov rcx, qword [rcx + 0x28]
test rcx, rcx
je 0x2bbf9a870
cmp dword [rcx], edi
jne 0x2bbf9a6f0
mov rax, qword [rcx + 8]
mov r15, qword [rax + 0x120]
test r15, r15
jne 0x2bbf9a72d
jmp 0x2bbf9a8b0
mov r15, qword [r15 + 0x28]
test r15, r15
je 0x2bbf9a8b0
cmp dword [r15 + 4], ebp
jne 0x2bbf9a720
cmp dword [r15], edi
jne 0x2bbf9a720
mov rsi, qword [rsp + 0x40]
movq xmm0, r15
lea rax, [rsp + 0x50]
xor ebx, ebx
movhps xmm0, qword [rsi]
movups xmmword [rsp + 0x50], xmm0
mov qword [rsi], rax
lea rsi, [rsp + 0x60]
jmp 0x2bbf9a7af
cmp qword [rsp + 0x50], 0
je 0x2bbf9a7cb
cmp rax, 0xfa0
jg 0x2bbf9a8f8
mov byte [rsp + rax + 0x60], 0
mov rcx, qword [rsp + 0x38]
mov r8, rsi
mov rdx, r12
call r13
test eax, eax
jne 0x2bbf9a842
cmp r14, 0xf9f
jle 0x2bbf9a842
cmp qword [rsp + 0x50], 0
je 0x2bbf9a840
add rbx, 0xfa0
mov rcx, qword [r15 + 0x18]
mov r9d, 0xfa0
mov r8, rsi
mov rdx, rbx
call qword [r15 + 0x10]
mov r14, rax
test rax, rax
jns 0x2bbf9a760
mov rax, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x40]
mov qword [rbx], rax
mov rax, qword [0x2bc041fd0]
mov r14, qword [rsp + 0x48]
mov edx, ebp
mov rax, qword [rax]
mov rcx, r14
mov rsi, qword [rax + 0x768]
mov r13, qword [rax + 0x1220]
call sym.tcl9tk90.dll_Tk_GetAtomName
mov edx, edi
mov rcx, r14
mov rbx, rax
call sym.tcl9tk90.dll_Tk_GetAtomName
mov r8, rbx
lea rcx, str._s_selection_doesnt_exist_or_form___s__not_defined
mov rdx, rax
call r13
mov rcx, r12
mov rdx, rax
call rsi
mov eax, 1
add rsp, 0x1018
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
xor eax, eax
mov rdx, qword [rsp + 0x58]
mov rdi, qword [rsp + 0x40]
mov qword [rdi], rdx
jmp 0x2bbf9a829
mov rcx, qword [rsp + 0x48]
call sym.tcl9tk90.dll_TkSelInit
jmp 0x2bbf9a6df
mov rax, qword [rsp + 0x38]
mov rdx, qword [rsp + 0x48]
mov r9d, ebp
mov r8d, edi
mov rcx, r12
mov qword [rsp + 0x1080], r13
mov qword [rsp + 0x1088], rax
add rsp, 0x1018
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
jmp sym.tcl9tk90.dll_TkSelGetSelection
lea rax, [rsp + 0x50]
lea rbx, [rsp + 0x60]
mov r9d, 0xfa0
mov edx, ebp
mov qword [rsp + 0x20], rax
mov r8, rbx
call sym.TkSelDefaultSelection
test rax, rax
js 0x2bbf9a7d8
cmp rax, 0xfa0
jg 0x2bbf9a8f8
mov byte [rsp + rax + 0x60], 0
mov rcx, qword [rsp + 0x38]
mov r8, rbx
mov rdx, r12
call r13
jmp 0x2bbf9a829
mov rax, qword [0x2bc041fd0]
lea rcx, str.selection_handler_returned_too_many_bytes
mov rax, qword [rax]
call qword [rax + 0x20]
nop
nop dword [rax]