joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14019ea00
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x20
mov r14, qword [rcx]
mov ebp, edx
mov esi, dword [rcx + 0x10]
mov edi, r8d
imul esi, r9d
mov rbx, rcx
movsxd rdx, dword [r14 + 0x10]
mov eax, edx
imul eax, ebp
sub ebp, dword [rcx + 0x14]
sar esi, 8
movsxd r11, eax
add r11, qword [rcx + 0x20]
cmp esi, 0xfe
jge 0x14019eb4c
mov r14, rdx
mov rax, qword [rbx + 8]
mov edx, ebp
inc ebp
dec edi
mov ecx, dword [rax + 0x10]
mov rax, qword [rbx + 0x28]
imul ecx, edx
movsxd rdx, ecx
mov ecx, 0x100
mov r8d, dword [rdx + rax]
mov r10d, r8d
shr r10d, 8
and r8d, 0xff00ff
and r10d, 0xff00ff
imul r8d, esi
imul r10d, esi
mov edx, 0x100
shr r8d, 8
shr r10d, 8
and r8d, 0xff00ff
and r10d, 0xff00ff
mov eax, r10d
shr eax, 0x10
sub ecx, eax
mov eax, dword [r11]
mov r9d, eax
shr eax, 8
and eax, 0xff00ff
and r9d, 0xff00ff
imul eax, ecx
imul r9d, ecx
mov ecx, 0x100
shr eax, 8
and eax, 0xff00ff
shr r9d, 8
add r10d, eax
and r9d, 0xff00ff
add r9d, r8d
mov eax, r10d
shr eax, 8
and eax, 0xff00ff
sub edx, eax
mov eax, r10d
shl eax, 8
shl edx, 8
or edx, eax
mov eax, r9d
shr eax, 8
and eax, 0xff00ff
sub ecx, eax
mov eax, r10d
or ecx, r9d
shr eax, 8
xor edx, ecx
shl r10d, 8
and eax, 0xff00ff
and edx, 0xff00ff
mov ecx, 0x100
sub ecx, eax
shl ecx, 8
or ecx, r10d
xor edx, ecx
mov dword [r11], edx
add r11, r14
test edi, edi
jg 0x14019ea51
jmp 0x14019ec54
mov r8, qword [rcx + 8]
movsxd rcx, dword [r8 + 0x10]
mov eax, ecx
imul eax, ebp
movsxd r10, eax
add r10, qword [rbx + 0x28]
cmp edx, ecx
jne 0x14019eb88
cmp dword [r8 + 8], 1
jne 0x14019eb88
cmp dword [r14 + 8], 1
jne 0x14019eb88
imul ecx, edi
mov rdx, r10
movsxd r8, ecx
mov rcx, r11
call sub.VCRUNTIME140.dll_memcpy
jmp 0x14019ec54
mov rbx, rdx
mov rsi, rcx
nop
mov edx, dword [r10]
mov ecx, 0x100
mov r9d, edx
add r10, rsi
and edx, 0xff00ff
shr r9d, 8
and r9d, 0xff00ff
dec edi
mov eax, r9d
shr eax, 0x10
sub ecx, eax
mov eax, dword [r11]
mov r8d, eax
shr eax, 8
and eax, 0xff00ff
and r8d, 0xff00ff
imul eax, ecx
imul r8d, ecx
mov ecx, 0x100
shr eax, 8
and eax, 0xff00ff
shr r8d, 8
add r9d, eax
and r8d, 0xff00ff
add r8d, edx
mov eax, r9d
shr eax, 8
mov edx, 0x100
and eax, 0xff00ff
sub edx, eax
mov eax, r9d
shl eax, 8
shl edx, 8
or edx, eax
mov eax, r8d
shr eax, 8
and eax, 0xff00ff
sub ecx, eax
mov eax, r9d
or ecx, r8d
shr eax, 8
xor edx, ecx
shl r9d, 8
and eax, 0xff00ff
and edx, 0xff00ff
mov ecx, 0x100
sub ecx, eax
shl ecx, 8
or ecx, r9d
xor edx, ecx
mov dword [r11], edx
add r11, rbx
test edi, edi
jg 0x14019eb90
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
Function at 0x1401a2770
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x20
movzx ebp, r8b
movzx r14d, dl
mov rsi, rcx
call fcn.1401faeb0
mov rbx, rax
mov qword [rsp + 0x58], rax
test rax, rax
je 0x1401a27a3
lock inc dword [rax + 8]
test r14b, r14b
je 0x1401a27ca
mov rdx, qword [rsi]
mov rcx, rsi
call qword [rdx + 0x120]
test rbx, rbx
je 0x1401a2897
mov rax, qword [rbx + 0x10]
test rax, rax
je 0x1401a2897
test bpl, bpl
je 0x1401a2829
mov rax, qword [rsi]
mov rcx, rsi
call qword [rax + pe_nt_image_headers64]
test rbx, rbx
