joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140101020
Capabilities:
Enumerate processes

Disassembly:
push rbx
sub rsp, 0x270
mov rax, qword [0x1402e0068]
xor rax, rsp
mov qword [rsp + 0x260], rax
mov rbx, rcx
test rcx, rcx
jne 0x14010104a
xor eax, eax
jmp 0x1401010d5
lea rcx, [rsp + 0x24]
xor edx, edx
mov r8d, 0x234
mov qword [rsp + 0x288], rdi
mov dword [rsp + 0x20], 0
call fcn.1401e6750
xor edx, edx
lea ecx, [rdx + 2]
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x1401010cb
lea rdx, [rsp + 0x20]
mov rcx, rax
mov dword [rsp + 0x20], 0x238
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x1401010c2
nop dword [rax + rax]
lea rcx, [rsp + 0x4c]
mov rdx, rbx
call fcn.1401e8298
test eax, eax
je 0x1401010ee
lea rdx, [rsp + 0x20]
mov rcx, rdi
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x1401010a0
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov rdi, qword [rsp + 0x288]
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.1401e6720
add rsp, 0x270
pop rbx
ret
mov ebx, dword [rsp + 0x28]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, ebx
jmp 0x1401010cd

Function at 0x140101330
Capabilities:
Simulate ctrl alt del

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov rbx, rcx
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ecx, eax
call qword [sym.imp.USER32.dll_GetThreadDesktop]
lea rcx, str.Winlogon
mov r9d, 0x400001cf
xor r8d, r8d
xor edx, edx
call qword [sym.imp.USER32.dll_OpenDesktopW]
mov rdi, rax
test rax, rax
je 0x1401013e9
mov rcx, rax
call qword [sym.imp.USER32.dll_SetThreadDesktop]
test eax, eax
jne 0x1401013a9
cmp dword [reloc.WS2_32.dll_accept], 3
jg 0x1401013a9
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea r9, str.SetThreadDesktop_ERROR__d
lea rdx, str.d:work_t120_vs2008gotohttpTShareApe.h
mov r8d, 0xff
mov ecx, 3
mov dword [rsp + 0x20], eax
call fcn.1400045f0
lea rdx, str.SAS_window
lea rcx, str.SAS_window_class
call qword [sym.imp.USER32.dll_FindWindowW]
mov ecx, 0xffff
mov r9d, 0x2e0003
test rax, rax
mov edx, 0x312
cmove rax, rcx
xor r8d, r8d
mov rcx, rax
call qword [sym.imp.USER32.dll_PostMessageW]
mov rcx, rdi
call qword [sym.imp.USER32.dll_CloseDesktop]
test rbx, rbx
je 0x1401013fc
mov rax, qword [rbx]
mov edx, 1
mov rcx, rbx
call qword [rax + reloc.WS2_32.dll_htonl]
xor eax, eax
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret

Function at 0x1401017e0
Capabilities:
Start service

Disassembly:
sub rsp, 0x28
xor edx, edx
xor r8d, r8d
lea ecx, [rdx + 6]
call fcn.14001df20
test al, al
jne 0x140101845
mov ecx, 0x20
call fcn.1401e65ec
test rax, rax
je 0x140101832
lea rcx, vtable.CADThread.0
xor r8d, r8d
xor edx, edx
mov qword [rax], rcx
mov rcx, rax
mov qword [rax + 8], 0
mov dword [rax + 0x10], 0
mov qword [rax + 0x18], rax
add rsp, 0x28
jmp fcn.1400010a0
xor eax, eax
xor r8d, r8d
xor edx, edx
mov rcx, rax
add rsp, 0x28
jmp fcn.1400010a0
mov ecx, 0x83
add rsp, 0x28
jmp fcn.140100990
Function at 0x140101de0
Capabilities:
Acquire debug privileges
Create process on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
sub rsp, 0x900
mov rax, qword [0x1402e0068]
xor rax, rsp
mov qword [rsp + 0x8f0], rax
xor ebp, ebp
mov esi, r8d
mov rbx, rdx
mov rdi, rbp
test rcx, rcx
je 0x140101e19
call fcn.140001980
mov rdi, rax
lea rax, [rsp + 0xf0]
mov rdx, rdi
sub rax, rdi
nop word [rax + rax]
movzx ecx, word [rdx]
add rdx, 2
mov word [rax + rdx - 2], cx
test cx, cx
jne 0x140101e30
test rdi, rdi
je 0x140101e4e
mov rcx, rdi
call fcn.1401e64f8
test rbx, rbx
je 0x140101eb0
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rsp + 0xf0]
repne scasw ax, word [rdi]
mov eax, dword [0x14023f310]
mov rcx, rbx
mov dword [rdi - 2], eax
call fcn.140001980
or rcx, 0xffffffffffffffff
lea rdi, [rsp + 0xf0]
mov r11, rax
xor eax, eax
repne scasw ax, word [rdi]
xor edx, edx
nop dword [rax + rax]
movzx ecx, word [r11 + rdx]
add rdx, 2
mov word [rdi + rdx - 4], cx
test cx, cx
jne 0x140101e90
test r11, r11
je 0x140101eb0
mov rcx, r11
call fcn.1401e64f8
call fcn.140101930
lea rcx, str.SeDebugPrivilege
mov rbx, rax
call fcn.140101100
xor edx, edx
lea r8d, [rdx + 0x68]
lea rcx, [rsp + 0x80]
call fcn.1401e6750
mov dword [rsp + 0x80], WSASetLastError
test esi, esi
je 0x140101ef9
mov dword [rsp + 0xbc], 1
mov word [rsp + 0xc0], bp
xor eax, eax
lea rcx, [rsp + 0x60]
mov rdx, rbx
lea r8d, [rax + 1]
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x60], rbp
lea edi, [rax + 0x20]
call qword [sym.imp.USERENV.dll_CreateEnvironmentBlock]
mov ecx, 0x420
lea r8, [rsp + 0xf0]
test eax, eax
lea rax, [rsp + 0x68]
mov qword [rsp + 0x50], rax
cmovne edi, ecx
lea rax, [rsp + 0x80]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x40], rbp
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], edi
xor r9d, r9d
xor edx, edx
mov rcx, rbx
mov dword [rsp + 0x28], ebp
mov qword [rsp + 0x20], rbp
call qword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
test eax, eax
jne 0x140101fb0
cmp dword [reloc.WS2_32.dll_accept], 3
jg 0x140101fac
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea r9, str.CreateProcess_err__d
lea rdx, str..Service.cpp
mov r8d, 0x7d4
mov ecx, 3
mov dword [rsp + 0x20], eax
call fcn.1400045f0
xor eax, eax
jmp 0x140101fd4
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
mov rcx, qword [rsp + 0x8f0]
xor rcx, rsp
call fcn.1401e6720
mov rbx, qword [rsp + 0x930]
add rsp, 0x900
pop rdi
pop rsi
pop rbp
ret
Function at 0x140102000
Capabilities:
Create process on windows

Disassembly:
push rdi
sub rsp, 0x40
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x60], rsi
mov rsi, rcx
xor ebx, ebx
mov qword [rsp + 0x58], rbx
lea ecx, [rbx + 0x18]
call fcn.1401e65ec
mov rdi, rax
test rax, rax
je 0x140102058
mov qword [rax], rbx
mov dword [rax + 8], 0x80
mov dword [rax + 0xc], ebx
mov dword [rax + 0x10], 1
mov ecx, 0x80
call fcn.1401e6440
mov qword [rdi], rax
mov byte [rax], bl
jmp 0x14010205b
mov rdi, rbx
mov qword [rsp + 0x58], rdi
lea rdx, str._C_start
lea rcx, [rsp + 0x58]
call fcn.1400042e0
mov rdx, rsi
lea rcx, [rsp + 0x58]
call fcn.140003570
lea r8, [0x14023f348]
mov edx, 0x26
lea rcx, [rsp + 0x58]
call fcn.140101cd0
xor r8d, r8d
xor edx, edx
lea ecx, [rdx + 0xa]
call fcn.14001df20
test al, al
je 0x1401020ff
mov rax, qword [rsp + 0x58]
test rax, rax
je 0x1401020b7
mov rdx, qword [rax]
test rdx, rdx
jne 0x1401020ba
mov rdx, rbx
mov r8d, 1
lea rcx, str.cmd.exe
call fcn.140101de0
test eax, eax
je 0x1401020ff
mov rbx, qword [rsp + 0x58]
test rbx, rbx
je 0x1401020f8
dec dword [rbx + 0x10]
cmp dword [rbx + 0x10], 0
jg 0x1401020f8
mov rcx, qword [rbx]
test rcx, rcx
je 0x1401020f0
call fcn.1401e64f8
mov rcx, rbx
call fcn.1401e60f0
mov eax, 1
jmp 0x140102151
mov dword [rsp + 0x28], 1
mov qword [rsp + 0x20], rbx
xor r9d, r9d
mov r8, rsi
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
cmp eax, 0x20
seta bl
mov rdi, qword [rsp + 0x58]
test rdi, rdi
je 0x14010214f
dec dword [rdi + 0x10]
cmp dword [rdi + 0x10], 0
jg 0x14010214f
mov rcx, qword [rdi]
test rcx, rcx
je 0x140102147
call fcn.1401e64f8
mov rcx, rdi
call fcn.1401e60f0
mov eax, ebx
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret
Function at 0x140102370
Capabilities:
Delete directory
Delete file
Enumerate files on windows
Enumerate files recursively

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x6b0
mov rax, qword [0x1402e0068]
xor rax, rsp
mov qword [rsp + 0x6a0], rax
mov rbx, rcx
mov r9, rcx
lea r8, [0x14023f428]
lea rcx, [rsp + 0x490]
mov edx, 0x104
call fcn.1401e9e04
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x490]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov rbp, rax
cmp rax, 0xffffffffffffffff
je 0x14010249b
test byte [rsp + 0x30], 0x10
je 0x140102444
lea rsi, [rsp + 0x5c]
lea rdi, [0x14023f424]
mov ecx, 2
repe cmpsw word [rsi], word [rdi]
je 0x14010247c
lea rsi, [rsp + 0x5c]
lea rdi, [0x14023f41c]
mov ecx, 3
repe cmpsw word [rsi], word [rdi]
je 0x14010247c
lea rax, [rsp + 0x5c]
lea r8, str._s_s
lea rcx, [rsp + 0x280]
mov r9, rbx
mov edx, 0x104
mov qword [rsp + 0x20], rax
call fcn.1401e9e04
lea rcx, [rsp + 0x280]
call fcn.140102370
jmp 0x140102478
lea rax, [rsp + 0x5c]
lea r8, str._s_s
lea rcx, [rsp + 0x280]
mov r9, rbx
mov edx, 0x104
mov qword [rsp + 0x20], rax
call fcn.1401e9e04
lea rcx, [rsp + 0x280]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
je 0x1401024a8
lea rdx, [rsp + 0x30]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x1401023d8
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_FindClose]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
jne 0x1401024ac
xor eax, eax
jmp 0x1401024b1
mov eax, 1
mov rcx, qword [rsp + 0x6a0]
xor rcx, rsp
call fcn.1401e6720
lea r11, [rsp + 0x6b0]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret

Function at 0x1401024e0
Capabilities:
Delete file

Disassembly:
push rbx
sub rsp, 0x280
mov rax, qword [0x1402e0068]
xor rax, rsp
mov qword [rsp + 0x270], rax
lea rdx, [rsp + 0x20]
mov rbx, rcx
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp rax, 0xffffffffffffffff
je 0x140102531
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_FindClose]
test byte [rsp + 0x20], 0x10
mov rcx, rbx
je 0x140102529
call fcn.140102370
jmp 0x140102533
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x140102533
xor eax, eax
mov rcx, qword [rsp + 0x270]
xor rcx, rsp
call fcn.1401e6720
add rsp, 0x280
pop rbx
ret
Function at 0x140102ee0
Capabilities:
Capture microphone audio

Disassembly:
mov qword [rsp + 0x18], rbp
push rsi
sub rsp, 0x20
cmp dword [rcx + 8], 0x7e
mov rsi, rcx
je 0x140102f8e
cmp qword [rcx + 0xc8], 0
jne 0x140102f8e
xor ebp, ebp
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x38], rdi
mov dword [rcx + 0xc], ebp
mov rbx, rbp
lea rdi, [rcx + 0x10]
nop dword [rax + rax]
mov rdx, qword [rdi]
mov rcx, qword [rsi + 0xb8]
mov r8d, gethostbyaddr
call qword [sym.imp.WINMM.dll_waveInAddBuffer]
test eax, eax
jne 0x140102f75
inc rbx
add rdi, 8
cmp rbx, 0x10
jl 0x140102f20
mov rcx, qword [rsi + 0xb8]
call qword [sym.imp.WINMM.dll_waveInStart]
mov ecx, 2
test eax, eax
cmovne ebp, ecx
mov eax, ebp
mov rbx, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
add rsp, 0x20
pop rsi
ret
mov rcx, qword [rsi + 0xb8]
test rcx, rcx
je 0x140102f87
call qword [sym.imp.WINMM.dll_waveInReset]
mov eax, 1
jmp 0x140102f60
add rcx, 0x98
xor edx, edx
mov r8d, 0x80000
call fcn.1400010a0
xor ebp, ebp
test eax, eax
sete bpl
mov eax, ebp
mov rbp, qword [rsp + 0x40]
add rsp, 0x20
pop rsi
ret

Function at 0x140103060
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rbx, rcx
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, rbx
repne scasw ax, word [rdi]
not rcx
lea rsi, [rcx + rcx]
lea ecx, [rax + 0x40]
mov rdx, rsi
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov rdi, rax
test rax, rax
je 0x140103102
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GlobalLock]
test rax, rax
je 0x1401030be
mov r8, rsi
mov rdx, rbx
mov rcx, rax
call fcn.1401e75a0
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
xor ecx, ecx
call qword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x1401030f9
call qword [sym.imp.USER32.dll_EmptyClipboard]
mov rdx, rdi
mov ecx, reloc.WS2_32.dll_listen
call qword [sym.imp.USER32.dll_SetClipboardData]
call qword [sym.imp.USER32.dll_CloseClipboard]
mov eax, 1
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GlobalFree]
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
xor eax, eax
add rsp, 0x20
pop rdi
ret

Function at 0x1401031a0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x30
xor ebp, ebp
mov ebx, r8d
mov rdi, rdx
mov rsi, rcx
mov dword [rsp + 0x50], ebp
test r8d, r8d
je 0x1401031f3
nop dword [rax + rax]
lea r9, [rsp + 0x50]
mov r8d, ebx
mov rdx, rdi
mov rcx, rsi
mov qword [rsp + 0x20], rbp
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x14010320d
sub ebx, dword [rsp + 0x50]
jne 0x1401031d0
mov eax, 1
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
xor eax, eax
jmp 0x1401031f8
Function at 0x140103350
Capabilities:
Log keystrokes

Disassembly:
push rbx
sub rsp, 0x60
mov ebx, ecx
mov dword [rsp + 0x30], 1
mov qword [rsp + 0x48], r9
mov dword [rsp + 0x3c], r8d
mov dword [rsp + 0x40], 0
mov word [rsp + 0x3a], dx
mov word [rsp + 0x38], cx
test edx, edx
jne 0x1401033f8
call qword [sym.imp.USER32.dll_MapVirtualKeyW]
mov word [rsp + 0x3a], ax
test ax, ax
je 0x1401033f8
mov eax, dword [rsp + 0x3c]
or eax, 8
mov dword [rsp + 0x3c], eax
cmp ebx, 0x5b
je 0x1401033f1
cmp ebx, 0x5c
je 0x1401033f1
cmp ebx, 0x5d
je 0x1401033f1
cmp ebx, 0x25
je 0x1401033f1
cmp ebx, 0x27
je 0x1401033f1
cmp ebx, 0x26
je 0x1401033f1
cmp ebx, 0x28
je 0x1401033f1
cmp ebx, 0x24
je 0x1401033f1
cmp ebx, 0x23
je 0x1401033f1
cmp ebx, 0x2e
je 0x1401033f1
cmp ebx, 0x2d
je 0x1401033f1
cmp ebx, 0x21
je 0x1401033f1
cmp ebx, 0x22
je 0x1401033f1
cmp ebx, 0xa5
je 0x1401033f1
cmp ebx, 0xa3
je 0x1401033f1
cmp ebx, 0x13
jne 0x1401033f8
or eax, 1
mov dword [rsp + 0x3c], eax
mov r8d, 0x28
lea rdx, [rsp + 0x30]
lea ecx, [r8 - 0x27]
call qword [sym.imp.USER32.dll_SendInput]
cmp eax, 1
je 0x140103443
cmp dword [reloc.WS2_32.dll_accept], 3
jg 0x140103443
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea r9, str.Injection_failed._err_d
lea rdx, str..TShareApe.cpp
mov r8d, 0x522
mov ecx, 3
mov dword [rsp + 0x20], eax
call fcn.1400045f0
add rsp, 0x60
pop rbx
ret

Function at 0x140103720
Capabilities:
Log keystrokes via polling

Disassembly:
push rdi
sub rsp, 0x20
mov qword [rsp + 0x38], rsi
xor esi, esi
mov rdi, rcx
cmp qword [rcx + 0x390], rsi
jbe 0x1401037f6
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x40], r12
mov r12d, 0x8000
nop dword [rax]
mov rax, qword [rdi + 0x380]
movzx ebx, word [rax + rsi*2]
cmp ebx, 0xa2
je 0x1401037ac
cmp ebx, 0xa3
je 0x1401037ac
cmp ebx, 0x11
je 0x1401037ac
cmp ebx, 0xa0
je 0x1401037a5
cmp ebx, 0xa1
je 0x1401037a5
cmp ebx, 0x10
je 0x1401037a5
cmp ebx, 0xa4
je 0x14010379e
cmp ebx, 0xa5
je 0x14010379e
cmp ebx, 0x12
je 0x14010379e
mov ecx, ebx
jmp 0x1401037b1
mov ecx, reloc.WS2_32.dll_select
jmp 0x1401037b1
mov ecx, reloc.WS2_32.dll_recv
jmp 0x1401037b1
mov ecx, reloc.WS2_32.dll_recvfrom
call qword [sym.imp.USER32.dll_GetKeyState]
test r12w, ax
je 0x1401037dc
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov ecx, ebx
call fcn.140103350
xor r9d, r9d
xor edx, edx
lea r8d, [r9 + 2]
mov ecx, ebx
call fcn.140103350
inc rsi
cmp rsi, qword [rdi + 0x390]
jb 0x140103750
mov r12, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x30]
mov rcx, qword [rdi + 0x380]
mov rsi, qword [rsp + 0x38]
test rcx, rcx
je 0x14010380c
call fcn.1401e64f8
mov qword [rdi + 0x380], 0
mov qword [rdi + 0x388], 0
mov qword [rdi + 0x390], 0
add rsp, 0x20
pop rdi
ret
Function at 0x140105590
Capabilities:
Log keystrokes via polling

Disassembly:
mov rax, rsp
push rsi
push r12
push r14
sub rsp, 0x60
mov r14, rcx
mov ecx, 0x45
mov r12d, edx
mov dword [rax - 0x48], 0x14
mov dword [rax - 0x44], 0xa2
mov dword [rax - 0x40], 0xa0
mov dword [rax - 0x3c], 0xa4
mov dword [rax - 0x38], 0xa3
mov dword [rax - 0x34], 0xa1
mov dword [rax - 0x30], 0xa5
mov dword [rax - 0x2c], 0x5b
call fcn.1401e6440
mov rsi, rax
test rax, rax
je 0x140105737
mov qword [rsp + 0x80], rbx
mov qword [rsp + 0x88], rbp
mov dword [rsi + 0x18], 0
mov qword [rsp + 0x90], rdi
mov qword [rsp + 0x58], r13
lea r13, [rsi + 0x34]
mov edi, 1
lea rax, vtable.TBufferImpl_class_TBufferAlloc__20_.0
mov qword [rsp + 0x50], r15
mov qword [rsi], rax
mov dword [rsi + 0x1c], edi
mov qword [rsi + 8], r13
mov dword [rsi + 0x10], reloc.WS2_32.dll_recvfrom
lea rbp, [rsp + 0x30]
lea r15d, [rdi + 7]
mov byte [r13], reloc.WS2_32.dll_recvfrom
nop dword [rax + rax]
mov ebx, dword [rbp]
cmp ebx, 0xa2
je 0x1401056a4
cmp ebx, 0xa3
je 0x1401056a4
cmp ebx, 0x11
je 0x1401056a4
cmp ebx, 0xa0
je 0x14010569d
cmp ebx, 0xa1
je 0x14010569d
cmp ebx, 0x10
je 0x14010569d
cmp ebx, 0xa4
je 0x140105696
cmp ebx, 0xa5
je 0x140105696
cmp ebx, 0x12
je 0x140105696
mov ecx, ebx
jmp 0x1401056a9
mov ecx, reloc.WS2_32.dll_select
jmp 0x1401056a9
mov ecx, reloc.WS2_32.dll_recv
jmp 0x1401056a9
mov ecx, reloc.WS2_32.dll_recvfrom
call qword [sym.imp.USER32.dll_GetKeyState]
movsx ecx, ax
cmp ebx, 0x14
jne 0x1401056bf
movsx ecx, cl
and ecx, 1
jmp 0x1401056c5
shr ecx, 0xf
and ecx, 1
mov eax, edi
inc edi
add rbp, 4
mov byte [rax + r13], bl
mov byte [rdi + r13], cl
inc edi
sub r15, 1
jne 0x140105650
mov r15, qword [rsp + 0x50]
mov r13, qword [rsp + 0x58]
mov rdi, qword [rsp + 0x90]
mov rbp, qword [rsp + 0x88]
mov rbx, qword [rsp + 0x80]
test r12d, r12d
jne 0x14010570f
mov r12d, dword [r14 + 0x358]
mov rcx, qword [r14 + 8]
mov r9d, 3
mov r8, rsi
mov rax, qword [rcx]
mov edx, r12d
mov dword [rsp + 0x20], 0
call qword [rax + reloc.WS2_32.dll_recv]
mov r11, qword [rsi]
mov rcx, rsi
call qword [r11 + reloc.WS2_32.dll_htonl]
add rsp, 0x60
pop r14
pop r12
pop rsi
ret
Function at 0x140105c10
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
push rsi
push rdi
push r12
sub rsp, 0x30
mov esi, ecx
xor ecx, ecx
mov r12, rdx
xor edi, edi
call qword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x140105dfb
mov ecx, esi
mov qword [rsp + 0x58], rbp
call qword [sym.imp.USER32.dll_GetClipboardData]
mov rbp, rax
test rax, rax
je 0x140105df0
mov rcx, rax
mov qword [rsp + 0x50], rbx
call qword [sym.imp.KERNEL32.dll_GlobalSize]
mov rbx, rax
cmp rax, r12
jae 0x140105deb
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_GlobalLock]
mov r12, rax
test rax, rax
je 0x140105deb
mov qword [rsp + 0x68], r13
cmp esi, 1
jne 0x140105d32
lea rcx, [rbx + 1]
mov eax, 2
mov r13, 0xffffffffffffffff
mul rcx
cmovo rax, r13
mov rcx, rax
call fcn.1401e74e4
lea ecx, [rbx + 1]
mov r9d, ebx
mov dword [rsp + 0x28], ecx
mov r8, r12
xor edx, edx
xor ecx, ecx
mov rsi, rax
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov word [rsi + rbx*2], di
mov rbx, rdi
test rsi, rsi
je 0x140105cdb
mov rcx, rsi
call fcn.140001a20
mov rbx, rax
mov rcx, rsi
call fcn.1401e6538
xor eax, eax
mov rcx, r13
mov rdi, rbx
repne scasb al, byte [rdi]
not rcx
inc ecx
call fcn.14001e5c0
mov rdi, rax
test rax, rax
je 0x140105d1c
mov rcx, qword [rax + 8]
mov rdx, rbx
mov byte [rcx], reloc.WS2_32.dll_ntohl
mov r8d, dword [rax + 0x10]
mov rcx, qword [rax + 8]
dec r8d
inc rcx
call fcn.1401e75a0
test rbx, rbx
je 0x140105ddd
mov rcx, rbx
call fcn.1401e64f8
jmp 0x140105ddd
shr rbx, 1
je 0x140105ddd
lea rcx, [rsp + 0x60]
mov r9d, ebx
xor r8d, r8d
mov rdx, rax
call fcn.140105ae0
mov rbx, qword [rsp + 0x60]
test rbx, rbx
je 0x140105d60
mov rcx, qword [rbx]
test rcx, rcx
jne 0x140105d63
mov rcx, rdi
mov rsi, rdi
test rcx, rcx
je 0x140105d73
call fcn.140001a20
mov rsi, rax
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, rsi
repne scasb al, byte [rdi]
not rcx
inc ecx
call fcn.14001e5c0
mov rdi, rax
test rax, rax
je 0x140105dad
mov rax, qword [rax + 8]
mov rdx, rsi
mov byte [rax], reloc.WS2_32.dll_ntohl
mov r8d, dword [rdi + 0x10]
mov rcx, qword [rdi + 8]
dec r8d
inc rcx
call fcn.1401e75a0
test rsi, rsi
je 0x140105dba
mov rcx, rsi
call fcn.1401e64f8
test rbx, rbx
je 0x140105ddd
dec dword [rbx + 0x10]
cmp dword [rbx + 0x10], 0
jg 0x140105ddd
mov rcx, qword [rbx]
test rcx, rcx
je 0x140105dd5
call fcn.1401e64f8
mov rcx, rbx
call fcn.1401e60f0
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov r13, qword [rsp + 0x68]
mov rbx, qword [rsp + 0x50]
call qword [sym.imp.USER32.dll_CloseClipboard]
mov rbp, qword [rsp + 0x58]
mov rax, rdi
add rsp, 0x30
pop r12
pop rdi
pop rsi
ret
Function at 0x140107a50
Capabilities:
Create directory
Create process on windows
Get file size
Move file
Read file on windows
Shutdown system

Disassembly:
sub rcx, 0xb0
jmp method.TShareApe.5.virtual_8
Function at 0x14010a6e0
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov ebx, edx
mov rdi, rcx
mov rdx, rcx
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_GetTempPathA]
mov r11d, eax
test eax, eax
je 0x14010a764
lea edx, [rbx - 0x14]
cmp r11d, edx
jae 0x14010a764
test eax, eax
je 0x14010a724
lea ecx, [r11 - 1]
cmp byte [rcx + rdi], 0x5c
je 0x14010a724
mov byte [r11 + rdi], 0x5c
inc r11d
mov byte [r11 + rdi], 0
xor eax, eax
or rcx, 0xffffffffffffffff
repne scasb al, byte [rdi]
mov rax, qword [str.gotohttp_ft_temp.zip]
mov qword [rdi - 1], rax
mov rax, qword [0x14023ffe0]
mov qword [rdi + 7], rax
mov eax, dword [0x14023ffe8]
mov dword [rdi + 0xf], eax
movzx eax, byte [0x14023ffec]
mov byte [rdi + 0x13], al
lea eax, [r11 + 0x14]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
xor eax, eax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x14010a780
Capabilities:
Get common file path

Disassembly:
sub rsp, 0x148
mov rax, qword [0x1402e0068]
xor rax, rsp
mov qword [rsp + 0x130], rax
lea rcx, [rsp + 0x21]
xor edx, edx
mov r8d, 0x103
mov byte [rsp + 0x20], 0
call fcn.1401e6750
lea rdx, [rsp + 0x20]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetTempPathA]
mov r11d, eax
test eax, eax
je 0x14010a846
cmp r11d, 0xf0
jae 0x14010a846
mov qword [rsp + 0x140], rdi
test eax, eax
je 0x14010a7f6
lea ecx, [r11 - 1]
cmp byte [rsp + rcx + 0x20], 0x5c
je 0x14010a7f6
mov byte [rsp + r11 + 0x20], 0x5c
inc r11d
mov byte [rsp + r11 + 0x20], 0
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rsp + 0x20]
repne scasb al, byte [rdi]
mov rax, qword [str.gotohttp_ft_temp.zip]
mov qword [rdi - 1], rax
mov rax, qword [0x14023ffe0]
mov qword [rdi + 7], rax
mov eax, dword [0x14023ffe8]
mov dword [rdi + 0xf], eax
movzx eax, byte [0x14023ffec]
mov byte [rdi + 0x13], al
mov rdi, qword [rsp + 0x140]
lea eax, [r11 + 0x14]
test eax, eax
je 0x14010a846
lea rcx, [rsp + 0x20]
call fcn.1401e97b8
mov rcx, qword [rsp + 0x130]
xor rcx, rsp
call fcn.1401e6720
add rsp, 0x148
ret