joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140083730
Capabilities:
Create process on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x30
mov rsi, rcx
call fcn.14008f814
mov rcx, rax
call fcn.14008f674
mov rcx, qword [rsi + 0x70]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x1004
mov r14, rax
or ebp, 0xffffffff
xor edi, edi
xor ebx, ebx
call qword [sym.imp.USER32.dll_SendMessageW]
test eax, eax
jle 0x140083866
mov rcx, qword [rsi + 0x70]
mov edx, 0x102c
movsxd r8, ebx
mov r9d, 2
call qword [sym.imp.USER32.dll_SendMessageW]
test eax, eax
je 0x140083799
mov ebp, ebx
inc edi
mov rcx, qword [rsi + 0x70]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x1004
inc ebx
call qword [sym.imp.USER32.dll_SendMessageW]
cmp ebx, eax
jl 0x140083779
cmp edi, 1
jne 0x140083866
mov edx, dword [rsi + 0x5e0]
mov rcx, r14
call fcn.140072980
mov rcx, rax
mov edx, ebp
call fcn.140072304
test rax, rax
je 0x140083866
mov rbx, qword [rax + 8]
cmp dword [rbx - 0xc], 0
jl 0x1400837f3
mov qword [rsp + 0x50], rbx
lock inc dword [rbx - 0xc]
jmp 0x140083820
mov rax, qword [0x140174018]
mov qword [rsp + 0x50], rax
test rbx, rbx
jne 0x140083808
xor eax, eax
jmp 0x140083811
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov r8, rbx
lea rcx, [rsp + 0x50]
mov edx, eax
call fcn.1400670f0
mov rbx, qword [rsp + 0x50]
lea rdx, str.open
mov r8, rbx
mov dword [rsp + 0x28], 1
and qword [rsp + 0x20], 0
xor r9d, r9d
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
lea rcx, [rbx - 0xc]
cmp rcx, qword [0x140174010]
je 0x140083866
or eax, 0xffffffff
lock xadd dword [rcx], eax
sub eax, 1
jg 0x140083866
call fcn.1400b0230
mov rbx, qword [rsp + 0x58]
xor eax, eax
mov rbp, qword [rsp + 0x60]
add rsp, 0x30
pop r14
pop rdi
pop rsi
ret
Function at 0x1400853b4
Capabilities:
Hide graphical window

Disassembly:
push rdi
sub rsp, 0x60
mov qword [rsp + 0x58], 0xfffffffffffffffe
mov qword [rsp + 0x70], rbx
mov rdi, rcx
call fcn.14008f814
mov rbx, rax
mov rcx, rax
call fcn.14008f674
cmp dword [rax + 0x7c], 0
je 0x140085516
mov rcx, rbx
call fcn.14008f674
mov rcx, rax
xor edx, edx
call fcn.140072980
mov rcx, rax
call fcn.140072ac4
mov rdx, rax
lea rcx, [rsp + 0x40]
call fcn.14006883c
nop
mov rax, qword [0x140174018]
mov qword [rsp + 0x50], rax
lea r9, str.SubHeaderText
lea r8, str.MainDlg
lea rdx, [rsp + 0x48]
mov rcx, rbx
call fcn.14008f858
nop
mov r8, qword [rsp + 0x40]
mov rdx, qword [rax]
lea rcx, [rsp + 0x50]
call fcn.14006895c
nop
mov rcx, qword [rsp + 0x48]
add rcx, 0xfffffffffffffff4
cmp rcx, qword [0x140174010]
je 0x140085474
or eax, 0xffffffff
lock xadd dword [rcx], eax
sub eax, 1
jg 0x140085474
mov rcx, qword [rsp + 0x48]
add rcx, 0xfffffffffffffff4
call fcn.1400b0230
mov rbx, qword [rsp + 0x50]
mov rdx, rbx
mov rcx, qword [rdi + 0x78]
call qword [sym.imp.USER32.dll_SetWindowTextW]
mov edx, 5
mov rcx, qword [rdi + 8]
call qword [sym.imp.USER32.dll_ShowWindow]
mov dword [rsp + 0x30], 0x43
and dword [rsp + 0x28], 0
and dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, qword [rdi + 8]
call qword [sym.imp.USER32.dll_SetWindowPos]
mov edx, 1
mov rcx, qword [rdi + 8]
call qword [sym.imp.USER32.dll_FlashWindow]
nop
lea rcx, [rbx - 0xc]
cmp rcx, qword [0x140174010]
je 0x1400854e8
or eax, 0xffffffff
lock xadd dword [rcx], eax
sub eax, 1
jg 0x1400854e8
call fcn.1400b0230
nop
mov rcx, qword [rsp + 0x40]
add rcx, 0xfffffffffffffff4
cmp rcx, qword [0x140174010]
je 0x14008552a
or eax, 0xffffffff
lock xadd dword [rcx], eax
sub eax, 1
jg 0x14008552a
mov rcx, qword [rsp + 0x40]
add rcx, 0xfffffffffffffff4
call fcn.1400b0230
jmp 0x14008552a
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 0x10]
mov rcx, qword [rdi + 8]
call qword [sym.imp.USER32.dll_SendMessageW]
xor eax, eax
mov rbx, qword [rsp + 0x70]
add rsp, 0x60
pop rdi
ret
Function at 0x140085574
Capabilities:
Get graphical window text

