joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400041d3
Capabilities:
Resolve dns

Disassembly:
jmp 0x1400e9530
mov word [rsp + 0x20], r9w
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
sub rsp, 0x48
mov rax, qword [rsp + 0x78]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], 0
mov rax, qword [rsp + 0x30]
mov qword [rax], 0
mov eax, 1
imul rax, rax, 0
mov rcx, qword [rsp + 0x70]
mov byte [rcx + rax], 0
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.WS2_32.dll_gethostbyname]
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
je 0x1400e9650
mov rax, qword [rsp + 0x28]
movsx eax, word [rax + 0x10]
cmp eax, 2
jne 0x1400e962e
mov rax, qword [rsp + 0x28]
movsx rax, word [rax + 0x12]
cmp rax, 4
jne 0x1400e962e
mov rax, qword [rsp + 0x28]
mov rax, qword [rax + 0x18]
mov qword [rsp + 0x38], rax
jmp 0x1400e95d5
mov rax, qword [rsp + 0x38]
add rax, 8
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
cmp qword [rax], 0
je 0x1400e962e
mov rax, qword [rsp + 0x38]
mov rax, qword [rax]
mov r9d, dword [rax]
movzx r8d, word [rsp + 0x68]
mov edx, dword [rsp + 0x60]
mov ecx, dword [rsp + 0x58]
call fcn.140001131
mov rcx, qword [rsp + 0x30]
mov qword [rcx], rax
mov rax, qword [rsp + 0x30]
cmp qword [rax], 0
jne 0x1400e961b
mov eax, 8
jmp 0x1400e96a5
mov rax, qword [rsp + 0x30]
mov rax, qword [rax]
add rax, 0x28
mov qword [rsp + 0x30], rax
jmp 0x1400e95c7
mov r9d, 0x400
mov rax, qword [rsp + 0x28]
mov r8, qword [rax]
mov edx, 0x401
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.MSVCR120D.dll_strncpy_s]
xor eax, eax
jmp 0x1400e96a5
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x20], 0x2af9
je 0x1400e9684
cmp dword [rsp + 0x20], 0x2afa
je 0x1400e968b
cmp dword [rsp + 0x20], 0x2afb
je 0x1400e9692
cmp dword [rsp + 0x20], 0x2afc
je 0x1400e9699
jmp 0x1400e96a0
mov eax, 0x2af9
jmp 0x1400e96a5
mov eax, 0x2afa
jmp 0x1400e96a5
mov eax, 0x2afb
jmp 0x1400e96a5
mov eax, 0x2af9
jmp 0x1400e96a5
mov eax, 0x2af9
add rsp, 0x48
ret
Function at 0x140004214
Capabilities:
Set registry value

Disassembly:
jmp 0x140068be0
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x48
mov rax, qword [rsp + 0x50]
cmp qword [rax], 0
jne 0x140068c3e
lea rax, str.m_hKey___0
mov qword [rsp + 0x28], rax
lea rax, [0x140214388]
mov qword [rsp + 0x20], rax
xor r9d, r9d
mov r8d, 0x187d
lea rdx, [0x140215fa0]
mov ecx, 2
call qword [sym.imp.MSVCR120D.dll__CrtDbgReportW]
cmp eax, 1
jne 0x140068c3e
int3
xor eax, eax
test eax, eax
jne 0x140068bf8
cmp qword [rsp + 0x60], 0
je 0x140068c56
mov dword [rsp + 0x30], 1
jmp 0x140068c5e
mov dword [rsp + 0x30], 0
mov eax, dword [rsp + 0x30]
mov dword [rsp + 0x34], eax
cmp dword [rsp + 0x34], 0
jne 0x140068ca8
lea rax, str.__atl_condVal
mov qword [rsp + 0x28], rax
lea rax, [0x140214388]
mov qword [rsp + 0x20], rax
xor r9d, r9d
mov r8d, 0x187e
lea rdx, [0x140215fa0]
mov ecx, 2
call qword [sym.imp.MSVCR120D.dll__CrtDbgReportW]
cmp eax, 1
jne 0x140068ca8
int3
cmp dword [rsp + 0x34], 0
jne 0x140068cb9
mov eax, recv
jmp 0x140068d43
xor eax, eax
test eax, eax
jne 0x140068c44
cmp dword [rsp + 0x68], 1
je 0x140068d08
cmp dword [rsp + 0x68], 2
je 0x140068d08
lea rax, str._dwType____1______dwType____2___
mov qword [rsp + 0x28], rax
lea rax, [0x140214388]
mov qword [rsp + 0x20], rax
xor r9d, r9d
mov r8d, 0x187f
lea rdx, [0x140215fa0]
mov ecx, 2
call qword [sym.imp.MSVCR120D.dll__CrtDbgReportW]
cmp eax, 1
jne 0x140068d08
int3
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.MSVCR120D.dll_wcslen]
inc eax
mov eax, eax
shl rax, 1
mov dword [rsp + 0x28], eax
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x20], rax
mov r9d, dword [rsp + 0x68]
xor r8d, r8d
mov rdx, qword [rsp + 0x58]
mov rax, qword [rsp + 0x50]
mov rcx, qword [rax]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
add rsp, 0x48
ret
Function at 0x140004359
Capabilities:
Resolve function by parsing pe exports

Disassembly:
jmp 0x1400b9ed0
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0xc8
mov qword [rsp + 0x90], 0xfffffffffffffffe
mov rax, qword [rsp + 0xe0]
mov qword [rax], 0
lea rcx, [rsp + 0x28]
call fcn.140002d51
nop
lea rax, [rsp + 0x98]
mov qword [rsp + 0x78], rax
mov rdx, qword [rsp + 0xd8]
mov rcx, qword [rsp + 0x78]
call fcn.140001a7d
mov qword [rsp + 0x48], rax
lea r8, [rsp + 0x28]
mov rdx, qword [rsp + 0x48]
mov rcx, qword [rsp + 0xd0]
call fcn.1400050c4
mov dword [rsp + 0x24], eax
cmp dword [rsp + 0x24], 0
jne 0x1400b9f7b
mov dword [rsp + 0x3c], 0
lea rcx, [rsp + 0x28]
call fcn.1400053e9
nop
mov rcx, qword [rsp + 0xd8]
call fcn.1400053e9
mov eax, dword [rsp + 0x3c]
jmp 0x1400ba168
lea rcx, [rsp + 0x28]
call fcn.140004b60
cdqe
mov rcx, qword [rsp + 0xe0]
add rax, qword [rcx]
mov rcx, qword [rsp + 0xe0]
mov qword [rcx], rax
mov rax, qword [rsp + 0xd0]
add rax, 8
mov r8, qword [rsp + 0xd8]
lea rdx, [rsp + 0x60]
mov rcx, rax
call fcn.14000155a
nop
mov rax, qword [rsp + 0xd0]
add rax, 8
lea rdx, [rsp + 0xa8]
mov rcx, rax
call fcn.140001690
mov qword [rsp + 0x88], rax
mov rax, qword [rsp + 0x88]
mov qword [rsp + 0x80], rax
mov rdx, qword [rsp + 0x80]
lea rcx, [rsp + 0x60]
call fcn.140003c7e
mov byte [rsp + 0x20], al
lea rcx, [rsp + 0xa8]
call fcn.140005885
movzx eax, byte [rsp + 0x20]
test eax, eax
je 0x1400ba053
mov dword [rsp + 0x38], 0
lea rcx, [rsp + 0x60]
call fcn.140005885
nop
lea rcx, [rsp + 0x28]
call fcn.1400053e9
nop
mov rcx, qword [rsp + 0xd8]
call fcn.1400053e9
mov eax, dword [rsp + 0x38]
jmp 0x1400ba168
lea rcx, [rsp + 0x60]
call fcn.140002e1e
add rax, 8
mov rcx, rax
call fcn.140002a9a
mov rcx, qword [rsp + 0xe0]
add rax, qword [rcx]
mov rcx, qword [rsp + 0xe0]
mov qword [rcx], rax
lea rcx, [rsp + 0x30]
call fcn.140002d51
nop
lea rax, [rsp + 0xa0]
mov qword [rsp + 0x58], rax
mov rdx, qword [rsp + 0xd8]
mov rcx, qword [rsp + 0x58]
call fcn.140001a7d
mov qword [rsp + 0x50], rax
lea r8, [rsp + 0x30]
mov rdx, qword [rsp + 0x50]
mov rcx, qword [rsp + 0xd0]
call fcn.1400032b0
mov dword [rsp + 0x24], eax
cmp dword [rsp + 0x24], 0
jne 0x1400ba10c
mov dword [rsp + 0x44], 0
lea rcx, [rsp + 0x30]
call fcn.1400053e9
nop
lea rcx, [rsp + 0x60]
call fcn.140005885
nop
lea rcx, [rsp + 0x28]
call fcn.1400053e9
nop
mov rcx, qword [rsp + 0xd8]
call fcn.1400053e9
mov eax, dword [rsp + 0x44]
jmp 0x1400ba168
lea rcx, [rsp + 0x30]
call fcn.140004b60
cdqe
mov rcx, qword [rsp + 0xe0]
add rax, qword [rcx]
mov rcx, qword [rsp + 0xe0]
mov qword [rcx], rax
mov dword [rsp + 0x40], 1
lea rcx, [rsp + 0x30]
call fcn.1400053e9
nop
lea rcx, [rsp + 0x60]
call fcn.140005885
nop
lea rcx, [rsp + 0x28]
call fcn.1400053e9
nop
mov rcx, qword [rsp + 0xd8]
call fcn.1400053e9
mov eax, dword [rsp + 0x40]
add rsp, 0xc8
ret
Function at 0x140004629
Capabilities:
Resolve dns

Disassembly:
jmp 0x1400dce70
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0xc8
mov qword [rsp + 0xa8], 0xfffffffffffffffe
mov qword [rsp + 0x30], 0
mov rdx, qword [rsp + 0xd8]
lea rcx, [rsp + 0x50]
call fcn.140002b67
nop
lea rcx, [rsp + 0x48]
call fcn.140002d51
nop
mov dx, reloc.OLEAUT32.dll_VarI4FromDisp
lea rcx, [rsp + 0x50]
call fcn.140004309
inc eax
mov r8d, eax
lea rdx, [rsp + 0x80]
lea rcx, [rsp + 0x50]
call fcn.140001488
mov qword [rsp + 0xa0], rax
mov rax, qword [rsp + 0xa0]
mov qword [rsp + 0x68], rax
mov rdx, qword [rsp + 0x68]
lea rcx, [rsp + 0x48]
call fcn.140001451
nop
lea rcx, [rsp + 0x80]
call fcn.1400053e9
lea rcx, [rsp + 0x38]
call fcn.140002d51
nop
mov r8, qword [rsp + 0x48]
lea rdx, str.Quering_MX_record_of_domain__s
lea rcx, [rsp + 0x38]
call fcn.140001d8e
lea rax, [rsp + 0xb0]
mov qword [rsp + 0x98], rax
lea rdx, [rsp + 0x38]
mov rcx, qword [rsp + 0x98]
call fcn.140001a7d
mov qword [rsp + 0x90], rax
mov r9b, 1
mov r8d, 2
mov rdx, qword [rsp + 0x90]
mov rax, qword [rsp + 0xd0]
mov rcx, qword [rax + 0x28]
call fcn.140002a31
lea rcx, [rsp + 0x48]
call fcn.140002b08
mov qword [rsp + 0x28], 0
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x20], rcx
xor r9d, r9d
xor r8d, r8d
mov dx, reloc.WS2_32.dll_ntohs
mov rcx, rax
call sub.DNSAPI.dll_DnsQuery_W
mov dword [rsp + 0x40], eax
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x70], rax
cmp dword [rsp + 0x40], 0
jne 0x1400dd06f
cmp qword [rsp + 0x30], 0
je 0x1400dd02f
mov rax, qword [rsp + 0x30]
movzx eax, word [rax + 0x10]
cmp eax, 0xf
jne 0x1400dd020
mov rax, qword [rsp + 0x30]
mov rdx, qword [rax + 0x20]
lea rcx, [rsp + 0x60]
call fcn.140002b67
nop
mov rax, qword [rsp + 0x30]
add rax, 0x28
mov rdx, rax
mov rcx, qword [rsp + 0xe0]
call fcn.140001ca3
lea rdx, [rsp + 0x60]
mov rcx, rax
call fcn.140001451
nop
lea rcx, [rsp + 0x60]
call fcn.1400053e9
mov rax, qword [rsp + 0x30]
mov rax, qword [rax]
mov qword [rsp + 0x30], rax
jmp 0x1400dcfc5
mov edx, 1
mov rcx, qword [rsp + 0x70]
call sub.DNSAPI.dll_DnsFree
mov dword [rsp + 0x58], 0
lea rcx, [rsp + 0x38]
call fcn.1400053e9
nop
lea rcx, [rsp + 0x48]
call fcn.1400053e9
nop
lea rcx, [rsp + 0x50]
call fcn.1400053e9
mov eax, dword [rsp + 0x58]
jmp 0x1400dd0f7
mov r8d, dword [rsp + 0x40]
lea rdx, str.DNS_query_failed_with_code__d
lea rcx, [rsp + 0x38]
call fcn.140001d8e
lea rax, [rsp + 0xb8]
mov qword [rsp + 0x78], rax
lea rdx, [rsp + 0x38]
mov rcx, qword [rsp + 0x78]
call fcn.140001a7d
mov qword [rsp + 0x88], rax
mov r9b, 1
mov r8d, 2
mov rdx, qword [rsp + 0x88]
mov rax, qword [rsp + 0xd0]
mov rcx, qword [rax + 0x28]
call fcn.140002a31
mov dword [rsp + 0x5c], 1
lea rcx, [rsp + 0x38]
call fcn.1400053e9
nop
lea rcx, [rsp + 0x48]
call fcn.1400053e9
nop
lea rcx, [rsp + 0x50]
call fcn.1400053e9
mov eax, dword [rsp + 0x5c]
add rsp, 0xc8
ret
Function at 0x14000468d
Capabilities:
Get system information on windows

Disassembly:
jmp 0x14000c630
mov qword [rsp + 8], rcx
sub rsp, 0x68
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov rax, qword [rsp + 0x70]
mov rcx, rax
call fcn.140002d51
nop
mov rax, qword [rsp + 0x70]
add rax, 0x20
mov rcx, rax
call fcn.140004a2a
mov rax, qword [rsp + 0x70]
mov qword [rax + 0x18], 0
mov rax, qword [rsp + 0x70]
mov qword [rax + 8], 0
lea rcx, [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov rax, qword [rsp + 0x70]
mov ecx, dword [rsp + 0x50]
mov dword [rax + 0x10], ecx
mov rax, qword [rsp + 0x70]
add rsp, 0x68
ret

Function at 0x1400048ea
Capabilities:
Hash data with md5

Disassembly:
jmp 0x1400c9de0
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
mov eax, 4
imul rax, rax, 1
mov rcx, qword [rsp + 0x10]
mov dword [rcx + rax + 0x10], 0
mov eax, 4
imul rax, rax, 0
mov rcx, qword [rsp + 0x10]
mov dword [rcx + rax + 0x10], 0
mov eax, 4
imul rax, rax, 0
mov rcx, qword [rsp + 0x10]
mov dword [rcx + rax], 0x67452301
mov eax, 4
imul rax, rax, 1
mov rcx, qword [rsp + 0x10]
mov dword [rcx + rax], 0xefcdab89
mov eax, 4
imul rax, rax, 2
mov rcx, qword [rsp + 0x10]
mov dword [rcx + rax], 0x98badcfe
mov eax, 4
imul rax, rax, 3
mov rcx, qword [rsp + 0x10]
mov dword [rcx + rax], 0x10325476
ret
Function at 0x140004c6e
Capabilities:
Write clipboard data

Disassembly:
jmp 0x1400cc580
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x58
mov rax, qword [rsp + 0x60]
add rax, 8
mov rcx, rax
call fcn.140004f84
test eax, eax
je 0x1400cc66c
call qword [sym.imp.USER32.dll_EmptyClipboard]
mov rcx, qword [rsp + 0x68]
call fcn.140004b60
inc eax
cdqe
shl rax, 1
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x20]
mov edx, eax
mov ecx, 0x2000
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov qword [rsp + 0x28], rax
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_GlobalLock]
mov qword [rsp + 0x30], rax
cmp qword [rsp + 0x30], 0
je 0x1400cc666
mov rcx, qword [rsp + 0x68]
call fcn.140004b60
cdqe
shl rax, 1
mov qword [rsp + 0x38], rax
mov rcx, qword [rsp + 0x68]
call fcn.140002b08
mov qword [rsp + 0x40], rax
mov ecx, dword [rsp + 0x20]
xor edx, edx
mov eax, ecx
mov ecx, 2
div rcx
mov rcx, qword [rsp + 0x38]
mov r9, rcx
mov rcx, qword [rsp + 0x40]
mov r8, rcx
mov rdx, rax
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.MSVCR120D.dll_wcsncpy_s]
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov rdx, qword [rsp + 0x28]
mov ecx, recv
call qword [sym.imp.USER32.dll_SetClipboardData]
call qword [sym.imp.USER32.dll_CloseClipboard]
xor eax, eax
jmp 0x1400cc671
call qword [sym.imp.USER32.dll_CloseClipboard]
mov eax, 1
add rsp, 0x58
ret
Function at 0x140004cf5
Capabilities:
Enumerate processes
Terminate process

Disassembly:
jmp 0x14007e340
sub rsp, 0x2a8
mov qword [rsp + 0x40], 0xfffffffffffffffe
mov rax, qword [0x14028c8d0]
xor rax, rsp
mov qword [rsp + 0x290], rax
lea rcx, [rsp + 0x20]
call fcn.140002d51
nop
mov r8d, 0x57b
lea rdx, str.CrashSender_dd.exe
lea rcx, [rsp + 0x20]
call fcn.140001d8e
mov dword [rsp + 0x50], 0x238
xor edx, edx
mov ecx, 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov qword [rsp + 0x28], rax
lea rdx, [rsp + 0x50]
mov rcx, qword [rsp + 0x28]
call sub.KERNEL32.dll_Process32FirstW
cmp eax, 1
jne 0x14007e421
lea rdx, [rsp + 0x50]
mov rcx, qword [rsp + 0x28]
call sub.KERNEL32.dll_Process32NextW
cmp eax, 1
jne 0x14007e421
lea rcx, [rsp + 0x20]
call fcn.140002b08
mov rdx, rax
lea rcx, [rsp + 0x7c]
call qword [sym.imp.MSVCR120D.dll__wcsicmp]
test eax, eax
jne 0x14007e41f
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp dword [rsp + 0x58], eax
je 0x14007e41f
mov r8d, dword [rsp + 0x58]
xor edx, edx
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rsp + 0x38], rax
mov edx, 1
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x14007e3b1
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [rsp + 0x30], 0
lea rcx, [rsp + 0x20]
call fcn.1400053e9
mov eax, dword [rsp + 0x30]
mov rcx, qword [rsp + 0x290]
xor rcx, rsp
call fcn.1401b0dd0
add rsp, 0x2a8
ret

Function at 0x140004e94
Capabilities:
Read file on windows

Disassembly:
jmp 0x1400a8430
mov qword [rsp + 8], rcx
sub rsp, 0x38
mov dword [rsp + 0x20], 0
mov qword [rsp + 0x28], 0
mov rax, qword [rsp + 0x40]
add rax, 0x90
mov rcx, qword [rsp + 0x40]
add rcx, 0x68
mov rdx, rax
call fcn.1401230e0
cmp eax, 1
je 0x1400a84fd
mov rax, qword [rsp + 0x40]
add rax, 0x68
mov edx, 0x1000
mov rcx, rax
call fcn.140122b00
mov rcx, qword [rsp + 0x40]
mov qword [rcx + 0x88], rax
mov rax, qword [rsp + 0x40]
cmp qword [rax + 0x88], 0
jne 0x1400a84a4
jmp 0x1400a8505
mov rax, qword [rsp + 0x40]
mov r9, qword [rax + 0x38]
mov r8d, 0x1000
mov edx, 1
mov rax, qword [rsp + 0x40]
mov rcx, qword [rax + 0x88]
call qword [sym.imp.MSVCR120D.dll_fread]
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
jne 0x1400a84db
jmp 0x1400a8505
mov rax, qword [rsp + 0x40]
add rax, 0x68
mov edx, dword [rsp + 0x28]
mov rcx, rax
call fcn.140122c60
test eax, eax
je 0x1400a84f8
jmp 0x1400a8505
jmp 0x1400a844a
mov dword [rsp + 0x20], 1
mov eax, dword [rsp + 0x20]
add rsp, 0x38
ret
Function at 0x140004ed0
Capabilities:
Set registry value

Disassembly:
jmp 0x140068460
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x58
mov rax, qword [rsp + 0x60]
cmp qword [rax], 0
jne 0x1400684b9
lea rax, str.m_hKey___0
mov qword [rsp + 0x28], rax
lea rax, [0x140214388]
mov qword [rsp + 0x20], rax
xor r9d, r9d
mov r8d, 0x188c
lea rdx, [0x140215fa0]
mov ecx, 2
call qword [sym.imp.MSVCR120D.dll__CrtDbgReportW]
cmp eax, 1
jne 0x1400684b9
int3
xor eax, eax
test eax, eax
jne 0x140068473
cmp qword [rsp + 0x70], 0
je 0x1400684d1
mov dword [rsp + 0x38], 1
jmp 0x1400684d9
mov dword [rsp + 0x38], 0
mov eax, dword [rsp + 0x38]
mov dword [rsp + 0x3c], eax
cmp dword [rsp + 0x3c], 0
jne 0x140068523
lea rax, str.__atl_condVal
mov qword [rsp + 0x28], rax
lea rax, [0x140214388]
mov qword [rsp + 0x20], rax
xor r9d, r9d
mov r8d, 0x188d
lea rdx, [0x140215fa0]
mov ecx, 2
call qword [sym.imp.MSVCR120D.dll__CrtDbgReportW]
cmp eax, 1
jne 0x140068523
int3
cmp dword [rsp + 0x3c], 0
jne 0x140068534
mov eax, recv
jmp 0x1400685b4
xor eax, eax
test eax, eax
jne 0x1400684bf
mov dword [rsp + 0x34], 0
mov rax, qword [rsp + 0x70]
mov qword [rsp + 0x40], rax
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.MSVCR120D.dll_wcslen]
inc eax
mov dword [rsp + 0x30], eax
mov eax, dword [rsp + 0x30]
mov rcx, qword [rsp + 0x40]
lea rax, [rcx + rax*2]
mov qword [rsp + 0x40], rax
mov eax, dword [rsp + 0x30]
mov ecx, dword [rsp + 0x34]
lea rax, [rcx + rax*2]
mov dword [rsp + 0x34], eax
cmp dword [rsp + 0x30], 1
jne 0x14006854c
mov eax, dword [rsp + 0x34]
mov dword [rsp + 0x28], eax
mov rax, qword [rsp + 0x70]
mov qword [rsp + 0x20], rax
mov r9d, 7
xor r8d, r8d
mov rdx, qword [rsp + 0x68]
mov rax, qword [rsp + 0x60]
mov rcx, qword [rax]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
add rsp, 0x58
ret

Function at 0x140004f84
Capabilities:
Open clipboard

Disassembly:
jmp 0x1400ce030
mov qword [rsp + 8], rcx
sub rsp, 0x38
mov rax, qword [rsp + 0x40]
mov rcx, qword [rax]
call qword [sym.imp.USER32.dll_IsWindow]
test eax, eax
jne 0x1400ce086
lea rax, str.::IsWindow_m_hWnd_
mov qword [rsp + 0x28], rax
lea rax, [0x140214388]
mov qword [rsp + 0x20], rax
xor r9d, r9d
mov r8d, 0x6ee
lea rdx, [0x14021e6b0]
mov ecx, 2
call qword [sym.imp.MSVCR120D.dll__CrtDbgReportW]
cmp eax, 1
jne 0x1400ce086
int3
mov rax, qword [rsp + 0x40]
mov rcx, qword [rax]
call qword [sym.imp.USER32.dll_OpenClipboard]
add rsp, 0x38
ret
Function at 0x1400053d0
Capabilities:
Read file on windows

Disassembly:
jmp 0x140080050
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x2d8
mov qword [rsp + 0x48], 0xfffffffffffffffe
mov rax, qword [0x14028c8d0]
xor rax, rsp
mov qword [rsp + 0x2c0], rax
mov qword [rsp + 0x28], 0
lea rcx, [rsp + 0x20]
call fcn.140002ee6
mov rcx, qword [rsp + 0x2f0]
call fcn.140002ae5
xor edx, edx
mov rcx, qword [rsp + 0x2e8]
call fcn.140003d2d
lea r8, [0x1402234c0]
mov rdx, rax
lea rcx, [rsp + 0x28]
call qword [sym.imp.MSVCR120D.dll__wfopen_s]
cmp qword [rsp + 0x28], 0
jne 0x1400800eb
mov dword [rsp + 0x3c], 0xffffffff
mov rcx, qword [rsp + 0x2e8]
call fcn.1400053e9
mov eax, dword [rsp + 0x3c]
jmp 0x1400801f3
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x20]
call fcn.1400048ea
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.MSVCR120D.dll_feof]
test eax, eax
jne 0x140080152
mov r9, qword [rsp + 0x28]
mov r8d, 0x200
mov edx, 1
lea rcx, [rsp + 0xc0]
call qword [sym.imp.MSVCR120D.dll_fread]
mov qword [rsp + 0x40], rax
cmp qword [rsp + 0x40], 0
jbe 0x140080150
mov r9d, dword [rsp + 0x40]
lea r8, [rsp + 0xc0]
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x20]
call fcn.140004647
jmp 0x1400800fa
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.MSVCR120D.dll_fclose]
lea r8, [rsp + 0x50]
lea rdx, [rsp + 0xb0]
lea rcx, [rsp + 0x20]
call fcn.140003b89
mov dword [rsp + 0x24], 0
jmp 0x140080188
mov eax, dword [rsp + 0x24]
inc eax
mov dword [rsp + 0x24], eax
cmp dword [rsp + 0x24], 0x10
jge 0x1400801da
lea rcx, [rsp + 0x30]
call fcn.140002d51
nop
movsxd rax, dword [rsp + 0x24]
movzx eax, byte [rsp + rax + 0xb0]
mov r8d, eax
lea rdx, str._02x
lea rcx, [rsp + 0x30]
call fcn.140001d8e
lea rdx, [rsp + 0x30]
mov rcx, qword [rsp + 0x2f0]
call fcn.1400033c3
nop
lea rcx, [rsp + 0x30]
call fcn.1400053e9
jmp 0x14008017e
mov dword [rsp + 0x38], 0
mov rcx, qword [rsp + 0x2e8]
call fcn.1400053e9
mov eax, dword [rsp + 0x38]
mov rcx, qword [rsp + 0x2c0]
xor rcx, rsp
call fcn.1401b0dd0
add rsp, 0x2d8
ret

Function at 0x1400053ee
Capabilities:
Read file on windows

Disassembly:
jmp 0x1400a63f0
mov qword [rsp + 8], rcx
sub rsp, 0x48
mov rax, qword [0x14028c8d0]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.MSVCR120D.dll_rewind]
mov r9, qword [rsp + 0x50]
mov r8d, 1
mov edx, recv
lea rcx, [rsp + 0x28]
call qword [sym.imp.MSVCR120D.dll_fread]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 1
je 0x1400a643f
xor eax, eax
jmp 0x1400a6463
mov r8d, 2
lea rdx, [0x14022a3fc]
lea rcx, [rsp + 0x28]
call sub.MSVCR120D.dll_memcmp
test eax, eax
je 0x1400a645e
xor eax, eax
jmp 0x1400a6463
mov eax, 1
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.1401b0dd0
add rsp, 0x48
ret
Function at 0x140005745
Capabilities:
Get graphical window text

Disassembly:
jmp 0x14005b830
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x38
mov rax, qword [rsp + 0x40]
mov rcx, qword [rax]
call qword [sym.imp.USER32.dll_IsWindow]
test eax, eax
jne 0x14005b890
lea rax, str.::IsWindow_m_hWnd_
mov qword [rsp + 0x28], rax
lea rax, [0x140214388]
mov qword [rsp + 0x20], rax
xor r9d, r9d
mov r8d, 0x3bc
lea rdx, [0x14021e6b0]
mov ecx, 2
call qword [sym.imp.MSVCR120D.dll__CrtDbgReportW]
cmp eax, 1
jne 0x14005b890
int3
mov r8d, dword [rsp + 0x50]
mov rdx, qword [rsp + 0x48]
mov rax, qword [rsp + 0x40]
mov rcx, qword [rax]
call qword [sym.imp.USER32.dll_GetWindowTextW]
add rsp, 0x38
ret

Function at 0x1400057d1
Capabilities:
Encrypt data using rc4 prga

Disassembly:
jmp 0x14006ba10
mov qword [rsp + 8], rcx
sub rsp, 0x58
mov rax, qword [0x14028c8d0]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x30], 0xffffffff
mov dword [rsp + 0x34], 0xffffffff
mov dword [rsp + 0x38], 0xffffffff
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
jmp 0x14006ba5d
mov eax, dword [rsp + 0x20]
inc eax
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x20], 2
jge 0x14006baef
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x28], rax
jmp 0x14006ba84
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.USER32.dll_CharNextW]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
movzx eax, word [rax]
test eax, eax
je 0x14006bad7
mov rax, qword [rsp + 0x28]
movzx eax, word [rax]
cmp eax, 0x2c
jne 0x14006bad5
xor eax, eax
mov rcx, qword [rsp + 0x28]
mov word [rcx], ax
mov rcx, qword [rsp + 0x60]
call fcn.1400060dc
movsxd rcx, dword [rsp + 0x20]
mov dword [rsp + rcx*4 + 0x30], eax
mov eax, 2
imul rax, rax, 1
mov rcx, qword [rsp + 0x28]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x60], rax
jmp 0x14006bad7
jmp 0x14006ba74
movsxd rax, dword [rsp + 0x20]
cmp dword [rsp + rax*4 + 0x30], 0xffffffff
jne 0x14006baea
mov eax, 0xffffffff
jmp 0x14006bb4d
jmp 0x14006ba53
mov rax, qword [rsp + 0x60]
movzx eax, word [rax]
test eax, eax
jne 0x14006bb02
mov eax, 0xffffffff
jmp 0x14006bb4d
mov rcx, qword [rsp + 0x60]
call fcn.1400060dc
mov ecx, 4
imul rcx, rcx, 2
mov dword [rsp + rcx + 0x30], eax
mov eax, 4
imul rax, rax, 0
movzx eax, byte [rsp + rax + 0x30]
mov ecx, 4
imul rcx, rcx, 1
movzx ecx, byte [rsp + rcx + 0x30]
shl ecx, 8
or eax, ecx
mov ecx, 4
imul rcx, rcx, 2
movzx ecx, byte [rsp + rcx + 0x30]
shl ecx, 0x10
or eax, ecx
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.1401b0dd0
add rsp, 0x58
ret