joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140009910
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
sub rsp, 0x930
mov rbp, rcx
movsxd rsi, r8d
mov rbx, rdx
lea rcx, [rsp + 0x131]
xor edx, edx
mov r8d, 0xfe
mov edi, r9d
mov byte [rsp + 0x130], 0
call sub.msvcrt.dll_memset
lea rcx, [rsp + 0x331]
xor edx, edx
mov r8d, 0xfe
mov byte [rsp + 0x330], 0
call sub.msvcrt.dll_memset
lea rcx, [rsp + 0x231]
xor edx, edx
mov r8d, 0xfe
mov byte [rsp + 0x230], 0
call sub.msvcrt.dll_memset
cmp edi, 0xffffffff
je 0x1400099e0
mov eax, edi
lea rdx, str._2.2X_2.2X_2.2X
movzx r8d, dil
shr eax, 0x10
movzx ecx, al
movzx eax, di
shr ax, 8
mov dword [rsp + 0x20], ecx
lea rcx, [rsp + 0x430]
movzx r9d, al
call sub.msvcrt.dll_sprintf
lea r8, [rsp + 0x430]
lea rdx, str._bgcolor__s_
lea rcx, [rsp + 0x130]
call sub.msvcrt.dll_sprintf
mov edx, dword [rsp + 0x960]
cmp edx, 0xffffffff
je 0x140009a49
mov eax, edx
movzx r8d, dl
shr eax, 0x10
movzx ecx, al
movzx eax, dx
lea rdx, str._2.2X_2.2X_2.2X
shr ax, 8
mov dword [rsp + 0x20], ecx
lea rcx, [rsp + 0x430]
movzx r9d, al
call sub.msvcrt.dll_sprintf
lea r8, [rsp + 0x430]
lea rdx, str._font_color__s__
lea rcx, [rsp + 0x330]
call sub.msvcrt.dll_sprintf
movabs rdx, 0x3e746e6f662f3c
mov qword [rsp + 0x230], rdx
lea r8, [rsp + 0x130]
lea rdx, str._table_border_1__cellpadding_5___tr_s__r_n
lea rcx, [rsp + 0x530]
call sub.msvcrt.dll_sprintf
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [rsp + 0x530]
lea r9, [rsp + 0x960]
lea rdx, [rsp + 0x530]
repne scasb al, byte [rdi]
xor r12d, r12d
not rcx
mov qword [rsp + 0x20], r12
lea r8, [rcx - 1]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_WriteFile]
test rsi, rsi
jle 0x140009b61
add rbx, 8
nop
nop
lea rcx, [rsp + 0x31]
xor edx, edx
mov r8d, 0xfe
mov byte [rsp + 0x30], r12b
call sub.msvcrt.dll_memset
mov r8, qword [rbx]
cmp byte [r8], r12b
je 0x140009ae2
lea rdx, str._width__s_
lea rcx, [rsp + 0x30]
call sub.msvcrt.dll_sprintf
jmp 0x140009ae7
mov byte [rsp + 0x30], r12b
lea rax, [rsp + 0x230]
lea r9, [rsp + 0x330]
lea r8, [rsp + 0x30]
mov qword [rsp + 0x28], rax
mov rax, qword [rbx - 8]
lea rdx, str._th_s__s_s_s_r_n
lea rcx, [rsp + 0x530]
mov qword [rsp + 0x20], rax
call sub.msvcrt.dll_sprintf
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [rsp + 0x530]
lea r9, [rsp + 0x960]
lea rdx, [rsp + 0x530]
repne scasb al, byte [rdi]
mov qword [rsp + 0x20], r12
not rcx
lea r8, [rcx - 1]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_WriteFile]
add rbx, 0x10
sub rsi, 1
jne 0x140009ab0
lea r11, [rsp + 0x930]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop r12
ret
Function at 0x14000a1e0
Capabilities:
Check if file exists
Get file attributes
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x430
mov rbx, rcx
lea rcx, [rsp + 0x31]
xor edx, edx
mov r8d, 0x3ff
mov byte [rsp + 0x30], 0
call sub.msvcrt.dll_memset
lea rax, [rsp + 0x458]
lea rdx, str.http_shellopencommand
mov r9d, 0x20019
xor r8d, r8d
mov rcx, 0xffffffff80000000
