joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140131280
Capabilities:
Log keystrokes via polling

Disassembly:
push rsi
push rbx
sub rsp, 0x28
mov eax, dword [0x140601e88]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
mov ecx, dword [rax + 8]
lea edx, [rcx + 1]
mov dword [rax + 8], edx
test ecx, ecx
je 0x1401312ba
cmp byte [0x14056ad2c], 0
je 0x1401312d8
jmp 0x14013133e
lea rcx, [0x140569688]
call fcn.1400f4fe0
mov rcx, rax
call qword [sym.imp.KERNEL32.DLL_EnterCriticalSection]
cmp byte [0x14056ad2c], 0
jne 0x14013133e
mov bl, byte [0x140569849]
mov byte [0x140569849], 0
mov ecx, 1
call qword [sym.imp.USER32.dll_GetKeyState]
mov byte [0x140569849], bl
test ax, ax
js 0x14013133e
cmp byte [0x140569bb4], 0
jne 0x14013133e
mov byte [0x140569849], 0
mov ecx, 2
call qword [sym.imp.USER32.dll_GetKeyState]
mov byte [0x140569849], bl
test ax, ax
js 0x14013133e
mov byte [0x140569849], 0
mov ecx, 4
call qword [sym.imp.USER32.dll_GetKeyState]
mov byte [0x140569849], bl
test ax, ax
jns 0x14013134a
call fcn.1401310f0
mov byte [0x140569b89], 1
mov eax, dword [0x140601e88]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
add dword [rax + 8], 0xffffffff
jne 0x14013137b
lea rcx, [0x140569688]
call fcn.1400f4fe0
mov rcx, rax
call qword [sym.imp.KERNEL32.DLL_LeaveCriticalSection]
nop
add rsp, 0x28
pop rbx
pop rsi
ret
Function at 0x140147150
Capabilities:
Access peb ldr_data

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x78
mov ebx, r9d
mov ebp, r8d
mov rsi, rdx
mov rdi, rcx
mov r15d, dword [rsp + 0xd8]
mov r14d, dword [rsp + 0xd0]
mov eax, dword [0x140601e88]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
mov ecx, dword [rax + 8]
lea edx, [rcx + 1]
mov dword [rax + 8], edx
test ecx, ecx
jne 0x1401471b3
lea rcx, [0x140569688]
call fcn.1400f4fe0
mov rcx, rax
call qword [sym.imp.KERNEL32.DLL_EnterCriticalSection]
mov rcx, qword [rsi + 0x90]
mov qword [rdi + 0x18], rcx
mov rax, r15
shl rax, 0x20
mov edx, r14d
or rdx, rax
mov qword [rdi + 8], rdx
mov dword [rdi], ebp
mov dword [rdi + 4], ebx
call qword [sym.imp.GDI32.dll_CreateCompatibleDC]
mov qword [rdi + 0x20], rax
mov qword [rsp + 0x58], 0
mov ecx, 0x428
call fcn.140308730
mov rbx, rax
mov qword [rsp + 0x58], rax
xorps xmm0, xmm0
movaps xmmword [rsp + 0x60], xmm0
lea rdx, [rsp + 0x60]
mov r8d, 0x28
mov rcx, rax
call fcn.140252a90
mov dword [rbx], 0x28
mov dword [rbx + 0xc], 0x200001
mov qword [rbx + 0x10], 0
mov qword [rbx + 0x20], 0
mov dword [rbx + 4], r14d
mov eax, r15d
neg eax
mov dword [rbx + 8], eax
mov rcx, qword [rdi + 0x18]
lea r9, [rdi + 0x10]
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov rdx, rbx
xor r8d, r8d
call qword [sym.imp.GDI32.dll_CreateDIBSection]
mov qword [rdi + 0x28], rax
mov rcx, qword [rdi + 0x20]
mov rdx, rax
call qword [sym.imp.GDI32.dll_SelectObject]
mov qword [rdi + 0x30], rax
mov rcx, qword [rdi + 0x20]
mov rax, qword [rdi + 0x18]
mov edx, dword [rdi]
mov ebp, dword [rdi + 4]
mov dword [rsp + 0x38], ebp
mov dword [rsp + 0x30], edx
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], r15d
mov dword [rsp + 0x40], 0xcc0020
xor edx, edx
xor r8d, r8d
mov r9d, r14d
call qword [sym.imp.GDI32.dll_BitBlt]
mov rcx, rbx
call fcn.140309590
mov eax, dword [0x140601e88]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
add dword [rax + 8], 0xffffffff
jne 0x1401472e5
lea rcx, [0x140569688]
call fcn.1400f4fe0
mov rcx, rax
call qword [sym.imp.KERNEL32.DLL_LeaveCriticalSection]
nop
add rsp, 0x78
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
Function at 0x14014f090
Capabilities:
Open clipboard

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x48
movaps xmmword [rsp + 0x30], xmm6
mov eax, dword [0x140601e88]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
mov ecx, dword [rax + 8]
lea edx, [rcx + 1]
mov dword [rax + 8], edx
test ecx, ecx
jne 0x14014f0d9
lea rcx, [0x140569688]
call fcn.1400f4fe0
mov rcx, rax
call qword [sym.imp.KERNEL32.DLL_EnterCriticalSection]
mov al, byte [0x14056ac18]
test al, al
je 0x14014f21a
cmp dword [0x14056ac10], 0
je 0x14014f1da
mov rcx, qword [0x14056aac0]
call qword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x14014f1da
xor esi, esi
lea r14, [0x14056ac18]
lea rdi, [0x14056abe0]
xorps xmm6, xmm6
lea rbx, [0x140151640]
mov al, byte [0x14056ac18]
test al, al
je 0x14014f169
nop dword [rax]
movsxd rax, dword [0x14056ac10]
cmp rsi, rax
jge 0x14014f1d4
movzx eax, byte [0x14056ac18]
test al, al
je 0x14014f19d
mov rax, qword [0x14056abf8]
mov ecx, dword [rax + rsi*4]
call fcn.14014dd90
add rsi, 1
movzx eax, byte [0x14056ac18]
test al, al
jne 0x14014f130
mov rcx, r14
call fcn.14035f9c4
test eax, eax
je 0x14014f130
mov rcx, rdi
call fcn.140285dc0
movups xmmword [0x14056ac08], xmm6
movups xmmword [0x14056abf8], xmm6
mov rcx, rbx
call fcn.140001440
mov rcx, r14
call fcn.14035fa9b
jmp 0x14014f130
mov rcx, r14
call fcn.14035f9c4
test eax, eax
je 0x14014f14b
mov rcx, rdi
call fcn.140285dc0
movups xmmword [0x14056ac08], xmm6
movups xmmword [0x14056abf8], xmm6
mov rcx, rbx
call fcn.140001440
mov rcx, r14
call fcn.14035fa9b
jmp 0x14014f14b
call qword [sym.imp.USER32.dll_CloseClipboard]
mov eax, dword [0x140601e88]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
add dword [rax + 8], 0xffffffff
jne 0x14014f20b
lea rcx, [0x140569688]
call fcn.1400f4fe0
mov rcx, rax
call qword [sym.imp.KERNEL32.DLL_LeaveCriticalSection]
movaps xmm6, xmmword [rsp + 0x30]
add rsp, 0x48
pop rbx
pop rdi
pop rsi
pop r14
ret
lea rcx, [0x14056ac18]
call fcn.14035f9c4
test eax, eax
je 0x14014f0e7
lea rcx, [0x14056abe0]
call fcn.140285dc0
xorps xmm0, xmm0
movups xmmword [0x14056ac08], xmm0
movups xmmword [0x14056abf8], xmm0
lea rcx, [0x140151640]
call fcn.140001440
lea rcx, [0x14056ac18]
call fcn.14035fa9b
jmp 0x14014f0e7
Function at 0x14014f830
Capabilities:
Hide graphical window

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x98
movaps xmmword [rsp + 0x80], xmm6
mov r15d, r9d
mov ebx, r8d
mov r14, rdx
mov rsi, rcx
mov eax, dword [0x140601e88]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
mov ecx, dword [rax + 8]
lea edx, [rcx + 1]
mov dword [rax + 8], edx
test ecx, ecx
jne 0x14014f88e
lea rcx, [0x140569688]
call fcn.1400f4fe0
mov rcx, rax
call qword [sym.imp.KERNEL32.DLL_EnterCriticalSection]
movq xmm0, qword [rsi + 0x28]
punpcklwd xmm0, xmm0
psrad xmm0, 0x10
movdqa xmmword [rsp + 0x70], xmm0
lea rcx, [rsp + 0x70]
mov edx, ebx
xor r8d, r8d
mov r9d, r15d
call qword [sym.imp.USER32.dll_AdjustWindowRectEx]
or byte [rsi + 0x5a], 0x20
mov ecx, 0xa8
call fcn.14030dfa0
mov rdi, rax
xorps xmm6, xmm6
movups xmmword [rax + 0x10], xmm6
lea rcx, [rax + 0x28]
call fcn.140285dc0
lea rbp, [rdi + 0x20]
movups xmmword [rdi + 0x50], xmm6
movups xmmword [rdi + 0x40], xmm6
lea rcx, [rdi + 0x68]
call fcn.140285dc0
pxor xmm0, xmm0
movdqu xmmword [rdi + 0x90], xmm0
movdqu xmmword [rdi + 0x80], xmm0
mov qword [rdi + 0xa0], 0
mov qword [rsi + 0x30], rdi
or byte [rsi + 0x5b], 0x40
mov al, byte [rsp + 0xf0]
and ebx, 0xefffffff
lea rcx, str.UPP_CLASS_SB_W
lea rdx, str.UPP_CLASS_W
test al, al
cmovne rdx, rcx
mov rax, qword [0x14056aa40]
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x40], r14
mov qword [rsp + 0x48], 0
mov dword [rsp + 0x38], 0
mov dword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
lea r8, [0x1403c5280]
mov ecx, r15d
mov r9d, ebx
call qword [sym.imp.USER32.dll_CreateWindowExA]
mov qword [rdi], rax
and byte [rsi + 0x5a], 0xef
mov rcx, rsi
call fcn.14014f6a0
mov rcx, qword [rdi]
mov edx, dword [rsp + 0x70]
mov r8d, dword [rsp + 0x74]
mov r9d, dword [rsp + 0x78]
sub r9d, edx
mov eax, dword [rsp + 0x7c]
sub eax, r8d
mov dword [rsp + 0x20], eax
mov dword [rsp + 0x28], 0
call qword [sym.imp.USER32.dll_MoveWindow]
xor edx, edx
test byte [rsi + 0x59], 8
mov rcx, qword [rdi]
cmovne edx, dword [rsp + 0xf8]
call qword [sym.imp.USER32.dll_ShowWindow]
mov rcx, rsi
mov edx, 0x10
call fcn.14011bda0
mov r14, qword [rdi]
mov ecx, 0x48
call fcn.14030dfa0
mov rbx, rax
lea rax, [0x1403c6b50]
mov qword [rbx], rax
lea rbp, [rbx + 0x18]
mov qword [rbx + 0x18], 0
mov rcx, rbx
add rcx, 0x20
call fcn.140285dc0
pxor xmm0, xmm0
movdqu xmmword [rbx + 0x38], xmm0
mov dword [rbx + 8], 1
mov qword [rbx + 0x10], 0
lea rdx, [rsi + 8]
mov rcx, rbp
call fcn.1402bc100
mov qword [rdi + 8], rbx
mov rcx, r14
mov rdx, rbx
call qword [sym.imp.ole32.dll_RegisterDragDrop]
mov rcx, qword [rdi]
xor edx, edx
xor r8d, r8d
call sub.IMM32.dll_ImmAssociateContextEx
mov rax, qword [rsi]
mov rcx, rsi
call qword [rax + 0x88]
mov rcx, rsi
mov edx, 2
call fcn.140127790
mov eax, dword [0x140601e88]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
add dword [rax + 8], 0xffffffff
jne 0x14014faa2
lea rcx, [0x140569688]
call fcn.1400f4fe0
mov rcx, rax
call qword [sym.imp.KERNEL32.DLL_LeaveCriticalSection]
movaps xmm6, xmmword [rsp + 0x80]
add rsp, 0x98
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
Function at 0x140150610
Capabilities:
Create thread

Disassembly:
push rsi
push rdi
sub rsp, 0x48
mov esi, ecx
mov eax, dword [0x140601e88]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
mov ecx, dword [rax + 8]
lea edi, [rcx + 1]
mov dword [rax + 8], edi
test ecx, ecx
je 0x140150652
test edi, edi
jne 0x140150684
cmp qword [0x14056aa48], 0
jne 0x1401506fc
jmp 0x1401506c0
lea rcx, [0x140569688]
call fcn.1400f4fe0
mov rcx, rax
call qword [sym.imp.KERNEL32.DLL_EnterCriticalSection]
mov eax, dword [0x140601e88]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
mov edi, dword [rax + 8]
test edi, edi
je 0x140150642
lea rcx, [0x140569688]
call fcn.1400f4fe0
mov rcx, rax
call qword [sym.imp.KERNEL32.DLL_LeaveCriticalSection]
mov eax, dword [0x140601e88]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
mov dword [rax + 8], 0
cmp qword [0x14056aa48], 0
jne 0x1401506fc
lea rax, [rsp + 0x44]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0
lea r8, [0x14014dac0]
mov edx, 0x100000
xor ecx, ecx
xor r9d, r9d
call qword [sym.imp.KERNEL32.DLL_CreateThread]
mov qword [0x14056aa48], rax
lea rcx, [0x14056aa60]
call fcn.1402e4b30
mov rax, qword [0x14056aa60]
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x20], 0x4ff
lea rdx, [rsp + 0x38]
mov ecx, 1
xor r8d, r8d
mov r9d, esi
call qword [sym.imp.USER32.dll_MsgWaitForMultipleObjects]
mov eax, dword [0x140601e88]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
mov eax, dword [rax + 8]
test edi, edi
jle 0x140150790
test eax, eax
jne 0x140150775
lea rcx, [0x140569688]
call fcn.1400f4fe0
mov rcx, rax
call qword [sym.imp.KERNEL32.DLL_EnterCriticalSection]
mov eax, dword [0x140601e88]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
mov eax, dword [rax + 8]
add eax, edi
mov ecx, dword [0x140601e88]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
mov dword [rcx + 8], eax
mov ecx, dword [0x140601e88]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
add eax, 0xffffffff
mov dword [rcx + 8], eax
jne 0x1401507c3
lea rcx, [0x140569688]
call fcn.1400f4fe0
mov rcx, rax
call qword [sym.imp.KERNEL32.DLL_LeaveCriticalSection]
nop
add rsp, 0x48
pop rdi
pop rsi
ret
Function at 0x140152510
Capabilities:
Open clipboard

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
mov eax, dword [0x140601e88]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
mov ecx, dword [rax + 8]
lea edx, [rcx + 1]
mov dword [rax + 8], edx
test ecx, ecx
jne 0x140152554
lea rcx, [0x140569688]
call fcn.1400f4fe0
mov rcx, rax
call qword [sym.imp.KERNEL32.DLL_EnterCriticalSection]
mov al, byte [0x14056ac18]
test al, al
je 0x140152671
mov rcx, qword [0x14056abf8]
test rcx, rcx
je 0x140152573
call fcn.140309590
xorps xmm0, xmm0
movups xmmword [0x14056abf8], xmm0
lea rcx, [0x14056abe0]
call fcn.140286220
lea rcx, [0x14056ac08]
call fcn.1400f0c80
xorps xmm0, xmm0
movups xmmword [0x14056ac08], xmm0
lea rcx, str._ClearClipboard
call fcn.140151de0
xor edi, edi
mov bl, 1
mov r14, qword [sym.imp.USER32.dll_OpenClipboard]
mov rsi, qword [sym.imp.KERNEL32.DLL_Sleep]
nop dword [rax]
mov rcx, qword [0x14056aac0]
call r14
test eax, eax
jne 0x1401525f8
mov ecx, 0xa
call rsi
cmp edi, 0xc7
lea eax, [rdi + 1]
setb bl
mov edi, eax
cmp eax, 0xc8
jne 0x1401525c0
lea rcx, str.ClipboardOpen_has_failed_
call fcn.140151f30
jmp 0x140152604
lea rcx, str.______ClipboardOpen_OK
call fcn.140151de0
test bl, 1
je 0x140152635
call qword [sym.imp.USER32.dll_EmptyClipboard]
test eax, eax
jne 0x14015261f
lea rcx, str.EmptyClipboard_ERROR
call fcn.140151f30
call qword [sym.imp.USER32.dll_CloseClipboard]
test eax, eax
jne 0x140152635
lea rcx, str.CloseClipboard_ERROR
call fcn.140151f30
mov eax, dword [0x140601e88]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
add dword [rax + 8], 0xffffffff
jne 0x140152666
lea rcx, [0x140569688]
call fcn.1400f4fe0
mov rcx, rax
call qword [sym.imp.KERNEL32.DLL_LeaveCriticalSection]
nop
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret
lea rcx, [0x14056ac18]
call fcn.14035f9c4
test eax, eax
je 0x140152562
lea rcx, [0x14056abe0]
call fcn.140285dc0
xorps xmm0, xmm0
movups xmmword [0x14056ac08], xmm0
movups xmmword [0x14056abf8], xmm0
lea rcx, [0x140151640]
call fcn.140001440
lea rcx, [0x14056ac18]
call fcn.14035fa9b
jmp 0x140152562
Function at 0x1401526f0
Capabilities:
Write clipboard data

Disassembly:
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x30
mov esi, r8d
mov rbx, rdx
mov r14d, ecx
mov eax, dword [0x140601e88]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
mov ecx, dword [rax + 8]
lea edx, [rcx + 1]
mov dword [rax + 8], edx
test ecx, ecx
jne 0x14015273e
lea rcx, [0x140569688]
call fcn.1400f4fe0
mov rcx, rax
call qword [sym.imp.KERNEL32.DLL_EnterCriticalSection]
lea rcx, str._SetClipboardRaw
call fcn.140151de0
test rbx, rbx
je 0x14015279c
lea eax, [rsi + 2]
movsxd rdx, eax
mov ecx, 0x2002
call qword [sym.imp.KERNEL32.DLL_GlobalAlloc]
mov rdi, rax
test rax, rax
je 0x1401527c9
mov rcx, rdi
call qword [sym.imp.KERNEL32.DLL_GlobalLock]
mov rbp, rax
test rax, rax
je 0x1401527d7
movsxd rsi, esi
mov rcx, rbp
mov rdx, rbx
mov r8, rsi
call sub.msvcrt.dll_memcpy
mov word [rbp + rsi], 0
mov rcx, rdi
call qword [sym.imp.KERNEL32.DLL_GlobalUnlock]
jmp 0x14015279e
xor edi, edi
mov ecx, r14d
mov rdx, rdi
call qword [sym.imp.USER32.dll_SetClipboardData]
cmp rax, rdi
je 0x1401527ec
lea rcx, str.SetCliboardData
mov edx, r14d
call fcn.140152140
mov rcx, rdi
call qword [sym.imp.KERNEL32.DLL_GlobalFree]
jmp 0x1401527ec
lea rcx, str.GlobalAlloc_ERROR
call fcn.140151f30
jmp 0x1401527ec
lea rcx, str.GlobalLock_ERROR
call fcn.140151f30
mov rcx, rdi
call qword [sym.imp.KERNEL32.DLL_GlobalFree]
mov eax, dword [0x140601e88]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
add dword [rax + 8], 0xffffffff
jne 0x14015281d
lea rcx, [0x140569688]
call fcn.1400f4fe0
mov rcx, rax
call qword [sym.imp.KERNEL32.DLL_LeaveCriticalSection]
nop
add rsp, 0x30
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
ret

Function at 0x140152850
Capabilities:
Open clipboard

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x30
mov r15d, r8d
mov r12, rdx
mov r14d, ecx
mov eax, dword [0x140601e88]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
mov ecx, dword [rax + 8]
lea edx, [rcx + 1]
mov dword [rax + 8], edx
test ecx, ecx
jne 0x1401528a2
lea rcx, [0x140569688]
call fcn.1400f4fe0
mov rcx, rax
call qword [sym.imp.KERNEL32.DLL_EnterCriticalSection]
lea rcx, str._AppendClipboard
call fcn.140151de0
xor edi, edi
mov bl, 1
mov rbp, qword [sym.imp.USER32.dll_OpenClipboard]
mov rsi, qword [sym.imp.KERNEL32.DLL_Sleep]
mov rcx, qword [0x14056aac0]
call rbp
test eax, eax
jne 0x1401528f7
mov ecx, 0xa
call rsi
cmp edi, 0xc7
lea eax, [rdi + 1]
setb bl
mov edi, eax
cmp eax, 0xc8
jne 0x1401528c0
lea rcx, str.ClipboardOpen_has_failed_
call fcn.140151f30
jmp 0x140152903
lea rcx, str.______ClipboardOpen_OK
call fcn.140151de0
test bl, 1
je 0x14015292f
mov ecx, r14d
mov rdx, r12
mov r8d, r15d
call fcn.1401526f0
call qword [sym.imp.USER32.dll_CloseClipboard]
test eax, eax
jne 0x14015292f
lea rcx, [0x1403c6a44]
mov edx, r14d
call fcn.140152140
mov eax, dword [0x140601e88]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
add dword [rax + 8], 0xffffffff
jne 0x140152960
lea rcx, [0x140569688]
call fcn.1400f4fe0
mov rcx, rax
call qword [sym.imp.KERNEL32.DLL_LeaveCriticalSection]
nop
add rsp, 0x30
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
Function at 0x140152bd0
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x48
mov r15, rdx
mov r14, rcx
mov eax, dword [0x140601e88]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
mov ecx, dword [rax + 8]
lea edx, [rcx + 1]
mov dword [rax + 8], edx
test ecx, ecx
jne 0x140152c1e
lea rcx, [0x140569688]
call fcn.1400f4fe0
mov rcx, rax
call qword [sym.imp.KERNEL32.DLL_EnterCriticalSection]
xor edi, edi
mov bl, 1
mov r12, qword [sym.imp.USER32.dll_OpenClipboard]
mov rsi, qword [sym.imp.KERNEL32.DLL_Sleep]
mov rcx, qword [0x14056aac0]
call r12
test eax, eax
jne 0x140152c68
mov ecx, 0xa
call rsi
cmp edi, 0xc7
lea eax, [rdi + 1]
setb bl
mov edi, eax
cmp eax, 0xc8
jne 0x140152c30
lea rcx, str.ClipboardOpen_has_failed_
call fcn.140151f30
jmp 0x140152c74
lea rcx, str.______ClipboardOpen_OK
call fcn.140151de0
test bl, 1
je 0x140152d10
mov rcx, r15
call fcn.140151690
mov ecx, eax
call qword [sym.imp.USER32.dll_GetClipboardData]
mov rdi, rax
test rax, rax
je 0x140152cea
mov rcx, rdi
call qword [sym.imp.KERNEL32.DLL_GlobalLock]
mov rbx, rax
mov rcx, rdi
call qword [sym.imp.KERNEL32.DLL_GlobalSize]
test eax, eax
js 0x140152cfe
xorps xmm0, xmm0
movaps xmmword [rsp + 0x30], xmm0
cmp eax, 0xe
ja 0x140152d59
mov byte [rsp + 0x3f], al
mov ecx, eax
cmp eax, 4
ja 0x140152d6b
cmp eax, 1
ja 0x140152d80
test eax, eax
je 0x140152da6
mov al, byte [rbx]
mov byte [rsp + 0x30], al
jmp 0x140152da6
lea rcx, str.GetClipboardData_failed
call fcn.140151f30
call qword [sym.imp.USER32.dll_CloseClipboard]
jmp 0x140152d10
lea rcx, str.ReadCliboard_length___0
call fcn.140151f30
call qword [sym.imp.USER32.dll_CloseClipboard]
xorps xmm0, xmm0
movups xmmword [r14], xmm0
mov eax, dword [0x140601e88]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
add dword [rax + 8], 0xffffffff
jne 0x140152d48
lea rcx, [0x140569688]
call fcn.1400f4fe0
mov rcx, rax
call qword [sym.imp.KERNEL32.DLL_LeaveCriticalSection]
mov rax, r14
add rsp, 0x48
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
lea rcx, [rsp + 0x30]
mov rdx, rbx
mov r8d, eax
call fcn.14030b0a0
jmp 0x140152da6
cmp eax, 8
ja 0x140152d94
mov eax, dword [rbx]
mov dword [rsp + 0x30], eax
mov eax, dword [rbx + rcx - 4]
mov dword [rsp + rcx + 0x2c], eax
jmp 0x140152da6
movzx eax, word [rbx]
mov word [rsp + 0x30], ax
movzx eax, word [rbx + rcx - 2]
mov word [rsp + rcx + 0x2e], ax
jmp 0x140152da6
mov rax, qword [rbx]
mov qword [rsp + 0x30], rax
mov rax, qword [rbx + rcx - 8]
mov qword [rsp + rcx + 0x28], rax
mov rcx, rdi
call qword [sym.imp.KERNEL32.DLL_GlobalUnlock]
call qword [sym.imp.USER32.dll_CloseClipboard]
movaps xmm0, xmmword [rsp + 0x30]
jmp 0x140152d13
Function at 0x14018b390
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x58
mov r15d, dword [rsp + 0xc0]
mov dword [rsp + 0x40], r8d
mov dword [rsp + 0x3c], r9d
test r15d, r15d
jle 0x14018b56e
mov ebx, edx
mov r13, rcx
mov esi, dword [rsp + 0xe0]
mov ebp, dword [rsp + 0xd8]
mov ecx, dword [rsp + 0xc8]
test dl, dl
je 0x14018b40b
lea eax, [r15 + r8]
mov r14, rcx
add ecx, r9d
mov dword [rsp + 0x48], r8d
mov dword [rsp + 0x4c], r9d
mov dword [rsp + 0x50], eax
mov dword [rsp + 0x54], ecx
mov rax, qword [r13]
lea rdx, [rsp + 0x48]
mov rcx, r13
call qword [rax + 0x38]
lea rdi, [rsp + 0x40]
jmp 0x14018b43c
mov r14, rcx
lea eax, [rcx + r8]
lea ecx, [r15 + r9]
mov dword [rsp + 0x48], r8d
mov dword [rsp + 0x4c], r9d
mov dword [rsp + 0x50], eax
mov dword [rsp + 0x54], ecx
mov rax, qword [r13]
lea rdx, [rsp + 0x48]
mov rcx, r13
call qword [rax + 0x38]
lea rdi, [rsp + 0x3c]
mov ecx, ebp
call fcn.1402a50b0
xor ecx, ecx
test al, al
mov eax, 0xffffff
cmove eax, ecx
sub dword [rdi], esi
mov ebp, dword [rsp + 0x40]
mov edi, dword [rsp + 0x3c]
add r15d, esi
jle 0x14018b55c
mov ecx, eax
mov rdx, qword [rsp + 0xd0]
test bl, bl
mov dword [rsp + 0x44], eax
je 0x14018b4ed
xor r12d, r12d
nop word [rax + rax]
movzx r12d, r12b
mov eax, r12d
and eax, 1
mov ebx, dword [rdx + rax*4]
mov esi, dword [rdx + 8]
mov rax, qword [r13]
mov ecx, dword [rsp + 0xd8]
mov dword [rsp + 0x28], ecx
mov dword [rsp + 0x20], r14d
mov rcx, r13
mov edx, ebp
mov r8d, edi
mov r9d, ebx
call qword [rax + 0x68]
add ebp, ebx
mov rax, qword [r13]
mov ecx, dword [rsp + 0x44]
mov dword [rsp + 0x28], ecx
mov dword [rsp + 0x20], r14d
mov rcx, r13
mov edx, ebp
mov r8d, edi
mov r9d, esi
call qword [rax + 0x68]
mov rdx, qword [rsp + 0xd0]
add ebp, esi
add ebx, esi
sub r15d, ebx
xor r12b, 1
test r15d, r15d
jg 0x14018b480
jmp 0x14018b55c
xor esi, esi
nop
movzx esi, sil
mov eax, esi
and eax, 1
mov ebx, dword [rdx + rax*4]
mov r12d, dword [rdx + 8]
mov rax, qword [r13]
mov ecx, dword [rsp + 0xd8]
mov dword [rsp + 0x28], ecx
mov dword [rsp + 0x20], ebx
mov rcx, r13
mov edx, ebp
mov r8d, edi
mov r9d, r14d
call qword [rax + 0x68]
add edi, ebx
mov rax, qword [r13]
mov ecx, dword [rsp + 0x44]
mov dword [rsp + 0x28], ecx
mov dword [rsp + 0x20], r12d
mov rcx, r13
mov edx, ebp
mov r8d, edi
mov r9d, r14d
call qword [rax + 0x68]
mov rdx, qword [rsp + 0xd0]
add edi, r12d
add ebx, r12d
sub r15d, ebx
xor sil, 1
test r15d, r15d
jg 0x14018b4f0
mov dword [rsp + 0x40], ebp
mov dword [rsp + 0x3c], edi
mov rax, qword [r13]
mov rcx, r13
call qword [rax + 0x28]
nop
add rsp, 0x58
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x140228a50
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x60
movaps xmmword [rsp + 0x50], xmm9
movaps xmmword [rsp + 0x40], xmm8
movaps xmmword [rsp + 0x30], xmm7
movaps xmmword [rsp + 0x20], xmm6
mov r15, rdx
mov r12d, dword [rdx + 0x10]
lea r14, [rcx + 8]
cmp dword [rcx + 0x10], r12d
je 0x140228ab4
mov rsi, rcx
jg 0x140228ab0
cmp dword [rsi + 0x14], r12d
jge 0x140228ab0
mov rdi, qword [r14]
mov rcx, r14
mov edx, r12d
call fcn.1400f7f80
test al, al
je 0x140228ab0
test rdi, rdi
je 0x140228ab0
mov rcx, rdi
call fcn.140309590
mov dword [rsi + 0x10], r12d
test r12d, r12d
jle 0x140228ba1
xor r13d, r13d
movaps xmm8, xmmword [0x1403cdb90]
xorps xmm7, xmm7
movaps xmm9, xmmword [0x1403cdba0]
movaps xmm6, xmmword [0x1403cdbb0]
jmp 0x140228af4
mov rax, qword [r14]
mov qword [rax + r13*8], rbx
add r13, 1
cmp r12, r13
je 0x140228ba1
mov ecx, 0xa8
call fcn.14030dfa0
mov rbx, rax
mov rax, qword [r15 + 8]
mov rsi, qword [rax + r13*8]
movups xmmword [rbx + 0x14], xmm8
movups xmmword [rbx + 4], xmm7
movups xmmword [rbx + 0x24], xmm9
mov word [rbx + 0x34], 0
movups xmmword [rbx + 0x48], xmm7
movups xmmword [rbx + 0x58], xmm7
movups xmmword [rbx + 0x68], xmm7
movups xmmword [rbx + 0x78], xmm7
mov dword [rbx + 0xa0], 0
mov qword [rbx + 0x98], 0xffffffffffffffff
movups xmmword [rbx + 0x88], xmm6
movups xmm0, xmmword [rsi + 4]
movups xmm1, xmmword [rsi + 0x14]
movups xmm2, xmmword [rsi + 0x24]
movups xmmword [rbx + 0x24], xmm2
movups xmmword [rbx + 0x14], xmm1
movups xmmword [rbx + 4], xmm0
movzx eax, word [rsi + 0x34]
mov word [rbx + 0x34], ax
mov eax, dword [rsi + 0x3c]
mov dword [rbx + 0x3c], eax
mov eax, dword [rsi + 0x38]
mov dword [rbx + 0x38], eax
cmp rsi, rbx
je 0x140228ae0
mov rdi, rbx
add rdi, 0x40
add rsi, 0x40
mov rcx, rdi
call fcn.1400f0330
mov rcx, rdi
mov rdx, rsi
call fcn.1401eee00
jmp 0x140228ae0
movaps xmm6, xmmword [rsp + 0x20]
movaps xmm7, xmmword [rsp + 0x30]
movaps xmm8, xmmword [rsp + 0x40]
movaps xmm9, xmmword [rsp + 0x50]
add rsp, 0x60
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret