joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14010d7c0
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0xc0
mov rsi, rcx
mov byte [rsp + 0x20], 0
mov edi, 0x40
lea rdx, str.mimalloc_
mov r8d, edi
lea rcx, [rsp + 0x20]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy]
mov rdx, qword [rsi + 0x10]
lea rcx, [rsp + 0x20]
mov r8d, edi
mov byte [rsp + 0x60], 0
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncat]
lea r8d, [rdi + 1]
mov byte [rsp + 0x60], 0
lea rdx, [rsp + 0x70]
mov byte [rsp + 0x70], 0
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
mov eax, eax
dec rax
cmp rax, 0x3f
ja 0x14010d93f
mov qword [rsp + 0xd8], rbx
lea rax, [rsp + 0x70]
mov rbx, 0xffffffffffffffff
inc rbx
cmp byte [rax + rbx], 0
jne 0x14010d847
cmp rbx, 0x41
cmovae rbx, rdi
xor edi, edi
test rbx, rbx
je 0x14010d877
nop
movsx ecx, byte [rsp + rdi + 0x70]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_toupper]
mov byte [rsp + rdi + 0x20], al
inc rdi
cmp rdi, rbx
jb 0x14010d860
mov byte [rsp + rbx + 0x20], 0
cmp byte [rsp + 0x20], 0
mov rbx, qword [rsp + 0xd8]
je 0x14010d957
lea rdx, [rsp + 0x20]
lea rcx, str.1_TRUE_YES_ON
call sub.VCRUNTIME140.dll_strstr
test rax, rax
jne 0x14010d957
lea rdx, [rsp + 0x20]
lea rcx, str.0_FALSE_NO_OFF
call sub.VCRUNTIME140.dll_strstr
test rax, rax
je 0x14010d8dd
mov dword [rsi], 0
mov dword [rsi + 4], 2
mov rsi, qword [rsp + 0xe0]
add rsp, 0xc0
pop rdi
ret
lea rax, [rsp + 0x20]
mov r8d, 0xa
lea rdx, [rsp + 0xd0]
mov qword [rsp + 0xd0], rax
lea rcx, [rsp + 0x20]
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_strtol]
mov rcx, qword [rsp + 0xd0]
cmp byte [rcx], 0
jne 0x14010d92a
mov dword [rsi], eax
mov dword [rsi + 4], 2
mov rsi, qword [rsp + 0xe0]
add rsp, 0xc0
pop rdi
ret
mov rdx, qword [rsi + 0x10]
lea r8, [rsp + 0x20]
lea rcx, str.environment_option_mimalloc__s_has_an_invalid_value:__s_n
call fcn.14010d660
mov dword [rsi + 4], 1
mov rsi, qword [rsp + 0xe0]
add rsp, 0xc0
pop rdi
ret
mov dword [rsi], 1
mov dword [rsi + 4], 2
mov rsi, qword [rsp + 0xe0]
add rsp, 0xc0
pop rdi
ret
Function at 0x14010dab0
Capabilities:
Query environment variable

Disassembly:
push rbx
sub rsp, 0xc0
movsxd rax, ecx
lea rcx, [rax + rax*2]
lea rax, [0x140167350]
cmp dword [rax + rcx*8 + 4], 0
lea rbx, [rax + rcx*8]
jne 0x14010dc76
mov qword [rsp + 0xd0], rsi
lea rdx, str.mimalloc_
mov esi, 0x40
mov byte [rsp + 0x20], 0
mov r8d, esi
lea rcx, [rsp + 0x20]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy]
mov rdx, qword [rbx + 0x10]
lea rcx, [rsp + 0x20]
mov r8d, esi
mov byte [rsp + 0x60], 0
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncat]
lea r8d, [rsi + 1]
mov byte [rsp + 0x60], 0
lea rdx, [rsp + 0x70]
mov byte [rsp + 0x70], 0
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
mov eax, eax
dec rax
cmp rax, 0x3f
ja 0x14010dc51
mov qword [rsp + 0xe0], rdi
lea rax, [rsp + 0x70]
mov rdi, 0xffffffffffffffff
inc rdi
cmp byte [rax + rdi], 0
jne 0x14010db55
cmp rdi, 0x41
cmovae rdi, rsi
xor esi, esi
test rdi, rdi
je 0x14010db87
nop dword [rax]
movsx ecx, byte [rsp + rsi + 0x70]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_toupper]
mov byte [rsp + rsi + 0x20], al
inc rsi
cmp rsi, rdi
jb 0x14010db70
mov byte [rsp + rdi + 0x20], 0
cmp byte [rsp + 0x20], 0
mov rdi, qword [rsp + 0xe0]
je 0x14010dc6b
lea rdx, [rsp + 0x20]
lea rcx, str.1_TRUE_YES_ON
call sub.VCRUNTIME140.dll_strstr
test rax, rax
jne 0x14010dc6b
lea rdx, [rsp + 0x20]
lea rcx, str.0_FALSE_NO_OFF
call sub.VCRUNTIME140.dll_strstr
test rax, rax
je 0x14010dbef
mov dword [rbx], 0
mov eax, dword [rbx]
mov rsi, qword [rsp + 0xd0]
mov dword [rbx + 4], 2
add rsp, 0xc0
pop rbx
ret
lea rax, [rsp + 0x20]
mov r8d, 0xa
lea rdx, [rsp + 0xd8]
mov qword [rsp + 0xd8], rax
lea rcx, [rsp + 0x20]
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_strtol]
mov rcx, qword [rsp + 0xd8]
cmp byte [rcx], 0
jne 0x14010dc3c
mov rsi, qword [rsp + 0xd0]
mov dword [rbx], eax
mov dword [rbx + 4], 2
add rsp, 0xc0
pop rbx
ret
mov rdx, qword [rbx + 0x10]
lea r8, [rsp + 0x20]
lea rcx, str.environment_option_mimalloc__s_has_an_invalid_value:__s_n
call fcn.14010d660
mov eax, dword [rbx]
mov rsi, qword [rsp + 0xd0]
mov dword [rbx + 4], 1
add rsp, 0xc0
pop rbx
ret
mov dword [rbx], 1
jmp 0x14010dbd5
mov eax, dword [rbx]
add rsp, 0xc0
pop rbx
ret
Function at 0x14010dd40
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
push rbx
sub rsp, 0x40
movsd xmm0, qword [0x140238480]
movaps xmmword [rsp + 0x30], xmm6
xorps xmm6, xmm6
ucomisd xmm0, xmm6
jp 0x14010de0a
jne 0x14010de0a
lea rcx, [rsp + 0x50]
movaps xmmword [rsp + 0x20], xmm7
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
movsd xmm0, qword [0x140238488]
comisd xmm6, xmm0
mov rbx, qword [rsp + 0x50]
jb 0x14010dda6
lea rcx, [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
xorps xmm0, xmm0
cvtsi2sd xmm0, qword [rsp + 0x58]
movsd qword [0x140238488], xmm0
xorps xmm7, xmm7
lea rcx, [rsp + 0x50]
cvtsi2sd xmm7, rbx
divsd xmm7, xmm0
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
movsd xmm1, qword [0x140238488]
comisd xmm6, xmm1
mov rbx, qword [rsp + 0x50]
jb 0x14010dded
lea rcx, [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
xorps xmm1, xmm1
cvtsi2sd xmm1, qword [rsp + 0x58]
movsd qword [0x140238488], xmm1
xorps xmm0, xmm0
cvtsi2sd xmm0, rbx
divsd xmm0, xmm1
subsd xmm0, xmm7
movaps xmm7, xmmword [rsp + 0x20]
movsd qword [0x140238480], xmm0
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
movsd xmm1, qword [0x140238488]
mov rbx, qword [rsp + 0x50]
comisd xmm6, xmm1
movaps xmm6, xmmword [rsp + 0x30]
jb 0x14010de4a
lea rcx, [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
xorps xmm1, xmm1
cvtsi2sd xmm1, qword [rsp + 0x58]
movsd qword [0x140238488], xmm1
xorps xmm0, xmm0
cvtsi2sd xmm0, rbx
divsd xmm0, xmm1
add rsp, 0x40
pop rbx
ret
Function at 0x14010f120
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
push rbx
sub rsp, 0x50
movaps xmmword [rsp + 0x40], xmm6
call fcn.14010f500
lea rbx, [0x1402321d0]
mov rcx, qword [rax]
add rcx, 0x88
cmp rcx, rbx
je 0x14010f153
xor edx, edx
mov r8d, 0x240
call sub.VCRUNTIME140.dll_memset
xor edx, edx
mov r8d, 0x240
mov rcx, rbx
call sub.VCRUNTIME140.dll_memset
movsd xmm0, qword [0x140238480]
xorps xmm6, xmm6
ucomisd xmm0, xmm6
jp 0x14010f222
jne 0x14010f222
lea rcx, [rsp + 0x60]
movaps xmmword [rsp + 0x30], xmm7
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
movsd xmm0, qword [0x140238488]
comisd xmm6, xmm0
mov rbx, qword [rsp + 0x60]
jb 0x14010f1be
lea rcx, [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
xorps xmm0, xmm0
cvtsi2sd xmm0, qword [rsp + 0x68]
movsd qword [0x140238488], xmm0
xorps xmm7, xmm7
lea rcx, [rsp + 0x70]
cvtsi2sd xmm7, rbx
divsd xmm7, xmm0
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
movsd xmm1, qword [0x140238488]
comisd xmm6, xmm1
mov rbx, qword [rsp + 0x70]
jb 0x14010f205
lea rcx, [rsp + 0x78]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
xorps xmm1, xmm1
cvtsi2sd xmm1, qword [rsp + 0x78]
movsd qword [0x140238488], xmm1
xorps xmm0, xmm0
cvtsi2sd xmm0, rbx
divsd xmm0, xmm1
subsd xmm0, xmm7
movaps xmm7, xmmword [rsp + 0x30]
movsd qword [0x140238480], xmm0
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
movsd xmm1, qword [0x140238488]
mov rbx, qword [rsp + 0x20]
comisd xmm6, xmm1
movaps xmm6, xmmword [rsp + 0x40]
jb 0x14010f262
lea rcx, [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
xorps xmm1, xmm1
cvtsi2sd xmm1, qword [rsp + 0x28]
movsd qword [0x140238488], xmm1
xorps xmm0, xmm0
cvtsi2sd xmm0, rbx
divsd xmm0, xmm1
movsd qword [0x140238478], xmm0
add rsp, 0x50
pop rbx
ret
Function at 0x1405b6268
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.1405b63ef
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x1405b6299
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1405b627f
add dl, dl
jne 0x1405b62a6
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1405b6306
xor eax, eax
add dl, dl
jne 0x1405b62b5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1405b63bd
add dl, dl
jne 0x1405b62c6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1405b62d3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1405b62e0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1405b62ed
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x1405b62fa
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x1405b628e
mov eax, 1
add dl, dl
jne 0x1405b6316
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1405b6323
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1405b630b
sub eax, ebx
mov ebx, 1
jne 0x1405b635c
mov ecx, 1
add dl, dl
jne 0x1405b633e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1405b634b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1405b6333
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1405b628e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x1405b6378
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1405b6385
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1405b636d
cmp eax, 0x7d00
jae 0x1405b63ab
cmp eax, 0x500
jb 0x1405b63a6
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1405b628e
cmp eax, 0x7f
ja 0x1405b63ae
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1405b628e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x1405b63e2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x1405b628e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x1400114b5
Capabilities:
Terminate process

Disassembly:
jmp 0x14002e670
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x28
ret

Function at 0x1400115f0
Capabilities:
Parse pe header

Disassembly:
jmp 0x14002da20
sub rsp, 0x38
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x14002da40
xor al, al
jmp 0x14002dac1
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x14002da53
xor al, al
jmp 0x14002dac1
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax], 0x4550
je 0x14002da7d
xor al, al
jmp 0x14002dac1
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x14002da91
xor al, al
jmp 0x14002dac1
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0x84], 0xe
ja 0x14002daa3
xor al, al
jmp 0x14002dac1
mov eax, 8
imul rax, rax, 0xe
mov rcx, qword [rsp + 0x28]
cmp dword [rcx + rax + 0x88], 0
jne 0x14002dabf
xor al, al
jmp 0x14002dac1
mov al, 1
add rsp, 0x38
ret
Function at 0x14046d5f0
Capabilities:
Terminate process

Disassembly:
cld
pop r11
jmp 0x14046d5fd
inc rsi
mov byte [rdi], dl
inc rdi
mov dl, byte [rsi]
add ebx, ebx
jne 0x14046d60d
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jb 0x14046d5f5
lea eax, [rcx + 1]
jmp 0x14046d61b
dec eax
call r11
adc eax, eax
call r11
adc eax, eax
add ebx, ebx
jne 0x14046d62e
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jae 0x14046d614
sub eax, 3
jb 0x14046d64e
shl eax, 8
movzx edx, dl
or eax, edx
inc rsi
xor eax, 0xffffffff
je 0x14046d69d
sar eax, 1
movsxd rbp, eax
jb 0x14046d684
jmp 0x14046d65c
add ebx, ebx
jne 0x14046d65a
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x14046d684
inc ecx
add ebx, ebx
jne 0x14046d66a
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x14046d684
call r11
adc ecx, ecx
add ebx, ebx
jne 0x14046d67d
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jae 0x14046d66c
add ecx, 2
jmp 0x14046d689
call r11
adc ecx, ecx
cmp rbp, 0xfffffffffffffb00
adc ecx, 2
call fcn.14046d5b2
jmp 0x14046d5fd
pop rsi
pop rdi
pop rax
mov dword [rdi], eax
mov rdi, rsi
push rsi
mov rdi, rsi
mov rsi, 0x179e00
mov dl, 0x51
push rbx
push rdi
lea rcx, [rdi + rsi - 3]
pop rsi
push rsi
pop rbx
jmp 0x14046d6ed
cmp rsi, rcx
jae 0x14046d6f5
push rsi
pop rsi
lodsb al, byte [rsi]
cmp al, 0x80
jb 0x14046d6d4
cmp al, 0x8f
ja 0x14046d6d4
cmp byte [rsi - 2], 0xf
je 0x14046d6da
sub al, 0xe8
cmp al, 1
ja 0x14046d6be
cmp rsi, rcx
jae 0x14046d6f5
push rsi
lodsd eax, dword [rsi]
sub al, dl
jne 0x14046d6c4
pop rdi
bswap eax
sub eax, edi
add eax, ebx
stosd dword [rdi], eax
cmp rsi, rcx
jae 0x14046d6f5
lodsb al, byte [rsi]
jmp 0x14046d6d4
pop rbx
pop rsi
sub rsp, 0x28
lea rdi, [rsi + 0x44d000]
mov eax, dword [rdi]
or eax, eax
je 0x14046d75e
mov ebx, dword [rdi + 4]
lea rcx, [rax + rsi + 0x48ac48]
add rbx, rsi
add rdi, 8
call qword [sym.imp.KERNEL32.DLL_LoadLibraryA]
xchg rbp, rax
mov al, byte [rdi]
inc rdi
or al, al
je 0x14046d702
jns 0x14046d737
movzx rdx, word [rdi]
add rdi, 2
jmp 0x14046d741
mov rcx, rdi
mov rdx, rdi
dec eax
repne scasb al, byte [rdi]
mov rcx, rbp
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
or rax, rax
je 0x14046d758
mov qword [rbx], rax
add rbx, 8
jmp 0x14046d722
jmp qword [sym.imp.KERNEL32.DLL_ExitProcess]
add rsp, 0x28
add rdi, 4
lea rbx, [rsi - 4]
xor eax, eax
mov al, byte [rdi]
inc rdi
or eax, eax
je 0x14046d7a2
cmp al, 0xef
ja 0x14046d78a
add rbx, rax
mov rax, qword [rbx]
bswap rax
add rax, rsi
mov qword [rbx], rax
jmp 0x14046d76a
and al, 0xf
shl eax, 0x10
mov ax, word [rdi]
add rdi, 2
or eax, eax
jne 0x14046d779
mov eax, dword [rdi]
add rdi, 4
jmp 0x14046d779
mov rbp, qword [sym.imp.KERNEL32.DLL_VirtualProtect]
lea rdi, [rsi - 0x1000]
mov ebx, 0x1000
push rax
mov r9, rsp
mov r8d, 4
mov rdx, rbx
mov rcx, rdi
sub rsp, 0x20
call rbp
lea rax, [rdi + 0x24f]
and byte [rax], 0x7f
and byte [rax + 0x28], 0x7f
lea r9, [rsp + 0x20]
mov r8, qword [r9]
mov rdx, rbx
mov rcx, rdi
call rbp
add rsp, 0x28
pop rbp
pop rdi
pop rsi
pop rbx
lea rax, [rsp - 0x80]
push 0
cmp rsp, rax
jne 0x14046d7f6
sub rsp, 0xffffffffffffff80
jmp 0x140135274
Function at 0x1402d358d
Capabilities:
Execute anti-debugging instructions

Disassembly:
push r12
mov r11d, 0x228e7d38
push rax
rdtsc
push rbx
movzx ebx, dx
push rdi
movzx rdi, r12w
bswap r11w
push r8
push rcx
lahf
push r13
push rsi
rdtsc
push r15
movzx rdi, r10w
sets sil
cbw
push r10
push r9
jmp 0x140306616
add r11, 4
cmp edi, 0x354914a2
xor esi, ebx
jmp 0x140341274
push r11
mov r11w, r8w
push r14
setae r11b
bswap r11w
push rdx
movsx dx, r11b
jmp 0x1402acb5e
pushfq
inc rdx
cwde
push rbp
movzx r10, sp
movsx r11, dx
movabs rdx, 0
setle r10b
movzx esi, r10w
cbw
push rdx
mov dil, r9b
dec bx
cbw
mov r11d, dword [rsp + 0x90]
cmovns si, bp
dec r11d
or bpl, 0xe1
neg r11d
sub r10b, r15b
bswap si
sub r11d, 0x27ac01fa
sub r10b, r10b
setne dil
cbw
bswap r11d
dec bp
bsr edi, r9d
sub bpl, r8b
lea r11, [r11 + rdx]
movabs rbp, 0x100000000
sal bh, 0x23
add r11, rbp
and bh, 0xb4
movsx r10d, r15w
mov rdi, rsp
shr r10d, cl
test r10b, 0x28
rol bh, cl
sub rsp, 0x180
movzx rbx, si
bswap rax
and rsp, 0xfffffffffffffff0
ror r10b, 0xc8
xadd sil, bl
mov rbx, r11
adc sil, 0x8d
stc
cmc
movabs rax, 0
and sil, 0x44
movsxd r10, ebp
sub rbx, rax
movsx esi, r9w
btc si, sp
lea r10, [0x1403066e3]
and esi, 0x58176c59
mov esi, dword [r11]
jmp 0x1402b474a
bswap esi
inc esi
jmp 0x140374250
not esi
jmp 0x140319772
dec esi
jmp 0x140333528
push rbx
mov bh, 0xe2
movsx bx, spl
bswap bx
xor dword [rsp], esi
btc ebx, 0xa7
pop rbx
clc
test r11b, 0x30
cmp r14w, 0x5781
movsxd rsi, esi
test sil, r14b
add r10, rsi
push r10
ret
Function at 0x140004de0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x60
xor r12d, r12d
lea r15, [0x140161768]
mov esi, r12d
lea r14, [0x140160520]
cmp byte [r15], r12b
je 0x140004eb4
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], reloc.WSOCK32.dll_gethostbyname
mov ecx, esi
mov dword [rsp + 0x24], 0x80
call qword [sym.imp.WINMM.dll_joyGetPosEx]
test eax, eax
jne 0x140004eb4
mov eax, dword [rsp + 0x40]
mov ebp, eax
xor ebp, dword [r14]
mov dword [r14], eax
and ebp, eax
je 0x140004eb4
movzx edx, word [0x14016179c]
mov ebx, r12d
cmp r12w, dx
jae 0x140004eb4
mov rdi, r12
nop
mov rax, qword [0x140161788]
mov rax, qword [rdi + rax]
cmp byte [rax + 0x12], 4
jne 0x140004ea7
movzx ecx, byte [rax + 0x10]
cmp ecx, esi
jne 0x140004ea7
movzx ecx, word [rax + 8]
sub ecx, 0xc
movzx eax, cl
bt ebp, eax
jae 0x140004ea7
mov rcx, qword [0x140160760]
xor r9d, r9d
movsxd r8, ebx
mov edx, 0x312
call qword [sym.imp.USER32.dll_PostMessageW]
movzx edx, word [0x14016179c]
inc ebx
movzx eax, dx
add rdi, 8
cmp ebx, eax
jl 0x140004e60
inc esi
inc r15
add r14, 4
cmp esi, 0x10
jl 0x140004e12
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop r12
ret
Function at 0x140007590
Capabilities:
Write clipboard data

Disassembly:
push rbx
sub rsp, 0x20
cmp dword [rcx + 0x2c], 0
mov rbx, rcx
jne 0x1400075bc
call fcn.1400078b0
test eax, eax
jne 0x1400075bc
lea rdx, str.Cant_open_clipboard_for_writing.
mov rcx, rbx
add rsp, 0x20
pop rbx
jmp 0x1400076e0
mov qword [rsp + 0x38], rdi
call qword [sym.imp.USER32.dll_EmptyClipboard]
test eax, eax
jne 0x14000760a
cmp dword [rbx + 0x2c], eax
je 0x1400075f1
xor edi, edi
cmp qword [rbx + 0x10], rdi
je 0x1400075e5
mov rcx, qword [rbx]
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov qword [rbx + 0x10], rdi
call qword [sym.imp.USER32.dll_CloseClipboard]
mov dword [rbx + 0x2c], edi
mov qword [rbx], rdi
lea rdx, [0x140120b78]
mov rcx, rbx
mov rdi, qword [rsp + 0x38]
add rsp, 0x20
pop rbx
jmp 0x1400076e0
mov rdx, qword [rbx + 8]
xor edi, edi
test rdx, rdx
je 0x140007658
mov rax, qword [rbx + 0x18]
mov qword [rsp + 0x30], rsi
xor sil, sil
test rax, rax
je 0x140007641
cmp word [rax], di
mov rcx, rdx
sete sil
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov rdx, qword [rbx + 8]
mov qword [rbx + 0x18], rdi
mov dword [rbx + 0x28], edi
test sil, sil
mov rsi, qword [rsp + 0x30]
je 0x14000768c
mov rcx, rdx
call qword [sym.imp.KERNEL32.dll_GlobalFree]
mov qword [rbx + 8], rax
cmp dword [rbx + 0x2c], edi
je 0x14000767c
cmp qword [rbx + 0x10], rdi
je 0x140007670
mov rcx, qword [rbx]
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov qword [rbx + 0x10], rdi
call qword [sym.imp.USER32.dll_CloseClipboard]
mov dword [rbx + 0x2c], edi
mov qword [rbx], rdi
mov rdi, qword [rsp + 0x38]
mov eax, 1
add rsp, 0x20
pop rbx
ret
mov ecx, ntohs
call qword [sym.imp.USER32.dll_SetClipboardData]
test rax, rax
je 0x1400076a2
mov qword [rbx + 8], rdi
jmp 0x140007658
cmp dword [rbx + 0x2c], edi
je 0x1400076c6
cmp qword [rbx + 0x10], rdi
je 0x1400076ba
mov rcx, qword [rbx]
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov qword [rbx + 0x10], rdi
call qword [sym.imp.USER32.dll_CloseClipboard]
mov dword [rbx + 0x2c], edi
mov qword [rbx], rdi
lea rdx, [0x140120b98]
mov rcx, rbx
mov rdi, qword [rsp + 0x38]
add rsp, 0x20
pop rbx
jmp 0x1400076e0
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
xor esi, esi
mov rdi, rdx
mov rbx, rcx
cmp dword [rcx + 0x2c], esi
je 0x14000771b
cmp qword [rcx + 0x10], rsi
je 0x14000770f
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov qword [rbx + 0x10], rsi
call qword [sym.imp.USER32.dll_CloseClipboard]
mov dword [rbx + 0x2c], esi
mov qword [rbx], rsi
cmp qword [rbx + 0x18], rsi
je 0x140007732
mov rcx, qword [rbx + 8]
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov qword [rbx + 0x18], rsi
mov dword [rbx + 0x28], esi
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x140007745
call qword [sym.imp.KERNEL32.dll_GlobalFree]
mov qword [rbx + 8], rax
cmp word [rdi], si
je 0x14000776f
lea r8, [0x14012046c]
mov rdx, rdi
lea rcx, [0x140163cc0]
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp fcn.140063260
mov rbx, qword [rsp + 0x30]
mov eax, esi
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x140007790
Capabilities:
Read clipboard data

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x230
xor ecx, ecx
mov rbx, r8
mov edi, edx
test r8, r8
je 0x1400077ac
mov dword [r8], ecx
lea eax, [rdx - 0xc000]
cmp eax, 0x3fff
ja 0x14000788b
mov r8d, 0x104
lea rdx, [rsp + 0x20]
mov ecx, edi
call qword [sym.imp.USER32.dll_GetClipboardFormatNameW]
mov r8d, reloc.WSOCK32.dll_inet_ntoa
lea rdx, str.Link_Source
lea rcx, [rsp + 0x20]
call fcn.1400f7630
test eax, eax
je 0x140007878
lea rdx, str.ObjectLink
lea rcx, [rsp + 0x20]
call fcn.1400f55a0
test eax, eax
je 0x140007878
lea rdx, str.OwnerLink
lea rcx, [rsp + 0x20]
call fcn.1400f55a0
test eax, eax
je 0x140007878
lea rdx, str.Native
lea rcx, [rsp + 0x20]
call fcn.1400f55a0
test eax, eax
je 0x140007878
lea rdx, str.Embed_Source
lea rcx, [rsp + 0x20]
call fcn.1400f55a0
test eax, eax
je 0x140007878
lea rdx, str.MSDEVColumnSelect
lea rcx, [rsp + 0x20]
call fcn.1400f55a0
test eax, eax
je 0x14000786d
lea rdx, str.MSDEVLineSelect
lea rcx, [rsp + 0x20]
call fcn.1400f55a0
test eax, eax
jne 0x140007890
test rbx, rbx
je 0x140007878
mov dword [rbx], 1
xor eax, eax
mov rbx, qword [rsp + 0x240]
add rsp, 0x230
pop rdi
ret
mov word [rsp + 0x20], cx
mov ecx, edi
call qword [sym.imp.USER32.dll_GetClipboardData]
mov rbx, qword [rsp + 0x240]
add rsp, 0x230
pop rdi
ret

Function at 0x1400078b0
Capabilities:
Check for time delay via gettickcount
Open clipboard

Disassembly:
push rbx
sub rsp, 0x20
cmp dword [rcx + 0x2c], 0
mov rbx, rcx
je 0x1400078ca
mov eax, 1
add rsp, 0x20
pop rbx
ret
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x38], rdi
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov rcx, qword [0x140160760]
mov edi, eax
call qword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
jne 0x140007944
xor esi, esi
nop
mov ecx, dword [0x14015bc20]
cmp ecx, 0xffffffff
je 0x140007914
test ecx, ecx
je 0x140007960
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov edx, dword [0x14015bc20]
add edx, edi
sub edx, eax
cmp edx, 5
jle 0x140007960
mov edx, 1
mov dword [0x14015bc04], esi
mov ecx, 0x8000012f
call fcn.140001a10
mov rcx, qword [0x140160760]
mov dword [0x14015bc04], 1
call qword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x1400078f0
mov rsi, qword [rsp + 0x30]
mov eax, 1
mov rdi, qword [rsp + 0x38]
mov dword [rbx + 0x2c], 1
add rsp, 0x20
pop rbx
ret
mov rsi, qword [rsp + 0x30]
xor eax, eax
mov rdi, qword [rsp + 0x38]
add rsp, 0x20
pop rbx
ret