joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140005070
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x80
mov rax, qword [0x14000d010]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov edi, edx
mov rbx, rcx
cmp edx, 0xffffffff
jne 0x14000509d
xor eax, eax
jmp 0x1400051f2
mov rdx, qword [rcx + 0x40]
mov rax, qword [rdx]
test rax, rax
je 0x1400050c8
mov rdx, qword [rcx + 0x58]
movsxd r8, dword [rdx]
add r8, rax
cmp rax, r8
jae 0x1400050c8
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::_Pninc_void____ptr64]
mov byte [rax], dil
mov eax, edi
jmp 0x1400051f2
cmp qword [rcx + 0x80], 0
mov qword [rsp + 0xa0], rsi
je 0x1400051e5
mov r8, qword [rcx + 0x18]
lea rax, [rcx + 0x70]
cmp qword [r8], rax
jne 0x14000510b
mov rdx, qword [rcx + 0x90]
mov rcx, qword [rcx + 0x88]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
mov rcx, qword [rbx + 0x68]
test rcx, rcx
jne 0x140005136
mov rdx, qword [rbx + 0x80]
movsx ecx, dil
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x1400051ea
lea rax, [rsp + 0x40]
mov byte [rsp + 0x50], dil
mov qword [rsp + 0x38], rax
lea rdx, [rbx + 0x74]
lea rax, [rsp + 0x78]
mov qword [rsp + 0x30], rax
lea r9, [rsp + 0x51]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea r8, [rsp + 0x50]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet____ptr64__char_const____ptr64__char_const____ptr64__char_const____ptr64____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x1400051a5
sub eax, 1
je 0x1400051a5
cmp eax, 2
jne 0x1400051e5
movsx ecx, byte [rsp + 0x50]
mov rdx, qword [rbx + 0x80]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x1400051ea
mov rsi, qword [rsp + 0x40]
lea rax, [rsp + 0x58]
sub rsi, rax
je 0x1400051d3
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x58]
mov r8, rsi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rsi, rax
jne 0x1400051e5
lea rax, [rsp + 0x50]
mov byte [rbx + 0x71], 1
cmp qword [rsp + 0x48], rax
mov eax, edi
jne 0x1400051ea
mov eax, 0xffffffff
mov rsi, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.140006a60
mov rbx, qword [rsp + 0xa8]
add rsp, 0x80
pop rdi
ret
Function at 0x1400056a0
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x60
mov rax, qword [0x14000d010]
xor rax, rsp
mov qword [rsp + 0x58], rax
cmp qword [rcx + 0x68], 0
mov rbx, rcx
je 0x140005773
cmp byte [rcx + 0x71], 0
je 0x140005773
mov rax, qword [rcx]
mov edx, 0xffffffff
mov qword [rsp + 0x78], rdi
call qword [rax + 0x18]
cmp eax, 0xffffffff
je 0x14000576f
mov rcx, qword [rbx + 0x68]
lea rax, [rsp + 0x30]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x38]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x140005734
sub eax, 1
je 0x140005738
cmp eax, 2
jne 0x14000576f
mov byte [rbx + 0x71], 0
mov al, 1
mov rdi, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140006a60
add rsp, 0x60
pop rbx
ret
mov byte [rbx + 0x71], 0
mov rdi, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
sub rdi, rax
je 0x140005766
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x38]
mov r8, rdi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rdi, rax
jne 0x14000576f
cmp byte [rbx + 0x71], 0
sete al
jmp 0x14000571c
xor al, al
jmp 0x14000571c
mov al, 1
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140006a60
add rsp, 0x60
pop rbx
ret
Function at 0x140004ca0
Capabilities:
Log keystrokes via polling
Terminate process

Disassembly:
push rbx
sub rsp, 0x20
mov ecx, 0x23
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
xor ebx, ebx
test ax, ax
jns 0x140004cc1
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov ecx, 0x2d
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
mov edx, 1
test dl, al
je 0x140004d5a
cmp byte [0x140103c09], bl
mov eax, dword [0x140103d14]
sete cl
mov byte [0x140103c09], cl
test eax, eax
jle 0x140004cfc
mov eax, edx
mov dword [0x140103d14], edx
test eax, eax
jns 0x140004d04
mov dword [0x140103d14], edx
mov eax, dword [0x140103d10]
cmp eax, 0x230
jle 0x140004d19
mov eax, ebx
mov dword [0x140103d10], ebx
cmp eax, edx
jge 0x140004d23
mov dword [0x140103d10], ebx
test cl, cl
mov r8d, ebx
mov rcx, qword [0x140103c60]
mov edx, 0x2000d
sete r8b
call fcn.1400745f0
cmp byte [0x140103c09], bl
je 0x140004d5a
mov rcx, qword [0x140103c60]
call fcn.14007ba70
mov rcx, rax
call qword [sym.imp.USER32.dll_SetForegroundWindow]
add rsp, 0x20
pop rbx
ret
Function at 0x14000572c
Capabilities:
Encode data using add xor sub operations
Encode data using xor
Execute command

Disassembly:
sub rsp, 0x88
mov rax, qword [0x1400eef00]
xor rax, rsp
mov qword [rsp + 0x70], rax
movaps xmm0, xmmword [str.__TDC]
lea r9, [rsp + 0x20]
movaps xmm1, xmmword [0x1400b0750]
xor r8d, r8d
movaps xmmword [rsp + 0x20], xmm0
movaps xmm0, xmmword [0x1400b0760]
movaps xmmword [rsp + 0x40], xmm0
movsd xmm0, qword [0x1400b0780]
movaps xmmword [rsp + 0x30], xmm1
movaps xmm1, xmmword [str._n_v__tCSEQ_C]
movsd qword [rsp + 0x60], xmm0
movaps xmmword [rsp + 0x50], xmm1
mov eax, 0x51eb851f
mul r8d
shr edx, 4
movsx eax, dl
imul ecx, eax, 0x32
mov al, r8b
inc r8d
sub al, cl
add al, 0x33
xor byte [r9], al
inc r9
cmp r8d, 0x48
jl 0x140005788
lea rcx, [rsp + 0x20]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.140089d60
add rsp, 0x88
ret
Function at 0x140005b48
Capabilities:
Create process on windows
Encode data using xor

Disassembly:
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0xf0
mov rax, qword [0x1400eef00]
xor rax, rsp
mov qword [rbp + 0x4f], rax
movups xmm0, xmmword [str.GUF_QUVe]
movups xmmword [rbp + 0x2f], xmm0
movsd xmm0, qword [0x1400aaa38]
movsd qword [rbp + 0x3f], xmm0
mov eax, dword [0x1400aaa40]
mov dword [rbp + 0x47], eax
movzx eax, word [0x1400aaa44]
mov word [rbp + 0x4b], ax
mov al, byte [0x1400aaa46]
mov byte [rbp + 0x4d], al
xor r8d, r8d
lea r9, [rbp + 0x2f]
mov eax, 0x51eb851f
mul r8d
shr edx, 4
movsx eax, dl
imul ecx, eax, 0x32
mov al, r8b
sub al, cl
add al, 0x33
xor byte [r9], al
inc r8d
inc r9
cmp r8d, 0x1f
jl 0x140005ba0
xorps xmm0, xmm0
movups xmmword [rbp + 0xf], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x1f], xmm1
lea rax, [rbp + 0x2f]
or r8, 0xffffffffffffffff
inc r8
cmp byte [rax + r8], 0
jne 0x140005bde
lea rdx, [rbp + 0x2f]
lea rcx, [rbp + 0xf]
call fcn.140017bd0
nop
mov r9d, 3
lea r8, [0x1400aa07c]
lea rcx, [rbp + 0xf]
call fcn.1400115f0
xor edx, edx
lea r8d, [rdx + 0x70]
lea rcx, [rbp - 0x69]
call sub.VCRUNTIME140.dll_memset
mov dword [rbp - 0x69], 0x70
mov dword [rbp - 0x65], 0x40
and qword [rbp - 0x61], 0
mov eax, dword [str.AA_WD8]
mov dword [rbp + 7], eax
movzx eax, word [0x1400af6dc]
mov word [rbp + 0xb], ax
xor r8d, r8d
lea r9, [rbp + 7]
mov eax, 0x51eb851f
mul r8d
shr edx, 4
movsx eax, dl
imul ecx, eax, 0x32
mov al, r8b
sub al, cl
add al, 0x33
xor byte [r9], al
inc r8d
inc r9
cmp r8d, 6
jl 0x140005c49
lea rax, [rbp + 7]
mov qword [rbp - 0x59], rax
lea rax, str.cmd.exe
mov qword [rbp - 0x51], rax
lea rax, [rbp + 0xf]
cmp qword [rbp + 0x27], 0x10
cmovae rax, qword [rbp + 0xf]
mov qword [rbp - 0x49], rax
and qword [rbp - 0x41], 0
and dword [rbp - 0x39], 0
and qword [rbp - 0x31], 0
lea rcx, [rbp - 0x69]
call qword [sym.imp.SHELL32.dll_ShellExecuteExA]
test eax, eax
jne 0x140005cbe
or edx, 0xffffffff
mov rcx, qword [rbp - 1]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea rdx, [rbp - 0x79]
mov rcx, qword [rbp - 1]
call qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov rcx, qword [rbp - 1]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov rdx, qword [rbp + 0x27]
cmp rdx, 0x10
jb 0x140005d15
inc rdx
mov rcx, qword [rbp + 0xf]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005d10
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140005d10
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14008a204
mov rcx, qword [rbp + 0x4f]
xor rcx, rsp
call fcn.140089d60
add rsp, 0xf0
pop rbp
ret
Function at 0x14000b104
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x90
mov rax, qword [0x1400eef00]
xor rax, rsp
mov qword [rsp + 0x80], rax
call fcn.140074e10
xor ebx, ebx
cmp dword [0x140103dd8], ebx
jne 0x14000b133
call fcn.14004c798
call fcn.14004bae4
call fcn.1400300e8
cmp byte [0x140103c08], bl
je 0x14000b21d
movsd xmm0, qword [0x1400b1200]
movsd qword [rsp + 0x50], xmm0
mov eax, dword [0x1400b1208]
mov dword [rsp + 0x58], eax
cmp byte [0x1400b120b], bl
je 0x14000b191
lea r8, [rsp + 0x50]
mov eax, 0x51eb851f
mul ebx
shr edx, 4
movsx eax, dl
imul ecx, eax, 0x32
mov al, bl
sub al, cl
add al, 0x33
xor byte [r8], al
inc ebx
inc r8
cmp ebx, 0xc
jl 0x14000b16e
xor edx, edx
mov r8d, 0x127
lea rcx, [rsp + 0x50]
call fcn.140035000
mov rax, qword [0x140103c70]
mov rax, qword [rax + 0x1dc0]
lea r8, str.Background
xor edx, edx
mov rcx, qword [rax]
call fcn.14002f3c4
mov rax, qword [0x140103c70]
mov rax, qword [rax + 0x1dc0]
lea r8, str.Background
xor edx, edx
mov rcx, qword [rax]
call fcn.14002f3c4
movd xmm2, dword [0x1400eef78]
cvtdq2ps xmm2, xmm2
mov dword [rsp + 0x50], 0x44700000
mov dword [rsp + 0x54], 0x44070000
movss xmm0, dword [0x1400b25f4]
movss dword [rsp + 0x28], xmm0
lea rdx, [rsp + 0x50]
mov rcx, rax
call fcn.140046740
call fcn.14003742c
nop
call fcn.140006ae0
call fcn.1400320f8
lea r8, [rsp + 0x30]
lea rdx, [rsp + 0x34]
mov rcx, qword [0x140103c60]
call fcn.140073a00
mov r9d, dword [rsp + 0x30]
mov r8d, dword [rsp + 0x34]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.OPENGL32.dll_glViewport]
mov ecx, 0x4000
call qword [sym.imp.OPENGL32.dll_glClear]
mov rax, qword [0x140103c70]
mov rcx, qword [rax + 0x1dc0]
mov rdx, qword [rcx]
add rdx, 0x40
mov al, byte [rdx]
neg al
sbb rcx, rcx
and rcx, rdx
call fcn.14004c0f0
mov rcx, qword [0x140103c60]
call fcn.14006fb80
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.140089d60
add rsp, 0x90
pop rbx
ret
Function at 0x14000e7ac
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0xc0
mov rax, qword [0x1400eef00]
xor rax, rsp
mov qword [rsp + 0xb8], rax
movups xmm0, xmmword [str.__AFD]
movups xmmword [rsp + 0x50], xmm0
movsd xmm0, qword [0x1400aa370]
movsd qword [rsp + 0x60], xmm0
xor ebx, ebx
cmp byte [0x1400aa377], bl
je 0x14000e81a
mov r8d, ebx
lea r9, [rsp + 0x50]
mov eax, 0x51eb851f
mul r8d
shr edx, 4
movsx eax, dl
imul ecx, eax, 0x32
mov al, r8b
sub al, cl
add al, 0x33
xor byte [r9], al
inc r8d
inc r9
cmp r8d, 0x18
jl 0x14000e7f3
lea rcx, [rsp + 0x50]
call fcn.14000e02c
mov byte [0x140103c58], 1
movups xmm0, xmmword [str.cfped]
movups xmmword [rsp + 0x78], xmm0
movups xmm1, xmmword [0x1400aa468]
movups xmmword [rsp + 0x88], xmm1
movups xmm0, xmmword [0x1400aa478]
movups xmmword [rsp + 0x98], xmm0
movsd xmm0, qword [0x1400aa488]
movsd qword [rsp + 0xa8], xmm0
mov eax, dword [0x1400aa490]
mov dword [rsp + 0xb0], eax
mov r8d, ebx
lea r9, [rsp + 0x78]
mov eax, 0x51eb851f
mul r8d
shr edx, 4
movsx eax, dl
imul ecx, eax, 0x32
mov al, r8b
sub al, cl
add al, 0x33
xor byte [r9], al
inc r8d
inc r9
cmp r8d, 0x3c
jl 0x14000e87b
lea rcx, [rsp + 0x78]
call fcn.14000327c
call fcn.1400043b0
mov rcx, qword [0x140103c60]
test rcx, rcx
jne 0x14000e962
lea rdx, [rsp + 0x70]
call fcn.14000ea38
mov r11, rax
cmp byte [rax + 6], bl
je 0x14000e900
mov r8d, ebx
mov r9, rax
mov eax, 0x51eb851f
mul r8d
shr edx, 4
movsx ecx, dl
imul edx, ecx, 0x32
mov al, r8b
sub al, dl
add al, 0x33
xor byte [r9], al
inc r8d
inc r9
cmp r8d, 7
jl 0x14000e8d9
lea rdx, [rsp + 0x50]
call fcn.14000ea18
mov r10, rax
cmp byte [rax + 0x14], bl
je 0x14000e938
mov r8, rax
mov eax, 0x51eb851f
mul ebx
shr edx, 4
movsx ecx, dl
imul edx, ecx, 0x32
mov al, bl
sub al, dl
add al, 0x33
xor byte [r8], al
inc ebx
inc r8
cmp ebx, 0x15
jl 0x14000e915
xor r9d, r9d
mov r8, r11
mov rdx, r10
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
mov ecx, 0x9c4
call qword [sym.imp.KERNEL32.dll_Sleep]
call fcn.140004b24
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
cmp byte [0x140103c09], bl
sete dl
mov byte [0x140103c09], dl
mov eax, dword [0x140103d14]
test eax, eax
jle 0x14000e985
mov eax, ebx
mov dword [0x140103d14], ebx
test eax, eax
jns 0x14000e98d
mov dword [0x140103d14], ebx
mov eax, dword [0x140103d10]
cmp eax, 0x230
jle 0x14000e9a2
mov eax, ebx
mov dword [0x140103d10], ebx
cmp eax, 1
jge 0x14000e9ad
mov dword [0x140103d10], ebx
mov r8d, ebx
test dl, dl
sete r8b
mov edx, 0x2000d
call fcn.1400745f0
cmp byte [0x140103c09], bl
je 0x14000e9de
mov rcx, qword [0x140103c60]
call fcn.14007ba70
mov rcx, rax
call qword [sym.imp.USER32.dll_SetForegroundWindow]
nop
mov rcx, qword [0x140103c60]
call fcn.140073270
test eax, eax
jne 0x14000e9fa
call fcn.140004ca0
call fcn.14000b104
jmp 0x14000e9de
call fcn.140004b24
mov rcx, qword [rsp + 0xb8]
xor rcx, rsp
call fcn.140089d60
add rsp, 0xc0
pop rbx
ret
jmp 0x14000e7ac
Function at 0x14000ea58
Capabilities:
Encode data using xor
Terminate process

Disassembly:
push rbx
sub rsp, 0xc0
mov rax, qword [0x1400eef00]
xor rax, rsp
mov qword [rsp + 0xb8], rax
movups xmm0, xmmword [str.__AFD]
movups xmmword [rsp + 0x50], xmm0
movsd xmm0, qword [0x1400aa370]
movsd qword [rsp + 0x60], xmm0
xor ebx, ebx
cmp byte [0x1400aa377], bl
je 0x14000e81a
mov r8d, ebx
lea r9, [rsp + 0x50]
mov eax, 0x51eb851f
mul r8d
shr edx, 4
movsx eax, dl
imul ecx, eax, 0x32
mov al, r8b
sub al, cl
add al, 0x33
xor byte [r9], al
inc r8d
inc r9
cmp r8d, 0x18
jl 0x14000e7f3
lea rcx, [rsp + 0x50]
call fcn.14000e02c
mov byte [0x140103c58], 1
movups xmm0, xmmword [str.cfped]
movups xmmword [rsp + 0x78], xmm0
movups xmm1, xmmword [0x1400aa468]
movups xmmword [rsp + 0x88], xmm1
movups xmm0, xmmword [0x1400aa478]
movups xmmword [rsp + 0x98], xmm0
movsd xmm0, qword [0x1400aa488]
movsd qword [rsp + 0xa8], xmm0
mov eax, dword [0x1400aa490]
mov dword [rsp + 0xb0], eax
mov r8d, ebx
lea r9, [rsp + 0x78]
mov eax, 0x51eb851f
mul r8d
shr edx, 4
movsx eax, dl
imul ecx, eax, 0x32
mov al, r8b
sub al, cl
add al, 0x33
xor byte [r9], al
inc r8d
inc r9
cmp r8d, 0x3c
jl 0x14000e87b
lea rcx, [rsp + 0x78]
call fcn.14000327c
call fcn.1400043b0
mov rcx, qword [0x140103c60]
test rcx, rcx
jne 0x14000e962
lea rdx, [rsp + 0x70]
call fcn.14000ea38
mov r11, rax
cmp byte [rax + 6], bl
je 0x14000e900
mov r8d, ebx
mov r9, rax
mov eax, 0x51eb851f
mul r8d
shr edx, 4
movsx ecx, dl
imul edx, ecx, 0x32
mov al, r8b
sub al, dl
add al, 0x33
xor byte [r9], al
inc r8d
inc r9
cmp r8d, 7
jl 0x14000e8d9
lea rdx, [rsp + 0x50]
call fcn.14000ea18
mov r10, rax
cmp byte [rax + 0x14], bl
je 0x14000e938
mov r8, rax
mov eax, 0x51eb851f
mul ebx
shr edx, 4
movsx ecx, dl
imul edx, ecx, 0x32
mov al, bl
sub al, dl
add al, 0x33
xor byte [r8], al
inc ebx
inc r8
cmp ebx, 0x15
jl 0x14000e915
xor r9d, r9d
mov r8, r11
mov rdx, r10
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
mov ecx, 0x9c4
call qword [sym.imp.KERNEL32.dll_Sleep]
call fcn.140004b24
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
cmp byte [0x140103c09], bl
sete dl
mov byte [0x140103c09], dl
mov eax, dword [0x140103d14]
test eax, eax
jle 0x14000e985
mov eax, ebx
mov dword [0x140103d14], ebx
test eax, eax
jns 0x14000e98d
mov dword [0x140103d14], ebx
mov eax, dword [0x140103d10]
cmp eax, 0x230
jle 0x14000e9a2
mov eax, ebx
mov dword [0x140103d10], ebx
cmp eax, 1
jge 0x14000e9ad
mov dword [0x140103d10], ebx
mov r8d, ebx
test dl, dl
sete r8b
mov edx, 0x2000d
call fcn.1400745f0
cmp byte [0x140103c09], bl
je 0x14000e9de
mov rcx, qword [0x140103c60]
call fcn.14007ba70
mov rcx, rax
call qword [sym.imp.USER32.dll_SetForegroundWindow]
nop
mov rcx, qword [0x140103c60]
call fcn.140073270
test eax, eax
jne 0x14000e9fa
call fcn.140004ca0
call fcn.14000b104
jmp 0x14000e9de
call fcn.140004b24
mov rcx, qword [rsp + 0xb8]
xor rcx, rsp
call fcn.140089d60
add rsp, 0xc0
pop rbx
ret
jmp 0x14000e7ac
Function at 0x14002d38c
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
not r8d
mov r9d, 4
movzx eax, byte [rcx]
inc rcx
movzx edx, r8b
xor rdx, rax
shr r8d, 8
lea rax, [0x1400aafd0]
xor r8d, dword [rax + rdx*4]
sub r9, 1
jne 0x14002d395
not r8d
mov eax, r8d
ret

Function at 0x14002d3c0
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
not r8d
mov r10, rcx
mov r9d, r8d
test rdx, rdx
je 0x14002d41a
mov r11b, 0x23
lea rdi, [0x1400aafd0]
movzx ebx, byte [r10]
dec rdx
inc r10
cmp bl, r11b
jne 0x14002d404
cmp rdx, 2
jb 0x14002d404
cmp byte [r10], r11b
jne 0x14002d404
cmp byte [r10 + 1], r11b
cmove r9d, r8d
movzx ecx, r9b
xor rcx, rbx
shr r9d, 8
xor r9d, dword [rdi + rcx*4]
test rdx, rdx
jne 0x14002d3e2
jmp 0x14002d45b
mov dl, byte [rcx]
inc r10
test dl, dl
je 0x14002d45b
mov r11b, 0x23
lea rdi, [0x1400aafd0]
cmp dl, r11b
jne 0x14002d43f
cmp byte [r10], r11b
jne 0x14002d43f
cmp byte [r10 + 1], r11b
cmove r9d, r8d
movzx ecx, r9b
movzx eax, dl
mov dl, byte [r10]
xor rcx, rax
shr r9d, 8
inc r10
xor r9d, dword [rdi + rcx*4]
test dl, dl
jne 0x14002d42d
mov rbx, qword [rsp + 8]
not r9d
mov rdi, qword [rsp + 0x10]
mov eax, r9d
ret

Function at 0x14002d590
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rsi, r8
test r8, r8
je 0x14002d5b0
and qword [r8], 0
lea rdx, [0x1400a9fb0]
call fcn.14002d46c
mov rbx, rax
test rax, rax
je 0x14002d6a1
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
mov ebp, eax
cmp eax, 0xffffffff
je 0x14002d698
xor edx, edx
mov rcx, rbx
lea r8d, [rdx + 2]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
test eax, eax
jne 0x14002d698
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
movsxd rdi, eax
cmp edi, 0xffffffff
je 0x14002d698
xor r8d, r8d
mov edx, ebp
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
test eax, eax
jne 0x14002d698
mov rbp, rdi
cmp rdi, 0xffffffffffffffff
je 0x14002d698
mov rax, qword [0x140103c70]
test rax, rax
je 0x14002d635
inc dword [rax + 0x3b4]
mov rcx, rbp
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rdi, rax
test rax, rax
je 0x14002d698
mov r9, rbx
mov r8, rbp
mov edx, 1
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
mov rcx, rbx
cmp rax, rbp
je 0x14002d685
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov rax, qword [0x140103c70]
test rax, rax
je 0x14002d67a
dec dword [rax + 0x3b4]
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
jmp 0x14002d6a1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
test rsi, rsi
je 0x14002d693
mov qword [rsi], rbp
mov rax, rdi
jmp 0x14002d6a3
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x14003bfc0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
cmp qword [rcx + 0x30c8], 0
lea rbx, [rcx + 0x30d0]
mov rsi, r8
mov rbp, rdx
mov rdi, rcx
je 0x14003c059
mov r9d, dword [rbx + 4]
test r9d, r9d
jns 0x14003c011
mov eax, r9d
mov rcx, rbx
cdq
sub eax, edx
xor edx, edx
sar eax, 1
add eax, r9d
test eax, eax
cmovg edx, eax
call fcn.14003d998
and dword [rbx], 0
mov r8, rsi
mov rdx, rbp
mov rcx, rbx
call fcn.14002dcc4
mov eax, dword [rbx]
mov edx, 1
mov r9, qword [rdi + 0x30c8]
lea ecx, [rax - 1]
neg eax
sbb eax, eax
and eax, ecx
lea rcx, [0x140103c59]
movsxd r8, eax
mov rax, qword [rdi + 0x30d8]
test rax, rax
cmovne rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
jmp 0x14003c061
mov rcx, rbx
call fcn.14002dcc4
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret

Function at 0x14003c71c
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x20
mov rax, qword [0x140103c70]
mov rbx, rcx
and dword [rax + 0x3064], 0
test rcx, rcx
je 0x14003c785
and qword [rsp + 0x30], 0
lea rcx, [rsp + 0x30]
call fcn.14003c790
lea rdx, [0x1400b19d4]
mov rcx, rbx
mov rdi, rax
call fcn.14002d46c
mov rbx, rax
test rax, rax
je 0x14003c785
mov r8, qword [rsp + 0x30]
mov r9, rax
mov edx, 1
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x140076320
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x50
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov r9d, 0xffffffff
mov r8, qword [rsp + 0x60]
xor edx, edx
mov ecx, 0xfde9
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov dword [rsp + 0x30], eax
cmp dword [rsp + 0x30], 0
jne 0x140076363
jmp 0x140076455
movsxd rax, dword [rsp + 0x30]
shl rax, 1
mov rdx, rax
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov qword [rsp + 0x38], rax
cmp qword [rsp + 0x38], 0
jne 0x14007639c
lea rdx, str.Win32:_Failed_to_allocate_global_handle_for_clipboard
mov ecx, 0x10008
call fcn.1400811e0
jmp 0x140076455
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_GlobalLock]
mov qword [rsp + 0x40], rax
cmp qword [rsp + 0x40], 0
jne 0x1400763d5
lea rdx, [0x1400e6ed0]
mov ecx, 0x10008
call fcn.1400811e0
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_GlobalFree]
jmp 0x140076455
mov eax, dword [rsp + 0x30]
mov dword [rsp + 0x28], eax
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x20], rax
mov r9d, 0xffffffff
mov r8, qword [rsp + 0x60]
xor edx, edx
mov ecx, 0xfde9
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov rcx, qword [0x140102158]
call qword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
jne 0x140076439
lea rdx, [0x1400e6ef8]
mov ecx, 0x10008
call fcn.1400811e0
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_GlobalFree]
jmp 0x140076455
call qword [sym.imp.USER32.dll_EmptyClipboard]
mov rdx, qword [rsp + 0x38]
mov ecx, 0xd
call qword [sym.imp.USER32.dll_SetClipboardData]
call qword [sym.imp.USER32.dll_CloseClipboard]
add rsp, 0x50
pop rdi
ret

Function at 0x140076470
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
push rdi
sub rsp, 0x30
mov rcx, qword [0x140102158]
call qword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
jne 0x14007649f
lea rdx, str.Win32:_Failed_to_open_clipboard
mov ecx, 0x10008
call fcn.1400811e0
xor eax, eax
jmp 0x14007653b
mov ecx, 0xd
call qword [sym.imp.USER32.dll_GetClipboardData]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x1400764d2
lea rdx, str.Win32:_Failed_to_convert_clipboard_to_string
mov ecx, 0x10009
call fcn.1400811e0
call qword [sym.imp.USER32.dll_CloseClipboard]
xor eax, eax
jmp 0x14007653b
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GlobalLock]
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
jne 0x140076505
lea rdx, str.Win32:_Failed_to_lock_global_handle
mov ecx, 0x10008
call fcn.1400811e0
call qword [sym.imp.USER32.dll_CloseClipboard]
xor eax, eax
jmp 0x14007653b
mov rcx, qword [0x140102170]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rcx, qword [rsp + 0x28]
call fcn.140080e30
mov qword [0x140102170], rax
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
call qword [sym.imp.USER32.dll_CloseClipboard]
mov rax, qword [0x140102170]
add rsp, 0x30
pop rdi
ret