joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14009a840
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov r11, qword [rcx + 0x110]
xor r9d, r9d
lea rbx, [0x1403be5d0]
mov r10, r11
cmp r11, rdx
je 0x14009a880
nop
movzx r8d, byte [r10]
movzx eax, r9b
inc r10
xor r8, rax
mov eax, r9d
mov r9d, dword [rbx + r8*4]
shr eax, 8
xor r9d, eax
cmp r10, rdx
jne 0x14009a860
mov r10d, dword [rcx + 0x118]
lea r8, [rdx + 4]
add r10, r11
cmp r8, r10
je 0x14009a8c0
nop word [rax + rax]
movzx eax, byte [r8]
movzx edx, r9b
mov ecx, r9d
xor rdx, rax
shr ecx, 8
inc r8
mov r9d, dword [rbx + rdx*4]
xor r9d, ecx
cmp r8, r10
jne 0x14009a8a0
mov rbx, qword [rsp + 8]
mov eax, r9d
ret

Function at 0x1400a2310
Capabilities:
Extract resource via kernel32 functions

Disassembly:
movzx edx, dx
jmp method.CSettingsTab.1.virtual_712
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rbp, r8
mov rdi, rdx
mov rsi, rcx
mov qword [rcx + 0xe0], rdx
test rdx, 0xffffffffffff0000
jne 0x14011fbbf
cmp dword [rcx + 0xd8], 0
jne 0x14011fbbf
movzx eax, dx
mov dword [rcx + 0xd8], eax
call fcn.14011eba0
mov r8d, 5
mov rdx, rdi
mov rbx, qword [rax + 0x18]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rcx, rbx
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov r9, rbx
mov r8, rbp
mov rdx, rax
mov rcx, rsi
mov rdi, rax
call fcn.14011fb24
mov rcx, rdi
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_FreeResource]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov eax, ebx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x1400a4280
Capabilities:
Create thread
Resume thread

Disassembly:
mov r11, rsp
push rdi
sub rsp, 0x90
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [r11 + 0x18], rbx
mov qword [r11 + 0x20], rsi
mov rbx, rcx
mov eax, 4
xor esi, esi
cmp dword [rcx + 0x15c], esi
cmovne eax, esi
lea rcx, [r11 + 0x10]
mov qword [r11 - 0x70], rcx
mov dword [rsp + 0x20], eax
mov r9, rbx
lea r8, [0x1400a41d0]
xor edx, edx
xor ecx, ecx
call fcn.14025f818
mov rdi, rax
cmp dword [rbx + 0x15c], esi
jne 0x1400a439d
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, eax
call fcn.14025e218
call fcn.14025e230
mov ebx, eax
mov eax, 0x66666667
imul ebx
sar edx, 2
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
lea ecx, [rdx + rdx*4]
add ecx, ecx
sub ebx, ecx
add ebx, 0xa
lea rcx, [rsp + 0x38]
call fcn.14009c910
nop
lea rcx, [rsp + 0x38]
call fcn.14009c940
xor r9d, r9d
xor r8d, r8d
xor edx, edx
lea rcx, [rsp + 0x58]
call qword [sym.imp.USER32.dll_GetMessageW]
test eax, eax
je 0x1400a4393
nop dword [rax + rax]
lea rcx, [rsp + 0x58]
call qword [sym.imp.USER32.dll_TranslateMessage]
lea rcx, [rsp + 0x58]
call qword [sym.imp.USER32.dll_DispatchMessageW]
mov dword [rsp + 0xa0], esi
lea rdx, [rsp + 0xa0]
lea rcx, [rsp + 0x38]
call fcn.14009c990
test eax, eax
je 0x1400a437c
cmp dword [rsp + 0xa0], ebx
ja 0x1400a4393
xor r9d, r9d
xor r8d, r8d
xor edx, edx
lea rcx, [rsp + 0x58]
call qword [sym.imp.USER32.dll_GetMessageW]
test eax, eax
jne 0x1400a4340
lea rcx, [rsp + 0x38]
call fcn.14008ec10
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_ResumeThread]
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x1400b0d40
Capabilities:
Check os version

Disassembly:
sub rsp, 0x148
cmp byte [0x1403e3e01], 0
je 0x1400b0d5f
movzx eax, byte [0x1403e3e00]
add rsp, 0x148
ret
lea rcx, [rsp + 0x24]
xor edx, edx
mov r8d, pe_nt_image_headers64
call fcn.14025e980
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x11c
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [rsp + 0x30], 2
jne 0x1400b0d9d
mov rax, qword [rsp + 0x20]
shr rax, 0x20
cmp eax, 6
jb 0x1400b0d9d
mov al, 1
jmp 0x1400b0d9f
xor al, al
mov byte [0x1403e3e00], al
mov byte [0x1403e3e01], 1
add rsp, 0x148
ret

Function at 0x1400b0f70
Capabilities:
Identify system language via api

Disassembly:
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
sub rsp, 0x50
mov qword [rsp + 0x40], 0xfffffffffffffffe
mov qword [rsp + 0x78], rbx
mov ebp, edx
mov rbx, rcx
mov dword [rsp + 0x80], 0
call fcn.14011c934
mov rcx, rax
xor r8d, r8d
test rax, rax
setne r8b
test r8d, r8d
jne 0x1400b0fbc
mov ecx, 0x80004005
call fcn.14008ec20
int3
mov rax, qword [rax]
call qword [rax + Ordinal_26]
add rax, 0x18
mov qword [rbx], rax
mov dword [rsp + 0x80], 1
xor edi, edi
mov esi, 0x1300
lea eax, [rbp - 0x834]
cmp eax, 0x383
ja 0x1400b1009
xor edx, edx
lea r8d, [rdi + 2]
lea rcx, str.netmsg.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rdi, rax
mov eax, 0x1b00
test rdi, rdi
cmovne esi, eax
call qword [sym.imp.KERNEL32.dll_GetUserDefaultUILanguage]
movzx r9d, ax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
lea rax, [rsp + 0x88]
mov qword [rsp + 0x20], rax
mov r8d, ebp
mov rdx, rdi
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_FormatMessageA]
test eax, eax
je 0x1400b1061
mov rdx, qword [rsp + 0x88]
mov rcx, rbx
call fcn.14008f760
mov rcx, qword [rsp + 0x88]
call qword [sym.imp.KERNEL32.dll_LocalFree]
test rdi, rdi
je 0x1400b106f
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rax, rbx
mov rbx, qword [rsp + 0x78]
add rsp, 0x50
pop rdi
pop rsi
pop rbp
ret

Function at 0x1400b1360
Capabilities:
Create process on windows
Create thread

Disassembly:
push rbx
sub rsp, 0x30
mov rbx, rcx
call fcn.1400b0d40
test al, al
je 0x1400b137f
mov rcx, rbx
add rsp, 0x30
pop rbx
jmp fcn.1400b1140
xor ecx, ecx
lea rax, [rsp + 0x48]
lea r8, [0x1400b1340]
mov qword [rsp + 0x28], rax
mov r9, rbx
xor edx, edx
mov dword [rsp + 0x20], ecx
mov dword [rsp + 0x48], ecx
call fcn.14025f818
add rsp, 0x30
pop rbx
ret
Function at 0x1400b3010
Capabilities:
Delete file

Disassembly:
mov r11, rsp
push rdi
sub rsp, 0x60
mov qword [rsp + 0x28], 0xfffffffffffffffe
mov qword [r11 + 0x18], rbx
mov qword [r11 + 0x20], rsi
mov rax, qword [0x1403c6da0]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov rbx, rdx
mov rdi, rcx
xor esi, esi
mov dword [rsp + 0x20], esi
lea rdx, [rcx + 0x4c8]
lea r8d, [rsi + 1]
lea rcx, [r11 - 0x38]
call fcn.14011d19c
movzx edi, byte [rdi + 0x500]
lea rcx, [rsp + 0x30]
call fcn.14011d11c
test dil, dil
je 0x1400b30f5
mov rdx, qword [rbx]
cmp dword [rdx - 0x10], esi
je 0x1400b30c8
mov qword [rsp + 0x48], 7
mov qword [rsp + 0x40], rsi
mov word [rsp + 0x30], si
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, rdx
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx - 1]
lea rcx, [rsp + 0x30]
call fcn.14008fca0
nop
mov esi, 1
mov dword [rsp + 0x20], esi
lea rcx, [rsp + 0x30]
call fcn.140098720
test al, al
je 0x1400b30c8
movzx edi, sil
jmp 0x1400b30cb
xor dil, dil
test sil, 1
je 0x1400b30e3
cmp qword [rsp + 0x48], 8
jb 0x1400b30e3
mov rcx, qword [rsp + 0x30]
call fcn.14011bc00
test dil, dil
je 0x1400b30f1
mov rcx, qword [rbx]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov al, 1
jmp 0x1400b30f7
xor al, al
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.14025db20
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x1400b7a00
Capabilities:
Reference sql statements
Reference wmi statements

Disassembly:
push rbp
push rsi
push rdi
lea rbp, [rsp - 0x47]
sub rsp, 0xc0
mov qword [rbp - 0x41], 0xfffffffffffffffe
mov qword [rsp + 0xf0], rbx
mov rax, qword [0x1403c6da0]
xor rax, rsp
mov qword [rbp + 0x3f], rax
mov rdi, rcx
mov qword [rbp - 0x49], rcx
lea rcx, [rbp + 0x17]
call fcn.1400a1c30
nop
cmp qword [rax + 0x18], 0x10
jb 0x1400b7a49
mov rax, qword [rax]
mov rdx, rax
lea rcx, [rbp - 0x59]
call fcn.140090fc0
nop
lea rdx, [rbp - 0x59]
lea rcx, [rbp - 0x51]
call fcn.1400ae9a0
mov rbx, rax
mov qword [rbp - 0x21], 7
xor esi, esi
mov qword [rbp - 0x29], rsi
mov word [rbp - 0x39], si
lea r8d, [rsi + 0x2c]
lea rdx, str.SELECT__FROM_Win32_Process_WHERE_ProcessId
lea rcx, [rbp - 0x39]
call fcn.14008fca0
nop
mov r8, qword [rbx]
lea rdx, [rbp - 0x39]
lea rcx, [rbp - 0x11]
call fcn.140091080
nop
movups xmm1, xmmword [0x1403325b8]
movups xmm0, xmmword [0x140332688]
lea rcx, [0x1402cf8c8]
mov qword [rdi], rcx
movups xmmword [rdi + 8], xmm0
movups xmmword [rdi + 0x18], xmm1
lea rcx, [rdi + 0x28]
mov qword [rcx + 0x18], 7
mov qword [rcx + 0x10], rsi
mov word [rcx], si
or rbx, 0xffffffffffffffff
mov r9, rbx
xor r8d, r8d
mov rdx, rax
call fcn.14008fb70
mov byte [rdi + 0x50], sil
mov qword [rdi + 0x58], rsi
mov qword [rdi + 0x60], rsi
mov qword [rdi + 0x68], rsi
mov qword [rdi + 0x78], rsi
mov qword [rdi + 0x80], rsi
mov qword [rdi + 0x88], rsi
cmp qword [rbp + 7], 8
jb 0x1400b7b15
mov rcx, qword [rbp - 0x11]
call fcn.14011bc00
mov qword [rbp + 7], 7
mov qword [rbp - 1], rsi
mov word [rbp - 0x11], si
cmp qword [rbp - 0x21], 8
jb 0x1400b7b35
mov rcx, qword [rbp - 0x39]
call fcn.14011bc00
mov qword [rbp - 0x21], 7
mov qword [rbp - 0x29], rsi
mov word [rbp - 0x39], si
mov rdx, qword [rbp - 0x51]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x1400b7b64
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rbp - 0x59]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], ebx
dec ebx
test ebx, ebx
jg 0x1400b7b81
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
cmp qword [rbp + 0x2f], 0x10
jb 0x1400b7b91
mov rcx, qword [rbp + 0x17]
call fcn.14011bc00
mov qword [rbp + 0x2f], reloc.WSOCK32.dll_ntohs
mov qword [rbp + 0x27], rsi
mov byte [rbp + 0x17], 0
lea rax, [0x1402cf948]
mov qword [rdi], rax
mov rcx, rdi
call fcn.1400b7890
nop
mov rax, rdi
mov rcx, qword [rbp + 0x3f]
xor rcx, rsp
call fcn.14025db20
mov rbx, qword [rsp + 0xf0]
add rsp, 0xc0
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400b7be0
Capabilities:
Reference sql statements
Reference wmi statements

Disassembly:
push rbp
push rsi
push rdi
lea rbp, [rsp - 0x47]
sub rsp, 0xe0
mov qword [rbp - 0x71], 0xfffffffffffffffe
mov qword [rsp + 0x110], rbx
mov rax, qword [0x1403c6da0]
xor rax, rsp
mov qword [rbp + 0x3f], rax
mov rbx, rdx
mov rdi, rcx
mov qword [rbp - 0x79], rcx
mov qword [rbp - 0x69], rdx
mov qword [rbp - 0x21], 7
xor esi, esi
mov qword [rbp - 0x29], rsi
mov word [rbp - 0x39], si
lea r8d, [rsi + 2]
lea rdx, [0x1402cfc6c]
lea rcx, [rbp - 0x39]
call fcn.14008fca0
nop
mov qword [rbp - 0x49], 7
mov qword [rbp - 0x51], rsi
mov word [rbp - 0x61], si
lea r8d, [rsi + 0x35]
lea rdx, str.SELECT__FROM_Win32_Process_WHERE_CommandLine_LIKE__
lea rcx, [rbp - 0x61]
call fcn.14008fca0
nop
lea edx, [rsi + 0x5c]
mov rcx, rbx
call fcn.1400b4d50
mov r8, rax
lea rdx, [rbp - 0x61]
lea rcx, [rbp + 0x17]
call fcn.1400ab2f0
nop
lea r8, [rbp - 0x39]
mov rdx, rax
lea rcx, [rbp - 0x11]
call fcn.140099190
nop
movups xmm1, xmmword [0x1403325b8]
movups xmm0, xmmword [0x140332688]
lea rcx, [0x1402cf8c8]
mov qword [rdi], rcx
movups xmmword [rdi + 8], xmm0
movups xmmword [rdi + 0x18], xmm1
lea rcx, [rdi + 0x28]
mov qword [rcx + 0x18], 7
mov qword [rcx + 0x10], rsi
mov word [rcx], si
or r9, 0xffffffffffffffff
xor r8d, r8d
mov rdx, rax
call fcn.14008fb70
mov byte [rdi + 0x50], sil
mov qword [rdi + 0x58], rsi
mov qword [rdi + 0x60], rsi
mov qword [rdi + 0x68], rsi
mov qword [rdi + 0x78], rsi
mov qword [rdi + 0x80], rsi
mov qword [rdi + 0x88], rsi
cmp qword [rbp + 7], 8
jb 0x1400b7d09
mov rcx, qword [rbp - 0x11]
call fcn.14011bc00
mov qword [rbp + 7], 7
mov qword [rbp - 1], rsi
mov word [rbp - 0x11], si
cmp qword [rbp + 0x2f], 8
jb 0x1400b7d29
mov rcx, qword [rbp + 0x17]
call fcn.14011bc00
mov qword [rbp + 0x2f], 7
mov qword [rbp + 0x27], rsi
mov word [rbp + 0x17], si
cmp qword [rbp - 0x49], 8
jb 0x1400b7d49
mov rcx, qword [rbp - 0x61]
call fcn.14011bc00
mov qword [rbp - 0x49], 7
mov qword [rbp - 0x51], rsi
mov word [rbp - 0x61], si
cmp qword [rbp - 0x21], 8
jb 0x1400b7d69
mov rcx, qword [rbp - 0x39]
call fcn.14011bc00
mov qword [rbp - 0x21], 7
mov qword [rbp - 0x29], rsi
mov word [rbp - 0x39], si
lea rax, [0x1402cf948]
mov qword [rdi], rax
mov rcx, rdi
call fcn.1400b7890
nop
cmp qword [rbx + 0x18], 8
jb 0x1400b7d9b
mov rcx, qword [rbx]
call fcn.14011bc00
mov qword [rbx + 0x18], 7
mov qword [rbx + 0x10], rsi
mov word [rbx], si
mov rax, rdi
mov rcx, qword [rbp + 0x3f]
xor rcx, rsp
call fcn.14025db20
mov rbx, qword [rsp + 0x110]
add rsp, 0xe0
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400bdae0
Capabilities:
Create process on windows

Disassembly:
push rdi
sub rsp, 0x60
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rsp + 0x70], rbx
mov qword [rsp + 0x80], rsi
mov rdi, r8
mov rbx, rdx
test rdx, rdx
je 0x1400bdc34
mov rcx, rdx
call fcn.1400bd8f0
test al, al
je 0x1400bdc43
mov edx, 5
mov rcx, qword [rbx + 0x40]
call qword [sym.imp.USER32.dll_GetWindow]
test rax, rax
jne 0x1400bdc43
call qword [sym.imp.USER32.dll_GetDesktopWindow]
mov rcx, rax
mov r9d, 0x5b5
xor r8d, r8d
xor edx, edx
call qword [sym.imp.USER32.dll_RedrawWindow]
mov edx, 0x7984
mov r8d, reloc.WSOCK32.dll_gethostbyname
mov rcx, qword [0x1403e4190]
call fcn.1400a3890
cmp eax, 6
jne 0x1400bdc43
lea rdx, str.rundll32.exe
lea rcx, [rsp + 0x78]
call fcn.140090560
nop
mov rcx, qword [rsp + 0x78]
mov r8d, 1
sub r8d, dword [rcx - 8]
mov eax, dword [rcx - 0xc]
sub eax, 0x104
or eax, r8d
jge 0x1400bdbaf
mov edx, 0x104
lea rcx, [rsp + 0x78]
call fcn.14008f160
mov rcx, qword [rsp + 0x78]
xor edx, edx
call qword [sym.imp.SHLWAPI.dll_PathFindOnPathW]
mov rcx, qword [rsp + 0x78]
movsxd rdx, dword [rcx - 0xc]
call fcn.14025de70
test eax, eax
js 0x1400bdc38
mov rcx, qword [rsp + 0x78]
cmp eax, dword [rcx - 0xc]
jg 0x1400bdc38
mov dword [rcx - 0x10], eax
movsxd rcx, eax
xor edx, edx
mov rax, qword [rsp + 0x78]
mov word [rax + rcx*2], dx
mov dword [rsp + 0x28], 1
lea rax, [0x1402c84e0]
mov qword [rsp + 0x20], rax
lea r9, str.sysdm.cpl_EditEnvironmentVariables
mov r8, qword [rsp + 0x78]
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
nop
mov rdx, qword [rsp + 0x78]
add rdx, 0xffffffffffffffe8
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x1400bdc34
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
xor al, al
jmp 0x1400bdc95
mov ecx, 0x80070057
call fcn.14008ec20
nop
xor edx, edx
mov dword [rsp + 0x20], edx
lea r9, vtable.type_info.0
lea r8, vtable.type_info.0
mov rcx, rdi
call fcn.14026170c
mov rsi, rax
test rax, rax
je 0x1400bdc84
mov rdx, qword [rbx + 0x40]
lea rcx, [rsp + 0x38]
call fcn.1400ba3f0
mov rdx, rax
mov rcx, rsi
call fcn.1400ec1e0
test eax, eax
je 0x1400bdc34
mov rax, qword [rbx]
mov rdx, rdi
mov rcx, rbx
call qword [rax + 0x2d0]
mov al, 1
mov rbx, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x80]
add rsp, 0x60
pop rdi
ret
Function at 0x1400c03a0
Capabilities:
Terminate thread

Disassembly:
push rdi
sub rsp, 0x50
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x68], rbp
mov qword [rsp + 0x70], rsi
mov rsi, rcx
lea rcx, [rsp + 0x38]
call fcn.1400d3820
nop
lea rdx, [rsp + 0x28]
mov rcx, qword [rax]
call fcn.1400d3910
nop
mov rcx, qword [rax]
call fcn.1400cc950
mov edx, eax
mov rcx, qword [rsi + 0x60]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
setne bpl
mov rbx, qword [rsp + 0x30]
test rbx, rbx
je 0x1400c041c
lock dec dword [rbx + 8]
jne 0x1400c041c
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax]
lock dec dword [rbx + 0xc]
jne 0x1400c041c
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rbx, qword [rsp + 0x40]
test rbx, rbx
je 0x1400c0443
lock dec dword [rbx + 8]
jne 0x1400c0443
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax]
lock dec dword [rbx + 0xc]
jne 0x1400c0443
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
test bpl, bpl
je 0x1400c0454
xor edx, edx
mov rcx, qword [rsi + 0x58]
call qword [sym.imp.KERNEL32.dll_TerminateThread]
mov rcx, qword [rsi + 0x58]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor r11d, r11d
mov qword [rsi + 0x58], r11
cmp qword [rsi + 8], r11
setne r11b
mov eax, r11d
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
ret
Function at 0x1400c4960
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
xor edi, edi
mov rbx, rcx
mov qword [rcx + 0x70], rdx
mov qword [rcx + 8], rdi
mov dword [rcx + 0x54], edi
mov dword [rcx + 0x7c], r8d
mov rcx, qword [rcx + 0x60]
mov dword [rsp + 0x50], edi
call qword [sym.imp.KERNEL32.dll_ResetEvent]
lea r11, [rsp + 0x50]
lea r8, [0x1400c48f0]
mov qword [rsp + 0x28], r11
mov r9, rbx
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], edi
call fcn.14025f818
mov qword [rbx + 0x58], rax
mov rbx, qword [rsp + 0x40]
lea eax, [rdi + 1]
add rsp, 0x30
pop rdi
ret

Function at 0x1400c5650
Capabilities:
Log keystrokes via polling

Disassembly:
mov r11, rsp
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x20], rsi
push rdi
sub rsp, 0x40
mov rax, qword [0x1403c6da0]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov r9d, dword [rcx + 0x10]
mov r10d, dword [rcx + 0x14]
mov eax, dword [rcx + 0x1c]
mov dword [r11 - 0x28], r9d
add r9d, dword [rcx + 0x18]
mov rdi, r8
mov rbx, rcx
lea r8d, [r10 + rax]
lea rcx, [r11 - 0x28]
mov dword [r11 - 0x20], r9d
mov dword [r11 - 0x24], r10d
mov dword [r11 - 0x1c], r8d
call qword [sym.imp.USER32.dll_PtInRect]
cmp eax, 1
sete sil
test sil, sil
je 0x1400c56ce
mov ecx, 1
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
movzx r11d, ax
mov eax, 0
bt r11d, 0xf
setb al
inc eax
jmp 0x1400c56d0
xor eax, eax
cmp dword [rbx + 8], eax
mov dword [rbx + 8], eax
movzx eax, sil
setne cl
or byte [rdi], cl
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.14025db20
mov rbx, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
ret

Function at 0x1400c6280
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
xor ecx, ecx
call qword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x1400c6335
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x40], rdi
call qword [sym.imp.USER32.dll_EmptyClipboard]
mov r9d, dword [rbx + 0x30]
mov r8d, dword [rbx + 0x2c]
lea rcx, [rbx + 0x20]
lea rdx, [rsp + 0x38]
call fcn.1400c0550
mov rbx, qword [rsp + 0x38]
mov ecx, 0x2000
mov eax, dword [rbx - 0x10]
inc eax
mov edi, eax
lea rdx, [rax + rax]
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov rcx, rax
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_GlobalLock]
mov r8, rbx
mov edx, edi
mov rcx, rax
call fcn.1402611bc
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov rdx, rsi
mov ecx, reloc.WSOCK32.dll_listen
call qword [sym.imp.USER32.dll_SetClipboardData]
call qword [sym.imp.USER32.dll_CloseClipboard]
lea rdx, [rbx - 0x18]
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
mov rdi, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x30]
dec eax
test eax, eax
jg 0x1400c6335
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
add rsp, 0x20
pop rbx
ret
Function at 0x1400c6740
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
push rdi
push r12
push r13
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x60], rbp
mov qword [rsp + 0x68], rsi
mov r12, rcx
xor ecx, ecx
call qword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x1400c68b7
mov ecx, reloc.WSOCK32.dll_listen
call qword [sym.imp.USER32.dll_GetClipboardData]
mov rdi, rax
test rax, rax
je 0x1400c68b1
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GlobalLock]
mov rbp, rax
call fcn.14011c934
mov r11, rax
xor r13d, r13d
mov ecx, r13d
test rax, rax
setne cl
test ecx, ecx
jne 0x1400c67bb
mov ecx, 0x80004005
call fcn.14008ec20
int3
mov rax, qword [rax]
mov rcx, r11
call qword [rax + Ordinal_26]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x58], rbx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GlobalSize]
mov rsi, rax
shr rsi, 1
lea edx, [rsi + 1]
test edx, edx
jns 0x1400c67ee
mov ecx, 0x80070057
call fcn.14008ec20
int3
mov ecx, 1
sub ecx, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
sub eax, edx
or eax, ecx
jge 0x1400c680e
lea rcx, [rsp + 0x58]
call fcn.14008f160
mov rbx, qword [rsp + 0x58]
mov edx, esi
mov r8, rbp
mov rcx, rbx
call fcn.1402611bc
movsxd rdx, dword [rbx - 0xc]
mov rcx, rbx
call fcn.14025de70
test eax, eax
js 0x1400c68a6
cmp eax, dword [rbx - 0xc]
jg 0x1400c68a6
mov dword [rbx - 0x10], eax
cdqe
mov word [rbx + rax*2], r13w
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov r8d, dword [r12 + 0x30]
mov edx, dword [r12 + 0x2c]
lea rcx, [r12 + 0x20]
call fcn.1400c5f50
mov r8, rbx
mov edx, dword [r12 + 0x2c]
lea rcx, [r12 + 0x20]
call fcn.1400c6480
mov ecx, dword [rbx - 0x10]
add ecx, dword [r12 + 0x2c]
mov dword [r12 + 0x2c], ecx
mov dword [r12 + 0x30], r13d
mov dword [r12 + 0x34], ecx
mov dword [r12 + 0x38], 1
lea rdx, [rbx - 0x18]
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x1400c68b1
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
jmp 0x1400c68b1
mov ecx, 0x80070057
call fcn.14008ec20
nop
call qword [sym.imp.USER32.dll_CloseClipboard]
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x30
pop r13
pop r12
pop rdi
ret
Function at 0x1400ca7d0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x20
mov rbx, rdx
mov r14, rcx
call fcn.14011eba0
mov r12, qword [rax + 0x10]
xor ebp, ebp
lea r8, [0x1402d2c68]
mov rdx, rbx
mov rcx, r12
mov qword [rsp + 0x60], rbp
mov edi, ebp
mov esi, ebp
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov r13, rax
test rax, rax
je 0x1400ca88c
mov rdx, rax
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov ebx, eax
test eax, eax
je 0x1400ca88c
mov rdx, r13
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov r12, rax
test rax, rax
je 0x1400ca88c
lea ecx, [rbp + 2]
mov edx, ebx
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov rdi, rax
test rax, rax
je 0x1400ca88c
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GlobalLock]
mov rsi, rax
test rax, rax
je 0x1400ca88c
mov r8d, ebx
mov rdx, r12
mov rcx, rax
call fcn.14025ccd0
lea r8, [rsp + 0x60]
xor edx, edx
mov rcx, rdi
call qword [sym.imp.ole32.dll_CreateStreamOnHGlobal]
cmp qword [rsp + 0x60], rbp
je 0x1400ca8d4
mov ecx, 0x50
call fcn.14011bbbc
test rax, rax
je 0x1400ca8ac
mov rcx, rax
call fcn.1400c5390
jmp 0x1400ca8af
mov rax, rbp
lea rcx, [r14 + 8]
mov rdx, rax
call fcn.1400ca750
mov rdx, qword [rsp + 0x60]
mov rcx, qword [r14 + 8]
call fcn.1400ca6b0
mov rcx, qword [rsp + 0x60]
mov rax, qword [rcx]
call qword [rax + reloc.WSOCK32.dll_recv]
test rsi, rsi
je 0x1400ca8e2
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
test rdi, rdi
je 0x1400ca8f0
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GlobalFree]
cmp qword [rsp + 0x60], rbp
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
setne al
add rsp, 0x20
pop r14
pop r13
pop r12
pop rdi
pop rsi
ret