je 0x1401a2897
mov rax, qword [rbx + 0x10]
test rax, rax
je 0x1401a2897
mov edi, dword [rsi + 0x50]
sub edi, 1
js 0x1401a2829
nop dword [rax]
movsxd rcx, edi
mov rax, qword [rsi + 0x40]
mov rcx, qword [rax + rcx*8]
mov rax, qword [rcx]
call qword [rax + 0x130]
mov rax, qword [rbx + 0x10]
test rax, rax
je 0x1401a2897
cmp dword [rsi + 0x50], edi
cmovl edi, dword [rsi + 0x50]
sub edi, 1
jns 0x1401a2800
mov rcx, qword [rsi + 0x18]
test rcx, rcx
je 0x1401a283e
mov rax, qword [rcx]
mov rdx, rsi
call qword [rax + 0x128]
test rbx, rbx
je 0x1401a2897
mov rax, qword [rbx + 0x10]
test rax, rax
je 0x1401a2897
mov edi, dword [rsi + 0x98]
mov rax, qword [rbx + 0x10]
test rax, rax
je 0x1401a2897
test edi, edi
jle 0x1401a2897
mov eax, dword [rsi + 0x98]
dec edi
cmp edi, eax
jl 0x1401a2877
lea edi, [rax - 1]
mov eax, edi
shr eax, 0x1f
xor al, 1
je 0x1401a2897
movsxd rax, edi
mov rcx, qword [rsi + 0x88]
movzx r9d, bpl
movzx r8d, r14b
mov rdx, rsi
mov rcx, qword [rcx + rax*8]
call fcn.14019fde0
jmp 0x1401a2852
test rbx, rbx
je 0x1401a28b8
mov eax, 0xffffffff
lock xadd dword [rbx + 8], eax
cmp eax, 1
jne 0x1401a28b8
mov rax, qword [rbx]
mov edx, 1
mov rcx, rbx
call qword [rax]
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x50]
add rsp, 0x20
pop r14
pop rdi
pop rsi
ret
Function at 0x1401f1e50
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov ecx, 0x10
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
movzx ebx, ax
mov ecx, 0x11
shr ebx, 0xf
and ebx, 1
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
shr eax, 0xf
mov edi, ebx
or edi, 2
mov ecx, 0x12
and al, 1
cmove edi, ebx
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
shr eax, 0xf
mov ebx, edi
or ebx, 4
mov ecx, 0xa5
and al, 1
cmove ebx, edi
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
mov ecx, dword [0x14036fcb8]
mov edx, ebx
and edx, 0xfffffff9
shr eax, 0xf
and ecx, 0x70
and al, 1
cmove edx, ebx
mov rbx, qword [rsp + 0x30]
or edx, ecx
mov dword [0x14036fcb8], edx
add rsp, 0x20
pop rdi
ret
Function at 0x1401f39b0
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
push rsi
push rdi
push r14
sub rsp, 0x40
mov rbp, rdx
mov rsi, rcx
cmp qword [0x140370108], 0
je 0x1401f39ee
call qword [sym.imp.USER32.dll_GetMessageExtraInfo]
mov ecx, 0xffffff00
and rax, rcx
mov ecx, 0xff515700
cmp rax, rcx
je 0x1401f3bd4
xor r14d, r14d
cmp byte [rsi + 0x82], r14b
jne 0x1401f3ad4
mov byte [rsi + 0x82], 1
call fcn.1401f1e50
lea ecx, [r14 + 1]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
shr eax, 0xf
and al, 1
movzx ebx, al
shl ebx, 4
lea ecx, [r14 + 2]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
shr eax, 0xf
mov edi, ebx
or edi, 0x20
and al, 1
cmove edi, ebx
lea ecx, [r14 + 4]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
shr eax, 0xf
mov ecx, dword [0x14036fcb8]
and ecx, 0xffffff8f
mov dword [rsp + 0x70], ecx
mov edx, edi
or edx, 0x40
and al, 1
cmove edx, edi
or edx, ecx
mov dword [0x14036fcb8], edx
call fcn.1401f1e50
mov dword [rsp + 0x20], 0x18
mov dword [rsp + 0x24], 2
mov rax, qword [rsi + 0x58]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x30], r14d
lea rcx, [rsp + 0x20]
call qword [sym.imp.USER32.dll_TrackMouseEvent]
mov rax, qword [0x14036ed68]
test rax, rax
jne 0x1401f3abb
mov ecx, 0x168
call fcn.14022d994
mov qword [rsp + 0x78], rax
mov rcx, rax
call fcn.1401a8d50
nop
mov qword [0x14036ed68], rax
mov rax, qword [rax + 0x38]
mov rcx, qword [rax + 0x20]
mov rcx, qword [rcx]
mov qword [rsp + 0x78], rcx
mov dl, 1
call fcn.1401a86b0
jmp 0x1401f3b19
cmp byte [rsi + 0x81], r14b
jne 0x1401f3b19
mov rax, qword [rsi]
mov r9, qword [rax + 0x90]
movss xmm0, dword [rbp]
call fcn.140182a20
mov dword [rsp + 0x70], eax
movss xmm0, dword [rbp + 4]
call fcn.140182a20
mov dword [rsp + 0x74], eax
xor r8d, r8d
lea rdx, [rsp + 0x70]
mov rcx, rsi
call r9
test al, al
je 0x1401f3bd4
mov edx, 8
mov rax, qword gs:[0x58]
mov rcx, qword [rax]
mov eax, dword [rdx + rcx]
cmp dword [0x140370fa0], eax
jle 0x1401f3b6f
lea rcx, [0x140370fa0]
call fcn.14022e128
cmp dword [0x140370fa0], 0xffffffff
jne 0x1401f3b6f
call fcn.140131420
mov edx, 0x10
cmp eax, 0x203
cmovge edx, r14d
mov dword [0x140370fa8], edx
lea rcx, [0x140370fa0]
call fcn.14022e0c8
call qword [sym.imp.WINMM.dll_timeGetTime]
mov edx, eax
mov ecx, dword [0x14036fb70]
cmp eax, ecx
jae 0x1401f3b95
add ecx, 0xfffffc18
cmp eax, ecx
jae 0x1401f3b9b
mov ecx, eax
xchg dword [0x14036fb70], ecx
jmp 0x1401f3b9b
xchg dword [0x14036fb70], eax
mov ecx, dword [0x140370fa8]
add ecx, dword [0x140370238]
cmp edx, ecx
jb 0x1401f3bd4
mov dword [0x140370238], edx
movss xmm0, dword [rbp]
movss dword [rsp + 0x70], xmm0
movss xmm1, dword [rbp + 4]
movss dword [rsp + 0x74], xmm1
lea rdx, [rsp + 0x70]
mov rcx, rsi
call fcn.1401f38b0
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
add rsp, 0x40
pop r14
pop rdi
pop rsi
ret
Function at 0x1401f4600
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x1a0
mov rax, qword [0x14033d010]
xor rax, rsp
mov qword [rsp + 0x190], rax
mov rsi, rdx
mov rdi, rcx
call fcn.1401f1e50
lea rax, [rsi - 0x10]
xor ebx, ebx
cmp rax, 0x95
ja case.0x1401f4657.19
lea rcx, [0x140000000]
movzx eax, byte [rcx + rax + 0x1f4804]
mov edx, dword [rcx + rax*4 + 0x1f47f8]
add rdx, rcx
jmp rdx
mov rcx, rdi
call fcn.1401f43e0
jmp 0x1401f4782
mov dl, 1
mov rcx, rdi
call fcn.1401edcc0
movzx ebp, al
mov ecx, dword [0x14036fcb8]
mov dword [0x14036fc74], ecx
and ecx, 0xffffff8f
bts esi, 0x10
mov dword [rsp + 0x30], esi
mov dword [rsp + 0x34], 0xffffffff
mov dword [rsp + 0x38], ecx
mov dword [rsp + 0x3c], ebx
jmp 0x1401f476c
mov dl, 1
mov rcx, rdi
call fcn.1401edcc0
movzx ebp, al
mov dword [rsp + 0x20], ebx
mov r9d, 0x103
lea r8d, [r9 - 1]
mov rdx, qword [rdi + 0x58]
lea rcx, [rsp + 0x40]
call qword [sym.imp.USER32.dll_PeekMessageW]
test eax, eax
jne 0x1401f477d
lea edx, [rax + 2]
mov ecx, esi
call qword [sym.imp.USER32.dll_MapVirtualKeyW]
mov r15d, eax
xor edx, edx
mov ecx, esi
call qword [sym.imp.USER32.dll_MapVirtualKeyW]
mov r14d, eax
lea rcx, [rsp + 0x90]
call qword [sym.imp.USER32.dll_GetKeyboardState]
xorps xmm0, xmm0
movups xmmword [rsp + 0x70], xmm0
movups xmmword [rsp + 0x80], xmm0
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], 8
lea r9, [rsp + 0x70]
lea r8, [rsp + 0x90]
mov edx, r14d
mov ecx, esi
