joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400dd010
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rdi
push r12
sub rsp, 0x20
cmp word [rdx], 0
movzx r12d, r9w
mov rbp, r8
mov rdi, rdx
mov rbx, rcx
jne 0x1400dd073
mov eax, dword [rsp + 0x58]
mov word [rcx + 0x38], r9w
mov dword [rcx + 0x40], eax
movzx eax, byte [rsp + 0x70]
mov byte [rcx + 0x3a], al
movzx eax, byte [rsp + 0x78]
mov byte [rcx + 0x3b], al
movzx eax, word [rsp + 0x80]
mov word [rcx + 0x3c], ax
mov rax, qword [rsp + 0x60]
mov qword [rcx + 0x48], rax
mov eax, 1
jmp 0x1400dd1ad
call fcn.1400dc8e0
test rax, rax
je 0x1400dd09a
lea rdx, str.Duplicate_declaration.
lea rcx, [0x140143150]
mov r8, rdi
call fcn.14005f7b0
xor eax, eax
jmp 0x1400dd1ad
mov rax, qword [rbx + 0x20]
mov qword [rsp + 0x30], rsi
cmp qword [rbx + 0x18], rax
jne 0x1400dd0d6
lea rsi, [rax + rax]
test rax, rax
jne 0x1400dd0b7
mov esi, 4
mov rcx, qword [rbx + 0x10]
lea rdx, [rsi + rsi*2]
shl rdx, 4
call qword [sym.imp.MSVCR100.dll_realloc]
test rax, rax
je 0x1400dd0e7
mov qword [rbx + 0x10], rax
mov qword [rbx + 0x20], rsi
mov rcx, rdi
call qword [sym.imp.MSVCR100.dll__wcsdup]
mov rsi, rax
test rax, rax
jne 0x1400dd108
lea r8, [0x1401035ac]
lea rdx, str.Out_of_memory.
lea rcx, [0x140143150]
call fcn.14005f7b0
xor eax, eax
jmp 0x1400dd1a8
mov rax, qword [rbp]
lea rcx, [rax + 1]
lea rdi, [rax + rax*2]
mov rax, qword [rbx + 0x18]
shl rdi, 4
mov qword [rbp], rcx
add rdi, qword [rbx + 0x10]
cmp rcx, rax
jge 0x1400dd141
sub rax, rcx
lea rcx, [rdi + 0x30]
mov rdx, rdi
lea r8, [rax + rax*2]
shl r8, 4
call qword [sym.imp.MSVCR100.dll_memmove]
inc qword [rbx + 0x18]
mov ecx, dword [rsp + 0x50]
mov eax, dword [rsp + 0x68]
mov dword [rdi + 0xc], ecx
movzx ecx, byte [rsp + 0x88]
mov dword [rdi + 8], eax
mov eax, dword [rsp + 0x58]
mov byte [rdi + 0x13], cl
movzx ecx, byte [rsp + 0x90]
mov byte [rdi + 0x12], cl
movzx ecx, byte [rsp + 0x70]
mov dword [rdi + 0x18], eax
mov byte [rdi + 0x14], cl
movzx ecx, byte [rsp + 0x78]
mov qword [rdi + 0x28], rsi
mov byte [rdi + 0x15], cl
movzx ecx, word [rsp + 0x80]
mov word [rdi + 0x10], r12w
mov word [rdi + 0x16], cx
mov rcx, qword [rsp + 0x60]
mov dword [rdi + 0x1c], 0
mov qword [rdi + 0x20], rcx
mov rax, rdi
mov rsi, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r12
ret
Function at 0x1400ddd70
Capabilities:
Clear file content

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rsi, rdx
mov rdx, qword [rcx + 0x30]
xor edi, edi
mov rbx, rcx
test rdx, rdx
je 0x1400dddac
sub rdx, qword [rcx + 0x38]
mov eax, dword [rcx + 0xc]
mov r9, qword [rcx]
lea r8d, [rdi + 1]
sub rdx, rax
call qword [r9 + 0x28]
mov qword [rbx + 0x30], rdi
mov dword [rbx + 0xc], edi
mov r8d, dword [rbx + 0xc]
test r8d, r8d
je 0x1400dddcb
cmp qword [rbx + 0x30], rdi
jne 0x1400dddcb
mov rax, qword [rbx]
mov rdx, qword [rbx + 0x38]
mov rcx, rbx
call qword [rax + 0x20]
mov dword [rbx + 0xc], edi
mov rax, qword [rbx]
mov rcx, rbx
mov word [rbx + 0x2c], di
call qword [rax + 0x30]
mov r9, qword [rbx]
xor r8d, r8d
mov rdx, rsi
mov rcx, rbx
mov rdi, rax
call qword [r9 + 0x28]
test al, al
je 0x1400dde2c
mov rcx, qword [rbx + 0x40]
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
je 0x1400dde2c
mov rax, qword [rbx]
cmp rsi, rdi
mov rcx, rbx
cmovl rdi, rsi
xor r8d, r8d
mov rdx, rdi
call qword [rax + 0x28]
mov r11, qword [rbx]
mov rcx, rbx
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp qword [r11 + reloc.WSOCK32.dll_getservbyport]
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
or rax, 0xffffffffffffffff
add rsp, 0x20
pop rdi
ret
Function at 0x1400e15a0
Capabilities:
Get file attributes

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x270
mov rdi, rdx
mov rbx, rcx
test rcx, rcx
je 0x1400e1698
cmp word [rcx], 0
je 0x1400e1698
lea rdx, [0x140126dc0]
mov r8d, 4
call qword [sym.imp.MSVCR100.dll_wcsncmp]
mov r8, rbx
test eax, eax
jne 0x1400e15e4
lea r8, [rbx + 8]
test r8, r8
je 0x1400e1630
movzx edx, word [r8]
test dx, dx
je 0x1400e1630
nop word [rax + rax]
lea rcx, [0x1401235d8]
mov eax, 0x3f
nop dword [rax]
cmp dx, ax
je 0x1400e165d
movzx eax, word [rcx + 2]
add rcx, 2
test ax, ax
jne 0x1400e1610
movzx edx, word [r8 + 2]
add r8, 2
test dx, dx
jne 0x1400e1600
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov r11d, eax
test rdi, rdi
je 0x1400e1643
mov dword [rdi], eax
xor eax, eax
cmp r11d, 0xffffffff
setne al
mov rbx, qword [rsp + 0x280]
add rsp, 0x270
pop rdi
ret
lea rdx, [rsp + 0x20]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp rax, 0xffffffffffffffff
je 0x1400e1698
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_FindClose]
test rdi, rdi
je 0x1400e1685
mov eax, dword [rsp + 0x20]
mov dword [rdi], eax
mov al, 1
mov rbx, qword [rsp + 0x280]
add rsp, 0x270
pop rdi
ret
xor al, al
mov rbx, qword [rsp + 0x280]
add rsp, 0x270
pop rdi
ret

Function at 0x1400e1df0
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
push rdi
mov eax, 0x10020
call fcn.140100df0
sub rsp, rax
mov rdi, rdx
lea rdx, [rsp + 0x20]
mov r8d, 0x7fff
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov ebx, eax
test eax, eax
je 0x1400e1e44
lea r8d, [rax + 1]
lea rdx, [rsp + 0x20]
mov rcx, rdi
add r8, r8
call sub.MSVCR100.dll_memcpy
mov eax, ebx
mov rbx, qword [rsp + 0x10030]
add rsp, 0x10020
pop rdi
ret
xor eax, eax
mov word [rdi], ax
mov eax, ebx
mov rbx, qword [rsp + 0x10030]
add rsp, 0x10020
pop rdi
ret
Function at 0x1400e26c0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x50
xor ebx, ebx
mov r13d, r9d
mov edi, r8d
mov r12d, edx
mov r15, rcx
mov r14d, ebx
test rcx, rcx
je 0x1400e26fe
lea r8d, [rbx + 2]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rsi, rax
jmp 0x1400e2705
mov rsi, qword [0x14013f6e0]
test rsi, rsi
je 0x1400e28ba
mov qword [rsp + 0x80], rbp
lea rbp, [0x140141f54]
test r12d, r12d
jns 0x1400e272e
movzx eax, r12w
neg ax
movzx edx, ax
jmp 0x1400e2766
mov eax, 1
test r12d, r12d
lea r9, [rsp + 0x40]
cmovne eax, r12d
lea r8, [0x1400e26a0]
mov edx, recv
mov rcx, rsi
mov dword [rsp + 0x44], ebx
mov qword [rsp + 0x48], rbp
mov dword [rsp + 0x40], eax
call qword [sym.imp.KERNEL32.dll_EnumResourceNamesW]
mov rdx, qword [rsp + 0x48]
cmp rdx, rbp
je 0x1400e2883
mov r8d, send
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FindResourceW]
test rax, rax
je 0x1400e2883
mov rdx, rax
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
je 0x1400e2883
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rbp, rax
test rax, rax
je 0x1400e2883
cmp edi, 0xffffffff
cmove edi, r13d
test edi, edi
jne 0x1400e27c7
lea ecx, [rdi + 0xb]
call qword [sym.imp.USER32.dll_GetSystemMetrics]
mov edi, eax
movzx eax, word [rbp + 4]
lea rcx, [rbp + 6]
cmp eax, 1
jle 0x1400e2814
lea r8, [rcx + 0xe]
dec eax
mov r9, r8
mov r10d, eax
movzx eax, byte [r8]
movzx edx, byte [rcx]
cmp al, dl
jbe 0x1400e27f7
movzx eax, dl
mov edx, ebx
cmp eax, edi
setl dl
jmp 0x1400e2801
movzx eax, al
mov edx, ebx
cmp eax, edi
setge dl
test edx, edx
cmovne rcx, r9
add r9, 0xe
add r8, 0xe
dec r10
jne 0x1400e27e0
movzx edx, word [rcx + 0xc]
mov r8d, 3
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rdi, rax
test rax, rax
je 0x1400e2883
mov rdx, rax
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
je 0x1400e2883
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rbp, rax
test rax, rax
je 0x1400e2883
mov rdx, rdi
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [rsp + 0x30], ebx
mov r9d, 0x30000
mov r8d, 1
mov rcx, rbp
mov edx, eax
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], ebx
call qword [sym.imp.USER32.dll_CreateIconFromResourceEx]
mov r14, rax
mov rcx, qword [rsp + 0xa0]
mov rbp, qword [rsp + 0x80]
test rcx, rcx
je 0x1400e28a2
test r14, r14
je 0x1400e28a2
mov qword [rcx], rsi
jmp 0x1400e28b0
test r15, r15
je 0x1400e28b0
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
test r14, r14
je 0x1400e28ba
mov rax, r14
jmp 0x1400e28dc
test r12d, r12d
jle 0x1400e28c6
lea ebx, [r12 - 1]
jmp 0x1400e28ce
cmp r12d, 0xffffffff
cmovl ebx, r12d
mov r8d, ebx
mov rdx, r15
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ExtractIconW]
lea r11, [rsp + 0x50]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x1400e4fd0
Capabilities:
Create new key via cryptacquirecontext
Encrypt data using aes via winapi
Hash data using sha1
Hash data using sha1 via wincrypt
Hash data via wincrypt
Initialize hashing via wincrypt

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
mov dword [rsp + 0x10], edx
push rdi
sub rsp, 0x860
mov rsi, rcx
mov rdi, r8
lea rcx, [rsp + 0x62]
xor ebx, ebx
xor edx, edx
mov r8d, 0x7fe
movzx ebp, r9b
mov word [rsp + 0x60], bx
call sub.MSVCR100.dll_memset
lea r9d, [rbx + 0x18]
lea rcx, [rsp + 0x48]
xor r8d, r8d
xor edx, edx
mov dword [rsp + 0x20], 0xf0000000
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x1400e51b0
mov rcx, qword [rsp + 0x48]
lea rax, [rsp + 0x50]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x8004
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
je 0x1400e51b0
test rdi, rdi
je 0x1400e509a
mov rcx, qword [rdi]
test rcx, rcx
je 0x1400e509a
mov eax, ebx
lea rdx, [0x140127300]
lea r8, [0x14013b1e0]
cmp rdi, r8
jne 0x1400e5081
movzx ecx, word [rdx]
jmp 0x1400e5084
movzx ecx, word [rcx]
mov word [rsp + rax*2 + 0x60], cx
mov rcx, qword [rdi + rax*8 + 8]
inc rax
add rdx, 0xa
test rcx, rcx
jne 0x1400e5077
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [rsp + 0x60]
repne scasw ax, word [rdi]
lea rdx, [rsp + 0x60]
xor r9d, r9d
not rcx
lea r8d, [rcx + rcx - 2]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
je 0x1400e51b0
lea rcx, [rsp + 0x60]
xor edx, edx
mov r8d, 0x800
call sub.MSVCR100.dll_memset
mov r9d, dword [rsp + 0x890]
cmp r9d, 0x80
jne 0x1400e50f5
mov ebx, 0x660e
jmp 0x1400e5105
cmp r9d, 0xc0
setne bl
add ebx, 0x660f
mov r8, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x48]
lea rax, [rsp + 0x40]
shl r9d, 0x10
mov edx, ebx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_CryptDeriveKey]
test eax, eax
je 0x1400e51b0
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
test eax, eax
je 0x1400e51b0
mov rcx, qword [rsp + 0x40]
xor r9d, r9d
xor edx, edx
lea r8d, [r9 + 1]
test bpl, bpl
je 0x1400e5177
mov eax, dword [rsp + 0x878]
add eax, 0x10
mov dword [rsp + 0x30], eax
lea rax, [rsp + 0x878]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rsi
call qword [0x1401404a8]
jmp 0x1400e518f
lea rax, [rsp + 0x878]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rsi
call qword [0x1401404b0]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
mov rcx, qword [rsp + 0x48]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov eax, dword [rsp + 0x878]
jmp 0x1400e51b2
xor eax, eax
lea r11, [rsp + 0x860]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x1400e51d0
Capabilities:
Encode data using base64 via winapi

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x50
mov r15, rdx
xor edx, edx
mov r13, r9
mov r14, rcx
mov r12d, r8d
lea r9d, [rdx + 4]
lea rcx, [rsp + 0xa8]
add r8d, 0x2800
mov qword [rsp + 0x20], 0
call fcn.14002cd40
mov rbx, qword [rsp + 0xa8]
lea rdx, [0x14011a640]
mov rcx, rbx
mov r9d, r12d
mov r8, r14
mov dword [rsp + 0x20], 0x24
call fcn.14002c1e0
mov edx, 1
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_IsBadReadPtr]
test eax, eax
je 0x1400e5251
mov eax, 9
jmp 0x1400e526f
mov rcx, rbx
call fcn.14002b110
mov rbp, qword [rbx + 0x30]
mov eax, dword [rbx + 0x28]
test rbp, rbp
jne 0x1400e527c
mov ecx, 0xa
test eax, eax
cmove eax, ecx
xor edi, edi
xor esi, esi
xor ebp, ebp
cmp eax, 9
je 0x1400e528b
jmp 0x1400e5283
mov rdi, qword [rbx + 8]
mov esi, dword [rbx + 0x18]
mov rcx, rbx
call fcn.14002cc40
cmp esi, r12d
jb 0x1400e52a8
mov rcx, rdi
mov esi, r12d
call qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rdi, r14
xor r9d, r9d
lea rax, [rsp + 0xa0]
mov edx, esi
lea r8d, [r9 + 1]
mov rcx, rdi
mov qword [rsp + 0x20], rax
call qword [sym.imp.CRYPT32.dll_CryptBinaryToStringA]
mov ecx, dword [rsp + 0xa0]
add ecx, 0x10
call qword [sym.imp.MSVCR100.dll_malloc]
mov r8d, 1
mov edx, esi
mov rbx, rax
lea rax, [rsp + 0xa0]
mov rcx, rdi
mov r9, rbx
mov qword [rsp + 0x20], rax
call qword [sym.imp.CRYPT32.dll_CryptBinaryToStringA]
test r13, r13
je 0x1400e5346
cmp qword [r13], 0
je 0x1400e5346
mov edx, dword [rsp + 0xa0]
mov r9b, 1
mov r8, r13
mov rcx, rbx
inc edx
mov dword [rsp + 0x20], 0x100
call fcn.1400e4fd0
mov dword [rsp + 0xa0], eax
test eax, eax
jne 0x1400e5341
mov rcx, rbx
call qword [sym.imp.MSVCR100.dll_free]
xor eax, eax
jmp 0x1400e5409
mov r13, rbx
jmp 0x1400e5352
xor eax, eax
mov r13, rdi
mov dword [rsp + 0xa0], eax
mov edx, esi
test eax, eax
lea r8, [rsp + 0x34]
mov r9d, 4
mov rcx, r13
cmovne edx, eax
mov qword [rsp + 0x30], 0x4034b50
mov dword [rsp + 0x38], esi
mov dword [rsp + 0x3c], r12d
mov dword [rsp + 0x40], eax
call qword [sym.imp.SHLWAPI.dll_HashData]
mov eax, dword [rsp + 0xa0]
test eax, eax
mov ecx, esi
cmovne ecx, eax
add rcx, 0x14
call qword [sym.imp.MSVCR100.dll_malloc]
mov rcx, qword [rsp + 0x30]
mov r9d, esi
mov qword [rax], rcx
mov rcx, qword [rsp + 0x38]
mov rdx, r13
mov qword [rax + 8], rcx
mov ecx, dword [rsp + 0x40]
mov qword [r15], rax
mov dword [rax + 0x10], ecx
mov r8d, dword [rsp + 0xa0]
lea rcx, [rax + 0x14]
test r8d, r8d
cmovne r9d, r8d
mov r8d, r9d
call sub.MSVCR100.dll_memcpy
mov rcx, rbx
call qword [sym.imp.MSVCR100.dll_free]
cmp rdi, r14
je 0x1400e53f7
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [rsp + 0xa0]
mov eax, esi
test ecx, ecx
cmovne eax, ecx
add rax, 0x14
mov rbx, qword [rsp + 0x90]
add rsp, 0x50
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400e5430
Capabilities:
Decode data using base64 via winapi

Disassembly:
push rsi
push rdi
push r15
sub rsp, 0x2c0
mov eax, dword [rcx + 0x10]
mov r15, r9
mov rsi, rdx
mov rdi, rcx
mov dword [rsp + 0x2f0], eax
cmp r8d, eax
jae 0x1400e5462
xor eax, eax
add rsp, 0x2c0
pop r15
pop rdi
pop rsi
ret
mov qword [rsp + 0x2e8], rbx
mov qword [rsp + 0x2b8], rbp
mov qword [rsp + 0x2b0], r12
mov qword [rsp + 0x2a8], r13
mov r13d, dword [rsp + 0x300]
xor ebx, ebx
test eax, eax
mov edx, r13d
mov qword [rsp + 0x2a0], r14
lea r14, [rcx + 0x14]
lea r9d, [rbx + 4]
lea r8, [rsp + 0x2e0]
cmovne edx, eax
mov rcx, r14
call qword [sym.imp.SHLWAPI.dll_HashData]
cmp dword [rdi], 0x4034b50
jne 0x1400e55c9
mov eax, dword [rdi + 4]
cmp dword [rsp + 0x2e0], eax
jne 0x1400e55c9
mov ebp, dword [rdi + 0xc]
mov ecx, ebp
call qword [sym.imp.MSVCR100.dll_malloc]
mov qword [rsi], rax
test rax, rax
je 0x1400e55c9
mov ecx, dword [rsp + 0x2f0]
test ecx, ecx
je 0x1400e55ff
mov ebx, ecx
call qword [sym.imp.MSVCR100.dll_malloc]
mov r8d, ebx
mov rcx, rax
mov rdx, r14
mov rdi, rax
call sub.MSVCR100.dll_memcpy
mov edx, dword [rsp + 0x2f0]
xor r9d, r9d
mov r8, r15
mov rcx, rdi
mov dword [rsp + 0x20], 0x100
call fcn.1400e4fd0
mov ecx, ebx
call qword [sym.imp.MSVCR100.dll_malloc]
xor r15d, r15d
xor edx, edx
mov rbx, rax
lea rax, [rsp + 0x2f0]
mov qword [rsp + 0x30], r15
lea r8d, [r15 + 1]
mov rcx, rdi
mov r9, rbx
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], rax
call qword [sym.imp.CRYPT32.dll_CryptStringToBinaryA]
mov rcx, rdi
call qword [sym.imp.MSVCR100.dll_free]
mov rdx, rbx
cmp ebp, r13d
jne 0x1400e558d
mov rcx, qword [rsi]
mov r8d, ebp
call sub.MSVCR100.dll_memcpy
mov rcx, rbx
call qword [sym.imp.MSVCR100.dll_free]
mov eax, ebp
jmp 0x1400e55cb
lea rcx, [rsp + 0x40]
mov r9d, 9
mov r8d, r13d
mov qword [rsp + 0x20], r15
call fcn.140028540
test eax, eax
je 0x1400e5642
mov rcx, qword [rsp + 0x40]
call fcn.140028500
mov rcx, qword [rsi]
call qword [sym.imp.MSVCR100.dll_free]
mov rcx, rbx
call qword [sym.imp.MSVCR100.dll_free]
xor eax, eax
mov r13, qword [rsp + 0x2a8]
mov r12, qword [rsp + 0x2b0]
mov rbp, qword [rsp + 0x2b8]
mov rbx, qword [rsp + 0x2e8]
mov r14, qword [rsp + 0x2a0]
add rsp, 0x2c0
pop r15
pop rdi
pop rsi
ret
mov rdx, r14
cmp ebp, r13d
jne 0x1400e5616
mov r8, rbp
mov rcx, rax
call sub.MSVCR100.dll_memcpy
mov eax, ebp
jmp 0x1400e55cb
xor r15d, r15d
lea rcx, [rsp + 0x40]
mov r8d, r13d
lea r9d, [r15 + 9]
mov qword [rsp + 0x20], r15
call fcn.140028540
test eax, eax
je 0x1400e5642
mov rcx, qword [rsp + 0x40]
call fcn.140028500
mov rcx, qword [rsi]
jmp 0x1400e55c3
mov rdi, qword [rsp + 0x40]
mov rdx, qword [rsi]
lea r8, [rsp + 0x50]
mov rcx, rdi
mov r9d, 1
mov qword [rsp + 0x80], rbp
mov qword [rsp + 0x78], rbp
call fcn.1400281f0
test eax, eax
je 0x1400e568d
mov rcx, qword [rsi]
call qword [sym.imp.MSVCR100.dll_free]
mov rcx, rdi
call fcn.140028500
test rbx, rbx
je 0x1400e55c9
jmp 0x1400e55c0
mov rcx, rdi
call fcn.140028500
test rbx, rbx
je 0x1400e56a3
mov rcx, rbx
call qword [sym.imp.MSVCR100.dll_free]
mov eax, ebp
jmp 0x1400e55cb
Function at 0x1400e5f70
Capabilities:
Write clipboard data

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x30
cmp byte [rdx + 0x23], 0
mov rbx, rdx
mov rdi, rcx
jne 0x1400e5f8a
mov rbx, qword [rdx + 0x10]
cmp byte [rcx + 0x23], 0
jne 0x1400e5f94
mov rdi, qword [rcx + 0x10]
movzx eax, byte [rbx + 0x21]
test al, 0x10
je 0x1400e6019
test al, 8
jne 0x1400e6014
mov rax, qword [rbx + 8]
mov r8, qword [rbx + 0x10]
movzx ecx, word [rax]
shr r8, 1
movzx edx, word [rax + r8*2 - 2]
cmp ecx, 0x20
je 0x1400e5fd2
cmp ecx, 9
je 0x1400e5fd2
cmp edx, 0x20
je 0x1400e5fd2
cmp edx, 9
je 0x1400e5fd2
cmp ecx, 0x30
je 0x1400e5fd2
cmp ecx, 0x2b
jne 0x1400e6014
xor r9d, r9d
mov rdx, rax
mov rcx, rdi
mov byte [rsp + 0x20], 1
call fcn.1400e6e20
test eax, eax
jne 0x1400e5ff6
xor eax, eax
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
mov r8b, reloc.WSOCK32.dll_recv
mov rdx, qword [rbx]
mov rcx, rdi
call fcn.140001090
mov eax, 1
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
mov r8b, reloc.OLEAUT32.dll_SafeArrayGetElement
jmp 0x1400e5ff9
test al, 0x20
je 0x1400e606b
mov rcx, rdi
test al, 8
jne 0x1400e6057
mov r8, qword [rbx + 0x10]
mov rdx, qword [rbx + 8]
xor r9d, r9d
shr r8, 1
mov byte [rsp + 0x20], 1
call fcn.1400e6e20
test eax, eax
je 0x1400e5fe9
movsd xmm0, qword [rbx]
mov r8b, 0x20
mov rcx, rdi
movsd qword [rsp + 0x40], xmm0
mov rdx, qword [rsp + 0x40]
jmp 0x1400e5fff
movsd xmm0, qword [rbx]
mov r8b, 0x28
movsd qword [rsp + 0x40], xmm0
mov rdx, qword [rsp + 0x40]
jmp 0x1400e5fff
test al, 1
je 0x1400e6084
mov rdx, rbx
mov rcx, rdi
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
jmp fcn.1400e6b50
test al, 2
je 0x1400e60a9
mov rbx, qword [rbx]
mov rcx, rbx
mov rax, qword [rbx]
call qword [rax + reloc.WSOCK32.dll_htonl]
mov rdx, rbx
mov rcx, rdi
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
jmp fcn.1400e71a0
cmp byte [rbx + 0x23], 0
jne 0x1400e60b5
mov rax, qword [rbx + 0x10]
jmp 0x1400e60b8
mov rax, rbx
test byte [rax + 0x21], 4
je 0x1400e60cd
lea rcx, [0x140143150]
mov rdx, rbx
call fcn.140060290
mov r8, qword [rbx + 0x10]
mov rdx, qword [rbx + 8]
xor r9d, r9d
mov rcx, rdi
shr r8, 1
mov byte [rsp + 0x20], 1
call fcn.1400e6e20
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
Function at 0x1400e6b50
Capabilities:
Write clipboard data

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
cmp byte [rcx + 0x23], 0
mov rdi, rdx
mov rbx, rcx
jne 0x1400e6b70
mov rbx, qword [rbx + 0x10]
cmp byte [rbx + 0x23], 0
je 0x1400e6b66
cmp byte [rdx + 0x23], 0
jne 0x1400e6b7a
mov rdi, qword [rdx + 0x10]
mov rcx, rdi
call fcn.140001130
cmp byte [rbx + 0x23], 1
jne 0x1400e6be7
cmp rbx, rdi
je 0x1400e6bd7
mov rax, qword [rdi + 0x10]
mov r9b, 1
xor edx, edx
mov r8, rax
and eax, 1
mov rcx, rbx
shr r8, 1
mov byte [rsp + 0x20], 0
add r8, rax
call fcn.1400e6e20
test eax, eax
jne 0x1400e6bbe
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
mov r8, qword [rdi + 0x10]
mov rdx, qword [rdi + 8]
mov rcx, qword [rbx + 8]
add r8, 2
call sub.MSVCR100.dll_memcpy
or byte [rbx + 0x21], 1
mov eax, 1
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
mov rdx, qword [rdi + 0x10]
mov rcx, qword [rdi + 8]
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
jmp fcn.1400e6c00
Function at 0x1400e6c00
Capabilities:
Write clipboard data

Disassembly:
push rbx
push rsi
sub rsp, 0x28
mov rsi, rcx
lea rcx, [0x140143dd0]
mov rbx, rdx
call fcn.1400070e0
test eax, eax
jne 0x1400e6c3d
lea r8, [0x1401035ac]
lea rdx, str.Cant_open_clipboard_for_writing.
lea rcx, [0x140143150]
add rsp, 0x28
pop rsi
pop rbx
jmp fcn.14005f7b0
mov qword [rsp + 0x40], rbp
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x50], r12
mov qword [rsp + 0x58], r13
mov qword [rsp + 0x20], r14
call qword [sym.imp.USER32.dll_EmptyClipboard]
lea rbp, [rsi + rbx]
lea rbx, [rsi + 4]
xor r14d, r14d
cmp rbx, rbp
ja 0x1400e6d02
mov r13d, dword [rsi]
test r13d, r13d
je 0x1400e6d02
mov rax, rbx
add rbx, 8
cmp rbx, rbp
ja 0x1400e6d02
mov edi, dword [rax]
mov rsi, rbx
add rbx, rdi
cmp rbx, rbp
ja 0x1400e6d02
mov rdx, r14
test rdi, rdi
mov ecx, 0x42
sete dl
add rdx, rdi
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov r12, rax
test rax, rax
je 0x1400e6dc0
test rdi, rdi
je 0x1400e6ce9
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GlobalLock]
test rax, rax
je 0x1400e6d61
mov r8d, edi
mov rdx, rsi
mov rcx, rax
call sub.MSVCR100.dll_memcpy
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov rsi, rbx
mov rdx, r12
mov ecx, r13d
call qword [sym.imp.USER32.dll_SetClipboardData]
lea rbx, [rsi + 4]
cmp rbx, rbp
jbe 0x1400e6c70
cmp dword [0x140143dfc], r14d
je 0x1400e6d3c
cmp qword [0x140143de0], r14
je 0x1400e6d28
mov rcx, qword [0x140143dd0]
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov qword [0x140143de0], r14
call qword [sym.imp.USER32.dll_CloseClipboard]
mov dword [0x140143dfc], r14d
mov qword [0x140143dd0], r14
mov eax, 1
mov r13, qword [rsp + 0x58]
mov r12, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x40]
mov r14, qword [rsp + 0x20]
add rsp, 0x28
pop rsi
pop rbx
ret
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_GlobalFree]
cmp dword [0x140143dfc], r14d
je 0x1400e6da4
cmp qword [0x140143de0], r14
je 0x1400e6d90
mov rcx, qword [0x140143dd0]
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov qword [0x140143de0], r14
call qword [sym.imp.USER32.dll_CloseClipboard]
mov dword [0x140143dfc], r14d
mov qword [0x140143dd0], r14
lea r8, [0x1401035ac]
lea rdx, [0x140103b58]
lea rcx, [0x140143150]
call fcn.14005f7b0
jmp 0x1400e6d41
cmp dword [0x140143dfc], r14d
je 0x1400e6dfa
cmp qword [0x140143de0], r14
je 0x1400e6de6
mov rcx, qword [0x140143dd0]
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov qword [0x140143de0], r14
call qword [sym.imp.USER32.dll_CloseClipboard]
mov dword [0x140143dfc], r14d
mov qword [0x140143dd0], r14
lea r8, [0x1401035ac]
lea rdx, str.Out_of_memory.
lea rcx, [0x140143150]
call fcn.14005f7b0
jmp 0x1400e6d41