joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140081bb0
Capabilities:
Acquire debug privileges

Disassembly:
jmp 0x140081bb0
mov qword [rsp + 8], rcx
sub rsp, 0xa8
mov rax, qword [0x14028c8d0]
xor rax, rsp
mov qword [rsp + 0x98], rax
mov dword [rsp + 0x30], 0
mov qword [rsp + 0x38], 0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea r8, [rsp + 0x38]
mov edx, 0x28
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x140081c42
lea rax, [rsp + 0x70]
mov qword [rsp + 0x60], rax
lea rdx, str.SetDumpPrivileges:_Could_not_get_the_process_token
mov rcx, qword [rsp + 0x60]
call fcn.140002b67
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0xb0]
add rax, 0x600
mov r9b, 1
xor r8d, r8d
mov rdx, qword [rsp + 0x50]
mov rcx, rax
call fcn.140002a31
jmp 0x140081d4d
mov dword [rsp + 0x88], 1
mov eax, reloc.WS2_32.dll_inet_ntoa
imul rax, rax, 0
lea rax, [rsp + rax + 0x8c]
mov r8, rax
lea rdx, str.SeDebugPrivilege
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
test eax, eax
jne 0x140081cbd
lea rax, [rsp + 0x80]
mov qword [rsp + 0x68], rax
lea rdx, str.SetDumpPrivileges:_Couldnt_lookup_SeDebugPrivilege_name
mov rcx, qword [rsp + 0x68]
call fcn.140002b67
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0xb0]
add rax, 0x600
mov r9b, 1
xor r8d, r8d
mov rdx, qword [rsp + 0x40]
mov rcx, rax
call fcn.140002a31
jmp 0x140081d4d
mov eax, reloc.WS2_32.dll_inet_ntoa
imul rax, rax, 0
mov dword [rsp + rax + 0x94], 2
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov r9d, reloc.WS2_32.dll_recv
lea r8, [rsp + 0x88]
xor edx, edx
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
test eax, eax
jne 0x140081d45
lea rax, [rsp + 0x78]
mov qword [rsp + 0x58], rax
lea rdx, str.SetDumpPrivileges:_Could_not_revoke_the_debug_privilege
mov rcx, qword [rsp + 0x58]
call fcn.140002b67
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0xb0]
add rax, 0x600
mov r9b, 1
xor r8d, r8d
mov rdx, qword [rsp + 0x48]
mov rcx, rax
call fcn.140002a31
jmp 0x140081d4d
mov dword [rsp + 0x30], 1
cmp qword [rsp + 0x38], 0
je 0x140081d60
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [rsp + 0x30]
mov rcx, qword [rsp + 0x98]
xor rcx, rsp
call fcn.1401b0dd0
add rsp, 0xa8
ret
Function at 0x1400a5d30
Capabilities:
Get system information on windows

Disassembly:
jmp 0x1400a5d30
mov qword [rsp + 8], rcx
sub rsp, 0x68
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov rax, qword [rsp + 0x70]
add rax, 0x20
mov rcx, rax
call fcn.1400032b5
nop
mov rax, qword [rsp + 0x70]
add rax, 0x48
mov rcx, rax
call fcn.14000404d
mov rax, qword [rsp + 0x70]
mov qword [rax], 0xffffffffffffffff
mov rax, qword [rsp + 0x70]
mov qword [rax + 0x18], 0
mov rax, qword [rsp + 0x70]
mov qword [rax + 8], 0
lea rcx, [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov rax, qword [rsp + 0x70]
mov ecx, dword [rsp + 0x50]
mov dword [rax + 0x10], ecx
mov rax, qword [rsp + 0x70]
add rsp, 0x68
ret

Function at 0x1400a5e10
Capabilities:
Get file size

Disassembly:
jmp 0x1400a5e10
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x58
mov rax, qword [rsp + 0x60]
cmp qword [rax], 0xffffffffffffffff
je 0x1400a5e33
mov rcx, qword [rsp + 0x60]
call fcn.1400012f8
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 1
mov edx, 0x80000000
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rcx, qword [rsp + 0x60]
mov qword [rcx], rax
mov rax, qword [rsp + 0x60]
cmp qword [rax], 0xffffffffffffffff
jne 0x1400a5e7c
xor eax, eax
jmp 0x1400a5ed5
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
mov r8d, 2
xor edx, edx
mov rax, qword [rsp + 0x60]
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov rcx, qword [rsp + 0x60]
mov qword [rcx + 8], rax
lea rdx, [rsp + 0x40]
mov rax, qword [rsp + 0x60]
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov rax, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x40]
mov qword [rax + 0x18], rcx
mov eax, 1
add rsp, 0x58
ret
Function at 0x1400a60b0
Capabilities:
Read file via mapping

Disassembly:
jmp 0x1400a60b0
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
sub rsp, 0xd8
mov qword [rsp + 0x90], 0xfffffffffffffffe
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [rsp + 0x3c], eax
xor edx, edx
mov eax, dword [rsp + 0xe8]
mov rcx, qword [rsp + 0xe0]
div dword [rcx + 0x10]
mov eax, edx
mov ecx, dword [rsp + 0xe8]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x34], eax
mov eax, dword [rsp + 0x34]
mov ecx, dword [rsp + 0xe8]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x38], eax
mov qword [rsp + 0x40], 0
mov rax, qword [rsp + 0xe0]
add rax, 0x20
mov rdx, rax
lea rcx, [rsp + 0x60]
call fcn.140003edb
nop
mov rax, qword [rsp + 0xe0]
add rax, 0x48
lea r8, [rsp + 0x3c]
lea rdx, [rsp + 0x70]
mov rcx, rax
call fcn.1400032e7
nop
mov rax, qword [rsp + 0xe0]
add rax, 0x48
lea rdx, [rsp + 0x98]
mov rcx, rax
call fcn.1400051cd
mov qword [rsp + 0x58], rax
mov rax, qword [rsp + 0x58]
mov qword [rsp + 0x48], rax
mov rdx, qword [rsp + 0x48]
lea rcx, [rsp + 0x70]
call fcn.14000293c
mov byte [rsp + 0x30], al
lea rcx, [rsp + 0x98]
call fcn.140004edf
movzx eax, byte [rsp + 0x30]
test eax, eax
je 0x1400a61bd
lea rcx, [rsp + 0x70]
call fcn.140005d8a
mov rcx, qword [rax + 8]
call qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov eax, dword [rsp + 0x38]
mov ecx, dword [rsp + 0xf0]
add ecx, eax
mov eax, ecx
mov eax, eax
mov qword [rsp + 0x20], rax
mov r9d, dword [rsp + 0x34]
xor r8d, r8d
mov edx, 4
mov rax, qword [rsp + 0xe0]
mov rcx, qword [rax + 8]
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0xe0]
add rax, 0x48
lea rdx, [rsp + 0xb0]
mov rcx, rax
call fcn.1400051cd
mov qword [rsp + 0x68], rax
mov rax, qword [rsp + 0x68]
mov qword [rsp + 0x88], rax
mov rdx, qword [rsp + 0x88]
lea rcx, [rsp + 0x70]
call fcn.14000293c
mov byte [rsp + 0x31], al
lea rcx, [rsp + 0xb0]
call fcn.140004edf
movzx eax, byte [rsp + 0x31]
test eax, eax
je 0x1400a6266
lea rcx, [rsp + 0x70]
call fcn.140005d8a
mov rcx, qword [rsp + 0x40]
mov qword [rax + 8], rcx
jmp 0x1400a6287
mov rax, qword [rsp + 0xe0]
add rax, 0x48
lea rdx, [rsp + 0x3c]
mov rcx, rax
call fcn.140002fc2
mov rcx, qword [rsp + 0x40]
mov qword [rax], rcx
mov eax, dword [rsp + 0x38]
mov rcx, qword [rsp + 0x40]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x50], rax
lea rcx, [rsp + 0x70]
call fcn.140004edf
nop
lea rcx, [rsp + 0x60]
call fcn.1400053da
mov rax, qword [rsp + 0x50]
add rsp, 0xd8
ret
Function at 0x1400a63f0
Capabilities:
Read file on windows

Disassembly:
jmp 0x1400a63f0
mov qword [rsp + 8], rcx
sub rsp, 0x48
mov rax, qword [0x14028c8d0]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.MSVCR120D.dll_rewind]
mov r9, qword [rsp + 0x50]
mov r8d, 1
mov edx, recv
lea rcx, [rsp + 0x28]
call qword [sym.imp.MSVCR120D.dll_fread]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 1
je 0x1400a643f
xor eax, eax
jmp 0x1400a6463
mov r8d, 2
lea rdx, [0x14022a3fc]
lea rcx, [rsp + 0x28]
call sub.MSVCR120D.dll_memcmp
test eax, eax
je 0x1400a645e
xor eax, eax
jmp 0x1400a6463
mov eax, 1
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.1401b0dd0
add rsp, 0x48
ret

Function at 0x1400a6480
Capabilities:
Read file on windows

Disassembly:
jmp 0x1400a6480
mov qword [rsp + 8], rcx
sub rsp, 0x38
mov rax, qword [0x14028c8d0]
xor rax, rsp
mov qword [rsp + 0x28], rax
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.MSVCR120D.dll_rewind]
mov r9, qword [rsp + 0x40]
mov r8d, 8
mov edx, 1
lea rcx, [rsp + 0x20]
call qword [sym.imp.MSVCR120D.dll_fread]
mov r8d, 8
xor edx, edx
lea rcx, [rsp + 0x20]
call fcn.140186310
test eax, eax
je 0x1400a64d8
xor eax, eax
jmp 0x1400a64dd
mov eax, 1
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.1401b0dd0
add rsp, 0x38
ret

Function at 0x1400a6500
Capabilities:
Read file on windows

Disassembly:
jmp 0x1400a6500
mov qword [rsp + 8], rcx
sub rsp, 0x38
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.MSVCR120D.dll_rewind]
mov r9, qword [rsp + 0x40]
mov r8d, 2
mov edx, 1
lea rcx, [rsp + 0x20]
call qword [sym.imp.MSVCR120D.dll_fread]
mov dword [rsp + 0x24], eax
cmp dword [rsp + 0x24], 2
je 0x1400a653e
xor eax, eax
jmp 0x1400a6553
movzx eax, word [rsp + 0x20]
cmp eax, 0xd8ff
jne 0x1400a6551
mov eax, 1
jmp 0x1400a6553
xor eax, eax
add rsp, 0x38
ret
Function at 0x1400a7ad0
Capabilities:
Read file on windows

Disassembly:
jmp 0x1400a7ad0
mov qword [rsp + 8], rcx
sub rsp, 0x38
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.MSVCR120D.dll_rewind]
mov r9, qword [rsp + 0x40]
mov r8d, 3
mov edx, 1
lea rcx, [rsp + 0x24]
call qword [sym.imp.MSVCR120D.dll_fread]
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x20], 3
je 0x1400a7b0e
xor eax, eax
jmp 0x1400a7b32
mov r8d, 3
lea rdx, [0x14022a46c]
lea rcx, [rsp + 0x24]
call sub.MSVCR120D.dll_memcmp
test eax, eax
jne 0x1400a7b30
mov eax, 1
jmp 0x1400a7b32
xor eax, eax
add rsp, 0x38
ret

Function at 0x1400a8430
Capabilities:
Read file on windows

Disassembly:
jmp 0x1400a8430
mov qword [rsp + 8], rcx
sub rsp, 0x38
mov dword [rsp + 0x20], 0
mov qword [rsp + 0x28], 0
mov rax, qword [rsp + 0x40]
add rax, 0x90
mov rcx, qword [rsp + 0x40]
add rcx, 0x68
mov rdx, rax
call fcn.1401230e0
cmp eax, 1
je 0x1400a84fd
mov rax, qword [rsp + 0x40]
add rax, 0x68
mov edx, 0x1000
mov rcx, rax
call fcn.140122b00
mov rcx, qword [rsp + 0x40]
mov qword [rcx + 0x88], rax
mov rax, qword [rsp + 0x40]
cmp qword [rax + 0x88], 0
jne 0x1400a84a4
jmp 0x1400a8505
mov rax, qword [rsp + 0x40]
mov r9, qword [rax + 0x38]
mov r8d, 0x1000
mov edx, 1
mov rax, qword [rsp + 0x40]
mov rcx, qword [rax + 0x88]
call qword [sym.imp.MSVCR120D.dll_fread]
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
jne 0x1400a84db
jmp 0x1400a8505
mov rax, qword [rsp + 0x40]
add rax, 0x68
mov edx, dword [rsp + 0x28]
mov rcx, rax
call fcn.140122c60
test eax, eax
je 0x1400a84f8
jmp 0x1400a8505
jmp 0x1400a844a
mov dword [rsp + 0x20], 1
mov eax, dword [rsp + 0x20]
add rsp, 0x38
ret
Function at 0x1400a9d30
Capabilities:
Read file on windows

Disassembly:
jmp 0x1400a9d30
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x48
mov dword [rsp + 0x28], 0
mov rax, qword [rsp + 0x60]
mov dword [rax], 0
mov qword [rsp + 0x30], 0
lea r8, [0x14022a578]
mov rdx, qword [rsp + 0x58]
lea rcx, [rsp + 0x30]
call qword [sym.imp.MSVCR120D.dll__wfopen_s]
cmp qword [rsp + 0x30], 0
jne 0x1400a9d88
jmp 0x1400a9ed1
mov r9, qword [rsp + 0x30]
mov r8d, 2
mov edx, 1
lea rcx, [rsp + 0x20]
call qword [sym.imp.MSVCR120D.dll_fread]
mov qword [rsp + 0x38], rax
cmp qword [rsp + 0x38], 2
je 0x1400a9dba
jmp 0x1400a9ed1
mov eax, 1
imul rax, rax, 0
movzx eax, byte [rsp + rax + 0x20]
cmp eax, 0xff
jne 0x1400a9e01
mov eax, 1
imul rax, rax, 1
movzx eax, byte [rsp + rax + 0x20]
cmp eax, 0xfe
jne 0x1400a9e01
mov dword [rsp + 0x28], 2
mov rax, qword [rsp + 0x60]
mov dword [rax], 2
jmp 0x1400a9ed1
mov eax, 1
imul rax, rax, 0
movzx eax, byte [rsp + rax + 0x20]
cmp eax, 0xfe
jne 0x1400a9e48
mov eax, 1
imul rax, rax, 1
movzx eax, byte [rsp + rax + 0x20]
cmp eax, 0xff
jne 0x1400a9e48
mov dword [rsp + 0x28], 3
mov rax, qword [rsp + 0x60]
mov dword [rax], 2
jmp 0x1400a9ed1
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.MSVCR120D.dll_rewind]
mov r9, qword [rsp + 0x30]
mov r8d, 3
mov edx, 1
lea rcx, [rsp + 0x24]
call qword [sym.imp.MSVCR120D.dll_fread]
mov qword [rsp + 0x38], rax
cmp qword [rsp + 0x38], 3
je 0x1400a9e7f
jmp 0x1400a9ed1
mov eax, 1
imul rax, rax, 0
movzx eax, byte [rsp + rax + 0x24]
cmp eax, 0xef
jne 0x1400a9ed1
mov eax, 1
imul rax, rax, 1
movzx eax, byte [rsp + rax + 0x24]
cmp eax, 0xbb
jne 0x1400a9ed1
mov eax, 1
imul rax, rax, 2
movzx eax, byte [rsp + rax + 0x24]
cmp eax, 0xbf
jne 0x1400a9ed1
mov dword [rsp + 0x28], 1
mov rax, qword [rsp + 0x60]
mov dword [rax], 3
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.MSVCR120D.dll_fclose]
mov eax, dword [rsp + 0x28]
add rsp, 0x48
ret

Function at 0x1400b8470
Capabilities:
Create thread

Disassembly:
jmp 0x1400b8470
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x48
mov rax, qword [rsp + 0x50]
mov rdx, qword [rsp + 0x58]
mov rcx, rax
call fcn.14000164a
mov rax, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x60]
mov qword [rax + 0x38], rcx
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
mov r9, qword [rsp + 0x50]
lea r8, [0x1400048ef]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rsp + 0x30], rax
cmp qword [rsp + 0x30], 0
jne 0x1400b84db
xor eax, eax
jmp 0x1400b84e0
mov eax, 1
add rsp, 0x48
ret
Function at 0x1400b9ed0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
jmp 0x1400b9ed0
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0xc8
mov qword [rsp + 0x90], 0xfffffffffffffffe
mov rax, qword [rsp + 0xe0]
mov qword [rax], 0
lea rcx, [rsp + 0x28]
call fcn.140002d51
nop
lea rax, [rsp + 0x98]
mov qword [rsp + 0x78], rax
mov rdx, qword [rsp + 0xd8]
mov rcx, qword [rsp + 0x78]
call fcn.140001a7d
mov qword [rsp + 0x48], rax
lea r8, [rsp + 0x28]
mov rdx, qword [rsp + 0x48]
mov rcx, qword [rsp + 0xd0]
call fcn.1400050c4
mov dword [rsp + 0x24], eax
cmp dword [rsp + 0x24], 0
jne 0x1400b9f7b
mov dword [rsp + 0x3c], 0
lea rcx, [rsp + 0x28]
call fcn.1400053e9
nop
mov rcx, qword [rsp + 0xd8]
call fcn.1400053e9
mov eax, dword [rsp + 0x3c]
jmp 0x1400ba168
lea rcx, [rsp + 0x28]
call fcn.140004b60
cdqe
mov rcx, qword [rsp + 0xe0]
add rax, qword [rcx]
mov rcx, qword [rsp + 0xe0]
mov qword [rcx], rax
mov rax, qword [rsp + 0xd0]
add rax, 8
mov r8, qword [rsp + 0xd8]
lea rdx, [rsp + 0x60]
mov rcx, rax
call fcn.14000155a
nop
mov rax, qword [rsp + 0xd0]
add rax, 8
lea rdx, [rsp + 0xa8]
mov rcx, rax
call fcn.140001690
mov qword [rsp + 0x88], rax
mov rax, qword [rsp + 0x88]
mov qword [rsp + 0x80], rax
mov rdx, qword [rsp + 0x80]
lea rcx, [rsp + 0x60]
call fcn.140003c7e
mov byte [rsp + 0x20], al
lea rcx, [rsp + 0xa8]
call fcn.140005885
movzx eax, byte [rsp + 0x20]
test eax, eax
je 0x1400ba053
mov dword [rsp + 0x38], 0
lea rcx, [rsp + 0x60]
call fcn.140005885
nop
lea rcx, [rsp + 0x28]
call fcn.1400053e9
nop
mov rcx, qword [rsp + 0xd8]
call fcn.1400053e9
mov eax, dword [rsp + 0x38]
jmp 0x1400ba168
lea rcx, [rsp + 0x60]
call fcn.140002e1e
add rax, 8
mov rcx, rax
call fcn.140002a9a
mov rcx, qword [rsp + 0xe0]
add rax, qword [rcx]
mov rcx, qword [rsp + 0xe0]
mov qword [rcx], rax
lea rcx, [rsp + 0x30]
call fcn.140002d51
nop
lea rax, [rsp + 0xa0]
mov qword [rsp + 0x58], rax
mov rdx, qword [rsp + 0xd8]
mov rcx, qword [rsp + 0x58]
call fcn.140001a7d
mov qword [rsp + 0x50], rax
lea r8, [rsp + 0x30]
mov rdx, qword [rsp + 0x50]
mov rcx, qword [rsp + 0xd0]
call fcn.1400032b0
mov dword [rsp + 0x24], eax
cmp dword [rsp + 0x24], 0
jne 0x1400ba10c
mov dword [rsp + 0x44], 0
lea rcx, [rsp + 0x30]
call fcn.1400053e9
nop
lea rcx, [rsp + 0x60]
call fcn.140005885
nop
lea rcx, [rsp + 0x28]
call fcn.1400053e9
nop
mov rcx, qword [rsp + 0xd8]
call fcn.1400053e9
mov eax, dword [rsp + 0x44]
jmp 0x1400ba168
lea rcx, [rsp + 0x30]
call fcn.140004b60
cdqe
mov rcx, qword [rsp + 0xe0]
add rax, qword [rcx]
mov rcx, qword [rsp + 0xe0]
mov qword [rcx], rax
mov dword [rsp + 0x40], 1
lea rcx, [rsp + 0x30]
call fcn.1400053e9
nop
lea rcx, [rsp + 0x60]
call fcn.140005885
nop
lea rcx, [rsp + 0x28]
call fcn.1400053e9
nop
mov rcx, qword [rsp + 0xd8]
call fcn.1400053e9
mov eax, dword [rsp + 0x40]
add rsp, 0xc8
ret
Function at 0x1400bb960
Capabilities:
Send data

Disassembly:
jmp 0x1400bb960
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x88
mov qword [rsp + 0x70], 0xfffffffffffffffe
mov dword [rsp + 0x20], 0
lea rcx, [rsp + 0x28]
call fcn.140002d51
nop
lea rdx, [rsp + 0x28]
mov rcx, qword [rsp + 0x90]
call fcn.140001ba4
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x20], 0
jne 0x1400bb9c5
mov dword [rsp + 0x4c], 0
lea rcx, [rsp + 0x28]
call fcn.1400053e9
mov eax, dword [rsp + 0x4c]
jmp 0x1400bbaa7
lea rcx, [rsp + 0x50]
call fcn.1400037e7
nop
lea rcx, [rsp + 0x28]
call fcn.140002b08
mov rdx, rax
lea rcx, [rsp + 0x50]
call fcn.1400023ce
mov qword [rsp + 0x40], rax
cmp qword [rsp + 0x40], 0
jne 0x1400bba1a
mov dword [rsp + 0x38], 0
lea rcx, [rsp + 0x50]
call fcn.140004179
nop
lea rcx, [rsp + 0x28]
call fcn.1400053e9
mov eax, dword [rsp + 0x38]
jmp 0x1400bbaa7
mov dword [rsp + 0x30], 0
mov rcx, qword [rsp + 0x40]
call sub.MSVCR120D.dll_strlen
lea r9, [rsp + 0x30]
mov r8d, eax
mov rdx, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x98]
call qword [sym.imp.WININET.dll_InternetWriteFile]
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x20], 0
jne 0x1400bba75
mov dword [rsp + 0x34], 0
lea rcx, [rsp + 0x50]
call fcn.140004179
nop
lea rcx, [rsp + 0x28]
call fcn.1400053e9
mov eax, dword [rsp + 0x34]
jmp 0x1400bbaa7
mov edx, dword [rsp + 0x30]
mov rcx, qword [rsp + 0x90]
call fcn.140002658
mov dword [rsp + 0x48], 1
lea rcx, [rsp + 0x50]
call fcn.140004179
nop
lea rcx, [rsp + 0x28]
call fcn.1400053e9
mov eax, dword [rsp + 0x48]
add rsp, 0x88
ret

Function at 0x1400cc580
Capabilities:
Write clipboard data

Disassembly:
jmp 0x1400cc580
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x58
mov rax, qword [rsp + 0x60]
add rax, 8
mov rcx, rax
call fcn.140004f84
test eax, eax
je 0x1400cc66c
call qword [sym.imp.USER32.dll_EmptyClipboard]
mov rcx, qword [rsp + 0x68]
call fcn.140004b60
inc eax
cdqe
shl rax, 1
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x20]
mov edx, eax
mov ecx, 0x2000
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov qword [rsp + 0x28], rax
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_GlobalLock]
mov qword [rsp + 0x30], rax
cmp qword [rsp + 0x30], 0
je 0x1400cc666
mov rcx, qword [rsp + 0x68]
call fcn.140004b60
cdqe
shl rax, 1
mov qword [rsp + 0x38], rax
mov rcx, qword [rsp + 0x68]
call fcn.140002b08
mov qword [rsp + 0x40], rax
mov ecx, dword [rsp + 0x20]
xor edx, edx
mov eax, ecx
mov ecx, 2
div rcx
mov rcx, qword [rsp + 0x38]
mov r9, rcx
mov rcx, qword [rsp + 0x40]
mov r8, rcx
mov rdx, rax
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.MSVCR120D.dll_wcsncpy_s]
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov rdx, qword [rsp + 0x28]
mov ecx, recv
call qword [sym.imp.USER32.dll_SetClipboardData]
call qword [sym.imp.USER32.dll_CloseClipboard]
xor eax, eax
jmp 0x1400cc671
call qword [sym.imp.USER32.dll_CloseClipboard]
mov eax, 1
add rsp, 0x58
ret
Function at 0x1400ce030
Capabilities:
Open clipboard

Disassembly:
jmp 0x1400ce030
mov qword [rsp + 8], rcx
sub rsp, 0x38
mov rax, qword [rsp + 0x40]
mov rcx, qword [rax]
call qword [sym.imp.USER32.dll_IsWindow]
test eax, eax
jne 0x1400ce086
lea rax, str.::IsWindow_m_hWnd_
mov qword [rsp + 0x28], rax
lea rax, [0x140214388]
mov qword [rsp + 0x20], rax
xor r9d, r9d
mov r8d, 0x6ee
lea rdx, [0x14021e6b0]
mov ecx, 2
call qword [sym.imp.MSVCR120D.dll__CrtDbgReportW]
cmp eax, 1
jne 0x1400ce086
int3
mov rax, qword [rsp + 0x40]
mov rcx, qword [rax]
call qword [sym.imp.USER32.dll_OpenClipboard]
add rsp, 0x38
ret

Function at 0x1400d1020
Capabilities:
Create process on windows

Disassembly:
jmp 0x1400d1020
mov qword [rsp + 0x20], r9
mov word [rsp + 0x18], r8w
mov word [rsp + 0x10], dx
mov qword [rsp + 8], rcx
sub rsp, 0x68
mov qword [rsp + 0x58], 0xfffffffffffffffe
call fcn.140002e82
mov qword [rsp + 0x30], rax
lea rdx, [rsp + 0x48]
mov rcx, qword [rsp + 0x30]
call fcn.1400060e6
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x40], rax
mov rcx, qword [rsp + 0x40]
call fcn.140002b08
mov dword [rsp + 0x28], 5
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8, rax
lea rdx, str.open
mov rax, qword [rsp + 0x70]
mov rcx, qword [rax + 8]
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
mov qword [rsp + 0x50], rax
lea rcx, [rsp + 0x48]
call fcn.1400053e9
cmp dword [rsp + 0x50], 0x20
jg 0x1400d10f2
lea rax, str._int_hInst_32
mov qword [rsp + 0x28], rax
lea rax, [0x140230a5c]
mov qword [rsp + 0x20], rax
xor r9d, r9d
mov r8d, 0x228
lea rdx, str.D:crashRpt_2013_reportingcrashsenderResendDlg.cpp
mov ecx, 2
call qword [sym.imp.MSVCR120D.dll__CrtDbgReportW]
cmp eax, 1
jne 0x1400d10f2
int3
xor eax, eax
add rsp, 0x68
ret
Function at 0x1400d5ff0
Capabilities:
Enumerate gui resources

Disassembly:
jmp 0x1400d5ff0
mov qword [rsp + 0x20], r9
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
sub rsp, 0x78
mov qword [rsp + 0x40], 0xfffffffffffffffe
mov rax, qword [0x14028c8d0]
xor rax, rsp
mov qword [rsp + 0x68], rax
mov eax, dword [rsp + 0x90]
mov dword [rsp + 0x34], eax
mov eax, dword [rsp + 0x88]
mov dword [rsp + 0x30], eax
mov rax, qword [rsp + 0x98]
mov qword [rsp + 0x38], rax
lea rdx, [rsp + 0x30]
lea rcx, [0x140001573]
call qword [sym.imp.USER32.dll_EnumWindows]
cmp dword [rsp + 0x90], 0
jne 0x1400d619b
lea rcx, [rsp + 0x48]
call fcn.14000138e
nop
mov dword [rsp + 0x20], 0
mov qword [rsp + 0x28], 0
jmp 0x1400d608d
mov rax, qword [rsp + 0x28]
inc rax
mov qword [rsp + 0x28], rax
mov rcx, qword [rsp + 0x98]
call fcn.140005e66
cmp qword [rsp + 0x28], rax
jae 0x1400d612d
mov rdx, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x98]
call fcn.1400026d5
mov eax, dword [rax + 0x1c]
and eax, 0x40000
test eax, eax
je 0x1400d6128
mov rdx, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x98]
call fcn.1400026d5
mov eax, dword [rax + 0x18]
and eax, 0xc00000
test eax, eax
je 0x1400d6128
mov rdx, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x98]
call fcn.1400026d5
mov eax, dword [rax + 0x18]
and eax, 0x80000
test eax, eax
je 0x1400d6128
mov dword [rsp + 0x20], 1
mov rdx, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x98]
call fcn.1400026d5
mov rdx, rax
lea rcx, [rsp + 0x48]
call fcn.14000105a
jmp 0x1400d612d
jmp 0x1400d6080
cmp dword [rsp + 0x20], 0
jne 0x1400d616a
mov rcx, qword [rsp + 0x98]
call fcn.140005e66
test rax, rax
jbe 0x1400d616a
xor edx, edx
mov rcx, qword [rsp + 0x98]
call fcn.1400026d5
mov rdx, rax
lea rcx, [rsp + 0x48]
call fcn.14000105a
mov dword [rsp + 0x20], 1
cmp dword [rsp + 0x20], 0
je 0x1400d6191
mov rcx, qword [rsp + 0x98]
call fcn.140001c62
lea rdx, [rsp + 0x48]
mov rcx, qword [rsp + 0x98]
call fcn.140002815
nop
lea rcx, [rsp + 0x48]
call fcn.1400052f4
mov eax, 1
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.1401b0dd0
add rsp, 0x78
ret