joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100c99330
Capabilities:
Accept command line arguments

Disassembly:
push rbx
push rdi
push rsi
push r12
push r13
push r14
lea rsp, [rsp - 0x138]
mov esi, 0
mov qword [0x100f453b0], 0
mov dword [rsp + 0x20], 0
lea rdx, [rsp + 0x28]
mov r8d, 0x104
movabs rcx, 0
call sub.kernel32.dll_GetModuleFileNameA
mov ebx, eax
mov eax, ebx
and eax, 0xffffffff
mov byte [rsp + rax + 0x28], 0
mov r8d, ebx
mov rcx, rsp
mov edx, 0
call fcn.100c99510
movsxd rax, ebx
lea r8, [rax + 1]
mov rax, qword [0x100f453b0]
mov rdx, qword [rax]
lea rcx, [rsp + 0x28]
call fcn.100c86fe0
call sub.kernel32.dll_GetCommandLineA
mov qword [0x100e5b780], rax
mov r14, qword [0x100e5b780]
jmp 0x100c994c0
add r14, 1
movzx eax, byte [r14]
sub eax, 1
cmp eax, 0x20
jb 0x100c993d0
cmp byte [r14], 0
je 0x100c994ca
mov dil, 0
mov r12, r14
mov ebx, 0
jmp 0x100c99432
mov al, byte [r14]
cmp al, 1
jb 0x100c9942b
sub al, 1
sub al, 0x1f
jbe 0x100c9940b
sub al, 2
je 0x100c99415
jmp 0x100c9942b
test dil, dil
je 0x100c99438
add ebx, 1
jmp 0x100c9942e
cmp byte [r14 + 1], 0x22
je 0x100c99425
test dil, dil
sete dil
jmp 0x100c9942e
add r14, 1
jmp 0x100c9942e
add ebx, 1
add r14, 1
cmp byte [r14], 0
jne 0x100c993f8
test esi, esi
je 0x100c994bd
mov r8d, ebx
mov edx, esi
mov rcx, rsp
call fcn.100c99510
mov dil, 0
mov r14, r12
mov rdx, qword [0x100f453b0]
movsxd rax, esi
mov r13, qword [rdx + rax*8]
jmp 0x100c994b2
mov al, byte [r14]
cmp al, 1
jb 0x100c994a3
sub al, 1
sub al, 0x1f
jbe 0x100c9947b
sub al, 2
je 0x100c9948d
jmp 0x100c994a3
test dil, dil
je 0x100c994b8
mov al, byte [r14]
mov byte [r13], al
add r13, 1
jmp 0x100c994ae
cmp byte [r14 + 1], 0x22
je 0x100c9949d
test dil, dil
sete dil
jmp 0x100c994ae
add r14, 1
jmp 0x100c994ae
mov al, byte [r14]
mov byte [r13], al
add r13, 1
add r14, 1
cmp byte [r14], 0
jne 0x100c99468
mov byte [r13], 0
add esi, 1
cmp byte [r14], 0
jne 0x100c993d4
mov dword [0x100f453a0], esi
movsxd rax, esi
lea rdx, [rax + 1]
shl rdx, 3
lea rcx, [0x100f453b0]
call fcn.100c96080
mov rax, qword [0x100f453b0]
movsxd rsi, esi
mov qword [rax + rsi*8], 0
nop
lea rsp, [rsp + 0x138]
pop r14
pop r13
pop r12
pop rsi
pop rdi
pop rbx
ret

Function at 0x100cadd70
Capabilities:
Set registry value

Disassembly:
lea rsp, [rsp - 0x58]
mov qword [rsp + 0x48], 0xffffffffffffffff
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0xf003f
mov dword [rsp + 0x20], 0
lea rax, [rsp + 0x48]
mov qword [rsp + 0x38], rax
lea rdx, str.SYSTEMCurrentControlSetControlSession_Manager
movabs r9, 0
mov r8d, 0
movabs rcx, 0xffffffff80000002
call sub.advapi32.dll_RegCreateKeyExA
test eax, eax
jne 0x100cade0f
mov dword [rsp + 0x28], 0x1b
lea rax, str.netapi32.dll
mov qword [rsp + 0x20], rax
lea rdx, str.ExcludeFromKnownDLLs
mov rcx, qword [rsp + 0x48]
mov r9d, 7
mov r8d, 0
call sub.advapi32.dll_RegSetValueExA
mov rcx, qword [rsp + 0x48]
call sub.advapi32.dll_RegCloseKey
nop
lea rsp, [rsp + 0x58]
ret
Function at 0x100cade50
Capabilities:
Terminate process

Disassembly:
push rbp
mov rbp, rsp
lea rsp, [rsp - 0x60]
mov qword [rbp - 0x38], rbx
mov qword [rbp - 0x30], rdi
mov qword [rbp - 0x28], rsi
mov qword [rbp - 0x20], r12
mov rbx, rcx
mov esi, edx
mov qword [rbp - 0x18], 0
mov qword [rbp - 0x10], 0
mov qword [rbp - 8], 0
nop
mov edi, 5
mov r8d, esi
mov edx, 0
mov ecx, 1
call sub.kernel32.dll_OpenProcess
mov r12, rax
cmp r12, 0xffffffffffffffff
jne 0x100cadef6
lea rcx, [rbp - 0x10]
call fcn.100c8d4f0
mov edx, esi
lea rcx, [rbp - 0x18]
call fcn.100ce1560
mov r8, qword [rbp - 0x18]
lea rdx, str.Cannot_open_process
lea rcx, [rbp - 0x10]
mov r9d, 0
call fcn.100c8d680
mov rdx, qword [rbp - 0x10]
lea rcx, [rbp - 8]
call fcn.100c8f3e0
mov rdx, qword [rbp - 8]
mov rcx, rbx
mov r8d, 0
call fcn.100cb52e0
jmp 0x100cadf0c
mov rcx, r12
mov edx, 0
call sub.kernel32.dll_TerminateProcess
test eax, eax
je 0x100cadf0c
mov edi, 0
nop
mov rcx, rbp
call fcn.100cade20
mov eax, edi
mov rbx, qword [rbp - 0x38]
mov rdi, qword [rbp - 0x30]
mov rsi, qword [rbp - 0x28]
mov r12, qword [rbp - 0x20]
lea rsp, [rbp]
pop rbp
ret
Function at 0x100cb52e0
Capabilities:
Write file on windows

Disassembly:
push rbp
mov rbp, rsp
lea rsp, [rsp - 0xa0]
mov qword [rbp - 0x58], rbx
mov qword [rbp - 0x50], rsi
mov rbx, rcx
mov qword [rbp - 8], rdx
mov sil, r8b
lea rcx, [rbp - 8]
call fcn.100c8f1f0
mov qword [rbp - 0x18], 0
mov qword [rbp - 0x38], 0
mov qword [rbp - 0x30], 0
mov qword [rbp - 0x28], 0
nop
cmp byte [rbx + 0xa34], 0
jne 0x100cb5362
mov rdx, qword [rbp - 8]
test rdx, rdx
jne 0x100cb5341
lea rdx, [0x100f45460]
lea r8, [0x100e71a80]
mov r9d, 0
movabs rcx, 0
call sub.user32.dll_MessageBoxW
jmp 0x100cb54bd
cmp qword [rbx + 0x9d0], 0
je 0x100cb54ae
lea rcx, [rbp - 0x30]
call fcn.100c8d4f0
call fcn.100ce6210
movapd xmm1, xmm0
lea rcx, [rbp - 0x38]
mov r8d, 0
call fcn.100ce6340
mov rdx, qword [rbp - 0x38]
lea r8, [0x100e71aa8]
lea rcx, [rbp - 0x30]
mov r9d, 0
call fcn.100c8d680
mov rdx, qword [rbp - 0x30]
lea rcx, [rbp - 0x28]
call fcn.100c8f3e0
mov rdx, qword [rbp - 0x28]
mov r8, qword [rbp - 8]
lea rcx, [rbp - 0x18]
call fcn.100c8f590
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 4
mov rcx, qword [rbx + 0x9d0]
test rcx, rcx
jne 0x100cb53f5
lea rcx, [0x100f45460]
movabs r9, 0
mov r8d, 0
mov edx, 0xc0000000
call sub.kernel32.dll_CreateFileA
mov rbx, rax
movabs rax, 0xffffffff
cmp rbx, rax
jne 0x100cb542b
mov ecx, 1
call sub.kernel32.dll_ExitProcess
mov dword [rbp - 0x10], 0xa000d
mov rcx, rbx
mov r9d, 2
movabs r8, 0
mov edx, 0
call sub.kernel32.dll_SetFilePointer
mov qword [rsp + 0x20], 0
mov r8, qword [rbp - 0x18]
test r8, r8
je 0x100cb5468
mov r8d, dword [r8 - 4]
shr r8, 1
shl r8, 1
mov rdx, qword [rbp - 0x18]
test rdx, rdx
jne 0x100cb547b
lea rdx, [0x100f45460]
lea r9, [rbp - 0x20]
mov rcx, rbx
call sub.kernel32.dll_WriteFile
mov qword [rsp + 0x20], 0
lea r9, [rbp - 0x20]
lea rdx, [rbp - 0x10]
mov rcx, rbx
mov r8d, 4
call sub.kernel32.dll_WriteFile
mov rcx, rbx
call sub.kernel32.dll_CloseHandle
test sil, sil
je 0x100cb54bd
mov ecx, 1
call sub.kernel32.dll_ExitProcess
nop
mov rcx, rbp
call fcn.100cb5290
mov rbx, qword [rbp - 0x58]
mov rsi, qword [rbp - 0x50]
lea rsp, [rbp]
pop rbp
ret
Function at 0x100cbc470
Capabilities:
Query environment variable

Disassembly:
push rbp
mov rbp, rsp
lea rsp, [rsp - 0x80]
mov qword [rbp - 0x60], rbx
mov qword [rbp - 0x58], rdi
mov qword [rbp - 0x50], rsi
mov qword [rbp - 0x48], r12
mov qword [rbp - 0x40], r13
mov qword [rbp - 0x38], r14
mov qword [rbp - 0x30], r15
mov r15, rcx
mov r12, rdx
mov qword [rbp - 8], r8
lea rcx, [rbp - 8]
call fcn.100c8f1f0
mov qword [rbp - 0x10], 0
mov qword [rbp - 0x20], 0
mov qword [rbp - 0x28], 0
nop
mov r14b, 0
movabs rdx, 0
lea rcx, [rbp - 0x10]
call fcn.100c8f4e0
movabs rdx, 0
lea rcx, [rbp - 0x20]
call fcn.100c8f4e0
mov edi, 1
lea rcx, [rbp - 0x18]
movabs rdx, 0x8000
call fcn.100c94d00
mov rax, qword [rbp - 8]
test rax, rax
je 0x100cbc511
mov eax, dword [rax - 4]
shr rax, 1
mov esi, eax
mov r13d, esi
mov ebx, 1
cmp r13d, ebx
jl 0x100cbc604
sub ebx, 1
nop
add ebx, 1
mov rdx, qword [rbp - 8]
movsxd rax, ebx
cmp word [rdx + rax*2 - 2], 0x25
jne 0x100cbc5fb
test r14b, r14b
jne 0x100cbc57c
movsxd r9, ebx
movsxd rax, edi
sub r9, rax
movsxd r8, edi
mov rdx, qword [rbp - 8]
lea rcx, [rbp - 0x28]
call fcn.100c8fa90
mov r8, qword [rbp - 0x28]
mov rdx, qword [rbp - 0x20]
lea rcx, [rbp - 0x20]
call fcn.100c8f590
lea eax, [ebx + 1]
mov edi, eax
mov r14b, 1
jmp 0x100cbc5fb
movsxd r9, ebx
movsxd rax, edi
sub r9, rax
movsxd r8, edi
mov rdx, qword [rbp - 8]
lea rcx, [rbp - 0x28]
call fcn.100c8fa90
mov rdx, qword [rbp - 0x28]
lea rcx, [rbp - 0x10]
call fcn.100c8f4e0
lea eax, [ebx + 1]
mov edi, eax
mov r14b, 0
mov rcx, qword [rbp - 0x10]
test rcx, rcx
jne 0x100cbc5bb
lea rcx, [0x100f45460]
mov rdx, qword [rbp - 0x18]
mov r8d, 0x3fff
call sub.kernel32.dll_GetEnvironmentVariableW
mov rdx, qword [rbp - 0x18]
lea rcx, [rbp - 0x28]
call fcn.100c8f470
mov r8, qword [rbp - 0x28]
mov rdx, qword [rbp - 0x20]
lea rcx, [rbp - 0x20]
call fcn.100c8f590
movabs rdx, 0
lea rcx, [rbp - 0x10]
call fcn.100c8f4e0
cmp r13d, ebx
jg 0x100cbc528
test r14b, r14b
je 0x100cbc638
lea r8, str.Incorrect_format_string
lea rcx, [0x100e801c8]
movabs rdx, 1
call fcn.100ce98d0
mov rcx, rax
lea rdx, [0x100cbc609]
mov r8, rbp
call fcn.100c9a350
mov rcx, qword [rbp - 0x18]
call fcn.100c94d60
movsxd rax, esi
movsxd rdx, edi
sub rax, rdx
lea r9, [rax + 1]
movsxd r8, edi
mov rdx, qword [rbp - 8]
lea rcx, [rbp - 0x28]
call fcn.100c8fa90
mov r8, qword [rbp - 0x28]
mov rcx, r12
mov rdx, qword [rbp - 0x20]
call fcn.100c8f590
nop
mov rcx, rbp
call fcn.100cbc430
mov rbx, qword [rbp - 0x60]
mov rdi, qword [rbp - 0x58]
mov rsi, qword [rbp - 0x50]
mov r12, qword [rbp - 0x48]
mov r13, qword [rbp - 0x40]
mov r14, qword [rbp - 0x38]
mov r15, qword [rbp - 0x30]
lea rsp, [rbp]
pop rbp
ret
Function at 0x100ceaec0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
lea rsp, [rsp - 0x28]
test rcx, rcx
jne 0x100ceaed1
lea rcx, [0x100f45460]
call sub.kernel32.dll_GetFileAttributesW
cmp eax, 0xffffffff
je 0x100ceaee7
and eax, 0x10
test eax, eax
sete al
jmp 0x100ceaee9
mov al, 0
and eax, 0xff
nop
lea rsp, [rsp + 0x28]
ret

Function at 0x100ceaf00
Capabilities:
Check if file exists
Get file attributes

Disassembly:
lea rsp, [rsp - 0x28]
test rcx, rcx
jne 0x100ceaf11
lea rcx, [0x100f45460]
call sub.kernel32.dll_GetFileAttributesW
cmp eax, 0xffffffff
je 0x100ceaf28
and eax, 0x10
cmp eax, 0
seta al
jmp 0x100ceaf2a
mov al, 0
and eax, 0xff
nop
lea rsp, [rsp + 0x28]
ret

Function at 0x100ceb210
Capabilities:
Get file attributes

Disassembly:
lea rsp, [rsp - 0x28]
test rcx, rcx
jne 0x100ceb221
lea rcx, [0x100f45460]
call sub.kernel32.dll_GetFileAttributesW
nop
lea rsp, [rsp + 0x28]
ret

Function at 0x100ceb230
Capabilities:
Set file attributes

Disassembly:
push rbx
lea rsp, [rsp - 0x20]
test rcx, rcx
jne 0x100ceb242
lea rcx, [0x100f45460]
call sub.kernel32.dll_SetFileAttributesW
test eax, eax
je 0x100ceb252
mov ebx, 0
jmp 0x100ceb259
call sub.kernel32.dll_GetLastError
mov ebx, eax
mov eax, ebx
nop
lea rsp, [rsp + 0x20]
pop rbx
ret

Function at 0x100ceba50
Capabilities:
Get geographical location

Disassembly:
push rbp
mov rbp, rsp
lea rsp, [rsp - 0x60]
mov qword [rbp - 0x28], rbx
mov qword [rbp - 0x20], rsi
mov qword [rbp - 0x18], 0
nop
mov ebx, 1
sub ebx, 1
nop
nop
add ebx, 1
mov eax, ebx
and eax, 0xffffffff
lea rdx, [0x100f46ec0]
lea rcx, [rdx + rax*8 - 8]
movabs rdx, 0
call fcn.100c8d560
mov eax, ebx
and eax, 0xffffffff
lea rdx, [0x100f46f00]
mov dword [rdx + rax*4 - 4], 0xffffffff
cmp ebx, 7
jl 0x100ceba78
call sub.kernel32.dll_GetThreadLocale
mov esi, eax
lea r8, [rbp - 0x10]
mov ecx, esi
mov r9d, 0xb
mov edx, 0x100b
call sub.kernel32.dll_GetLocaleInfoA
cmp eax, 0
jle 0x100cebb48
mov dword [rsp + 0x20], 1
lea rdx, [rbp - 0x10]
lea rcx, [rbp - 0x18]
mov r9d, 0
movabs r8, 0xa
call fcn.100c8e110
mov rcx, qword [rbp - 0x18]
mov edx, 1
call fcn.100ce1ad0
mov ebx, eax
mov eax, ebx
sub eax, 3
cmp eax, 3
jae 0x100cebb47
lea rcx, [0x100ceb8c0]
mov r8d, ebx
mov edx, esi
mov r9d, 4
call sub.kernel32.dll_EnumCalendarInfoA
lea rcx, [0x100ceb980]
mov r8d, ebx
mov edx, esi
mov r9d, 3
call sub.kernel32.dll_EnumCalendarInfoA
nop
mov rcx, rbp
call fcn.100ceba30
mov rbx, qword [rbp - 0x28]
mov rsi, qword [rbp - 0x20]
lea rsp, [rbp]
pop rbp
ret
Function at 0x100cef6a0
Capabilities:
Get common file path

Disassembly:
push rbp
mov rbp, rsp
lea rsp, [rsp - 0x130]
mov qword [rbp - 0x110], rbx
lea rcx, [rbp - 0x108]
mov edx, 0x104
call sub.kernel32.dll_GetSystemDirectoryA
mov ebx, eax
cmp ebx, 0
jle 0x100cef764
cmp ebx, 0xf6
jge 0x100cef764
movsxd rax, ebx
movabs rdx, 0x104
sub rdx, rax
lea r8, [rdx - 1]
mov eax, ebx
and eax, 0xffffffff
lea rcx, [rbp + rax - 0x108]
lea rdx, [0x100e80158]
call fcn.100ce8be0
lea rcx, [rbp - 0x108]
call sub.kernel32.dll_LoadLibraryA
mov qword [0x100e5e140], rax
cmp qword [0x100e5e140], 0
je 0x100cef764
lea rdx, str.SHGetFolderPathA
mov rcx, qword [0x100e5e140]
call sub.kernel32.dll_GetProcAddress
mov qword [0x100e5e130], rax
lea rax, [0x100e5e130]
test rax, rax
jne 0x100cef764
mov rcx, qword [0x100e5e140]
call sub.kernel32.dll_FreeLibrary
mov qword [0x100e5e140], 0
lea rax, [0x100e5e130]
test rax, rax
jne 0x100cef79f
lea r8, str.Could_not_determine_SHGetFolderPath_Function
lea rcx, [0x100e79630]
movabs rdx, 1
call fcn.100ce98d0
mov rcx, rax
lea rdx, [0x100cef770]
mov r8, rbp
call fcn.100c9a350
mov rbx, qword [rbp - 0x110]
lea rsp, [rbp]
pop rbp
ret
Function at 0x100d11180
Capabilities:
Get common file path

Disassembly:
push rbp
mov rbp, rsp
lea rsp, [rsp - 0x130]
lea rax, [rbp - 0x108]
mov rcx, rax
mov edx, 0x104
call sub.kernel32.dll_GetSystemDirectoryA
mov dword [rbp - 0x110], eax
cmp dword [rbp - 0x110], 0
jle 0x100d1124f
cmp dword [rbp - 0x110], 0xf6
jge 0x100d1124f
movsxd rdx, dword [rbp - 0x110]
movabs rax, 0x104
sub rax, rdx
lea r8, [rax - 1]
mov eax, dword [rbp - 0x110]
lea rcx, [rbp + rax - 0x108]
lea rdx, str._shfolder.dll
call fcn.100ce8be0
lea rcx, [rbp - 0x108]
call sub.kernel32.dll_LoadLibraryA
mov qword [0x100e5f900], rax
cmp qword [0x100e5f900], 0
je 0x100d1124f
lea rdx, str.SHGetFolderPathW
mov rcx, qword [0x100e5f900]
call sub.kernel32.dll_GetProcAddress
mov qword [0x100e5f8f0], rax
lea rax, [0x100e5f8f0]
test rax, rax
jne 0x100d1124f
mov rcx, qword [0x100e5f900]
call sub.kernel32.dll_FreeLibrary
mov qword [0x100e5f900], 0
lea rax, [0x100e5f8f0]
test rax, rax
jne 0x100d1128a
lea r8, str.Could_not_determine_SHGetFolderPathW_Function
lea rcx, [0x100e79630]
movabs rdx, 1
call fcn.100ce98d0
mov rcx, rax
lea rdx, [0x100d1125b]
mov r8, rbp
call fcn.100c9a350
nop
lea rsp, [rbp]
pop rbp
ret

Function at 0x100d34d50
Capabilities:
Hash data with crc32

Disassembly:
mov edx, 0
sub edx, 1
add edx, 1
mov eax, edx
mov ecx, eax
mov r9d, 0
sub r9d, 1
nop
nop
add r9d, 1
mov eax, ecx
and eax, 1
cmp eax, 1
jne 0x100d34d8b
mov eax, ecx
shr eax, 1
xor eax, 0xedb88320
mov ecx, eax
jmp 0x100d34d91
mov eax, ecx
shr eax, 1
mov ecx, eax
cmp r9d, 7
jl 0x100d34d70
mov eax, edx
and eax, 0xffffffff
lea r8, [0x100f477c0]
mov dword [r8 + rax*4], ecx
cmp edx, 0xff
jl 0x100d34d58
ret
Function at 0x100d36c20
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbx
push rdi
push rsi
push r12
push r13
push r14
lea rsp, [rsp - 0x28]
mov rbx, rcx
mov r14d, dword [rbx + 0x34]
nop
mov eax, dword [rbx + 0x48]
mov edx, dword [rbx + 0x8c]
sub eax, edx
mov edx, dword [rbx + 0x84]
sub eax, edx
mov esi, eax
test esi, esi
jne 0x100d36c6b
cmp dword [rbx + 0x84], 0
jne 0x100d36c6b
cmp dword [rbx + 0x8c], 0
jne 0x100d36c6b
mov esi, r14d
jmp 0x100d36d69
cmp esi, 0xffffffff
jne 0x100d36c7b
sub esi, 1
jmp 0x100d36d69
mov ecx, dword [rbx + 0x84]
mov eax, r14d
and eax, 0xffffffff
lea rdx, [rax - 0x106]
lea rax, [rdx + rax]
cmp rcx, rax
jl 0x100d36d69
mov rdx, qword [rbx + 0x40]
mov eax, r14d
and eax, 0xffffffff
lea rcx, [rdx + rax]
mov rdx, qword [rbx + 0x40]
mov r8d, r14d
and r8d, 0xffffffff
call fcn.100c86fe0
sub dword [rbx + 0x88], r14d
sub dword [rbx + 0x84], r14d
mov eax, r14d
sub dword [rbx + 0x74], eax
mov edi, dword [rbx + 0x64]
mov rdx, qword [rbx + 0x58]
mov eax, edi
and eax, 0xffffffff
lea rax, [rdx + rax*2]
mov r12, rax
nop
nop
sub r12, 2
movzx eax, word [r12]
mov r13d, eax
cmp r13d, r14d
jb 0x100d36d10
mov eax, r13d
mov edx, r14d
sub eax, edx
mov word [r12], ax
jmp 0x100d36d17
mov word [r12], 0
sub edi, 1
test edi, edi
jne 0x100d36cf0
mov edi, r14d
mov rdx, qword [rbx + 0x50]
mov eax, edi
and eax, 0xffffffff
lea rax, [rdx + rax*2]
mov r12, rax
nop
nop
sub r12, 2
movzx eax, word [r12]
mov r13d, eax
cmp r13d, r14d
jb 0x100d36d58
mov eax, r13d
mov edx, r14d
sub eax, edx
mov word [r12], ax
jmp 0x100d36d5f
mov word [r12], 0
sub edi, 1
test edi, edi
jne 0x100d36d38
add esi, r14d
mov rax, qword [rbx]
cmp dword [rax + 8], 0
je 0x100d36dff
mov rcx, qword [rbx + 0x40]
mov eax, dword [rbx + 0x84]
mov edx, dword [rbx + 0x8c]
lea rax, [rax + rdx]
lea rdx, [rcx + rax]
mov rcx, qword [rbx]
mov r8d, esi
call fcn.100d367c0
mov edi, eax
add dword [rbx + 0x8c], edi
cmp dword [rbx + 0x8c], 3
jb 0x100d36de6
mov rdx, qword [rbx + 0x40]
mov eax, dword [rbx + 0x84]
movzx eax, byte [rdx + rax]
mov dword [rbx + 0x60], eax
mov rdx, qword [rbx + 0x40]
mov eax, dword [rbx + 0x84]
movzx r8d, byte [rdx + rax + 1]
mov eax, dword [rbx + 0x70]
mov edx, dword [rbx + 0x60]
mov ecx, eax
and ecx, 0xffffffff
shl edx, cl
xor edx, r8d
mov eax, dword [rbx + 0x6c]
and eax, edx
mov dword [rbx + 0x60], eax
cmp dword [rbx + 0x8c], 0x106
jae 0x100d36dff
mov rax, qword [rbx]
cmp dword [rax + 8], 0
jne 0x100d36c38
nop
lea rsp, [rsp + 0x28]
pop r14
pop r13
pop r12
pop rsi
pop rdi
pop rbx
ret

Function at 0x100d58430
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov eax, 0
lea rdx, [rcx + 1]
movzx r8d, byte [rcx]
lea r8d, [r8d + 1]
and r8d, 0xff
lea rcx, [rcx + r8]
jmp 0x100d5846b
mov r8d, eax
shl r8d, 5
mov r9d, eax
sub r8d, r9d
movzx r9d, byte [rdx]
xor r9d, r8d
mov eax, r9d
add rdx, 1
cmp rdx, rcx
jb 0x100d58450
ret
Function at 0x100d642b0
Capabilities:
Check for software breakpoints

Disassembly:
push rbx
push rdi
push rsi
lea rsp, [rsp - 0x20]
mov rbx, rcx
cmp dword [rbx + 0x24], 0xca
jne 0x100d642e8
mov rcx, rbx
call fcn.100d69060
cmp byte [rbx + 0x50], 0
je 0x100d642e1
mov dword [rbx + 0x24], 0xcf
mov dil, 1
jmp 0x100d6439b
mov dword [rbx + 0x24], 0xcb
cmp dword [rbx + 0x24], 0xcb
jne 0x100d64376
mov rax, qword [rbx + 0x208]
cmp byte [rax + 0x20], 0
je 0x100d64368
nop
nop
cmp qword [rbx + 0x10], 0
je 0x100d64318
mov rcx, rbx
mov rax, qword [rbx + 0x10]
call qword [rax]
mov rcx, rbx
mov rax, qword [rbx + 0x208]
call qword [rax]
mov esi, eax
test esi, esi
jne 0x100d6432f
mov dil, 0
jmp 0x100d6439b
cmp esi, 2
je 0x100d64368
cmp qword [rbx + 0x10], 0
je 0x100d64308
cmp esi, 3
je 0x100d64345
cmp esi, 1
jne 0x100d64308
mov rax, qword [rbx + 0x10]
add dword [rax + 8], 1
mov rdx, qword [rbx + 0x10]
mov eax, dword [rdx + 8]
cmp eax, dword [rdx + 0xc]
jl 0x100d64308
mov rdx, qword [rbx + 0x10]
mov eax, dword [rbx + 0x16c]
add dword [rdx + 0xc], eax
jmp 0x100d64308
mov eax, dword [rbx + 0x84]
mov dword [rbx + 0x8c], eax
jmp 0x100d64390
cmp dword [rbx + 0x24], 0xcc
je 0x100d64390
mov r8d, dword [rbx + 0x24]
mov rcx, rbx
mov edx, 0x14
call fcn.100d64780
mov rcx, rbx
call fcn.100d643b0
mov dil, al
movzx eax, dil
nop
lea rsp, [rsp + 0x20]
pop rsi
pop rdi
pop rbx
ret
Function at 0x100d85070
Capabilities:
Hide graphical window

Disassembly:
push rbp
mov rbp, rsp
lea rsp, [rsp - 0x50]
mov qword [rbp - 0x10], rbx
mov qword [rbp - 8], rcx
mov rax, qword [rbp - 8]
cmp qword [rax + 0x50], 0
je 0x100d850d3
mov rax, qword [0x100e5c3b0]
mov rdx, qword [rbp - 8]
mov rax, qword [rax + 0x240]
cmp rax, qword [rdx + 0x50]
jne 0x100d850d3
mov rax, qword [0x100e5c3b0]
cmp byte [rax + 0x1cc], 0
jne 0x100d850d3
mov rcx, qword [0x100e5cbd0]
mov rax, qword [0x100e5cbd0]
mov rax, qword [rax]
call qword [rax + 0xd8]
mov rdx, qword [rbp - 8]
mov qword [rdx + 8], rax
mov rbx, qword [rbp - 8]
mov rcx, qword [0x100e5cbd0]
mov rax, qword [0x100e5cbd0]
mov rax, qword [rax]
call qword [rax + 0xd8]
cmp rax, qword [rbx + 8]
jne 0x100d8521d
mov rax, qword [0x100e5c3b0]
cmp byte [rax + 0x1cc], 0
jne 0x100d8521d
mov rcx, qword [0x100e5cbd0]
mov rax, qword [0x100e5cbd0]
mov rax, qword [rax]
call qword [rax + 0xd8]
mov rcx, rax
call fcn.100dfe840
mov rax, qword [0x100e5c3b0]
cmp qword [rax + 0x240], 0
je 0x100d851d9
mov dword [rsp + 0x30], 0x10
mov dword [rsp + 0x28], 0
mov rax, qword [0x100e5c3b0]
mov rax, qword [rax + 0x240]
mov eax, dword [rax + 0x3a4]
mov dword [rsp + 0x20], eax
mov rax, qword [0x100e5c3b0]
mov rax, qword [rax + 0x240]
mov r9d, dword [rax + 0x398]
mov rax, qword [0x100e5c3b0]
mov rax, qword [rax + 0x240]
mov r8d, dword [rax + 0x1c0]
mov rax, qword [rbp - 8]
mov rcx, qword [rax + 8]
movabs rdx, 0
call sub.user32.dll_SetWindowPos
mov rax, qword [0x100e5c3b0]
mov rcx, qword [rax + 0x240]
call fcn.100db7b40
test al, al
je 0x100d851d9
mov rcx, qword [0x100e5c3b0]
call fcn.100ca7d30
mov rcx, rax
mov edx, 0
call sub.user32.dll_ShowWindow
mov rax, qword [rbp - 8]
mov r9, qword [rax + 0x20]
mov rax, qword [rbp - 8]
mov r8, qword [rax + 0x18]
mov rax, qword [rbp - 8]
mov rcx, qword [rax + 8]
mov edx, 0x112
call sub.user32.dll_DefWindowProcA
mov rdx, qword [rbp - 8]
mov rdx, qword [rdx + 0x48]
mov qword [rdx + 0x18], rax
mov rax, qword [rbp - 8]
mov byte [rax + 0x58], 0
mov rcx, qword [0x100e5c3b0]
call fcn.100cab5f0
jmp 0x100d85282
mov rax, qword [rbp - 8]
cmp qword [rax + 0x50], 0
je 0x100d85282
mov rax, qword [rbp - 8]
mov rdx, qword [0x100e5c3b0]
mov rax, qword [rax + 0x50]
cmp rax, qword [rdx + 0x240]
jne 0x100d85282
mov rax, qword [rbp - 8]
mov r9, qword [rax + 0x20]
mov rax, qword [rbp - 8]
mov r8, qword [rax + 0x18]
mov rax, qword [rbp - 8]
mov rcx, qword [rax + 8]
mov edx, 0x112
call sub.user32.dll_DefWindowProcA
mov rdx, qword [rbp - 8]
mov rdx, qword [rdx + 0x48]
mov qword [rdx + 0x18], rax
mov rax, qword [rbp - 8]
mov byte [rax + 0x58], 0
mov rcx, qword [0x100e5c3b0]
call fcn.100cab5f0
mov rbx, qword [rbp - 0x10]
lea rsp, [rbp]
pop rbp
ret
Function at 0x100d8c410
Capabilities:
Read clipboard data

Disassembly:
push rbp
mov rbp, rsp
lea rsp, [rsp - 0x40]
mov qword [rbp - 0x10], rcx
mov qword [rbp - 8], rdx
mov byte [rbp - 0x18], 0
mov rax, qword [rbp - 0x10]
mov ecx, dword [rax - 0x10]
call sub.user32.dll_GetClipboardData
mov rdx, qword [rbp - 0x10]
mov qword [rdx - 0x30], rax
mov rax, qword [rbp - 0x10]
cmp qword [rax - 0x30], 0
je 0x100d8c4a6
mov rax, qword [rbp - 0x10]
mov rcx, qword [rax - 0x30]
call sub.kernel32.dll_GlobalSize
mov rdx, qword [rbp - 0x10]
mov dword [rdx - 0x40], eax
mov rax, qword [rbp - 0x10]
cmp dword [rax - 0x40], 0
jle 0x100d8c4a6
mov rax, qword [rbp - 0x10]
mov rcx, qword [rax - 0x30]
call sub.kernel32.dll_GlobalLock
mov rdx, qword [rbp - 0x10]
mov qword [rdx - 0x38], rax
nop
mov rax, qword [rbp - 0x10]
mov rdx, qword [rax - 0x38]
mov rax, qword [rbp - 0x10]
mov r8d, dword [rax - 0x40]
mov rcx, qword [rbp - 8]
mov rax, qword [rbp - 8]
mov rax, qword [rax]
call qword [rax + 0x108]
nop
mov rcx, rbp
call fcn.100d8c3e0
mov byte [rbp - 0x18], 1
movzx eax, byte [rbp - 0x18]
nop
lea rsp, [rbp]
pop rbp
ret
Function at 0x100d8ccb0
Capabilities:
Write clipboard data

Disassembly:
push rbp
mov rbp, rsp
lea rsp, [rsp - 0xf0]
mov qword [rbp - 0x50], rbx
mov qword [rbp - 0x18], rcx
mov dword [rbp - 8], edx
mov qword [rbp - 0x10], r8
mov qword [rbp - 0x48], 0
mov qword [rbp - 0x38], 0
mov qword [rbp - 0x30], 0
nop
mov rax, qword [rbp - 0x10]
mov rdx, qword [rbp - 0x10]
mov rdx, qword [rdx]
mov rcx, rax
call qword [rdx + 0xe0]
mov rdx, rax
mov ecx, 2
call sub.kernel32.dll_GlobalAlloc
mov qword [rbp - 0x20], rax
cmp qword [rbp - 0x20], 0
jne 0x100d8ce3d
lea rcx, [rbp - 0x30]
call fcn.100c8d4f0
lea rcx, [rbp - 0x38]
call fcn.100c8d4f0
mov rcx, qword [rbp - 0x10]
mov rax, qword [rbp - 0x10]
mov rax, qword [rax]
call qword [rax + 0xe0]
mov qword [rbp - 0x40], rax
mov rdx, qword [rbp - 0x40]
lea rcx, [rbp - 0x38]
call fcn.100d0b1c0
mov rdx, qword [rbp - 0x38]
lea rcx, [rbp - 0x30]
call fcn.100c8d560
lea rcx, [rbp - 0x38]
call fcn.100c8d4f0
lea rcx, [rbp - 0x48]
call fcn.100c8d4f0
mov rdx, qword [rbp - 0x20]
lea rcx, [rbp - 0x48]
call fcn.100d0b1f0
mov rdx, qword [rbp - 0x48]
lea rcx, [rbp - 0x38]
call fcn.100c8d560
call fcn.100d136e0
mov rbx, rax
mov qword [rsp + 0x90], 0
mov qword [rsp + 0x88], 0
mov qword [rsp + 0x80], 0
mov qword [rsp + 0x78], 0
mov qword [rsp + 0x70], 0
mov qword [rsp + 0x68], 0
mov qword [rsp + 0x60], 0
mov qword [rsp + 0x58], 0
mov qword [rsp + 0x50], 0
mov qword [rsp + 0x48], 0
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
mov rax, qword [rbp - 0x30]
mov qword [rsp + 0x20], rax
lea r9, str._DataSize
mov r8, qword [rbp - 0x38]
lea rdx, str.TWin32WidgetSet.ClipboardGetOwnerShip_DataHandle
mov rcx, rbx
call fcn.100d14f50
mov rax, qword [rbp - 0x18]
mov byte [rax - 0x28], 0
jmp 0x100d8ce8a
mov rcx, qword [rbp - 0x20]
call sub.kernel32.dll_GlobalLock
mov qword [rbp - 0x28], rax
nop
mov rcx, qword [rbp - 0x10]
mov rax, qword [rbp - 0x10]
mov rax, qword [rax]
call qword [rax + 0xe0]
mov r8, rax
mov rdx, qword [rbp - 0x28]
mov rcx, qword [rbp - 0x10]
mov rax, qword [rbp - 0x10]
mov rax, qword [rax]
call qword [rax + 0x100]
nop
mov rcx, rbp
call fcn.100d8cc60
mov rdx, qword [rbp - 0x20]
mov ecx, dword [rbp - 8]
call sub.user32.dll_SetClipboardData
nop
mov rcx, rbp
call fcn.100d8cc80
mov rbx, qword [rbp - 0x50]
lea rsp, [rbp]
pop rbp
ret