Disassembly:
mov rax, rsp
push rbp
push rdi
push r14
lea rbp, [rax - 0x788]
sub rsp, 0x870
mov qword [rsp + 0x40], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov rax, qword [0x1401740c0]
xor rax, rsp
mov qword [rbp + 0x760], rax
mov rbx, rcx
xor edx, edx
mov r8d, 0x800
lea rcx, [rsp + 0x60]
call fcn.1400b1c70
mov rax, qword [0x140174018]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rax
mov edi, 0x400
mov r8d, edi
lea rdx, [rsp + 0x60]
mov rcx, qword [rbx + 0x1c0]
call qword [sym.imp.USER32.dll_GetWindowTextW]
lea rcx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
lea r8, [rsp + 0x60]
mov edx, eax
lea rcx, [rsp + 0x38]
call fcn.1400670f0
mov r8d, edi
lea rdx, [rsp + 0x60]
mov rcx, qword [rbx + 0x1d0]
call qword [sym.imp.USER32.dll_GetWindowTextW]
lea rcx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
lea r8, [rsp + 0x60]
mov edx, eax
lea rcx, [rsp + 0x30]
call fcn.1400670f0
call fcn.14008f814
mov r14, rax
lea rax, [rsp + 0x20]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x28]
mov qword [rsp + 0x50], rax
mov rbx, qword [rsp + 0x30]
lea rsi, [rbx - 0xc]
cmp dword [rsi], 0
jl 0x14008566c
mov qword [rsp + 0x20], rbx
lock inc dword [rsi]
jmp 0x140085691
mov rax, qword [0x140174018]
mov qword [rsp + 0x20], rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov r8, rbx
mov edx, eax
lea rcx, [rsp + 0x20]
call fcn.1400670f0
nop
mov rbx, qword [rsp + 0x38]
lea rdi, [rbx - 0xc]
cmp dword [rdi], 0
jl 0x1400856a9
mov qword [rsp + 0x28], rbx
lock inc dword [rdi]
jmp 0x1400856ce
mov rax, qword [0x140174018]
mov qword [rsp + 0x28], rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov r8, rbx
mov edx, eax
lea rcx, [rsp + 0x28]
call fcn.1400670f0
nop
mov rcx, r14
call fcn.14008f674
mov rcx, rax
lea r8, [rsp + 0x20]
lea rdx, [rsp + 0x28]
call fcn.1400755d4
nop
or ebx, 0xffffffff
cmp rsi, qword [0x140174010]
je 0x14008570a
mov eax, ebx
lock xadd dword [rsi], eax
add eax, ebx
test eax, eax
jg 0x14008570a
mov rcx, rsi
call fcn.1400b0230
nop
cmp rdi, qword [0x140174010]
je 0x140085727
mov eax, ebx
lock xadd dword [rdi], eax
add eax, ebx
test eax, eax
jg 0x140085727
mov rcx, rdi
call fcn.1400b0230
xor eax, eax
mov rcx, qword [rbp + 0x760]
xor rcx, rsp
call fcn.1400b0730
lea r11, [rsp + 0x870]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
Function at 0x140089bf4
Capabilities:
Read file on windows

Disassembly:
mov rax, rsp
push rbp
push r14
push r15
lea rbp, [rax - 0x1e8]
sub rsp, 0x2d0
mov qword [rsp + 0x38], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x20], rsi
mov rax, qword [0x1401740c0]
xor rax, rsp
mov qword [rbp + 0x1c0], rax
mov r15, r8
mov rsi, rdx
mov qword [rsp + 0x40], rdx
and qword [rsp + 0x28], 0
mov rcx, r8
call fcn.1400686e8
xor edx, edx
mov rcx, rsi
call fcn.140069064
mov rdx, rax
lea r8, [0x1401523cc]
lea rcx, [rsp + 0x28]
call fcn.1400d96bc
cmp qword [rsp + 0x28], 0
jne 0x140089c9b
mov rax, qword [rsi]
add rax, 0xfffffffffffffff4
cmp rax, qword [0x140174010]
je 0x140089c93
or ecx, 0xffffffff
lock xadd dword [rax], ecx
sub ecx, 1
jg 0x140089c93
mov rcx, qword [rsi]
sub rcx, 0xc
call fcn.1400b0230
or eax, 0xffffffff
jmp 0x140089d96
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x20]
call fcn.14009f4c0
jmp 0x140089ce0
mov r9, qword [rsp + 0x28]
mov edx, 1
mov r8d, 0x200
lea rcx, [rbp - 0x40]
call fcn.1400dfe74
test rax, rax
je 0x140089ce0
mov r9d, eax
lea r8, [rbp - 0x40]
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x20]
call fcn.14009fd48
mov rcx, qword [rsp + 0x28]
call fcn.1400dfb4c
test eax, eax
je 0x140089cac
mov rcx, qword [rsp + 0x28]
call fcn.1400d9814
lea r8, [rsp + 0x50]
lea rdx, [rbp - 0x50]
lea rcx, [rsp + 0x20]
call fcn.14009f3fc
xor r14d, r14d
mov rax, qword [0x140174018]
mov qword [rsp + 0x30], rax
movzx r8d, byte [rbp + r14 - 0x50]
lea rdx, str._02x
lea rcx, [rsp + 0x30]
call fcn.14006895c
mov rbx, qword [rsp + 0x30]
mov r8, rbx
mov edx, dword [rbx - 8]
mov rcx, r15
call fcn.1400683e0
nop
lea rcx, [rbx - 0xc]
cmp rcx, qword [0x140174010]
je 0x140089d63
or eax, 0xffffffff
lock xadd dword [rcx], eax
sub eax, 1
jg 0x140089d63
call fcn.1400b0230
inc r14
cmp r14, 0x10
jl 0x140089d0e
mov rcx, qword [rsi]
add rcx, 0xfffffffffffffff4
cmp rcx, qword [0x140174010]
je 0x140089d94
or eax, 0xffffffff
lock xadd dword [rcx], eax
sub eax, 1
jg 0x140089d94
mov rcx, qword [rsi]
sub rcx, 0xc
call fcn.1400b0230
xor eax, eax
mov rcx, qword [rbp + 0x1c0]
xor rcx, rsp
call fcn.1400b0730
lea r11, [rsp + 0x2d0]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
Function at 0x14008db74
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov dword [rcx + 0x800], edx
lea r8, [0x140093528]
xor edi, edi
mov rbx, rcx
mov r9, rcx
mov qword [rsp + 0x28], rdi
xor edx, edx
mov dword [rsp + 0x20], edi
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
test rax, rax
mov qword [rbx + 0x5d0], rax
mov rbx, qword [rsp + 0x40]
setne dil
mov eax, edi
add rsp, 0x30
pop rdi
ret
Function at 0x140092d9c
Capabilities:
Acquire debug privileges

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rdi
push rbp
mov rbp, rsp
sub rsp, 0x60
mov rax, qword [0x1401740c0]
xor rax, rsp
mov qword [rbp - 0x10], rax
xor ebx, ebx
mov rdi, rcx
and qword [rbp - 0x28], rbx
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea r8, [rbp - 0x28]
lea edx, [rbx + 0x28]
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x140092e06
lea rdx, str.SetDumpPrivileges:_Could_not_get_the_process_token
lea rcx, [rbp - 0x30]
call fcn.140067e3c
lea rcx, [rdi + 0x5e0]
mov r9b, 1
xor r8d, r8d
mov rdx, rax
call fcn.14006b790
jmp 0x140092e66
lea r8, [rbp - 0x1c]
mov dword [rbp - 0x20], 1
lea rdx, str.SeDebugPrivilege
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
test eax, eax
jne 0x140092e2d
lea rdx, str.SetDumpPrivileges:_Couldnt_lookup_SeDebugPrivilege_name
jmp 0x140092de6
and qword [rsp + 0x28], rbx
lea r8, [rbp - 0x20]
mov rcx, qword [rbp - 0x28]
mov r9d, reloc.WS2_32.dll_recv
and qword [rsp + 0x20], rbx
xor edx, edx
mov dword [rbp - 0x14], 2
call qword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
test eax, eax
jne 0x140092e61
lea rdx, str.SetDumpPrivileges:_Could_not_revoke_the_debug_privilege
jmp 0x140092de6
mov ebx, 1
mov rcx, qword [rbp - 0x28]
test rcx, rcx
je 0x140092e75
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, ebx
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.1400b0730
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret

Function at 0x140093320
Capabilities:
Enumerate processes
Terminate process

Disassembly:
mov rax, rsp
push rdi
sub rsp, 0x280
mov qword [rsp + 0x28], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov rax, qword [0x1401740c0]
xor rax, rsp
mov qword [rsp + 0x270], rax
mov rax, qword [0x140174018]
mov qword [rsp + 0x20], rax
mov r8d, 0x57b
lea rdx, str.CrashSender_d.exe
lea rcx, [rsp + 0x20]
call fcn.14006895c
mov dword [rsp + 0x30], 0x238
xor edx, edx
lea ecx, [rdx + 2]
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov rsi, rax
lea rdx, [rsp + 0x30]
mov rcx, rax
call sub.KERNEL32.dll_Process32FirstW
mov rbx, qword [rsp + 0x20]
cmp eax, 1
jne 0x1400933f7
jmp 0x1400933e5
mov rdx, rbx
lea rcx, [rsp + 0x5c]
call fcn.1400da760
test eax, eax
jne 0x1400933e5
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, dword [rsp + 0x38]
cmp r8d, eax
je 0x1400933e5
xor edx, edx
lea ecx, [rdx + 1]
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rdi, rax
mov edx, 1
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, [rsp + 0x30]
mov rcx, rsi
call sub.KERNEL32.dll_Process32NextW
cmp eax, 1
je 0x14009339f
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
lea rcx, [rbx - 0xc]
cmp rcx, qword [0x140174010]
je 0x14009341f
or eax, 0xffffffff
lock xadd dword [rcx], eax
sub eax, 1
jg 0x14009341f
call fcn.1400b0230
xor eax, eax
mov rcx, qword [rsp + 0x270]
xor rcx, rsp
call fcn.1400b0730
lea r11, [rsp + 0x280]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret
Function at 0x1400958d0
Capabilities:
Get system information on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rcx
push rdi
sub rsp, 0x60
mov qword [rax - 0x48], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
mov rdi, rcx
add rcx, 0x20
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
nop
lea rbx, [rdi + 0x48]
mov qword [rsp + 0x78], rbx
and qword [rbx], 0
and qword [rbx + 8], 0
mov rcx, rbx
call fcn.140099b14
mov qword [rbx], rax
or qword [rdi], 0xffffffffffffffff
and qword [rdi + 0x18], 0
and qword [rdi + 8], 0
lea rcx, [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [rsp + 0x50]
mov dword [rdi + 0x10], eax
mov rax, rdi
mov rbx, qword [rsp + 0x80]
add rsp, 0x60
pop rdi
ret

Function at 0x140096104
Capabilities:
Read file via mapping

Disassembly:
mov rax, rsp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x50
mov qword [rax - 0x48], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
mov qword [rax + 0x20], rbp
mov r12d, r8d
mov ebp, edx
mov rsi, rcx
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [rsp + 0x88], eax
xor edx, edx
mov eax, ebp
div dword [rsi + 0x10]
mov r15d, edx
sub ebp, edx
lea rdi, [rsi + 0x20]
mov qword [rsp + 0x80], rdi
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
nop
lea r14, [rsi + 0x48]
mov rax, qword [r14]
mov rcx, qword [rax + 8]
mov rbx, rax
mov edx, dword [rsp + 0x88]
jmp 0x140096182
cmp dword [rcx + 0x20], edx
jae 0x14009617c
mov rcx, qword [rcx + 0x10]
jmp 0x140096182
mov rbx, rcx
mov rcx, qword [rcx]
cmp byte [rcx + 0x19], 0
je 0x140096171
cmp rbx, rax
je 0x140096192
cmp edx, dword [rbx + 0x20]
jae 0x140096195
mov rbx, rax
cmp rbx, rax
je 0x1400961a4
mov rcx, qword [rbx + 0x28]
call qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
lea ecx, [r15 + r12]
mov qword [rsp + 0x20], rcx
mov r9d, ebp
xor r8d, r8d
lea edx, [r8 + 4]
mov rcx, qword [rsi + 8]
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov rsi, rax
cmp rbx, qword [r14]
je 0x1400961cf
mov qword [rbx + 0x28], rax
jmp 0x1400961ed
lea r8, [rsp + 0x88]
lea rdx, [rsp + 0x38]
mov rcx, r14
call fcn.140095820
mov rax, qword [rsp + 0x38]
mov qword [rax + 0x28], rsi
lea rbx, [rsi + r15]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov rax, rbx
lea r11, [rsp + 0x50]
mov rbx, qword [r11 + 0x40]
mov rbp, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
Function at 0x140096b10
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
mov rbp, rsp
sub rsp, 0x30
xor ebx, ebx
lea rcx, [rbp - 0x10]
mov dword [r8], ebx
mov rdi, r8
lea r8, [0x1401523cc]
mov qword [rbp - 0x10], rbx
call fcn.1400d96bc
mov r9, qword [rbp - 0x10]
test r9, r9
je 0x140096bc4
lea edx, [rbx + 1]
lea r8d, [rbx + 2]
lea rcx, [rbp + 0x20]
call fcn.1400dfe74
cmp rax, 2
jne 0x140096bc4
cmp byte [rbp + 0x20], 0xff
jne 0x140096b6f
cmp byte [rbp + 0x21], 0xfe
jne 0x140096b88
mov ebx, eax
mov dword [rdi], eax
jmp 0x140096bc4
cmp byte [rbp + 0x20], 0xfe
jne 0x140096b88
cmp byte [rbp + 0x21], 0xff
jne 0x140096b88
mov ebx, 3
mov dword [rdi], 2
jmp 0x140096bc4
mov rcx, qword [rbp - 0x10]
call fcn.1400e0ac0
mov r9, qword [rbp - 0x10]
lea rcx, [rbp + 0x28]
mov edx, 1
lea r8d, [rdx + 2]
call fcn.1400dfe74
cmp rax, 3
jne 0x140096bc4
cmp byte [rbp + 0x28], 0xef
jne 0x140096bc4
cmp byte [rbp + 0x29], 0xbb
jne 0x140096bc4
cmp byte [rbp + 0x2a], 0xbf
jne 0x140096bc4
lea ebx, [rax - 2]
mov dword [rdi], eax
mov rcx, qword [rbp - 0x10]
call fcn.1400d9814
mov rdi, qword [rsp + 0x48]
mov eax, ebx
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rbp
ret

Function at 0x140097828
Capabilities:
Get file size

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x40
cmp qword [rcx], 0xffffffffffffffff
mov rdi, rdx
mov rbx, rcx
je 0x140097843
call fcn.1400962f8
and qword [rsp + 0x30], 0
xor r9d, r9d
and dword [rsp + 0x28], 0
mov edx, 0x80000000
mov rcx, rdi
mov dword [rsp + 0x20], 3
lea r8d, [r9 + 1]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rbx], rax
cmp rax, 0xffffffffffffffff
jne 0x140097878
xor eax, eax
jmp 0x1400978b5
and qword [rsp + 0x28], 0
xor r9d, r9d
and dword [rsp + 0x20], 0
xor edx, edx
mov rcx, rax
lea r8d, [r9 + 2]
call qword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov rcx, qword [rbx]
lea rdx, [rsp + 0x50]
mov qword [rbx + 8], rax
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov rcx, qword [rsp + 0x50]
mov eax, 1
mov qword [rbx + 0x18], rcx
mov rbx, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret

Function at 0x1400978c0
Capabilities:
Read file on windows

Disassembly:
push rbx
sub rsp, 0x40
mov rax, qword [0x1401740c0]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov rbx, rcx
call fcn.1400e0ac0
mov edx, ntohs
lea rcx, [rsp + 0x20]
mov r9, rbx
lea r8d, [rdx - 0xd]
call fcn.1400dfe74
cmp rax, 1
je 0x1400978fd
xor eax, eax
jmp 0x14009791d
mov r8d, 2
lea rdx, [0x140126440]
lea rcx, [rsp + 0x20]
call fcn.1400b29f0
xor ecx, ecx
test eax, eax
sete cl
mov eax, ecx
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.1400b0730
add rsp, 0x40
pop rbx
ret

Function at 0x140097a0c
Capabilities:
Read file on windows

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
call fcn.1400e0ac0
mov edx, 1
lea rcx, [rsp + 0x38]
mov r9, rbx
lea r8d, [rdx + 1]
call fcn.1400dfe74
cmp eax, 2
je 0x140097a39
xor eax, eax
jmp 0x140097a48
xor eax, eax
mov ecx, 0xd8ff
cmp word [rsp + 0x38], cx
sete al
add rsp, 0x20
pop rbx
ret
Function at 0x140097a50
Capabilities:
Read file on windows

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
call fcn.1400e0ac0
mov r9, rbx
lea rcx, [rsp + 0x38]
mov ebx, 3
mov r8d, ebx
lea edx, [rbx - 2]
call fcn.1400dfe74
cmp eax, ebx
je 0x140097a7e
xor eax, eax
jmp 0x140097a9b
mov r8, rbx
lea rdx, [0x140126444]
lea rcx, [rsp + 0x38]
call fcn.1400b29f0
xor ecx, ecx
test eax, eax
sete cl
mov eax, ecx
add rsp, 0x20
pop rbx
ret

Function at 0x140097aa4
Capabilities:
Read file on windows

Disassembly:
push rbx
sub rsp, 0x30
mov rax, qword [0x1401740c0]
xor rax, rsp
mov qword [rsp + 0x28], rax
mov rbx, rcx
call fcn.1400e0ac0
mov r9, rbx
lea rcx, [rsp + 0x20]
mov ebx, 8
mov r8d, ebx
lea edx, [rbx - 7]
call fcn.1400dfe74
mov r8d, ebx
lea rcx, [rsp + 0x20]
xor edx, edx
call fcn.14004948c
xor ecx, ecx
test eax, eax
sete cl
mov eax, ecx
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.1400b0730
add rsp, 0x30
pop rbx
ret

Function at 0x14009920c
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rsi, rcx
lea rbp, [rcx + 0x90]
xor ebx, ebx
lea rdi, [rcx + 0x68]
jmp 0x140099275
mov edx, 0x1000
mov rcx, rdi
call fcn.14001e720
mov qword [rsi + 0x88], rax
test rax, rax
je 0x140099287
mov r9, qword [rsi + 0x38]
mov edx, 1
mov r8d, 0x1000
mov rcx, rax
call fcn.1400dfe74
test rax, rax
je 0x140099287
mov edx, eax
mov rcx, rdi
call fcn.14001e7f0
test eax, eax
jne 0x140099287
mov rdx, rbp
mov rcx, rdi
call fcn.14001e980
cmp eax, 1
jne 0x140099232
mov ebx, eax
mov rbp, qword [rsp + 0x38]
mov eax, ebx
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x14009c51c
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov rbx, r8
mov rdi, rcx
call fcn.14009ad2c
mov qword [rdi + 0x28], rbx
lea r8, [0x14009c5a0]
xor ebx, ebx
mov r9, rdi
mov qword [rsp + 0x28], rbx
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], ebx
call qword [sym.imp.KERNEL32.dll_CreateThread]
test rax, rax
setne bl
mov eax, ebx
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
Function at 0x14009d000
Capabilities:
Send data

Disassembly:
mov r11, rsp
push rbp
push rsi
push rdi
sub rsp, 0x40
mov qword [r11 - 0x38], 0xfffffffffffffffe
mov qword [r11 + 0x10], rbx
mov rbp, rdx
mov rsi, rcx
mov rax, qword [0x140174018]
mov qword [r11 + 0x18], rax
mov r8, qword [rcx + 0x50]
lea rdx, str.___s___r_n
lea rcx, [r11 + 0x18]
call fcn.14006895c
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x28], xmm0
and qword [rsp + 0x38], 0
mov rbx, qword [rsp + 0x70]
mov rdx, rbx
lea rcx, [rsp + 0x28]
call fcn.1400773c4
mov rdi, rax
test rax, rax
je 0x14009d09c
and dword [rsp + 0x60], 0
mov rcx, rax
call fcn.1400d9890
mov r8, rax
lea r9, [rsp + 0x60]
mov rdx, rdi
mov rcx, rbp
call qword [sym.imp.WININET.dll_InternetWriteFile]
test eax, eax
je 0x14009d09c
mov edx, dword [rsp + 0x60]
mov rcx, rsi
call fcn.14009c568
mov edi, 1
jmp 0x14009d09e
xor edi, edi
lea rcx, [rsp + 0x28]
call fcn.140067f00
nop
lea rcx, [rbx - 0xc]
cmp rcx, qword [0x140174010]
je 0x14009d0c7
or edx, 0xffffffff
lock xadd dword [rcx], edx
sub edx, 1
jg 0x14009d0c7
call fcn.1400b0230
mov eax, edi
mov rbx, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
pop rsi
pop rbp
ret

Function at 0x1400a177c
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rcx, qword [rcx + 8]
mov rdi, rdx
call qword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x1400a180e
call qword [sym.imp.USER32.dll_EmptyClipboard]
mov rax, qword [rdi]
mov ecx, dword [rax - 8]
lea ecx, [rcx*2 + 2]
mov ebx, ecx
mov edx, ecx
mov ecx, 0x2000
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov rcx, rax
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_GlobalLock]
test rax, rax
je 0x1400a1808
mov r8, qword [rdi]
mov rcx, rax
shr rbx, 1
mov rdx, rbx
movsxd r9, dword [r8 - 8]
add r9, r9
call fcn.1400da5d4
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov rdx, rsi
mov ecx, ntohs
call qword [sym.imp.USER32.dll_SetClipboardData]
call qword [sym.imp.USER32.dll_CloseClipboard]
xor eax, eax
jmp 0x1400a1813
call qword [sym.imp.USER32.dll_CloseClipboard]
mov eax, 1
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret