joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14019f7e0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x78
movaps xmmword [rsp + 0x60], xmm6
movaps xmm6, xmm1
mov rcx, qword [rcx]
test rcx, rcx
jne 0x14019f7fa
xor eax, eax
xor edx, edx
jmp 0x14019f800
mov eax, dword [rcx + 0x18]
mov edx, dword [rcx + 0x14]
mov dword [rsp + 0x4c], edx
mov dword [rsp + 0x50], eax
mov qword [rsp + 0x58], 0
mov rax, qword [rcx]
mov dword [rsp + 0x20], 2
xor r9d, r9d
xor r8d, r8d
lea rdx, [rsp + 0x30]
call qword [rax + 0x20]
nop
mov ecx, dword [rsp + 0x40]
test ecx, ecx
je 0x14019f95a
sub ecx, 1
je 0x14019f95a
sub ecx, 1
je 0x14019f8ba
cmp ecx, 1
jne 0x14019f95a
xor r9d, r9d
mov r10d, dword [rsp + 0x50]
test r10d, r10d
jle 0x14019f95a
mov r8d, dword [rsp + 0x4c]
movsxd rcx, dword [rsp + 0x44]
movsxd rax, r9d
imul rcx, rax
add rcx, qword [rsp + 0x30]
xor edx, edx
test r8d, r8d
jle 0x14019f8ad
nop dword [rax]
movzx eax, byte [rcx]
movd xmm0, eax
cvtdq2ps xmm0, xmm0
mulss xmm0, xmm6
cvttss2si eax, xmm0
mov byte [rcx], al
movsxd rax, dword [rsp + 0x48]
add rcx, rax
inc edx
mov r8d, dword [rsp + 0x4c]
cmp edx, r8d
jl 0x14019f880
mov r10d, dword [rsp + 0x50]
inc r9d
cmp r9d, r10d
jl 0x14019f864
jmp 0x14019f95a
xor r10d, r10d
mov r8d, dword [rsp + 0x50]
test r8d, r8d
jle 0x14019f95a
movss xmm1, dword [0x1405239b8]
mov ecx, dword [rsp + 0x4c]
nop word [rax + rax]
movsxd rdx, dword [rsp + 0x44]
movsxd rax, r10d
imul rdx, rax
add rdx, qword [rsp + 0x30]
xor r9d, r9d
test ecx, ecx
jle 0x14019f952
movaps xmm0, xmm6
mulss xmm0, xmm1
cvttss2si eax, xmm0
mov r8d, 1
sub r8d, eax
nop dword [rax]
mov ecx, dword [rdx]
mov eax, ecx
shr eax, 8
and eax, 0xff00ff
imul eax, r8d
and ecx, 0xff00ff
imul ecx, r8d
shr ecx, 8
xor ecx, eax
and ecx, 0xff00ff
xor ecx, eax
mov dword [rdx], ecx
movsxd rax, dword [rsp + 0x48]
add rdx, rax
inc r9d
mov ecx, dword [rsp + 0x4c]
cmp r9d, ecx
jl 0x14019f910
mov r8d, dword [rsp + 0x50]
inc r10d
cmp r10d, r8d
jl 0x14019f8e0
mov rcx, qword [rsp + 0x58]
test rcx, rcx
je 0x14019f96e
mov rax, qword [rcx]
mov edx, 1
call qword [rax]
movaps xmm6, xmmword [rsp + 0x60]
add rsp, 0x78
ret
Function at 0x1401d5af0
Capabilities:
Log keystrokes via polling

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
test dl, dl
je 0x1401d5b95
mov ecx, reloc.WS2_32.dll_WSAStartup
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
movzx edx, ax
mov eax, dword [0x1405a7830]
shr edx, 0xf
test dl, 1
je 0x1401d5b27
mov edx, eax
and dl, 7
cmp dl, 4
je 0x1401d5b95
cmp byte [rbx + 0x245], 0
jne 0x1401d5b89
mov ebx, 0x1b
mov ecx, ebx
call qword [sym.imp.USER32.dll_VkKeyScanW]
cmp al, 0xff
je 0x1401d5b44
movzx ebx, al
mov ecx, ebx
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
shr eax, 0xf
test al, 1
je 0x1401d5b5c
test byte [0x1405a7830], 7
je 0x1401d5b95
mov ebx, SafeArrayGetDim
mov ecx, ebx
call qword [sym.imp.USER32.dll_VkKeyScanW]
cmp al, 0xff
je 0x1401d5b70
movzx ebx, al
mov ecx, ebx
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
shr eax, 0xf
test al, 1
mov eax, dword [0x1405a7830]
je 0x1401d5b89
test al, 7
je 0x1401d5b95
shr eax, 1
not al
and al, 1
add rsp, 0x20
pop rbx
ret
xor al, al
add rsp, 0x20
pop rbx
ret
Function at 0x1401e30a0
Capabilities:
Log keystrokes via polling

Disassembly:
sub rsp, 0x28
test dl, dl
je 0x1401e3150
mov ecx, 0x26
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
shr eax, 0xf
test al, 1
jne 0x1401e3149
mov ecx, 0x21
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
shr eax, 0xf
test al, 1
jne 0x1401e3149
mov ecx, 0x28
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
shr eax, 0xf
test al, 1
jne 0x1401e3149
mov ecx, 0x22
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
shr eax, 0xf
test al, 1
jne 0x1401e3149
mov ecx, 0x24
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
shr eax, 0xf
test al, 1
jne 0x1401e3149
mov ecx, 0x23
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
shr eax, 0xf
test al, 1
jne 0x1401e3149
mov qword [rsp + 0x20], rbx
mov ebx, SafeArrayGetDim
mov ecx, ebx
call qword [sym.imp.USER32.dll_VkKeyScanW]
cmp al, 0xff
je 0x1401e3135
movzx ebx, al
mov ecx, ebx
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
mov rbx, qword [rsp + 0x20]
shr eax, 0xf
test al, 1
je 0x1401e3150
mov al, 1
add rsp, 0x28
ret
xor al, al
add rsp, 0x28
ret

Function at 0x1401e62f0
Capabilities:
Log keystrokes via polling

Disassembly:
sub rsp, 0x28
test dl, dl
je 0x1401e6347
mov ecx, 0x26
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
shr eax, 0xf
test al, 1
jne 0x1401e6340
mov ecx, 0x25
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
shr eax, 0xf
test al, 1
jne 0x1401e6340
mov ecx, 0x28
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
shr eax, 0xf
test al, 1
jne 0x1401e6340
mov ecx, 0x27
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
shr eax, 0xf
test al, 1
je 0x1401e6347
mov al, 1
add rsp, 0x28
ret
xor al, al
add rsp, 0x28
ret
Function at 0x14021fe60
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x60
mov rbx, rdx
mov rsi, rcx
mov byte [rcx + 0x20e], 0
mov r8d, dword [rcx - 0xb4]
mov eax, dword [rcx - 0xb8]
xor ecx, ecx
mov qword [rsp + 0x40], rcx
mov dword [rsp + 0x48], eax
mov dword [rsp + 0x4c], r8d
movaps xmm0, xmmword [rsp + 0x40]
movdqa xmmword [rsp + 0x50], xmm0
mov r8b, 1
lea rdx, [rsp + 0x50]
lea rcx, [rsi - 0xf8]
call fcn.140237640
xor edx, edx
mov rcx, rbx
call fcn.14012fcd0
mov rdx, rax
lea rcx, [rsp + 0x70]
call fcn.140145b30
nop
lea rbp, [0x140592ec8]
mov rbx, qword [rsp + 0x70]
cmp byte [rbx], 0
je 0x14021ff6b
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x28]
call fcn.140016140
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
nop
cmp eax, 0xffffffff
je 0x14021ff66
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x30]
call fcn.140016140
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
nop
test al, 0x10
je 0x14021ff2e
cmp eax, 0xffffffff
je 0x14021ff2e
mov al, 1
jmp 0x14021ff30
xor al, al
cmp al, byte [rsi + 0x20c]
jne 0x14021ff66
mov rbx, qword [rsp + 0x70]
mov qword [rsp + 0x20], rbx
lea rax, [rbx - 0x10]
cmp rax, rbp
je 0x14021ff53
lock inc dword [rax]
mov rbx, qword [rsp + 0x70]
lea rdx, [rsp + 0x20]
lea rcx, [rsi - 0xf8]
call fcn.14021fa70
jmp 0x14021ff6b
mov rbx, qword [rsp + 0x70]
lea rcx, [rbx - 0x10]
cmp rcx, rbp
je 0x14021ff89
mov eax, 0xffffffff
lock xadd dword [rcx], eax
dec eax
cmp eax, 0xffffffff
jne 0x14021ff89
call fcn.1400c9d7c
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x140225d80
Capabilities:
Get file attributes

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rdx
mov rbx, rcx
lea rcx, [rsp + 0x48]
call fcn.140016140
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
nop
test al, 0x10
je 0x140225e23
cmp eax, 0xffffffff
je 0x140225e23
lea rcx, [rbx - 0xe8]
mov rdx, rdi
call fcn.140226c40
mov eax, dword [rbx + 0x50]
test al, 8
je 0x140225e71
bt eax, 8
jb 0x140225e71
lea rcx, [rbx + 0x280]
lea rbx, [0x140592ec8]
lea rax, [rbx + 0x10]
mov qword [rsp + 0x38], rax
mov r8b, 1
lea rdx, [rsp + 0x38]
call fcn.1401daa60
nop
mov rcx, qword [rsp + 0x38]
add rcx, 0xfffffffffffffff0
cmp rcx, rbx
je 0x140225e71
mov edx, 0xffffffff
lock xadd dword [rcx], edx
dec edx
cmp edx, 0xffffffff
jne 0x140225e71
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp fcn.1400c9d7c
lea rdx, [rbx - 0xe8]
lea rcx, [rsp + 0x40]
call fcn.1400a5460
nop
lea rcx, [rbx + 0x70]
mov qword [rsp + 0x38], rdi
lea r9, [rsp + 0x38]
lea r8, [rsp + 0x40]
call fcn.1400b1e90
nop
mov rax, qword [rsp + 0x40]
test rax, rax
je 0x140225e71
mov edx, 0xffffffff
lock xadd dword [rax + 8], edx
cmp edx, 1
jne 0x140225e71
mov rcx, qword [rsp + 0x40]
mov rax, qword [rcx]
call qword [rax]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x140227220
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
xor r8d, r8d
lea rdx, [rsp + 0x38]
call fcn.1402272e0
test byte [rbx + 0x138], 8
jne 0x140227265
lea rdx, [rsp + 0x38]
lea rcx, [rsp + 0x40]
call fcn.140016140
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
nop
test al, 0x10
je 0x140227265
cmp eax, 0xffffffff
je 0x140227265
xor bl, bl
jmp 0x14022729f
mov eax, dword [rbx + 0x138]
shr eax, 1
test al, 1
jne 0x14022729d
mov rax, qword [rsp + 0x38]
cmp byte [rax], 0
je 0x140227299
lea rdx, [rsp + 0x38]
lea rcx, [rsp + 0x30]
call fcn.140016140
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
nop
cmp eax, 0xffffffff
jne 0x14022729d
xor bl, bl
jmp 0x14022729f
mov bl, 1
mov rcx, qword [rsp + 0x38]
add rcx, 0xfffffffffffffff0
lea rax, [0x140592ec8]
cmp rcx, rax
je 0x1402272c9
mov edx, 0xffffffff
lock xadd dword [rcx], edx
dec edx
cmp edx, 0xffffffff
jne 0x1402272c9
call fcn.1400c9d7c
movzx eax, bl
add rsp, 0x20
pop rbx
ret
Function at 0x140228c90
Capabilities:
Get file attributes

Disassembly:
push rbx
sub rsp, 0x30
mov qword [rsp + 0x20], r14
mov rbx, rcx
mov r14, rdx
mov rdx, qword [rcx + 0x58]
cmp qword [r14], rdx
je 0x140228dd1
mov rcx, qword [r14]
call fcn.140017f20
test eax, eax
je 0x140228dd1
mov qword [rsp + 0x40], rbp
lea rdx, [rbx + 0x48]
mov qword [rsp + 0x28], rdi
mov ebp, 1
xor edi, edi
mov eax, ebp
xchg byte [rbx + 0xc0], al
mov rcx, qword [rbx + 0x68]
test rbx, rbx
cmove rdx, rdi
call fcn.14012c360
mov eax, edi
xchg byte [rbx + 0xc1], al
cmp dword [rbx + 0xb4], edi
je 0x140228d5e
lea rcx, [rbx + 0xa8]
mov qword [rsp + 0x48], rsi
call fcn.1400a46a0
cmp dword [rbx + 0xb0], edi
je 0x140228d27
mov rcx, qword [rbx + 0xa8]
call fcn.1400d4bdc
mov qword [rbx + 0xa8], rdi
mov rsi, qword [rsp + 0x48]
mov dword [rbx + 0xb0], edi
movzx eax, byte [rbx + 0x40]
nop
test al, al
je 0x140228d5e
mov rcx, qword [rbx + 0x10]
xor eax, eax
lock cmpxchg dword [rcx + 0x18], ebp
jne 0x140228d5e
mov rcx, qword [rbx + 0x10]
call fcn.140150f00
test al, al
jne 0x140228d5e
mov rcx, qword [rbx + 0x10]
mov eax, edi
xchg dword [rcx + 0x18], eax
mov rax, qword [r14]
lea rdx, [0x140592ec8]
sub rax, 0x10
cmp rax, rdx
je 0x140228d74
lock inc dword [rax]
mov rcx, qword [r14]
xchg qword [rbx + 0x58], rcx
add rcx, 0xfffffffffffffff0
cmp rcx, rdx
je 0x140228d99
mov eax, 0xffffffff
lock xadd dword [rcx], eax
dec eax
cmp eax, 0xffffffff
jne 0x140228d99
call fcn.1400c9d7c
movzx eax, byte [rbx + 0x40]
nop
test al, al
je 0x140228dc3
mov rcx, qword [rbx + 0x10]
xor eax, eax
lock cmpxchg dword [rcx + 0x18], ebp
jne 0x140228dc3
mov rcx, qword [rbx + 0x10]
call fcn.140150f00
test al, al
jne 0x140228dc3
mov rax, qword [rbx + 0x10]
xchg dword [rax + 0x18], edi
and dword [rbx + 0x70], 0xfffffffc
mov rdi, qword [rsp + 0x28]
mov rbp, qword [rsp + 0x40]
mov ecx, dword [rbx + 0x70]
mov r14, qword [rsp + 0x20]
or ecx, 3
cmp dword [rbx + 0x70], ecx
je 0x140228df1
mov dword [rbx + 0x70], ecx
mov rcx, rbx
add rsp, 0x30
pop rbx
jmp fcn.140228a00
add rsp, 0x30
pop rbx
ret

Function at 0x140228ff0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x30
mov rdi, rdx
mov rbx, rcx
mov rdx, qword [rcx + 8]
add rdx, 0x58
mov rax, qword [rdx]
cmp byte [rax], 0
je 0x14022909c
lea rcx, [rsp + 0x58]
call fcn.140016140
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
nop
cmp eax, 0xffffffff
je 0x14022909c
mov dword [rsp + 0x20], 0
lea r9, vtable.type_info.0
lea r8, vtable.type_info.0
xor edx, edx
mov rcx, rbx
call fcn.1400cc570
mov rdx, rax
lea rcx, [rsp + 0x50]
call fcn.1400a5460
nop
lea rcx, [rbx + 0x10]
mov qword [rsp + 0x40], rdi
lea r9, [rsp + 0x40]
lea r8, [rsp + 0x50]
call fcn.1400b1400
nop
mov rax, qword [rsp + 0x50]
test rax, rax
je 0x14022909c
mov ecx, 0xffffffff
lock xadd dword [rax + 8], ecx
cmp ecx, 1
jne 0x14022909c
mov rcx, qword [rsp + 0x50]
mov rax, qword [rcx]
mov edx, 1
call qword [rax]
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
Function at 0x14023ec90
Capabilities:
Create process on windows

Disassembly:
add rcx, 0x220
mov rax, qword [rcx]
cmp byte [rax], 0
jne fcn.140148850
ret

Function at 0x14023fd10
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
movzx eax, byte [rcx + 0xe0]
mov rdi, rcx
test al, 2
je 0x14023fdd2
mov rcx, qword [rcx + 0x30]
test rcx, rcx
je 0x14023fd41
call fcn.14023ab70
jmp 0x14023fd64
test al, 1
je 0x14023fdd2
mov rcx, rdi
call fcn.1401c8ed0
test rax, rax
je 0x14023fdd2
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x70]
test al, al
sete al
test al, al
je 0x14023fdd2
mov rcx, rdi
call fcn.140237cf0
test al, al
jne 0x14023fdd2
mov rbx, qword [rdi + 0x178]
movsxd rax, dword [rdi + 0x184]
lea rcx, [rax + rax*2]
lea rsi, [rbx + rcx*4]
cmp rbx, rsi
je 0x14023fdd2
nop
mov edi, dword [rbx]
bt edi, 0x10
jae 0x14023fd9d
movzx edi, di
jmp 0x14023fdad
movzx ecx, di
call qword [sym.imp.USER32.dll_VkKeyScanW]
cmp al, 0xff
je 0x14023fdad
movzx edi, al
mov ecx, edi
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
shr eax, 0xf
test al, 1
je 0x14023fdc9
mov eax, dword [rbx + 4]
xor eax, dword [0x1405a7830]
test al, 7
je 0x14023fde4
add rbx, 0xc
cmp rbx, rsi
jne 0x14023fd90
xor al, al
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov rbx, qword [rsp + 0x30]
mov al, 1
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x1402453a0
Capabilities:
Enumerate gui resources

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x30
mov rdi, rdx
mov r14, rcx
xor esi, esi
call fcn.140244410
test rax, rax
je 0x1402453e7
mov rdx, rdi
lea rcx, [rsp + 0x78]
call fcn.1400a6db0
mov rdx, qword [rax]
mov qword [rax], rsi
mov qword [r14], rdx
lea rcx, [rsp + 0x78]
call fcn.1401c1310
jmp 0x140245525
mov eax, dword [rdi + 0x24]
lea r15, [0x140592ec8]
cmp eax, 3
jne 0x1402453fa
mov ebp, eax
jmp 0x140245455
cmp eax, 2
jne 0x140245453
lea rcx, [rdi + 0x18]
xor edx, edx
call fcn.14012fcd0
mov rcx, qword [rax]
lea rbx, [rcx - 0x10]
cmp rbx, r15
je 0x140245419
lock inc dword [rbx]
lea rdx, [0x14052013c]
call fcn.140019fc0
mov ebp, 4
mov ecx, 1
test eax, eax
cmove ebp, ecx
cmp rbx, r15
je 0x140245455
mov eax, 0xffffffff
lock xadd dword [rbx], eax
dec eax
cmp eax, 0xffffffff
jne 0x140245455
mov rcx, rbx
call fcn.1400c9d7c
jmp 0x140245455
mov ebp, esi
mov ecx, 0x40
call fcn.1400c9d40
mov rbx, rax
mov qword [rsp + 0x70], rax
mov rax, qword [rdi + 0x28]
test rax, rax
je 0x140245476
mov rdx, qword [rax + 0x10]
jmp 0x140245479
mov rdx, rsi
lea rax, vtable.._AVWindowsMessageBoxBase__1__create_ScopedMessageBoxInterface_detail_juce__SA_AV__unique_ptr_UScopedMessageBoxInterface_detail_juce__U__default_delete_UScopedMessageBoxInterface_detail_juce___std___std__AEBVMessageBoxOptions_4__Z_.0
mov qword [rbx], rax
lea rcx, [rbx + 8]
call fcn.1400a5460
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], rsi
mov byte [rbx + 0x20], 0
lea rax, vtable.._AVPreVistaMessageBox__1__create_ScopedMessageBoxInterface_detail_juce__SA_AV__unique_ptr_UScopedMessageBoxInterface_detail_juce__U__default_delete_UScopedMessageBoxInterface_detail_juce___std___std__AEBVMessageBoxOptions_4__Z_.0
mov qword [rbx], rax
mov esi, dword [rdi]
mov byte [rsp + 0x70], 0
lea rdx, [rsp + 0x70]
lea rcx, [0x140248c70]
call qword [sym.imp.USER32.dll_EnumWindows]
movzx eax, byte [rsp + 0x70]
neg al
sbb ecx, ecx
and ecx, 0x40000
sub esi, 1
je 0x1402454ee
sub esi, 1
je 0x1402454e7
cmp esi, 1
je 0x1402454e0
mov eax, 0x12000
jmp 0x1402454f3
mov eax, 0x12040
jmp 0x1402454f3
mov eax, 0x12030
jmp 0x1402454f3
mov eax, 0x12020
or eax, ecx
or eax, ebp
mov dword [rbx + 0x28], eax
mov rax, qword [rdi + 8]
mov qword [rbx + 0x30], rax
add rax, 0xfffffffffffffff0
cmp rax, r15
je 0x14024550e
lock inc dword [rax]
mov rax, qword [rdi + 0x10]
mov qword [rbx + 0x38], rax
add rax, 0xfffffffffffffff0
cmp rax, r15
je 0x140245522
lock inc dword [rax]
mov qword [r14], rbx
mov rax, r14
mov rbx, qword [rsp + 0x60]
add rsp, 0x30
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x140246a80
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x30
mov rbx, rcx
mov dword [rsp + 0x20], 0
lea rax, [0x140592ed8]
mov qword [rcx], rax
mov dword [rsp + 0x20], 1
xor ecx, ecx
call qword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x140246b3c
mov ecx, SafeArrayGetDim
call qword [sym.imp.USER32.dll_GetClipboardData]
mov rdi, rax
test rax, rax
je 0x140246b36
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GlobalLock]
mov rsi, rax
test rax, rax
je 0x140246b36
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GlobalSize]
shr rax, 1
mov r8, rax
mov rdx, rsi
lea rcx, [rsp + 0x48]
call fcn.140019190
mov rax, qword [rbx]
mov rcx, qword [rsp + 0x48]
mov qword [rbx], rcx
lea rcx, [rax - 0x10]
lea rax, [0x140592ec8]
cmp rcx, rax
je 0x140246b2d
mov eax, 0xffffffff
lock xadd dword [rcx], eax
dec eax
cmp eax, 0xffffffff
jne 0x140246b2d
call fcn.1400c9d7c
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
call qword [sym.imp.USER32.dll_CloseClipboard]
mov rax, rbx
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret

Function at 0x140246b60
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push rsi
sub rsp, 0x20
mov rsi, rcx
xor ecx, ecx
call qword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x140246bfe
call qword [sym.imp.USER32.dll_EmptyClipboard]
test eax, eax
je 0x140246bf2
mov rcx, qword [rsi]
mov qword [rsp + 0x30], rbx
call fcn.140019a30
mov rbx, rax
add rbx, 4
je 0x140246bed
lea rdx, [rbx + 2]
mov qword [rsp + 0x38], rdi
mov ecx, 0x2042
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov rdi, rax
test rax, rax
je 0x140246be8
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GlobalLock]
test rax, rax
je 0x140246be8
mov r8, rbx
mov rdx, rax
mov rcx, rsi
call fcn.140131610
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov rdx, rdi
mov ecx, SafeArrayGetDim
call qword [sym.imp.USER32.dll_SetClipboardData]
mov rdi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rsi
jmp qword [sym.imp.USER32.dll_CloseClipboard]
add rsp, 0x20
pop rsi
ret
Function at 0x140248870
Capabilities:
Link many functions at runtime

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
lea rcx, str.user32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
xor ebx, ebx
test rax, rax
je 0x1402488a0
lea rdx, str.SetProcessDPIAware
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
jmp 0x1402488a3
mov rax, rbx
lea rcx, str.SHCore.dll
mov qword [0x1405a7c48], rax
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
lea rcx, str.SHCore.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rdi, rax
test rax, rax
je 0x140248a49
lea rdx, [0x1404fde40]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.SetProcessDpiAwareness
mov rcx, rdi
mov qword [0x1405a7cc8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rcx, str.user32.dll
mov qword [0x1405a7c90], rax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
je 0x140248922
lea rdx, [0x1404fdf90]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
jmp 0x140248925
mov rax, rbx
lea rdx, str.GetProcessDpiAwareness
mov qword [0x1405a7c50], rax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rcx, str.user32.dll
mov qword [0x1405a7c80], rax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
je 0x140248967
lea rdx, [0x1404fdf50]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
jmp 0x14024896a
mov rax, rbx
lea rcx, str.user32.dll
mov qword [0x1405a7cb0], rax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
je 0x140248993
lea rdx, [0x1404fdf70]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rcx, str.user32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
je 0x1402489b7
lea rdx, [0x1404fdf08]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
jmp 0x1402489ba
mov rax, rbx
lea rcx, str.user32.dll
mov qword [0x1405a7cc0], rax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
je 0x1402489e5
lea rdx, [0x1404fdf28]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
jmp 0x1402489e8
mov rax, rbx
lea rcx, str.user32.dll
mov qword [0x1405a7c70], rax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
je 0x140248a13
lea rdx, str.SetProcessDpiAwarenessContext
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
jmp 0x140248a16
mov rax, rbx
lea rcx, str.user32.dll
mov qword [0x1405a7c60], rax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
je 0x140248a42
lea rdx, str.EnableNonClientDpiScaling
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
mov qword [0x1405a7c58], rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x1400153f4
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14001543e
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14001543e
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14001543e
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14001543e
cmp dword [rcx + 0x84], 0xe
jbe 0x14001543e
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140015440
xor al, al
add rsp, 0x28
ret
Function at 0x401010
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
mov rax, qword [0x00416b80]
xor edx, edx
mov dword [rax], 1
mov rax, qword [0x00416b90]
mov dword [rax], 1
mov rax, qword [0x00416ba0]
mov dword [rax], 1
mov rax, qword [0x00416b70]
mov dword [rax], 1
mov rax, qword [0x00416a40]
cmp word [rax], 0x5a4d
je 0x4010b0
mov rax, qword [0x00416b60]
mov dword [0x00419008], edx
mov eax, dword [rax]
test eax, eax
je 0x4010a0
mov ecx, 2
call sym.__set_app_type
call sym.__p__fmode
mov rdx, qword [0x00416b00]
mov edx, dword [rdx]
mov dword [rax], edx
call sym._setargv
mov rax, qword [0x004169f0]
cmp dword [rax], 1
je 0x4010f0
xor eax, eax
add rsp, 0x28
ret
mov ecx, 1
call sym.__set_app_type
jmp 0x401075
movsxd rcx, dword [rax + 0x3c]
add rax, rcx
cmp dword [rax], 0x4550
jne 0x401058
movzx ecx, word [rax + 0x18]
cmp cx, 0x10b
je 0x401103
cmp cx, 0x20b
jne 0x401058
cmp dword [rax + 0x84], 0xe
jbe 0x401058
mov ecx, dword [rax + 0xf8]
xor edx, edx
test ecx, ecx
setne dl
jmp 0x401058
lea rcx, [sym._matherr]
call sym.__mingw_setusermatherr
xor eax, eax
add rsp, 0x28
ret
cmp dword [rax + 0x74], 0xe
jbe 0x401058
mov r8d, dword [rax + 0xe8]
xor edx, edx
test r8d, r8d
setne dl
jmp 0x401058