mov qword [rsp + 0x20], rax
xor edi, edi
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x14000a39a
mov rcx, qword [rsp + 0x458]
lea rax, [rsp + 0x448]
lea r9, [rsp + 0x450]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x30]
lea rdx, [0x140027e59]
xor r8d, r8d
mov dword [rsp + 0x448], 0x3ff
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x14000a295
mov eax, dword [rsp + 0x448]
add eax, 0xffffffff
mov byte [rsp + rax + 0x30], dil
mov edi, 1
mov rcx, qword [rsp + 0x458]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test edi, edi
je 0x14000a39a
movzx eax, byte [rsp + 0x30]
test al, al
je 0x14000a39a
cmp al, 0x22
lea rcx, [rsp + 0x31]
jne 0x14000a33a
mov edx, 0x22
call sub.msvcrt.dll_strchr
test rax, rax
je 0x14000a39a
lea rcx, [rsp + 0x31]
mov byte [rax], 0
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x14000a39a
or rcx, 0xffffffffffffffff
xor eax, eax
mov edx, 0x103
lea rdi, [rsp + 0x31]
repne scasb al, byte [rdi]
not rcx
sub rcx, 1
cmp ecx, 0x104
cmovge ecx, edx
lea rdx, [rsp + 0x31]
movsxd rdi, ecx
mov rcx, rbx
mov r8, rdi
call sub.msvcrt.dll_memcpy
mov byte [rdi + rbx], 0
mov eax, 1
mov rbx, qword [rsp + 0x440]
add rsp, 0x430
pop rdi
ret
mov edx, 0x5c
call sub.msvcrt.dll_strrchr
test rax, rax
je 0x14000a39a
mov edx, 0x20
mov rcx, rax
call sub.msvcrt.dll_strchr
test rax, rax
je 0x14000a35e
mov byte [rax], 0
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x14000a39a
or rcx, 0xffffffffffffffff
xor eax, eax
mov edx, 0x103
lea rdi, [rsp + 0x30]
repne scasb al, byte [rdi]
not rcx
sub rcx, 1
cmp ecx, 0x104
cmovge ecx, edx
lea rdx, [rsp + 0x30]
jmp 0x14000a312
xor eax, eax
mov rbx, qword [rsp + 0x440]
add rsp, 0x430
pop rdi
ret
Function at 0x14000a480
Capabilities:
Link many functions at runtime

Disassembly:
sub rsp, 0x28
cmp qword [0x14002ff10], 0
jne 0x14000a615
lea rcx, str.advapi32.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
test rax, rax
mov qword [0x14002ff10], rax
je 0x14000a615
lea rdx, str.OpenSCManagerA
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x14002ff10]
lea rdx, str.OpenServiceA
mov qword [0x14002ff18], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x14002ff10]
lea rdx, str.ChangeServiceConfigA
mov qword [0x14002ff20], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x14002ff10]
lea rdx, str.CloseServiceHandle
mov qword [0x14002ff28], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x14002ff10]
lea rdx, str.QueryServiceConfigA
mov qword [0x14002ff30], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x14002ff10]
lea rdx, str.QueryServiceConfig2A
mov qword [0x14002ff38], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x14002ff10]
lea rdx, str.ControlService
mov qword [0x14002ff40], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x14002ff10]
lea rdx, str.EnumServicesStatusA
mov qword [0x14002ff48], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x14002ff10]
lea rdx, str.StartServiceA
mov qword [0x14002ff50], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x14002ff10]
lea rdx, str.QueryServiceStatus
mov qword [0x14002ff58], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp qword [0x14002ff18], 0
mov qword [0x14002ff60], rax
je 0x14000a60e
cmp qword [0x14002ff20], 0
je 0x14000a60e
cmp qword [0x14002ff28], 0
je 0x14000a60e
cmp qword [0x14002ff30], 0
je 0x14000a60e
cmp qword [0x14002ff38], 0
je 0x14000a60e
cmp qword [0x14002ff48], 0
je 0x14000a60e
cmp qword [0x14002ff50], 0
je 0x14000a60e
cmp qword [0x14002ff58], 0
je 0x14000a60e
test rax, rax
jne 0x14000a615
xor eax, eax
add rsp, 0x28
ret
mov eax, 1
add rsp, 0x28
ret
Function at 0x14000bdc0
Capabilities:
Link many functions at runtime

Disassembly:
sub rsp, 0x28
cmp dword [0x14002feac], 0
jne 0x14000beaa
lea rcx, str.psapi.dll
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
test rax, rax
mov rbx, rax
je 0x14000bea5
lea rdx, str.GetModuleBaseNameA
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
mov qword [0x14002f938], rax
je 0x14000be93
lea rdx, str.EnumProcessModules
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
mov qword [0x14002f928], rax
je 0x14000be93
lea rdx, str.GetModuleFileNameExA
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
mov qword [0x14002f918], rax
je 0x14000be93
lea rdx, str.EnumProcesses
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
mov qword [0x14002fa68], rax
je 0x14000be93
lea rdx, str.GetModuleInformation
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
mov qword [0x14002f930], rax
je 0x14000be93
mov dword [0x14002feac], 1
mov rbx, qword [rsp + 0x20]
add rsp, 0x28
ret
cmp dword [0x14002feac], 0
jne 0x14000bea5
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rbx, qword [rsp + 0x20]
add rsp, 0x28
ret

Function at 0x14000bec0
Capabilities:
Link many functions at runtime

Disassembly:
sub rsp, 0x28
cmp dword [0x14002fea8], 0
jne 0x14000bf96
lea rcx, [0x140027da0]
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
mov rbx, rax
je 0x14000bf91
lea rdx, str.CreateToolhelp32Snapshot
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
mov qword [0x14002f920], rax
je 0x14000bf91
lea rdx, str.Module32First
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
mov qword [0x14002f910], rax
je 0x14000bf91
lea rdx, str.Module32Next
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
mov qword [0x14002f908], rax
je 0x14000bf91
lea rdx, str.Process32First
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
mov qword [0x14002f7e8], rax
je 0x14000bf91
lea rdx, str.Process32Next
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [0x14002fea8]
mov edx, 1
test rax, rax
mov qword [0x14002f900], rax
cmovne ecx, edx
mov dword [0x14002fea8], ecx
mov rbx, qword [rsp + 0x20]
add rsp, 0x28
ret
Function at 0x14000bfb0
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
sub rsp, 0x130
cmp byte [rdx + 1], 0x3a
mov rbx, rdx
mov rbp, rcx
jne 0x14000bfe4
sub rcx, rdx
nop
movzx eax, byte [rbx]
add rbx, 1
test al, al
mov byte [rcx + rbx - 1], al
jne 0x14000bfd0
jmp 0x14000c1f7
lea rcx, [rdx + 2]
mov edx, 0x3a
call sub.msvcrt.dll_strchr
test rax, rax
je 0x14000c015
lea rcx, [rax - 1]
mov rdx, rbp
sub rdx, rcx
movzx eax, byte [rcx]
add rcx, 1
test al, al
mov byte [rdx + rcx - 1], al
jne 0x14000c001
jmp 0x14000c1f7
or rcx, 0xffffffffffffffff
mov qword [rsp + 0x140], rsi
mov qword [rsp + 0x148], rdi
xor eax, eax
xor esi, esi
mov rdi, rbx
repne scasb al, byte [rdi]
mov qword [rsp + 0x150], r12
mov r12d, esi
not rcx
sub rcx, 1
cmp ecx, 0xb
mov rdi, rcx
jl 0x14000c07d
nop
movsxd rcx, r12d
lea rdx, str._systemroot
mov r8d, SafeArrayGetDim
add rcx, rbx
call sub.msvcrt.dll__memicmp
test eax, eax
je 0x14000c115
add r12d, 1
lea eax, [r12 + 0xb]
cmp eax, edi
jle 0x14000c050
cmp byte [rbx], 0x5c
jne 0x14000c1c2
lea rcx, [rsp + 0x21]
xor edx, edx
mov r8d, 0x104
mov byte [rsp + 0x20], sil
call sub.msvcrt.dll_memset
cmp byte [0x14002ff70], sil
lea rdi, [0x14002ff70]
jne 0x14000c0d0
mov edx, 0x104
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
mov dword [0x140030078], eax
nop
nop
nop
nop
movzx eax, byte [rsi + rdi]
add rsi, 1
test al, al
mov byte [rsp + rsi + 0x1f], al
jne 0x14000c0d0
movzx eax, word [rsp + 0x20]
or rcx, 0xffffffffffffffff
mov rdi, rbp
mov word [rbp], ax
xor eax, eax
mov byte [rbp + 2], 0
repne scasb al, byte [rdi]
xor ecx, ecx
nop
nop
movzx eax, byte [rbx + rcx]
add rcx, 1
test al, al
mov byte [rdi + rcx - 2], al
jne 0x14000c100
jmp 0x14000c1df
test r12d, r12d
js 0x14000c07d
lea rcx, [rsp + 0x21]
xor edx, edx
mov r8d, 0x104
mov byte [rsp + 0x20], sil
call sub.msvcrt.dll_memset
cmp byte [0x14002ff70], sil
lea rdi, [0x14002ff70]
jne 0x14000c160
mov edx, 0x104
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
mov dword [0x140030078], eax
nop
nop
movzx eax, byte [rsi + rdi]
add rsi, 1
test al, al
mov byte [rsp + rsi + 0x1f], al
jne 0x14000c160
lea rax, [rsp + 0x20]
mov rcx, rbp
lea rdx, [rsp + 0x20]
sub rcx, rax
movzx eax, byte [rdx]
add rdx, 1
test al, al
mov byte [rcx + rdx - 1], al
jne 0x14000c180
lea eax, [r12 + 0xb]
or rcx, 0xffffffffffffffff
mov rdi, rbp
movsxd rdx, eax
xor eax, eax
repne scasb al, byte [rdi]
add rdx, rbx
xor ecx, ecx
nop
nop
nop
movzx eax, byte [rdx + rcx]
add rcx, 1
test al, al
mov byte [rdi + rcx - 2], al
jne 0x14000c1b0
jmp 0x14000c1df
mov rcx, rbp
sub rcx, rbx
nop
nop
movzx eax, byte [rbx]
add rbx, 1
test al, al
mov byte [rcx + rbx - 1], al
jne 0x14000c1d0
mov rdi, qword [rsp + 0x148]
mov rsi, qword [rsp + 0x140]
mov r12, qword [rsp + 0x150]
mov rax, rbp
mov rbx, qword [rsp + 0x158]
add rsp, 0x130
pop rbp
ret
Function at 0x14000ea10
Capabilities:
Read .ini file

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
mov eax, 0x2050
call fcn.1400261c0
sub rsp, rax
mov r15, rdx
xor edx, edx
mov r14, r8
test ecx, ecx
mov rsi, r9
lea r8d, [rax - 0x50]
lea rcx, [rsp + 0x41]
je 0x14000eb00
call sub.msvcrt.dll_memset
mov rcx, qword [rsp + 0x20a0]
mov byte [rsp + 0x40], 0
mov r13d, dword [rcx]
test r13d, r13d
je 0x14000eae2
xor ebx, ebx
test r13d, r13d
mov edi, ebx
je 0x14000eada
mov ebp, ebx
lea r12, [rsp + 0x40]
nop
nop
movzx r8d, byte [rsi]
xor eax, eax
lea rdx, str._2.2X
lea rcx, [rsp + 0x30]
mov byte [rsp + 0x30], 0
mov qword [rsp + 0x31], rax
mov byte [rsp + 0x39], al
call sub.msvcrt.dll_sprintf
lea rcx, [rsp + 0x30]
movzx eax, word [rcx]
mov ebx, ebp
mov word [r12], ax
movzx eax, byte [rcx + 2]
mov byte [r12 + 2], al
lea eax, [rbp + 3]
cmp eax, 0x2000
jae 0x14000eada
add edi, 1
add ebp, 3
add rsi, 1
add r12, 3
cmp edi, r13d
jb 0x14000ea80
lea eax, [rbx + 2]
mov byte [rsp + rax + 0x40], 0
mov r9, qword [rsp + 0x20a8]
lea r8, [rsp + 0x40]
mov rdx, r14
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
jmp 0x14000ebd4
mov byte [rsp + 0x40], 0
call sub.msvcrt.dll_memset
mov rdx, qword [rsp + 0x20a8]
mov qword [rsp + 0x28], rdx
lea r9, [rsp + 0x40]
lea r8, [0x140027e59]
mov rdx, r14
mov rcx, r15
mov dword [rsp + 0x20], 0x2000
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
xor ebx, ebx
lea rdi, [rsp + 0x40]
test eax, eax
mov r12d, ebx
setne r12b
or rcx, 0xffffffffffffffff
xor eax, eax
repne scasb al, byte [rdi]
not rcx
sub rcx, 1
test ecx, ecx
je 0x14000ebd1
mov r14, qword [rsp + 0x20a0]
mov rdi, rbx
movsxd rbp, ecx
mov r13d, dword [r14]
jle 0x14000ebd1
nop
movzx eax, byte [rsp + rdi + 0x40]
cmp al, 0x20
jne 0x14000eb7f
add rdi, 1
jmp 0x14000ebc0
cmp ebx, r13d
mov byte [rsp + 0x2080], al
movzx eax, byte [rsp + rdi + 0x41]
mov byte [rsp + 0x2081], al
mov byte [rsp + 0x2082], 0
jae 0x14000ebc5
xor edx, edx
lea rcx, [rsp + 0x2080]
lea r8d, [rdx + 0x10]
call sub.msvcrt.dll_strtoul
add rsi, 1
add ebx, 1
mov byte [rsi - 1], al
add rdi, 2
cmp rdi, rbp
jl 0x14000eb70
test ebx, ebx
mov eax, r12d
je 0x14000ebd4
mov dword [r14], ebx
jmp 0x14000ebd4
mov eax, r12d
lea r11, [rsp + 0x2050]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x140011eb0
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push r12
sub rsp, 0x60
mov r12, qword [rcx + 0x2d8]
mov rbp, rcx
xor r9d, r9d
mov rsi, qword [r12 + 0x1f8]
xor r8d, r8d
mov edx, 0x1032
mov rcx, rsi
call qword [sym.imp.USER32.dll_SendMessageA]
cmp eax, 1
jne 0x140012029
xor r9d, r9d
xor r8d, r8d
mov edx, 0x1004
mov rcx, rsi
mov qword [rsp + 0x70], rbx
mov qword [rsp + 0x78], rdi
call qword [sym.imp.USER32.dll_SendMessageA]
xor edi, edi
test eax, eax
mov rbx, rax
jle 0x14001201f
nop
nop
movsxd r8, edi
mov edx, 0x102c
mov r9d, 2
mov rcx, rsi
call qword [sym.imp.USER32.dll_SendMessageA]
cmp eax, 2
je 0x140011f48
add edi, 1
cmp edi, ebx
jl 0x140011f20
jmp 0x14001201f
lea r9, [rsp + 0x20]
xor r8d, r8d
mov edx, 0x1005
mov rcx, rsi
mov dword [rsp + 0x20], 4
mov dword [rsp + 0x30], 0
mov dword [rsp + 0x24], edi
mov dword [rsp + 0x28], 0
call qword [sym.imp.USER32.dll_SendMessageA]
test eax, eax
je 0x14001201f
mov rax, qword [r12]
mov rdi, qword [rsp + 0x48]
mov rcx, r12
call qword [rax]
mov rcx, qword [rbp + 0x110]
mov rdx, qword [rax]
mov eax, dword [r12 + 8]
imul eax, edi
movsxd rbx, eax
add rbx, rdx
add rbx, 0x112
call qword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x14001201f
call qword [sym.imp.USER32.dll_EmptyClipboard]
test rbx, rbx
je 0x140012019
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, rbx
repne scasb al, byte [rdi]
not rcx
movsxd rsi, ecx
mov ecx, 0x2000
mov rdx, rsi
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
test rax, rax
mov rdi, rax
je 0x140012019
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GlobalLock]
mov r8, rsi
mov rdx, rbx
mov rcx, rax
call sub.msvcrt.dll_memcpy
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov rdx, rdi
mov ecx, 1
call qword [sym.imp.USER32.dll_SetClipboardData]
call qword [sym.imp.USER32.dll_CloseClipboard]
mov rbx, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x78]
mov rcx, qword [rbp + 0x2d8]
mov rcx, qword [rcx + 0x1f8]
lea r11, [rsp + 0x60]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop r12
jmp qword [sym.imp.USER32.dll_SetFocus]
Function at 0x140012060
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push r12
sub rsp, 0x60
mov r12, qword [rcx + 0x2d8]
mov rbp, rcx
xor r9d, r9d
mov rsi, qword [r12 + 0x1f8]
xor r8d, r8d
mov edx, 0x1032
mov rcx, rsi
call qword [sym.imp.USER32.dll_SendMessageA]
cmp eax, 1
jne 0x1400121d9
xor r9d, r9d
xor r8d, r8d
mov edx, 0x1004
mov rcx, rsi
mov qword [rsp + 0x70], rbx
mov qword [rsp + 0x78], rdi
call qword [sym.imp.USER32.dll_SendMessageA]
xor edi, edi
test eax, eax
mov rbx, rax
jle 0x1400121cf
nop
nop
movsxd r8, edi
mov edx, 0x102c
mov r9d, 2
mov rcx, rsi
call qword [sym.imp.USER32.dll_SendMessageA]
cmp eax, 2
je 0x1400120f8
add edi, 1
cmp edi, ebx
jl 0x1400120d0
jmp 0x1400121cf
lea r9, [rsp + 0x20]
xor r8d, r8d
mov edx, 0x1005
mov rcx, rsi
mov dword [rsp + 0x20], 4
mov dword [rsp + 0x30], 0
mov dword [rsp + 0x24], edi
mov dword [rsp + 0x28], 0
call qword [sym.imp.USER32.dll_SendMessageA]
test eax, eax
je 0x1400121cf
mov rax, qword [r12]
mov rdi, qword [rsp + 0x48]
mov rcx, r12
call qword [rax]
mov rcx, qword [rbp + 0x110]
mov rdx, qword [rax]
mov eax, dword [r12 + 8]
imul eax, edi
movsxd rbx, eax
add rbx, rdx
add rbx, 0x91
call qword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x1400121cf
call qword [sym.imp.USER32.dll_EmptyClipboard]
test rbx, rbx
je 0x1400121c9
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, rbx
repne scasb al, byte [rdi]
not rcx
movsxd rsi, ecx
mov ecx, 0x2000
mov rdx, rsi
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
test rax, rax
mov rdi, rax
je 0x1400121c9
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GlobalLock]
mov r8, rsi
mov rdx, rbx
mov rcx, rax
call sub.msvcrt.dll_memcpy
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov rdx, rdi
mov ecx, 1
call qword [sym.imp.USER32.dll_SetClipboardData]
call qword [sym.imp.USER32.dll_CloseClipboard]
mov rbx, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x78]
mov rcx, qword [rbp + 0x2d8]
mov rcx, qword [rcx + 0x1f8]
lea r11, [rsp + 0x60]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop r12
jmp qword [sym.imp.USER32.dll_SetFocus]
Function at 0x1400133c0
Capabilities:
Create process on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rdi
push r12
push r14
push r15
sub rsp, 0x80
mov rax, qword [rcx + 0x2d0]
mov r8, qword [rcx + 0x2d8]
mov r12, rcx
mov eax, dword [rax + 0x584]
mov r14d, edx
mov dword [r8 + 0x24c], eax
mov rdi, qword [rcx + 0x2d8]
mov rcx, rdi
call fcn.140019a00
xor eax, eax
lea rbx, [r12 + 0x1bc]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], eax
mov r15d, 1
mov rcx, rbx
xor r9d, r9d
mov edx, 0x40000000
mov r8d, r15d
mov dword [rsp + 0x20], 2
call qword [sym.imp.KERNEL32.dll_CreateFileA]
cmp rax, 0xffffffffffffffff
mov rbp, rax
je 0x140013609
mov edx, 0x7f02
xor ecx, ecx
mov qword [rsp + 0xb0], rsi
mov qword [rsp + 0xb8], r13
call qword [sym.imp.USER32.dll_LoadCursorA]
mov rcx, rax
call qword [sym.imp.USER32.dll_SetCursor]
mov r9, qword [rdi]
lea r8d, [r15 + 3]
mov rdx, rbp
mov rcx, rdi
mov qword [0x14002f270], rax
call qword [r9 + 0xa0]
mov rcx, qword [rdi + 0x1f8]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x1004
call qword [sym.imp.USER32.dll_SendMessageA]
mov r13, rax
xor eax, eax
test r13d, r13d
mov esi, eax
jle 0x14001359b
nop
mov rcx, qword [rdi + 0x1f8]
lea r9, [rsp + 0x40]
xor r8d, r8d
mov edx, 0x1005
mov dword [rsp + 0x40], 4
mov dword [rsp + 0x50], eax
mov dword [rsp + 0x44], esi
mov dword [rsp + 0x48], eax
call qword [sym.imp.USER32.dll_SendMessageA]
test eax, eax
je 0x140013577
mov rax, qword [rdi]
mov rbx, qword [rsp + 0x68]
mov rcx, rdi
call qword [rax]
mov rcx, qword [rax]
mov eax, dword [rdi + 8]
imul eax, ebx
movsxd rbx, eax
add rbx, rcx
cmp dword [rdi + 0x248], 0
je 0x14001352e
mov rcx, qword [rdi + 0x1f8]
movsxd r8, esi
mov edx, 0x102c
mov r9d, 0xf000
call qword [sym.imp.USER32.dll_SendMessageA]
shr eax, 0xc
sub eax, r15d
jmp 0x140013552
mov rcx, qword [rdi + 0x1f8]
movsxd r8, esi
mov edx, 0x102c
mov r9d, 2
call qword [sym.imp.USER32.dll_SendMessageA]
xor ecx, ecx
test eax, eax
setne cl
mov eax, ecx
test r14d, r14d
je 0x14001355b
test eax, eax
je 0x140013577
mov rax, qword [rdi]
mov r9d, 4
mov r8, rbx
mov rdx, rbp
mov rcx, rdi
call qword [rax + 0xf0]
test eax, eax
je 0x140013586
add esi, r15d
cmp esi, r13d
jge 0x140013593
xor eax, eax
jmp 0x1400134b0
xor r15d, r15d
lea rbx, [r12 + 0x1bc]
jmp 0x14001359b
lea rbx, [r12 + 0x1bc]
mov rax, qword [rdi]
mov r8d, 4
mov rdx, rbp
mov rcx, rdi
call qword [rax + 0x98]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [0x14002f270]
call qword [sym.imp.USER32.dll_SetCursor]
test r15d, r15d
mov r13, qword [rsp + 0xb8]
mov rsi, qword [rsp + 0xb0]
je 0x140013609
mov rcx, qword [r12 + 0x110]
lea r9, [0x140027e59]
lea rdx, str.open
mov r8, rbx
mov dword [rsp + 0x28], 5
mov qword [rsp + 0x20], r9
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
jmp 0x140013626
mov rax, qword [0x14002fec0]
mov rcx, qword [r12 + 0x110]
xor edx, edx
mov r8d, dword [rax + 0x59c]
call fcn.140020350
mov rbx, qword [rsp + 0xc0]
add rsp, 0x80
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret