joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14029a6b0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x6e8
lea rbp, [rsp + 0x20]
lea rdi, [rsp + 0x20]
mov ecx, 0x122
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x708]
mov rax, qword [0x140711040]
xor rax, rbp
mov qword [rbp + 0x6b8], rax
lea rcx, [0x1407575e0]
call fcn.1401d9db4
lea rdx, [rbp + 0x30]
mov rcx, qword [rbp + 0x6e0]
call fcn.1401d5b47
mov edx, 0x400
lea rcx, [rbp + 0x30]
call fcn.1401d6c4f
mov qword [rbp + 0x468], rax
mov r9, qword [rbp + 0x6e8]
mov r8d, 0x400
mov edx, 1
mov rcx, qword [rbp + 0x468]
call qword [sym.imp.ucrtbased.dll_fread]
mov qword [rbp + 8], rax
mov rax, qword [rbp + 8]
mov rcx, qword [rbp + 0x40]
add rcx, rax
mov rax, rcx
mov qword [rbp + 0x40], rax
cmp qword [rbp + 8], 0x400
je 0x14029a70e
lea rcx, [rbp + 0x30]
call fcn.1401d4d5a
lea rcx, [rbp - 0x20]
lea rdx, [0x1405b44d0]
call fcn.1401d7a64
mov rcx, qword [rbp + 0x6b8]
xor rcx, rbp
call fcn.1401d334c
lea rsp, [rbp + 0x6c8]
pop rdi
pop rbp
ret

Function at 0x14029a7d0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x6e8
lea rbp, [rsp + 0x20]
lea rdi, [rsp + 0x20]
mov ecx, 0x122
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x708]
mov rax, qword [0x140711040]
xor rax, rbp
mov qword [rbp + 0x6b8], rax
lea rcx, [0x1407575e0]
call fcn.1401d9db4
lea rdx, [rbp + 0x50]
mov rcx, qword [rbp + 0x6e0]
call fcn.1401d5b47
mov rdx, qword [rbp + 0x6f0]
lea rcx, [rbp + 0x50]
call fcn.1401d6c4f
mov qword [rbp + 0x28], rax
mov r9, qword [rbp + 0x6e8]
mov r8, qword [rbp + 0x6f0]
mov edx, 1
mov rcx, qword [rbp + 0x28]
call qword [sym.imp.ucrtbased.dll_fread]
mov qword [rbp + 8], rax
mov rax, qword [rbp + 8]
mov rcx, qword [rbp + 0x60]
add rcx, rax
mov rax, rcx
mov qword [rbp + 0x60], rax
lea rcx, [rbp + 0x50]
call fcn.1401d4d5a
cmp qword [rbp + 8], 0
jbe 0x14029a896
mov dword [rbp + 0x6b4], 1
jmp 0x14029a8a0
mov dword [rbp + 0x6b4], 0
mov eax, dword [rbp + 0x6b4]
mov edi, eax
lea rcx, [rbp - 0x20]
lea rdx, [0x1405b4550]
call fcn.1401d7a64
mov eax, edi
mov rcx, qword [rbp + 0x6b8]
xor rcx, rbp
call fcn.1401d334c
lea rsp, [rbp + 0x6c8]
pop rdi
pop rbp
ret
Function at 0x14000132c
Capabilities:
Find process by pid

Disassembly:
push rbx
sub rsp, 0x20
movsxd rcx, ecx
lea rdx, [rsp + 0x40]
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
mov ebx, eax
test eax, eax
jns 0x140001371
cmp eax, 0xc000000d
jne 0x140001359
lea rcx, [0x140001660]
call fcn.140001110
cmp ebx, 0xc000000b
jne 0x14000136d
lea rcx, [0x140001680]
call fcn.140001110
xor al, al
jmp 0x1400013c6
cmp qword [0x140003010], 0
jne 0x140001390
lea rcx, [0x1400016a0]
call fcn.140001110
call fcn.140001278
test al, al
je 0x1400013c6
mov rcx, qword [rsp + 0x40]
mov rax, qword [0x140003010]
and dword [rsp + 0x38], 0
mov dword [rsp + 0x38], 0x70
mov dword [rsp + 0x38], 0x72
mov byte [rax + rcx], 0x72
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov al, 1
jmp 0x1400013c6
add rsp, 0x20
pop rbx
ret
Function at 0x4023a0
Capabilities:
Create tcp socket
Create udp socket

Disassembly:
call fcn.00401018
mov rax, rsp
shr rax, 4
jae 0x4023b0
push 0
sub rsp, 0x80
mov ebx, 2
mov ecx, 0x17
test dword [rbp + 0x10], 1
cmovne ebx, ecx
mov edi, 1
mov ecx, 2
mov esi, 6
mov edx, 0x11
test dword [rbp + 0x10], 2
cmovne edi, ecx
cmovne esi, edx
mov r8d, esi
mov edx, edi
mov ecx, ebx
call qword [sym.imp.WS2_32.DLL_socket]
inc rax
test rax, rax
je 0x40248b
dec rax
mov rdx, rax
mov rsi, 0x10
sub rsp, 0x10
test dword [rbp + 0x10], 1
je 0x402427
sub rsp, 0x10
add rsi, 0x10
mov rdi, rsp
xor eax, eax
mov ecx, esi
rep stosb byte [rdi], al
mov rdi, rsp
mov word [rdi], bx
mov eax, dword [rbp + 0x18]
xchg ah, al
mov word [rdi + 2], ax
mov rbx, rdx
mov rax, rsp
shr rax, 4
jae 0x40244d
push 0
sub rsp, 0x80
mov r8, rsi
mov rdx, rdi
mov rcx, rbx
call qword [sym.imp.WS2_32.DLL_bind]
inc eax
test eax, eax
je 0x402493
test dword [rbp + 0x10], 2
jne 0x402488
mov rdx, 0x7fffffff
mov rcx, rbx
call qword [sym.imp.WS2_32.DLL_listen]
inc eax
test eax, eax
je 0x402493
mov rax, rbx
call fcn.00401030
ret 0x10
mov rcx, rbx
call qword [sym.imp.WS2_32.DLL_closesocket]
xor eax, eax
jmp 0x40248b

Function at 0x402853
Capabilities:
Send data
Send data on socket

Disassembly:
call fcn.00401018
mov rax, rsp
shr rax, 4
jae 0x402863
push 0
sub rsp, 0x80
mov rbx, qword [rbp + 0x10]
mov rsi, qword [rbp + 0x28]
mov rdi, qword [rbp + 0x30]
jmp 0x40287f
push 1
call fcn.004022ef
xor r9d, r9d
mov r8d, dword [rdi]
mov rdx, rsi
mov rcx, rbx
call qword [sym.imp.WS2_32.DLL_send]
test eax, eax
je 0x4028ac
inc eax
test eax, eax
jne 0x402912
mov ecx, 3
test dword [rbp + 0x18], 1
cmovne eax, ecx
jne 0x402918
call qword [sym.imp.WS2_32.DLL_WSAGetLastError]
cmp eax, 0x2747
je 0x402878
mov ecx, 1
cmp eax, 0x271e
cmove eax, ecx
je 0x402918
cmp eax, 0x2734
je 0x4028ed
cmp eax, 0x2733
je 0x4028ed
cmp eax, 0x2751
je 0x4028ed
cmp eax, 0x2714
je 0x4028ed
mov eax, 2
jmp 0x402918
push 0x1e
call fcn.004022ef
test dword [rbp + 0x18], 8
je 0x402878
sub dword [rbp + 0x20], 0x1e
jae 0x402878
mov eax, 4
jmp 0x402918
dec eax
mov dword [rdi], eax
xor eax, eax
call fcn.00401030
ret 0x28
Function at 0x402920
Capabilities:
Check for time delay via gettickcount
Receive data
Receive data on socket

Disassembly:
call fcn.00401018
mov rax, rsp
shr rax, 4
jae 0x402930
push 0
sub rsp, 0x80
mov rbx, qword [rbp + 0x10]
mov rdi, qword [rbp + 0x30]
mov esi, dword [rbp + 0x18]
call qword [sym.imp.KERNEL32.DLL_GetTickCount]
mov r12d, eax
xor r13d, r13d
xor eax, eax
mov ecx, esi
and ecx, 2
cmovne r13d, eax
jmp 0x402962
push 1
call fcn.004022ef
mov ecx, esi
and ecx, 2
mov eax, dword [rdi]
jne 0x40296e
sub eax, r13d
mov r9d, ecx
mov r8d, eax
mov rdx, qword [rbp + 0x28]
mov rcx, rbx
call qword [sym.imp.WS2_32.DLL_recv]
test eax, eax
je 0x40299f
inc eax
test eax, eax
jne 0x4029cb
mov ecx, 3
test esi, 1
cmovne eax, ecx
jne 0x402a29
call qword [sym.imp.WS2_32.DLL_WSAGetLastError]
push rax
push 1
call fcn.004022ef
pop rax
cmp eax, 0x2733
je 0x402a04
mov ecx, 2
cmp eax, 0x2749
cmove eax, ecx
je 0x402a29
mov eax, 3
jmp 0x402a29
dec eax
test esi, 4
je 0x4029df
test eax, eax
je 0x402a04
mov dword [rdi], eax
xor eax, eax
jmp 0x402a29
xor ecx, ecx
test esi, 2
cmovne r13d, eax
jne 0x4029f0
add r13d, eax
cmp r13d, dword [rdi]
cmove eax, ecx
je 0x402a29
test esi, 2
jne 0x402a04
add qword [rbp + 0x28], rax
mov edx, dword [rbp + 0x20]
test edx, edx
je 0x40295b
call qword [sym.imp.KERNEL32.DLL_GetTickCount]
sub eax, r12d
cmp eax, dword [rbp + 0x20]
jb 0x40295b
mov eax, 4
mov dword [rdi], r13d
call fcn.00401030
ret 0x28
Function at 0x2fc4d77c0
Capabilities:
Write file on windows

Disassembly:
push rbp
push rbx
sub rsp, 0x38
lea rbp, [rsp + 0x30]
mov qword [rbp + 0x20], rcx
mov qword [rbp + 0x28], rdx
mov qword [rbp + 0x30], r8
mov qword [rbp + 0x38], r9
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov ecx, 2
call sub.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func
mov r9, rax
mov r8d, 0x1b
mov edx, 1
lea rax, str.Mingw_w64_runtime_failure:_n
mov rcx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
mov rbx, qword [rbp - 8]
mov ecx, 2
call sub.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func
mov rcx, rax
mov rax, qword [rbp + 0x20]
mov r8, rbx
mov rdx, rax
call fcn.2fc4d88a0
call sub.api_ms_win_crt_runtime_l1_1_0.dll_abort
nop

Function at 0x2fc4d81c2
Capabilities:
Get thread local storage value

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov eax, dword [0x2fc4fa108]
test eax, eax
je 0x2fc4d825a
lea rax, [0x2fc4fa0e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
call rax
mov rax, qword [0x2fc4fa110]
mov qword [rbp - 8], rax
jmp 0x2fc4d823e
mov rax, qword [rbp - 8]
mov eax, dword [rax]
mov ecx, eax
mov rax, qword [sym.imp.KERNEL32.dll_TlsGetValue]
call rax
mov qword [rbp - 0x10], rax
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
test eax, eax
jne 0x2fc4d8232
cmp qword [rbp - 0x10], 0
je 0x2fc4d8232
mov rax, qword [rbp - 8]
mov rdx, qword [rax + 8]
mov rax, qword [rbp - 0x10]
mov rcx, rax
call rdx
mov rax, qword [rbp - 8]
mov rax, qword [rax + 0x10]
mov qword [rbp - 8], rax
cmp qword [rbp - 8], 0
jne 0x2fc4d81f8
lea rax, [0x2fc4fa0e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call rax
jmp 0x2fc4d825b
nop
add rsp, 0x30
pop rbp
ret

Function at 0x2fc4d8360
Capabilities:
Parse pe header

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov rax, qword [rbp + 0x10]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
movzx eax, word [rax]
cmp ax, 0x5a4d
je 0x2fc4d8388
mov eax, 0
jmp 0x2fc4d83d6
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp - 8]
add rax, rdx
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
cmp eax, 0x4550
je 0x2fc4d83b1
mov eax, 0
jmp 0x2fc4d83d6
mov rax, qword [rbp - 0x10]
add rax, 0x18
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
movzx eax, word [rax]
cmp ax, 0x20b
je 0x2fc4d83d1
mov eax, 0
jmp 0x2fc4d83d6
mov eax, 1
add rsp, 0x20
pop rbp
ret
Function at 0x2fc4d83dc
Capabilities:
Enumerate pe sections

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov rax, qword [rbp + 0x10]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp + 0x10]
add rax, rdx
mov qword [rbp - 0x18], rax
mov dword [rbp - 0xc], 0
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 0x14]
movzx edx, ax
mov rax, qword [rbp - 0x18]
add rax, rdx
add rax, 0x18
mov qword [rbp - 8], rax
jmp 0x2fc4d845a
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0xc]
mov eax, eax
cmp qword [rbp + 0x18], rax
jb 0x2fc4d8451
mov rax, qword [rbp - 8]
mov edx, dword [rax + 0xc]
mov rax, qword [rbp - 8]
mov eax, dword [rax + 8]
add eax, edx
mov eax, eax
cmp qword [rbp + 0x18], rax
jae 0x2fc4d8451
mov rax, qword [rbp - 8]
jmp 0x2fc4d846f
add dword [rbp - 0xc], 1
add qword [rbp - 8], 0x28
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 6]
movzx eax, ax
cmp dword [rbp - 0xc], eax
jb 0x2fc4d8424
mov eax, 0
add rsp, 0x20
pop rbp
ret
Function at 0x140002830
Capabilities:
Delete registry key

Disassembly:
push rdi
sub rsp, 0x40
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x58], rsi
mov rsi, rdx
mov rbx, rcx
mov rdi, qword [rcx + 0x10]
test rdi, rdi
je 0x1400028d0
mov rbx, qword [rcx]
cmp qword [rdi], 0
je 0x1400028a9
lea rcx, str.Advapi32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
nop
test rax, rax
je 0x1400028c9
lea rdx, str.RegDeleteKeyTransactedA
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
nop
test rax, rax
je 0x1400028c9
and qword [rsp + 0x28], 0
mov rdx, qword [rdi]
mov qword [rsp + 0x20], rdx
xor r9d, r9d
xor r8d, r8d
mov rdx, rsi
mov rcx, rbx
call rax
nop
jmp 0x1400028b9
cmp dword [rdi + 8], 0
je 0x1400028c9
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
nop
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret
mov eax, 1
jmp 0x1400028b9
cmp byte [0x14009e7d8], 0
jne 0x14000291d
lea rcx, str.Advapi32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
nop
test rax, rax
je 0x140002909
lea rdx, str.RegDeleteKeyExA
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
nop
mov r10, rax
mov qword [0x14009e7e0], rax
jmp 0x140002910
mov r10, qword [0x14009e7e0]
mov eax, 1
mov byte [0x14009e7d8], al
jmp 0x140002924
mov r10, qword [0x14009e7e0]
mov rdx, rsi
mov rcx, qword [rbx]
test r10, r10
je 0x1400028b2
xor r9d, r9d
mov r8d, dword [rbx + 8]
call r10
nop
jmp 0x1400028b9

Function at 0x140002a3c
Capabilities:
Query or enumerate registry key

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rbp
push rdi
push r14
lea rbp, [rsp - 0x80]
sub rsp, 0x180
mov rax, qword [0x1400991b0]
xor rax, rsp
mov qword [rbp + 0x70], rax
mov r9d, dword [rcx + 8]
xor r14d, r14d
mov rsi, rdx
mov qword [rsp + 0x48], r14
mov r8, rdx
mov qword [rsp + 0x40], r14
mov rdx, qword [rcx]
mov rdi, rcx
or r9d, 0x2001f
mov qword [rsp + 0x50], r14
lea rcx, [rsp + 0x40]
call fcn.140002940
jmp 0x140002aa8
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x40]
call fcn.140002a3c
mov rcx, qword [rsp + 0x40]
mov ebx, eax
test eax, eax
jne 0x140002b16
lea rax, [rsp + 0x60]
mov dword [rsp + 0x58], 0x100
mov qword [rsp + 0x38], rax
lea r9, [rsp + 0x58]
mov qword [rsp + 0x30], r14
lea r8, [rsp + 0x70]
mov qword [rsp + 0x28], r14
xor edx, edx
mov qword [rsp + 0x20], r14
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
test eax, eax
je 0x140002a99
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x140002aff
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x40], r14
mov rdx, rsi
mov dword [rsp + 0x48], r14d
mov rcx, rdi
call fcn.140002830
mov rcx, qword [rsp + 0x40]
mov ebx, eax
test rcx, rcx
je 0x140002b21
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
mov rcx, qword [rbp + 0x70]
xor rcx, rsp
call fcn.14004b000
lea r11, [rsp + 0x180]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
Function at 0x14000781c
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r12
push r13
push r15
mov rbp, rsp
sub rsp, 0x40
mov rax, qword [0x1400991b0]
xor rax, rsp
mov qword [rbp - 8], rax
mov rax, qword gs:[0x58]
mov rbx, rdx
mov r13d, 4
mov esi, 0xdff7
mov dword [rbp - 0x20], 0xf72e47f1
mov dword [rbp - 0x1c], 0x93badf9b
mov rdi, qword [rax]
mov dword [rbp - 0x18], 0xd7debfe3
mov dword [rbp - 0x14], 0x89e1a3
mov dword [rbp - 0x10], 0xf76547aa
mov eax, dword [rdi + r13]
cmp dword [0x14009ead8], eax
jle 0x1400078db
lea rcx, [0x14009ead8]
call fcn.14004b21c
cmp dword [0x14009ead8], 0xffffffff
jne 0x1400078db
movups xmm0, xmmword [rbp - 0x20]
mov eax, dword [rbp - 0x10]
lea rcx, [0x14006cf5c]
mov byte [0x14009edce], 1
movups xmmword [0x14009edb8], xmm0
mov dword [0x14009edc8], eax
mov word [0x14009edcc], si
call fcn.14004b990
lea rcx, [0x14009ead8]
call fcn.14004b1bc
xor esi, esi
lea rdx, [0x14009edb8]
cmp byte [0x14009edce], sil
je 0x14000791b
mov r8d, esi
mov cl, r8b
movabs rax, 0xe1d7bf93dff74797
and cl, 7
shl cl, 3
shr rax, cl
xor word [rdx + r8*2], ax
inc r8
cmp r8, 0xb
jb 0x1400078f0
mov byte [0x14009edce], sil
mov rcx, rbx
call fcn.140015850
cmp rax, 0xffffffffffffffff
jne 0x140007aa5
mov eax, dword [rdi + r13]
mov r15d, 0x5791
cmp dword [0x14009ef2c], eax
mov dword [rbp - 0x20], 0x370c57b0
mov dword [rbp - 0x1c], 0x1f3f7b74
mov dword [rbp - 0x18], 0x7febbf5e
mov dword [rbp - 0x14], 0xbee53e
jle 0x1400079a2
lea rcx, [0x14009ef2c]
call fcn.14004b21c
cmp dword [0x14009ef2c], 0xffffffff
jne 0x1400079a2
movups xmm0, xmmword [rbp - 0x20]
lea rcx, [0x14006cf3c]
mov byte [0x14009eeba], 1
mov word [0x14009eeb8], r15w
movups xmmword [0x14009eea8], xmm0
call fcn.14004b990
lea rcx, [0x14009ef2c]
call fcn.14004b1bc
cmp byte [0x14009eeba], sil
lea rdx, [0x14009eea8]
movabs r15, 0xe57fbf1f7b375791
je 0x1400079e3
mov r8, rsi
mov cl, r8b
mov rax, r15
and cl, 7
shl cl, 3
shr rax, cl
xor word [rdx + r8*2], ax
inc r8
cmp r8, 9
jb 0x1400079bf
mov byte [0x14009eeba], sil
mov rcx, rbx
call fcn.140015850
cmp rax, 0xffffffffffffffff
je 0x140007aa1
mov eax, dword [rdi + r13]
mov r12d, 0xbf1f
cmp dword [0x14009e8a4], eax
mov dword [rbp - 0x20], 0x61a957ca
mov dword [rbp - 0x1c], 0x1f260970
jle 0x140007a5c
lea rcx, [0x14009e8a4]
call fcn.14004b21c
cmp dword [0x14009e8a4], 0xffffffff
jne 0x140007a5c
mov rax, qword [rbp - 0x20]
lea rcx, [0x14006cf1c]
mov qword [0x14009e898], rax
mov byte [0x14009e8a2], 1
mov word [0x14009e8a0], r12w
call fcn.14004b990
lea rcx, [0x14009e8a4]
call fcn.14004b1bc
cmp byte [0x14009e8a2], sil
lea rdx, [0x14009e898]
je 0x140007a93
mov r8, rsi
mov cl, r8b
mov rax, r15
and cl, 7
shl cl, 3
shr rax, cl
xor word [rdx + r8*2], ax
inc r8
cmp r8, 5
jb 0x140007a6f
mov byte [0x14009e8a2], sil
mov rcx, rbx
call fcn.140015850
cmp rax, 0xffffffffffffffff
jne 0x140007aa5
xor al, al
jmp 0x140007aa7
mov al, 1
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.14004b000
lea r11, [rsp + 0x40]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r13
pop r12
pop rdi
pop rbp
ret
Function at 0x140007acc
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
mov rax, rsp
push rbp
push rdi
push r14
lea rbp, [rax - 0x5f]
sub rsp, 0xa0
mov qword [rbp - 0x39], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
mov qword [rax + 0x20], rsi
mov rax, qword [0x1400991b0]
xor rax, rsp
mov qword [rbp + 0x37], rax
mov esi, edx
mov rbx, rcx
mov qword [rbp - 0x31], rcx
movdqa xmm0, xmmword [0x140086d90]
movdqu xmmword [rbp + 0x27], xmm0
xor r14d, r14d
mov word [rbp + 0x17], r14w
mov ecx, edx
call qword [sym.imp.USER32.dll_IsClipboardFormatAvailable]
test eax, eax
je 0x140007c2f
xor ecx, ecx
call qword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x140007c2f
mov ecx, esi
call qword [sym.imp.USER32.dll_GetClipboardData]
mov rdi, rax
cmp esi, 0xd
jne 0x140007b76
test rax, rax
je 0x140007c29
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GlobalLock]
test rax, rax
je 0x140007c29
mov rdx, rax
lea rcx, [rbp + 0x17]
call fcn.1400183ec
jmp 0x140007c20
test rdi, rdi
je 0x140007c29
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GlobalLock]
test rax, rax
je 0x140007c29
mov rdx, rax
lea rcx, [rbp - 0x29]
call fcn.140015aec
nop
lea rdx, [rbp - 0x29]
lea rcx, [rbp - 9]
call fcn.140007c88
mov rsi, rax
lea rax, [rbp + 0x17]
cmp rax, rsi
je 0x140007bdf
lea rcx, [rbp + 0x17]
call fcn.140018388
movups xmm0, xmmword [rsi]
movups xmmword [rbp + 0x17], xmm0
movups xmm1, xmmword [rsi + 0x10]
movups xmmword [rbp + 0x27], xmm1
mov qword [rsi + 0x10], r14
mov qword [rsi + 0x18], 7
mov word [rsi], r14w
lea rcx, [rbp - 9]
call fcn.140018388
nop
mov rdx, qword [rbp - 0x11]
cmp rdx, 0x10
jb 0x140007c20
inc rdx
mov rcx, qword [rbp - 0x29]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140007c1b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140007c80
call fcn.14004b024
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
call qword [sym.imp.USER32.dll_CloseClipboard]
movups xmm0, xmmword [rbp + 0x17]
movups xmmword [rbx], xmm0
movups xmm1, xmmword [rbp + 0x27]
movdqa xmm0, xmmword [0x140086d90]
movups xmmword [rbx + 0x10], xmm1
movdqu xmmword [rbp + 0x27], xmm0
mov word [rbp + 0x17], r14w
lea rcx, [rbp + 0x17]
call fcn.140018388
mov rax, rbx
mov rcx, qword [rbp + 0x37]
xor rcx, rsp
call fcn.14004b000
lea r11, [rsp + 0xa0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
call fcn.140055fe8
nop
int3
Function at 0x1400084a0
Capabilities:
Parse url

Disassembly:
mov rax, rsp
push rbp
push rdi
push r14
mov rbp, rsp
sub rsp, 0x70
mov qword [rbp - 8], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
mov qword [rax + 0x20], rsi
mov rbx, rcx
and dword [rbp - 0x30], 0
lea rdi, [rcx + 0x68]
cmp rdi, rdx
je 0x140008513
mov rsi, qword [rdx + 0x10]
cmp qword [rdx + 0x18], 0x10
jb 0x1400084dc
mov rdx, qword [rdx]
cmp rsi, qword [rdi + 0x18]
ja 0x140008505
mov r14, rdi
cmp qword [rdi + 0x18], 0x10
jb 0x1400084ef
mov r14, qword [rdi]
mov qword [rdi + 0x10], rsi
mov r8, rsi
mov rcx, r14
call fcn.14004cf20
mov byte [r14 + rsi], 0
jmp 0x140008513
mov r9, rdx
mov rdx, rsi
mov rcx, rdi
call fcn.14001dd98
mov esi, 0x68
mov r8d, esi
xor edx, edx
mov rcx, rbx
call fcn.14004d380
mov dword [rbx], esi
lea r14d, [rsi - 0x67]
mov dword [rbx + 0x10], r14d
mov dword [rbx + 0x20], r14d
mov dword [rbx + 0x30], r14d
mov dword [rbx + 0x40], r14d
mov dword [rbx + 0x50], r14d
mov dword [rbx + 0x60], r14d
cmp qword [rdi + 0x18], 0x10
jb 0x14000854d
mov rdi, qword [rdi]
mov r9, rbx
xor r8d, r8d
mov edx, dword [rbx + 0x78]
mov rcx, rdi
call qword [sym.imp.WININET.dll_InternetCrackUrlA]
test eax, eax
je 0x140008688
mov r9, qword [rbx + 0x18]
test r9, r9
je 0x1400085b5
mov edi, dword [rbx + 0x20]
movdqa xmm0, xmmword [0x140086da0]
movdqu xmmword [rbp - 0x40], xmm0
mov byte [rbp - 0x50], 0
lea rcx, [rbp - 0x50]
cmp rdi, 0xf
ja 0x1400085a4
mov qword [rbp - 0x40], rdi
mov r8d, edi
mov rdx, r9
call fcn.14004cf20
mov byte [rbp + rdi - 0x50], 0
jmp 0x1400085ac
mov rdx, rdi
call fcn.14001dd98
lea rax, [rbp - 0x50]
mov esi, r14d
jmp 0x1400085ca
lea rdx, [0x140081365]
lea rcx, [rbp - 0x28]
call fcn.140015aec
mov esi, 2
lea rdi, [rbx + 0x88]
mov rdx, rax
mov rcx, rdi
call fcn.1400159cc
test sil, 2
je 0x140008632
and esi, 0xfffffffd
mov rax, qword [rbp - 0x10]
cmp rax, 0x10
jb 0x140008621
lea rdx, [rax + 1]
mov rcx, qword [rbp - 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000861c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400086a3
call fcn.14004b024
movdqa xmm0, xmmword [0x140086da0]
movdqu xmmword [rbp - 0x18], xmm0
mov byte [rbp - 0x28], 0
test r14b, sil
je 0x14000866e
mov rdx, qword [rbp - 0x38]
cmp rdx, 0x10
jb 0x14000866e
inc rdx
mov rcx, qword [rbp - 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140008669
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000869d
call fcn.14004b024
cmp qword [rdi + 0x18], 0x10
jb 0x140008678
mov rdi, qword [rdi]
mov qword [rbx + 0x18], rdi
mov ecx, dword [rbx + 0x98]
mov dword [rbx + 0x20], ecx
mov al, r14b
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
call fcn.140055fe8
nop
call fcn.140055fe8
nop
int3
Function at 0x14000b89c
Capabilities:
Hash data with md5

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r14
lea rbp, [rsp - 0x150]
sub rsp, 0x250
mov qword [rsp + 0x48], 0xfffffffffffffffe
mov rax, qword [0x1400991b0]
xor rax, rsp
mov qword [rbp + 0x140], rax
mov rdi, rcx
mov qword [rsp + 0x50], rcx
xor r14d, r14d
mov dword [rsp + 0x20], r14d
movdqa xmm1, xmmword [0x140086da0]
movdqu xmmword [rbp - 0x40], xmm1
mov byte [rbp - 0x50], r14b
test rdx, rdx
je 0x14000ba98
test r8d, r8d
je 0x14000ba98
mov qword [rsp + 0x60], 0x80
mov qword [rsp + 0x68], r14
mov qword [rsp + 0x70], r14
mov qword [rsp + 0x78], r14
mov qword [rbp - 0x80], r14
mov qword [rbp - 0x78], r14
mov qword [rbp - 0x70], r14
mov qword [rbp - 0x68], r14
movdqa xmm0, xmmword [0x140086e70]
movdqa xmmword [rbp - 0x60], xmm0
mov qword [rbp - 0x30], r14
mov dword [rbp - 0x28], 0x67452301
mov dword [rbp - 0x24], 0xefcdab89
mov dword [rbp - 0x20], 0x98badcfe
mov dword [rbp - 0x1c], 0x10325476
mov r9d, r8d
mov r8, rdx
lea rdx, [rbp - 0x30]
call fcn.14000ae84
xor edx, edx
mov r8d, 0x104
lea rcx, [rbp + 0x30]
call fcn.14004d380
lea r8, [rbp + 0x30]
lea rdx, [rbp - 0x30]
lea rcx, [rsp + 0x60]
call fcn.14000af70
nop
movdqa xmm0, xmmword [0x140086da0]
movdqu xmmword [rsp + 0x38], xmm0
mov byte [rsp + 0x28], r14b
mov dword [rsp + 0x20], 2
lea edx, [r14 + 0x20]
lea rcx, [rsp + 0x28]
call fcn.14001d12c
mov qword [rsp + 0x38], r14
mov esi, r14d
movzx ebx, byte [rbp + rsi + 0x30]
mov eax, ebx
shr rax, 4
mov r8b, byte [rbp + rax - 0x60]
mov edx, 1
lea rcx, [rsp + 0x28]
call fcn.140015954
and ebx, 0xf
mov r8b, byte [rbp + rbx - 0x60]
mov edx, 1
lea rcx, [rsp + 0x28]
call fcn.140015954
inc rsi
cmp rsi, 0x10
jb 0x14000b9b8
lea r9, [rsp + 0x28]
cmp qword [rsp + 0x40], 0x10
cmovae r9, qword [rsp + 0x28]
or rsi, 0xffffffffffffffff
inc rsi
cmp byte [r9 + rsi], r14b
jne 0x14000ba0c
cmp rsi, qword [rbp - 0x38]
ja 0x14000ba41
lea rbx, [rbp - 0x50]
cmp qword [rbp - 0x38], 0x10
cmovae rbx, qword [rbp - 0x50]
mov qword [rbp - 0x40], rsi
mov r8, rsi
mov rdx, r9
mov rcx, rbx
call fcn.14004cf20
mov byte [rbx + rsi], r14b
jmp 0x14000ba4e
mov rdx, rsi
lea rcx, [rbp - 0x50]
call fcn.14001dd98
nop
mov rdx, qword [rsp + 0x40]
cmp rdx, 0x10
jb 0x14000ba87
inc rdx
mov rcx, qword [rsp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000ba82
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000bac3
call fcn.14004b024
movups xmm0, xmmword [rbp - 0x50]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [rbp - 0x40]
movups xmmword [rdi + 0x10], xmm1
jmp 0x14000baa3
movups xmm0, xmmword [rbp - 0x50]
movups xmmword [rcx], xmm0
movups xmmword [rcx + 0x10], xmm1
mov rax, rdi
mov rcx, qword [rbp + 0x140]
xor rcx, rsp
call fcn.14004b000
add rsp, 0x250
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret
call fcn.140055fe8
nop
int3