call qword [sym.imp.USER32.dll_ToUnicode]
cmp eax, 1
je 0x1401f473d
movzx eax, bx
mov word [rsp + 0x70], bx
jmp 0x1401f4742
movzx eax, word [rsp + 0x70]
movzx edx, ax
mov eax, dword [0x14036fcb8]
mov dword [0x14036fc74], eax
and eax, 0xffffff8f
movzx ecx, r15w
mov dword [rsp + 0x30], ecx
movzx ecx, r14w
mov dword [rsp + 0x34], ecx
mov dword [rsp + 0x38], eax
mov dword [rsp + 0x3c], edx
lea rdx, [rsp + 0x30]
mov rcx, rdi
call fcn.1401edad0
test al, al
jne 0x1401f47cd
test bpl, bpl
jne 0x1401f47cd
call fcn.14019fec0
mov r8d, ebx
mov ecx, dword [rax + 0x28]
sub ecx, 1
movsxd rdx, ecx
js 0x1401f47c4
mov rax, qword [rax + 0x18]
lea rcx, [rax + rdx*8]
nop dword [rax]
mov r9, qword [rcx]
cmp byte [r9 + 0x6c], 0
je 0x1401f47b4
mov eax, r8d
inc r8d
test eax, eax
je 0x1401f47c0
sub rcx, 8
sub rdx, 1
js 0x1401f47c4
jmp 0x1401f47a0
mov rbx, qword [r9 + 0x48]
test rbx, rbx
jne 0x1401f47cd
xor al, al
jmp 0x1401f47cf
mov al, 1
mov rcx, qword [rsp + 0x190]
xor rcx, rsp
call fcn.14022d970
mov rbx, qword [rsp + 0x1e0]
add rsp, 0x1a0
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x1401f67a0
Capabilities:
Log keystrokes via input method manager

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 8], rcx
push rsi
push rdi
push r14
sub rsp, 0x30
mov ebp, r9d
mov r14, r8
mov rdi, rdx
xor r9d, r9d
xor r8d, r8d
mov edx, ebp
mov rcx, r14
call qword [sym.imp.IMM32.dll_ImmGetCompositionStringW]
movsxd rsi, eax
test eax, eax
jle 0x1401f682b
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rcx, rsi
shr rcx, 1
inc rcx
mov edx, 2
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_calloc]
mov rbx, rax
mov qword [rsp + 0x20], rax
mov r9d, esi
mov r8, rax
mov edx, ebp
mov rcx, r14
call qword [sym.imp.IMM32.dll_ImmGetCompositionStringW]
mov qword [rsp + 0x50], rbx
lea rdx, [rsp + 0x50]
mov rcx, rdi
call fcn.140133d60
nop
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
jmp 0x1401f684f
mov rax, qword [0x140356150]
mov qword [rdi], rax
mov rax, qword [0x140356150]
sub rax, 0x10
lea rcx, [0x140273478]
cmp rax, rcx
je 0x1401f684f
lock inc dword [rax]
mov rax, rdi
mov rbx, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x60]
add rsp, 0x30
pop r14
pop rdi
pop rsi
ret
Function at 0x1401f6940
Capabilities:
Log keystrokes via input method manager

Disassembly:
mov qword [rsp + 8], rcx
push rsi
push rdi
sub rsp, 0x48
xor eax, eax
mov rsi, r8
mov qword [rdx], rax
mov rdi, rdx
mov dword [rdx + 8], eax
mov dword [rdx + 0x10], eax
test r8, r8
je 0x1401f6ae8
test r9b, 0x20
je 0x1401f6ae8
xor r9d, r9d
mov qword [rsp + 0x40], rbp
xor r8d, r8d
lea edx, [rax + 0x20]
mov rcx, rsi
call qword [sym.imp.IMM32.dll_ImmGetCompositionStringW]
movsxd rbp, eax
test eax, eax
jle 0x1401f6ad9
mov qword [rsp + 0x70], rbx
mov qword [rsp + 0x20], r15
mov r15, rbp
shr r15, 2
lea rcx, [r15*4]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov r9d, ebp
mov edx, 0x20
mov r8, rax
mov qword [rsp + 0x68], rax
mov rcx, rsi
mov rbx, rax
call qword [sym.imp.IMM32.dll_ImmGetCompositionStringW]
test eax, eax
jle 0x1401f6ab7
cmp r15, 1
jbe 0x1401f6ab7
mov qword [rsp + 0x38], r12
mov rcx, rbx
mov rbx, qword [rsp + 0x60]
mov qword [rsp + 0x30], r13
mov qword [rsp + 0x28], r14
mov r14d, 1
nop dword [rax + rax]
mov ebp, dword [rcx]
lea r12, [rcx + 4]
cmp ebp, dword [r12]
mov edx, ebp
mov ecx, dword [rbx]
cmovl edx, dword [r12]
mov r8d, dword [rdi + 8]
lea r13d, [rcx + rbp]
lea eax, [rcx + rdx]
cmp r13d, eax
cmovl ebp, edx
add ebp, ecx
mov ecx, dword [rdi + 0x10]
lea edx, [rcx + 1]
cmp edx, r8d
jle 0x1401f6a80
mov eax, edx
test edx, edx
jns 0x1401f6a3a
lea eax, [rdx + 1]
sar eax, 1
lea esi, [rdx + 8]
add esi, eax
and esi, 0xfffffff8
cmp r8d, esi
je 0x1401f6a80
mov rcx, qword [rdi]
test esi, esi
jle 0x1401f6a6f
movsxd rdx, esi
shl rdx, 3
test rcx, rcx
jne 0x1401f6a67
mov rcx, rdx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
jmp 0x1401f6a77
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_realloc]
jmp 0x1401f6a77
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
xor eax, eax
mov qword [rdi], rax
mov dword [rdi + 8], esi
mov ecx, dword [rdi + 0x10]
lea eax, [rcx + 1]
inc r14
mov dword [rdi + 0x10], eax
mov rax, qword [rdi]
movsxd rcx, ecx
mov dword [rax + rcx*8], r13d
mov dword [rax + rcx*8 + 4], ebp
mov rcx, r12
cmp r14, r15
jb 0x1401f6a00
mov rbx, qword [rsp + 0x68]
mov r14, qword [rsp + 0x28]
mov r13, qword [rsp + 0x30]
mov r12, qword [rsp + 0x38]
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov r15, qword [rsp + 0x20]
mov rax, rdi
mov rbx, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
pop rdi
pop rsi
ret
mov rbp, qword [rsp + 0x40]
mov rax, rdi
add rsp, 0x48
pop rdi
pop rsi
ret
mov rax, rdi
add rsp, 0x48
pop rdi
pop rsi
ret
Function at 0x1401f6b50
Capabilities:
Log keystrokes via polling

Disassembly:
sub rsp, 0x58
mov rax, qword [0x14033d010]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov r8d, ecx
bt ecx, 0x10
jb 0x1401f6bc8
movdqa xmm0, xmmword [str.__._:__]
lea edx, [r8 - 0x20]
movdqa xmm1, xmmword [0x1402c2fd0]
xor eax, eax
add ecx, 0xffffff9f
mov dword [rsp + 0x40], 0xdb005b
cmp cx, 0x19
mov dword [rsp + 0x44], 0xdd005d
movdqu xmmword [rsp + 0x20], xmm0
cmova dx, r8w
movzx r8d, dx
movdqu xmmword [rsp + 0x30], xmm1
nop
cmp r8w, word [rsp + rax*2 + 0x20]
jne 0x1401f6bbe
movzx r8d, word [rsp + rax*2 + 0x22]
add rax, 2
cmp rax, 0x14
jl 0x1401f6bb0
movsx ecx, r8w
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
shr eax, 0xf
and al, 1
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.14022d970
add rsp, 0x58
ret

Function at 0x1401f6da0
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push rsi
sub rsp, 0x20
mov rsi, rcx
xor ecx, ecx
call qword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x1401f6e75
call qword [sym.imp.USER32.dll_EmptyClipboard]
test eax, eax
je 0x1401f6e69
mov rax, qword [rsi]
lea rcx, [rsp + 0x38]
mov qword [rsp + 0x30], rbx
xor ebx, ebx
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], rdi
call fcn.140117990
test eax, eax
je 0x1401f6e0f
mov edi, 4
nop
cmp eax, 0x10000
mov ecx, 2
cmovae rcx, rdi
add rbx, rcx
lea rcx, [rsp + 0x38]
call fcn.140117990
test eax, eax
jne 0x1401f6df0
add rbx, 4
je 0x1401f6e5f
lea rdx, [rbx + 2]
mov ecx, 0x2042
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov rdi, rax
test rax, rax
je 0x1401f6e5f
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GlobalLock]
test rax, rax
je 0x1401f6e5f
mov r8, rbx
mov rdx, rax
mov rcx, rsi
call fcn.140123c90
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov rdx, rdi
mov ecx, 0xd
call qword [sym.imp.USER32.dll_SetClipboardData]
mov rbx, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x40]
add rsp, 0x20
pop rsi
jmp qword [sym.imp.USER32.dll_CloseClipboard]
add rsp, 0x20
pop rsi
ret

Function at 0x1401f6e80
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
mov qword [rsp + 8], rcx
push rbx
push rsi
push rdi
sub rsp, 0x30
mov rbx, rcx
mov dword [rsp + 0x20], 0
lea rax, [0x140273488]
mov qword [rcx], rax
mov dword [rsp + 0x20], 1
xor ecx, ecx
call qword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x1401f6f3f
mov ecx, 0xd
call qword [sym.imp.USER32.dll_GetClipboardData]
mov rdi, rax
test rax, rax
je 0x1401f6f39
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GlobalLock]
mov rsi, rax
test rax, rax
je 0x1401f6f39
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GlobalSize]
shr rax, 1
mov qword [rsp + 0x58], rsi
mov r8, rax
lea rdx, [rsp + 0x58]
lea rcx, [rsp + 0x60]
call fcn.140133f70
mov rax, qword [rbx]
mov rcx, qword [rsp + 0x60]
mov qword [rbx], rcx
lea rcx, [rax - 0x10]
lea rax, [0x140273478]
cmp rcx, rax
je 0x1401f6f30
mov eax, 0xffffffff
lock xadd dword [rcx], eax
dec eax
cmp eax, 0xffffffff
jne 0x1401f6f30
call fcn.14022dcf0
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
call qword [sym.imp.USER32.dll_CloseClipboard]
mov rax, rbx
add rsp, 0x30
pop rdi
pop rsi
pop rbx
ret
Function at 0x140202d80
Capabilities:
Delete directory
Delete file

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
cmp edx, 1
je 0x140202dfa
lea eax, [rdx - 3]
test eax, 0xfffffff7
je 0x140202e02
cmp qword [rcx + 0x18], 8
jb 0x140202da2
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x140202de0
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x35
ja 0x140202dc7
movabs rdx, 0x2000000020800c
bt rdx, rax
jb 0x140202de0
cmp eax, 0x7b
je 0x140202de0
cmp eax, 0x57
je 0x140202de0
cmp eax, 0xa1
je 0x140202de0
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x140202de2
xor eax, eax
lea r9, str.boost::filesystem::remove
xor r8d, r8d
mov rdx, rbx
mov ecx, eax
call fcn.140202bf0
test al, al
je 0x140202e64
xor al, al
add rsp, 0x20
pop rbx
ret
cmp qword [rcx + 0x18], 8
jb 0x140202e0c
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
jne 0x140202e4a
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x35
ja 0x140202e31
movabs rdx, 0x2000000020800c
bt rdx, rax
jb 0x140202e4a
cmp eax, 0x7b
je 0x140202e4a
cmp eax, 0x57
je 0x140202e4a
cmp eax, 0xa1
je 0x140202e4a
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x140202e4c
xor eax, eax
lea r9, str.boost::filesystem::remove
xor r8d, r8d
mov rdx, rbx
mov ecx, eax
call fcn.140202bf0
test al, al
jne 0x140202dfa
mov al, 1
add rsp, 0x20
pop rbx
ret

Function at 0x140203350
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
cmp qword [rcx + 0x18], 8
mov rsi, rdx
mov rdi, rcx
jb 0x14020336f
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ebx, eax
cmp eax, 0xffffffff
jne 0x14020339e
mov r8, rsi
lea rcx, [rsp + 0x30]
mov rdx, rdi
call fcn.140203230
mov eax, dword [rax]
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
test rsi, rsi
je 0x1402033b2
mov dword [rsi], 0
call fcn.140208570
mov qword [rsi + 8], rax
bt ebx, 0xa
jae 0x1402033f9
mov rcx, rdi
call fcn.140203150
test al, al
je 0x1402033e4
test bl, 0x10
mov eax, 4
mov ecx, 0xb
cmovne eax, ecx
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
mov eax, 9
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
mov rsi, qword [rsp + 0x40]
and ebx, 0x10
or ebx, 0x20
shr ebx, 4
mov eax, ebx
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x140204080
Capabilities:
Create directory

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rdi
sub rsp, 0xd0
mov rax, qword [0x14033d010]
xor rax, rsp
mov qword [rsp + 0xc0], rax
mov rbx, rdx
mov rdi, rcx
cmp qword [rcx + 0x18], 8
jb 0x1402040b4
mov rcx, qword [rcx]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x1402040d8
test rbx, rbx
je 0x1402040d4
mov dword [rbx], 0
call fcn.140208570
mov qword [rbx + 8], rax
mov al, 1
jmp 0x14020412d
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebp, eax
mov dword [rsp + 0x20], 0
call fcn.140208570
mov qword [rsp + 0x28], rax
lea r8, [rsp + 0x20]
mov rdx, rdi
lea rcx, [rsp + 0x30]
call fcn.140204560
cmp dword [rax], 3
jne 0x14020411b
test rbx, rbx
je 0x14020412b
mov dword [rbx], 0
call fcn.140208570
jmp 0x140204127
call fcn.140208570
test rbx, rbx
je 0x140204152
mov dword [rbx], ebp
mov qword [rbx + 8], rax
xor al, al
mov rcx, qword [rsp + 0xc0]
xor rcx, rsp
call fcn.14022d970
lea r11, [rsp + 0xd0]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
mov r8, rax
mov edx, ebp
lea rcx, [rsp + 0x30]
call fcn.1402029d0
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x20], xmm0
lea rdx, str.boost::filesystem::create_directory
lea rcx, [rsp + 0x40]
call fcn.14004ed80
nop
movups xmm0, xmmword [rsp + 0x20]
movaps xmmword [rsp + 0x20], xmm0
lea r9, [rsp + 0x20]
mov r8, rdi
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x60]
call fcn.1400fe330
lea rdx, [0x140314ab8]
lea rcx, [rsp + 0x60]
call sub.VCRUNTIME140.dll__CxxThrowException
int3

Function at 0x1402041b0
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x10], rdx
push r14
sub rsp, 0x20
mov r14, rcx
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov esi, eax
mov eax, 1
test esi, esi
cmove esi, eax
mov edx, esi
mov eax, 2
mul rdx
mov rdi, 0xffffffffffffffff
cmovo rax, rdi
mov rcx, rax
call fcn.14022e2a8
mov rbx, rax
mov qword [rsp + 0x38], rax
mov rdx, rax
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
xor esi, esi
test eax, eax
jne 0x140204221
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x140204223
mov eax, esi
mov ecx, eax
call fcn.140202b50
mov qword [r14 + 0x10], rsi
mov qword [r14 + 0x18], 7
mov word [r14], si
nop word [rax + rax]
inc rdi
cmp word [rbx + rdi*2], si
jne 0x140204240
mov r8, rdi
mov rdx, rbx
mov rcx, r14
call fcn.1400dd760
nop
mov rcx, rbx
call fcn.14022dcf0
mov rax, r14
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret