joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10005bc20
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rbp
mov rbp, rsp
lea rsp, [rsp - 0x2b0]
mov qword [rbp - 0x290], rbx
mov qword [rbp - 0x288], rdi
mov qword [rbp - 0x280], rsi
mov qword [rbp - 8], rcx
mov byte [rbp - 0x10], dl
mov bl, r8b
lea rdx, [0x1001da878]
lea rcx, [rbp - 0x278]
call fcn.10000f8e0
nop
mov rcx, qword [rbp - 8]
test rcx, rcx
jne 0x10005bc6f
lea rcx, [0x100294460]
call sub.kernel32.dll_GetFileAttributesW
mov esi, eax
cmp esi, 0xffffffff
jne 0x10005bcb2
call sub.kernel32.dll_GetLastError
cmp eax, 0xa1
jbe 0x10005bc8d
clc
jmp 0x10005bc94
bt dword [0x1001d9ac8], eax
jb 0x10005bcaa
mov rcx, rbp
call fcn.10005bd60
test al, al
je 0x10005bcaa
mov dil, 1
jmp 0x10005bd30
xor dil, dil
jmp 0x10005bd30
mov eax, esi
and eax, 0x10
movzx ecx, byte [rbp - 0x10]
lea rdx, [0x1001a6b30]
cmp eax, dword [rdx + rcx*4]
sete dil
and bl, dil
je 0x10005bd30
and esi, 0x400
je 0x10005bd30
lea rbx, [rbp - 0x278]
lea rdx, [0x1001da878]
mov rcx, rbx
call fcn.10000f9c0
mov rdx, rbx
mov rcx, qword [rbp - 8]
xor r8b, r8b
call fcn.10005b850
test eax, eax
je 0x10005bd0c
sub eax, 1
je 0x10005bd24
jmp 0x10005bd2c
mov dl, byte [rbp - 0x10]
mov rcx, qword [rbp - 0x278]
xor r8b, r8b
call fcn.10005bc20
mov dil, al
jmp 0x10005bd30
mov dil, 1
jmp 0x10005bd30
xor dil, dil
nop
nop
mov rcx, rbp
call fcn.10005bbf0
mov al, dil
mov rbx, qword [rbp - 0x290]
mov rdi, qword [rbp - 0x288]
mov rsi, qword [rbp - 0x280]
lea rsp, [rbp]
pop rbp
ret

Function at 0x10005bfb0
Capabilities:
Get file attributes

Disassembly:
lea rsp, [rsp - 0x28]
test rcx, rcx
jne 0x10005bfc1
lea rcx, [0x100294460]
call sub.kernel32.dll_GetFileAttributesW
nop
lea rsp, [rsp + 0x28]
ret

Function at 0x10005c090
Capabilities:
Get geographical location

Disassembly:
push rbp
mov rbp, rsp
lea rsp, [rsp - 0x50]
mov qword [rbp - 0x30], rbx
mov qword [rbp - 0x28], rdi
mov qword [rbp - 0x20], rsi
mov qword [rbp - 0x18], r12
mov qword [rbp - 0x10], r13
mov rsi, rcx
mov edi, edx
mov r12d, r8d
mov r13, r9
mov qword [rbp - 8], 0
nop
mov edx, r12d
mov ecx, edi
xor r9d, r9d
xor r8, r8
call sub.kernel32.dll_GetLocaleInfoW
mov ebx, eax
test ebx, ebx
jle 0x10005c111
movsxd rdx, ebx
sub rdx, 1
lea rcx, [rbp - 8]
call fcn.10000c300
cmp ebx, 1
jle 0x10005c100
mov r8, qword [rbp - 8]
mov r9d, ebx
mov edx, r12d
mov ecx, edi
call sub.kernel32.dll_GetLocaleInfoW
mov ebx, eax
nop
mov rcx, rsi
mov rdx, qword [rbp - 8]
xor r8d, r8d
call fcn.10000b950
jmp 0x10005c11c
mov rcx, rsi
mov rdx, r13
call fcn.100008e90
nop
mov rcx, rbp
call fcn.10005c070
mov rbx, qword [rbp - 0x30]
mov rdi, qword [rbp - 0x28]
mov rsi, qword [rbp - 0x20]
mov r12, qword [rbp - 0x18]
mov r13, qword [rbp - 0x10]
lea rsp, [rbp]
pop rbp
ret
Function at 0x10005c5e0
Capabilities:
Get geographical location

Disassembly:
push rbp
mov rbp, rsp
lea rsp, [rsp - 0x60]
mov qword [rbp - 0x28], rbx
mov qword [rbp - 0x20], rsi
mov qword [rbp - 0x18], 0
nop
xor ebx, ebx
nop dword [rax]
add ebx, 1
mov eax, ebx
lea rdx, [0x100295f90]
lea rcx, [rdx + rax*8 - 8]
xor edx, edx
call fcn.100008e90
mov eax, ebx
lea rdx, [0x100295fd0]
mov dword [rdx + rax*4 - 4], 0xffffffff
cmp ebx, 7
jl 0x10005c600
call sub.kernel32.dll_GetThreadLocale
mov esi, eax
lea r8, [rbp - 0xc]
mov ecx, esi
mov r9d, 0xb
mov edx, 0x100b
call sub.kernel32.dll_GetLocaleInfoA
test eax, eax
jle 0x10005c6b4
nop
mov byte [rsp + 0x20], 1
lea rdx, [rbp - 0xc]
xor r9d, r9d
mov r8d, 0xa
lea rcx, [rbp - 0x18]
call fcn.1000099b0
mov rcx, qword [rbp - 0x18]
mov edx, 1
call fcn.1000516e0
mov ebx, eax
sub eax, 3
cmp eax, 3
jae 0x10005c6b4
lea rcx, [0x10005c480]
mov r8d, ebx
mov edx, esi
mov r9d, 4
call sub.kernel32.dll_EnumCalendarInfoA
lea rcx, [0x10005c530]
mov r8d, ebx
mov edx, esi
mov r9d, 3
call sub.kernel32.dll_EnumCalendarInfoA
nop dword [rax]
nop
mov rcx, rbp
call fcn.10005c5c0
mov rbx, qword [rbp - 0x28]
mov rsi, qword [rbp - 0x20]
lea rsp, [rbp]
pop rbp
ret

Function at 0x10005cd70
Capabilities:
Query environment variable

Disassembly:
push rbp
mov rbp, rsp
lea rsp, [rsp - 0x60]
mov qword [rbp - 0x40], rbx
mov qword [rbp - 0x38], rdi
mov qword [rbp - 0x30], rsi
mov qword [rbp - 0x28], r12
mov rbx, rcx
mov rsi, rdx
mov qword [rbp - 8], 0
mov qword [rbp - 0x10], 0
mov qword [rbp - 0x20], 0
mov qword [rbp - 0x18], 0
nop
mov rcx, rbx
xor edx, edx
call fcn.10000bb70
call sub.kernel32.dll_GetEnvironmentStringsW
mov rdi, rax
mov r12, rdi
mov rdx, rsi
lea rcx, [rbp - 0x10]
call fcn.100058080
jmp 0x10005ce71
mov rdx, r12
lea rcx, [rbp - 8]
call fcn.10000bb00
mov rdx, qword [rbp - 8]
mov r8d, 1
mov ecx, 0x3d
call fcn.10000c760
mov esi, eax
movsxd r9, eax
sub r9, 1
mov rdx, qword [rbp - 8]
mov r8d, 1
lea rcx, [rbp - 0x20]
call fcn.10000c4e0
mov rdx, qword [rbp - 0x20]
lea rcx, [rbp - 0x18]
call fcn.100058080
mov rcx, qword [rbp - 0x18]
mov rdx, qword [rbp - 0x10]
call fcn.10000c2b0
test rax, rax
jne 0x10005ce5c
mov r9, qword [rbp - 8]
test r9, r9
je 0x10005ce40
mov r9, qword [r9 - 8]
movsxd rax, esi
sub r9, rax
movsxd rax, esi
lea r8, [rax + 1]
mov rcx, rbx
mov rdx, qword [rbp - 8]
call fcn.10000c4e0
jmp 0x10005ce7e
mov rcx, r12
call fcn.100003fa0
shl rax, 1
add rax, r12
add rax, 2
mov r12, rax
cmp word [r12], 0
jne 0x10005cdd8
mov rcx, rdi
call sub.kernel32.dll_FreeEnvironmentStringsW
nop
mov rcx, rbp
call fcn.10005cd30
mov rbx, qword [rbp - 0x40]
mov rdi, qword [rbp - 0x38]
mov rsi, qword [rbp - 0x30]
mov r12, qword [rbp - 0x28]
lea rsp, [rbp]
pop rbp
ret
Function at 0x10005cef0
Capabilities:
Check os version

Disassembly:
lea rsp, [rsp - 0xb8]
mov qword [0x100296010], 0
mov dword [rsp + 0x20], 0x94
lea rcx, [rsp + 0x20]
call sub.kernel32.dll_GetVersionExA
mov eax, dword [rsp + 0x30]
mov dword [0x100295e50], eax
mov eax, dword [rsp + 0x24]
mov dword [0x100295e60], eax
mov eax, dword [rsp + 0x28]
mov dword [0x100295e70], eax
mov eax, dword [rsp + 0x2c]
mov dword [0x100295e80], eax
lea rdx, [0x100295e91]
lea rcx, [rsp + 0x34]
mov r8d, pe_nt_image_headers64
call fcn.100002d70
lea rcx, [rsp + 0x34]
call fcn.100003f70
mov byte [0x100295e90], al
lea rcx, [0x1001d9bf8]
call sub.kernel32.dll_GetModuleHandleA
mov qword [0x100296020], rax
test rax, rax
je 0x10005cf98
mov rcx, qword [0x100296020]
lea rdx, [0x1001d9c08]
call sub.kernel32.dll_GetProcAddress
mov qword [0x100296010], rax
nop
cmp dword [0x100295e60], 6
jae 0x10005cfac
mov dword [0x1001a5da0], 0
nop
cmp dword [0x100295e60], 6
jb 0x10005cfc8
cmp dword [0x100295e70], 1
jb 0x10005cfc8
mov dword [0x1001a5db0], 2
nop
lea rsp, [rsp + 0xb8]
ret

Function at 0x1000a2700
Capabilities:
Hash data with crc32

Disassembly:
mov eax, 0xffffffff
nop dword [rax]
add eax, 1
mov ecx, eax
mov r8d, 0xffffffff
nop dword [rax + rax]
add r8d, 1
mov edx, ecx
and edx, 1
cmp edx, 1
jne 0x1000a2734
mov edx, ecx
shr edx, 1
xor edx, 0xedb88320
mov ecx, edx
jmp 0x1000a2736
shr ecx, 1
cmp r8d, 7
jl 0x1000a2718
mov edx, eax
lea r9, [0x1002966f0]
mov dword [r9 + rdx*4], ecx
cmp eax, 0xff
jl 0x1000a2708
ret

Function at 0x1000a2760
Capabilities:
Encode data using xor

Disassembly:
push rbx
mov eax, ecx
lea ecx, [r8d - 1]
test ecx, ecx
jl 0x1000a27b0
mov r8d, 0xffffffff
nop word [rax + rax]
add r8d, 1
mov r9b, al
xor r9b, byte [rdx]
and r9d, 0xff
mov r10d, r9d
and r9d, r9d
mov r11d, eax
shr r11d, 8
lea rbx, [0x1002966f0]
xor r11d, dword [rbx + r9*4]
mov eax, r11d
add rdx, 1
cmp ecx, r8d
jg 0x1000a2778
nop dword [rax]
pop rbx
ret
Function at 0x1000a44a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbx
push rdi
push rsi
push r12
push r13
push r14
lea rsp, [rsp - 0x28]
mov rbx, rcx
mov r14d, dword [rbx + 0x34]
nop dword [rax]
mov rax, rbx
mov edx, dword [rax + 0x48]
mov ecx, dword [rax + 0x8c]
sub edx, ecx
sub edx, dword [rax + 0x84]
mov esi, edx
test edx, edx
jne 0x1000a44ef
mov rax, rbx
cmp dword [rax + 0x84], 0
jne 0x1000a44ef
cmp dword [rax + 0x8c], 0
jne 0x1000a44ef
mov esi, r14d
jmp 0x1000a45c8
cmp esi, 0xffffffff
jne 0x1000a44ff
sub esi, 1
jmp 0x1000a45c8
mov ecx, dword [rbx + 0x84]
mov eax, r14d
lea rdx, [rax - 0x106]
add rax, rdx
cmp rcx, rax
jl 0x1000a45c8
mov rdx, qword [rbx + 0x40]
mov eax, r14d
lea rcx, [rdx + rax]
mov rdx, qword [rbx + 0x40]
mov r8d, r14d
call fcn.100002d70
sub dword [rbx + 0x88], r14d
sub dword [rbx + 0x84], r14d
mov eax, r14d
sub dword [rbx + 0x74], eax
mov edi, dword [rbx + 0x64]
mov rdx, qword [rbx + 0x58]
mov eax, edi
lea r12, [rdx + rax*2]
nop dword [rax + rax]
sub r12, 2
movzx eax, word [r12]
mov r13d, eax
cmp r14d, r13d
ja 0x1000a4578
mov eax, r13d
mov edx, r14d
sub eax, edx
mov word [r12], ax
jmp 0x1000a457f
mov word [r12], 0
sub edi, 1
jne 0x1000a4558
mov edi, r14d
mov rdx, qword [rbx + 0x50]
mov eax, edi
lea r12, [rdx + rax*2]
nop dword [rax]
sub r12, 2
movzx eax, word [r12]
mov r13d, eax
cmp r14d, r13d
ja 0x1000a45b8
mov eax, r13d
mov edx, r14d
sub eax, edx
mov word [r12], ax
jmp 0x1000a45bf
mov word [r12], 0
sub edi, 1
jne 0x1000a4598
add esi, r14d
nop
mov rax, qword [rbx]
cmp dword [rax + 8], 0
je 0x1000a4668
nop dword [rax]
mov rax, rbx
mov rcx, qword [rax + 0x40]
mov edx, dword [rax + 0x84]
mov eax, dword [rax + 0x8c]
add rax, rdx
lea rdx, [rcx + rax]
mov rcx, qword [rbx]
mov r8d, esi
call fcn.1000a4070
mov edi, eax
add dword [rbx + 0x8c], edi
cmp dword [rbx + 0x8c], 3
jb 0x1000a464c
mov rax, rbx
mov rdx, qword [rax + 0x40]
mov eax, dword [rax + 0x84]
movzx eax, byte [rdx + rax]
mov dword [rbx + 0x60], eax
mov rax, rbx
mov rcx, qword [rax + 0x40]
mov edx, dword [rax + 0x84]
movzx r9d, byte [rcx + rdx + 1]
mov edx, dword [rax + 0x70]
mov r8d, dword [rax + 0x60]
mov ecx, edx
shl r8d, cl
xor r9d, r8d
and r9d, dword [rax + 0x6c]
mov dword [rbx + 0x60], r9d
mov rax, rbx
cmp dword [rax + 0x8c], 0x106
jae 0x1000a4668
mov rax, qword [rax]
cmp dword [rax + 8], 0
jne 0x1000a44b8
nop
lea rsp, [rsp + 0x28]
pop r14
pop r13
pop r12
pop rsi
pop rdi
pop rbx
ret
Function at 0x1000c7580
Capabilities:
Create process on windows

Disassembly:
push rbp
mov rbp, rsp
lea rsp, [rsp - 0x80]
mov qword [rbp - 8], rcx
mov rcx, qword [rbp - 8]
call fcn.100008e60
mov qword [rbp - 0x18], 0
mov qword [rbp - 0x48], 0
nop
mov byte [rbp - 0xc], 0
cmp qword [rbp - 8], 0
je 0x1000c75b4
jmp 0x1000c75bc
jmp 0x1000c76c1
mov rax, qword [rbp - 8]
mov rcx, rax
call fcn.1000c7010
mov byte [rbp - 0x28], al
cmp byte [rbp - 0x28], 0
jne 0x1000c75d3
jmp 0x1000c75f5
mov rcx, qword [rbp - 8]
call fcn.1000c70a0
test al, al
jne 0x1000c75e2
jmp 0x1000c75f5
mov rcx, qword [rbp - 8]
mov dl, 1
call fcn.1000c7200
mov byte [rbp - 0xc], al
jmp 0x1000c76c1
cmp byte [rbp - 0x28], 0
jne 0x1000c75fd
jmp 0x1000c7620
mov rdx, qword [rbp - 8]
mov r8, 1
mov ecx, 0x20
call fcn.10000a030
cmp rax, 0
jg 0x1000c761a
jmp 0x1000c7620
mov byte [rbp - 0x24], 1
jmp 0x1000c7624
mov byte [rbp - 0x24], 0
cmp byte [rbp - 0x24], 0
jne 0x1000c762c
jmp 0x1000c7664
lea rax, [0x1001f8178]
mov qword [rbp - 0x40], rax
mov rax, qword [rbp - 8]
mov qword [rbp - 0x38], rax
lea rax, [0x1001f8178]
mov qword [rbp - 0x30], rax
lea rdx, [rbp - 0x40]
lea rcx, [rbp - 8]
mov r9d, 0
mov r8, 2
call fcn.100009280
mov rdx, qword [rbp - 8]
lea rcx, [rbp - 0x48]
call fcn.10000d480
mov rdx, qword [rbp - 0x48]
lea rcx, [rbp - 0x18]
call fcn.10000ba60
mov dword [rsp + 0x28], 1
mov qword [rsp + 0x20], 0
mov r8, qword [rbp - 0x18]
test r8, r8
jne 0x1000c769f
lea r8, [0x100294460]
mov r9, 0
mov rdx, 0
mov rcx, 0
call sub.shell32.dll_ShellExecuteW
cmp rax, 0x20
seta byte [rbp - 0xc]
nop
mov rcx, rbp
call fcn.1000c7550
mov al, byte [rbp - 0xc]
nop
lea rsp, [rbp]
pop rbp
ret

Function at 0x1000c7c90
Capabilities:
Encrypt data using rc4 prga

Disassembly:
xor eax, eax
lea rdx, [rcx + 1]
movzx r8d, byte [rcx]
add r8d, 1
and r8d, 0xff
add rcx, r8
jmp 0x1000c7ccb
mov r8d, eax
shl r8d, 5
mov r9d, eax
sub r8d, r9d
movzx r9d, byte [rdx]
xor r8d, r9d
mov eax, r8d
add rdx, 1
cmp rcx, rdx
ja 0x1000c7cb0
ret
Function at 0x1000d6190
Capabilities:
Check for software breakpoints

Disassembly:
push rbx
push rdi
push rsi
lea rsp, [rsp - 0x20]
mov rbx, rcx
cmp dword [rbx + 0x24], 0xca
jne 0x1000d61cc
mov rcx, rbx
call fcn.1000dac10
cmp byte [rbx + 0x50], 0
je 0x1000d61c4
mov dword [rbx + 0x24], 0xcf
mov dil, 1
jmp 0x1000d628f
mov dword [rbx + 0x24], 0xcb
nop
cmp dword [rbx + 0x24], 0xcb
jne 0x1000d626a
mov rax, qword [rbx + 0x208]
cmp byte [rax + 0x20], 0
je 0x1000d625c
nop word [rax + rax]
cmp qword [rbx + 0x10], 0
je 0x1000d6200
mov rcx, rbx
mov rax, qword [rbx + 0x10]
call qword [rax]
mov rcx, rbx
mov rax, qword [rbx + 0x208]
call qword [rax]
mov esi, eax
test eax, eax
jne 0x1000d621c
xor dil, dil
jmp 0x1000d628f
cmp esi, 2
je 0x1000d625a
nop dword [rax]
cmp qword [rbx + 0x10], 0
je 0x1000d61f0
cmp esi, 3
je 0x1000d6235
cmp esi, 1
jne 0x1000d61f0
mov rax, qword [rbx + 0x10]
add dword [rax + 8], 1
mov rax, qword [rbx + 0x10]
mov edx, dword [rax + 8]
cmp edx, dword [rax + 0xc]
jl 0x1000d61f0
mov rdx, qword [rbx + 0x10]
mov eax, dword [rbx + 0x16c]
add dword [rdx + 0xc], eax
nop
jmp 0x1000d61f0
nop
mov eax, dword [rbx + 0x84]
mov dword [rbx + 0x8c], eax
jmp 0x1000d6284
cmp dword [rbx + 0x24], 0xcc
je 0x1000d6284
mov r8d, dword [rbx + 0x24]
mov rcx, rbx
mov edx, 0x14
call fcn.1000d6680
mov rcx, rbx
call fcn.1000d62a0
mov dil, al
mov al, dil
nop
lea rsp, [rsp + 0x20]
pop rsi
pop rdi
pop rbx
ret
Function at 0x1000ff640
Capabilities:
Read clipboard data

Disassembly:
push rbp
mov rbp, rsp
lea rsp, [rsp - 0x40]
mov qword [rbp - 0x10], rcx
mov qword [rbp - 8], rdx
mov byte [rbp - 0x14], 0
mov rax, qword [rbp - 0x10]
mov ecx, dword [rax - 0x10]
call sub.user32.dll_GetClipboardData
mov rdx, qword [rbp - 0x10]
mov qword [rdx - 0x30], rax
mov rax, qword [rbp - 0x10]
cmp qword [rax - 0x30], 0
jne 0x1000ff676
jmp 0x1000ff6dc
mov rax, qword [rbp - 0x10]
mov rcx, qword [rax - 0x30]
call sub.kernel32.dll_GlobalSize
mov rdx, qword [rbp - 0x10]
mov dword [rdx - 0x3c], eax
mov rax, qword [rbp - 0x10]
cmp dword [rax - 0x3c], 0
jg 0x1000ff696
jmp 0x1000ff6dc
mov rax, qword [rbp - 0x10]
mov rcx, qword [rax - 0x30]
call sub.kernel32.dll_GlobalLock
mov rdx, qword [rbp - 0x10]
mov qword [rdx - 0x38], rax
nop
mov rax, qword [rbp - 0x10]
mov rdx, qword [rax - 0x38]
mov rax, qword [rbp - 0x10]
mov r8d, dword [rax - 0x3c]
mov rcx, qword [rbp - 8]
mov rax, qword [rbp - 8]
mov rax, qword [rax]
call qword [rax + 0x108]
nop
mov rcx, rbp
call fcn.1000ff610
mov byte [rbp - 0x14], 1
nop
mov al, byte [rbp - 0x14]
nop
lea rsp, [rbp]
pop rbp
ret
Function at 0x1000fff00
Capabilities:
Write clipboard data

Disassembly:
push rbp
mov rbp, rsp
lea rsp, [rsp - 0xf0]
mov qword [rbp - 0x50], rbx
mov qword [rbp - 0x18], rcx
mov dword [rbp - 8], edx
mov qword [rbp - 0x10], r8
mov qword [rbp - 0x48], 0
mov qword [rbp - 0x38], 0
nop
mov rax, qword [rbp - 0x10]
mov rdx, qword [rbp - 0x10]
mov rdx, qword [rdx]
mov rcx, rax
call qword [rdx + 0xe0]
mov rdx, rax
mov ecx, 2
call sub.kernel32.dll_GlobalAlloc
mov qword [rbp - 0x20], rax
cmp qword [rbp - 0x20], 0
je 0x1000fff5d
jmp 0x100100058
mov rcx, qword [rbp - 0x10]
mov rax, qword [rbp - 0x10]
mov rax, qword [rax]
call qword [rax + 0xe0]
mov qword [rbp - 0x40], rax
mov rdx, qword [rbp - 0x40]
lea rcx, [rbp - 0x38]
call fcn.100078120
mov rax, qword [rbp - 0x38]
mov qword [rbp - 0x30], rax
mov rdx, qword [rbp - 0x20]
lea rcx, [rbp - 0x48]
call fcn.100078180
mov rax, qword [rbp - 0x48]
mov qword [rbp - 0x40], rax
call fcn.100078930
mov rbx, rax
mov qword [rsp + 0x90], 0
mov qword [rsp + 0x88], 0
mov qword [rsp + 0x80], 0
mov qword [rsp + 0x78], 0
mov qword [rsp + 0x70], 0
mov qword [rsp + 0x68], 0
mov qword [rsp + 0x60], 0
mov qword [rsp + 0x58], 0
mov qword [rsp + 0x50], 0
mov qword [rsp + 0x48], 0
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
mov rax, qword [rbp - 0x30]
mov qword [rsp + 0x20], rax
lea r9, str._DataSize
mov r8, qword [rbp - 0x40]
lea rdx, str.TWin32WidgetSet.ClipboardGetOwnerShip_DataHandle
mov rcx, rbx
call fcn.10007a2b0
mov rax, qword [rbp - 0x18]
mov byte [rax - 0x24], 0
jmp 0x1001000a4
mov rcx, qword [rbp - 0x20]
call sub.kernel32.dll_GlobalLock
mov qword [rbp - 0x28], rax
nop
mov rcx, qword [rbp - 0x10]
mov rax, qword [rbp - 0x10]
mov rax, qword [rax]
call qword [rax + 0xe0]
mov r8, rax
mov rdx, qword [rbp - 0x28]
mov rcx, qword [rbp - 0x10]
mov rax, qword [rbp - 0x10]
mov rax, qword [rax]
call qword [rax + 0x100]
nop
mov rcx, rbp
call fcn.1000ffeb0
mov rdx, qword [rbp - 0x20]
mov ecx, dword [rbp - 8]
call sub.user32.dll_SetClipboardData
nop
mov rcx, rbp
call fcn.1000ffed0
mov rbx, qword [rbp - 0x50]
lea rsp, [rbp]
pop rbp
ret
Function at 0x140f7f4d8
Capabilities:
Encode data using xor

Disassembly:
jmp 0x140f7f4e2
push rax
push rcx
push rdx
push rbx
push rbp
push rsi
push rdi
push r8
push r9
push r10
push r11
push r12
push r13
push r14
push r15
pushfq
sub rsp, 8
stmxcsr dword [rsp]
call 0x140f7f50b
pop rbp
sub rbp, 0x33
sub rbp, 0xf7f4d8
sub rsp, 0x20
jmp 0x140f7f52a
mov rax, 0xf7f4d8
add rax, rbp
add rax, 0x84
mov rcx, 0x60b
add byte [rax - 0x39], cl
ror dword [rbx], 6
add byte [rax], al
mov rdx, 0xffffffffc473cc96
invalid
xor byte [rax], dl
inc rax
dec rcx
jne 0x140f7f549
invalid
jmp 0x140f7f560
ficomp word [rdi]
jg 0x140f7f581
invalid
fisub word [rcx + 0x74]
ficom word [rdi - 0x65e8e2a9]
xchg esi, eax
xchg esi, eax
xchg esi, eax
ficom word [rdi - 0x21393982]
cmp ch, byte cs:[rsi]
mov esp, 0x96969696
xchg esi, eax
fisubr word [rdi]
mov edx, 0x96965baa
xchg esi, eax
xchg esi, eax
xchg esi, eax
ficom word [rdi - 0xcd32181]
imul ecx, dword [rbp - 0x41], 0x96969696
jle 0x140f7f548
xchg esi, eax
xchg esi, eax
xchg esi, eax
jg 0x140f7f53a
xchg esi, eax
xchg esi, eax
xchg esi, eax
push rdi
jle 0x140f7f554
cmpsd dword [rsi], dword [rdi]
xchg esi, ebx
invalid
Function at 0x14001b150
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 8], rcx
push rdi
push r14
push r15
sub rsp, 0x40
mov qword [rsp + 0x28], 0xfffffffffffffffe
mov qword [rsp + 0x68], rbx
mov qword [rsp + 0x70], rsi
mov rdi, r9
mov r14, rdx
mov rsi, rcx
movzx ecx, byte [r8]
mov eax, ecx
movabs rdx, 0xcbf29ce484222325
xor rax, rdx
movabs rdx, 0x100000001b3
imul rax, rdx
mov r8, qword [rsi + 0x30]
and r8, rax
add r8, r8
mov rdx, qword [rsi + 0x18]
mov rbx, qword [rsi + 8]
mov rax, qword [rdx + r8*8]
cmp rbx, rax
je 0x14001b1ec
mov rbx, qword [rdx + r8*8 + 8]
mov rbx, qword [rbx]
cmp rbx, rax
je 0x14001b1ec
mov rbx, qword [rbx + 8]
cmp cl, byte [rbx + 0x10]
jne 0x14001b1c3
mov rdx, rdi
mov rcx, rsi
call fcn.14001dc50
mov qword [r14], rbx
mov byte [r14 + 8], 0
mov rax, r14
jmp 0x14001b31b
mov qword [rsp + 0x20], rdi
mov rax, qword [r9]
cmp rbx, rax
je 0x14001b226
mov rcx, qword [r9 + 8]
mov qword [rcx], rax
mov rcx, qword [rax + 8]
mov qword [rcx], rbx
mov rcx, qword [rbx + 8]
mov qword [rcx], rdi
mov rdx, qword [rbx + 8]
mov rcx, qword [rax + 8]
mov qword [rbx + 8], rcx
mov rcx, qword [r9 + 8]
mov qword [rax + 8], rcx
mov qword [r9 + 8], rdx
mov rdx, qword [rsi + 0x18]
mov rax, qword [rdx + r8*8]
cmp rax, qword [rsi + 8]
jne 0x14001b243
mov qword [rdx + r8*8], rdi
mov rax, qword [rsi + 0x18]
mov qword [rax + r8*8 + 8], rdi
jmp 0x14001b272
cmp rax, rbx
jne 0x14001b24e
mov qword [rdx + r8*8], rdi
jmp 0x14001b272
mov rax, qword [rdx + r8*8 + 8]
mov rcx, qword [rax]
mov qword [rdx + r8*8 + 8], rcx
cmp rcx, rdi
je 0x14001b272
mov rdx, qword [rsi + 0x18]
mov rax, qword [rdx + r8*8 + 8]
mov rcx, qword [rax + 8]
mov qword [rdx + r8*8 + 8], rcx
mov rax, qword [rsi + 0x10]
mov rdx, qword [rsi + 0x38]
xorps xmm0, xmm0
cvtsi2ss xmm0, rax
movss xmm1, dword [0x1401b6b20]
test rax, rax
jns 0x14001b293
addss xmm0, xmm1
xorps xmm2, xmm2
cvtsi2ss xmm2, rdx
test rdx, rdx
jns 0x14001b2a4
addss xmm2, xmm1
divss xmm0, xmm2
comiss xmm0, dword [rsi]
jbe 0x14001b310
cmp rdx, 0x200
jae 0x14001b2c0
lea rdx, [rdx*8]
jmp 0x14001b2d2
movabs rax, 0xfffffffffffffff
cmp rdx, rax
jae 0x14001b2d2
add rdx, rdx
mov rcx, rsi
call fcn.14001ddb0
mov rax, qword [rsi + 8]
cmp qword [rax], rax
je 0x14001b310
mov r15, qword [rax + 8]
nop word [rax + rax]
mov rbx, qword [rsi + 8]
mov rbx, qword [rbx]
lea r8, [rbx + 0x10]
mov r9, rbx
lea rdx, [rsp + 0x30]
mov rcx, rsi
call fcn.14001b150
cmp rbx, r15
jne 0x14001b2f0
mov qword [r14], rdi
mov byte [r14 + 8], 1
mov rax, r14
mov rbx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x40
pop r15
pop r14
pop rdi
ret
Function at 0x14001bb50
Capabilities:
Hash data using fnv

Disassembly:
push rbx
sub rsp, 0x20
movzx eax, byte [r8 + 0x10]
mov r9, rcx
movabs rcx, 0xcbf29ce484222325
mov rbx, rdx
xor rax, rcx
movabs rcx, 0x100000001b3
imul rax, rcx
mov r10, qword [r9 + 0x30]
mov rcx, qword [r9 + 0x18]
and r10, rax
shl r10, 4
add rcx, r10
mov rax, qword [rcx]
cmp qword [rcx + 8], r8
jne 0x14001bbdc
cmp rax, r8
jne 0x14001bbc2
mov rax, qword [r9 + 8]
mov qword [rcx], rax
mov rcx, qword [r9 + 0x18]
mov rax, qword [r9 + 8]
mov qword [r10 + rcx + 8], rax
lea rcx, [r9 + 8]
call fcn.14001ec40
mov rax, rbx
add rsp, 0x20
pop rbx
ret
mov rax, qword [r8 + 8]
mov qword [rcx + 8], rax
lea rcx, [r9 + 8]
call fcn.14001ec40
mov rax, rbx
add rsp, 0x20
pop rbx
ret
cmp rax, r8
jne 0x14001bbe7
mov rax, qword [r8]
mov qword [rcx], rax
lea rcx, [r9 + 8]
call fcn.14001ec40
mov rax, rbx
add rsp, 0x20
pop rbx
ret

Function at 0x14001dcb0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x50
cmp qword [rcx + 0x68], 0
mov rbx, rcx
je 0x14001dd62
cmp byte [rcx + 0x71], 0
je 0x14001dd62
mov rax, qword [rcx]
mov edx, 0xffffffff
call qword [rax + 0x18]
cmp eax, 0xffffffff
je 0x14001dd12
mov rcx, qword [rbx + 0x68]
lea r8, [rsp + 0x60]
mov qword [rsp + 0x20], r8
lea rdx, [rbx + 0x74]
lea r9, [rsp + 0x50]
lea r8, [rsp + 0x30]
mov rax, qword [rcx]
call qword [rax + 0x40]
test eax, eax
je 0x14001dd1f
sub eax, 1
je 0x14001dd23
sub eax, 2
je 0x14001dd62
xor al, al
mov rbx, qword [rsp + 0x68]
add rsp, 0x50
pop rdi
ret
mov byte [rbx + 0x71], 0
mov rdi, qword [rsp + 0x60]
lea rax, [rsp + 0x30]
sub rdi, rax
je 0x14001dd50
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x30]
mov r8, rdi
mov edx, 1
call fcn.140171a5c
cmp rdi, rax
jne 0x14001dd12
cmp byte [rbx + 0x71], 0
sete al
mov rbx, qword [rsp + 0x68]
add rsp, 0x50
pop rdi
ret
mov rbx, qword [rsp + 0x68]
mov al, 1
add rsp, 0x50
pop rdi
ret
Function at 0x14001f970
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x70
mov edi, edx
mov rbx, rcx
cmp edx, 0xffffffff
jne 0x14001f994
xor eax, eax
mov rbx, qword [rsp + 0x88]
add rsp, 0x70
pop rdi
ret
mov rax, qword [rcx + 0x40]
mov rcx, qword [rax]
test rcx, rcx
je 0x14001f9d7
mov rdx, qword [rbx + 0x58]
movsxd r8, dword [rdx]
lea rax, [rcx + r8]
cmp rcx, rax
jae 0x14001f9d7
lea eax, [r8 - 1]
mov dword [rdx], eax
mov rcx, qword [rbx + 0x40]
mov rdx, qword [rcx]
lea rax, [rdx + 1]
mov qword [rcx], rax
mov eax, edi
mov byte [rdx], dil
mov rbx, qword [rsp + 0x88]
add rsp, 0x70
pop rdi
ret
cmp qword [rbx + 0x80], 0
mov qword [rsp + 0x80], rsi
je 0x14001fae2
mov r8, qword [rbx + 0x18]
lea rax, [rbx + 0x70]
cmp qword [r8], rax
jne 0x14001fa1a
mov rcx, qword [rbx + 0x88]
mov rdx, qword [rbx + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
mov rcx, qword [rbx + 0x68]
test rcx, rcx
jne 0x14001fa29
movsx ecx, dil
jmp 0x14001fa83
lea r8, [rsp + 0x90]
mov byte [rsp + 0x40], dil
mov rax, qword [rcx]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x38], r8
lea r9, [rsp + 0x41]
lea r8, [rsp + 0x68]
mov qword [rsp + 0x30], r8
lea r8, [rsp + 0x48]
mov qword [rsp + 0x28], r8
lea r8, [rsp + 0x98]
mov qword [rsp + 0x20], r8
lea r8, [rsp + 0x40]
call qword [rax + 0x38]
test eax, eax
js 0x14001fae2
cmp eax, 1
jle 0x14001fa9d
cmp eax, 3
jne 0x14001fae2
movsx ecx, byte [rsp + 0x40]
mov rdx, qword [rbx + 0x80]
call fcn.140171140
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x14001fae7
mov rsi, qword [rsp + 0x90]
lea rax, [rsp + 0x48]
sub rsi, rax
je 0x14001facd
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x48]
mov r8, rsi
mov edx, 1
call fcn.140171a5c
cmp rsi, rax
jne 0x14001fae2
lea rax, [rsp + 0x40]
mov byte [rbx + 0x71], 1
cmp qword [rsp + 0x98], rax
mov eax, edi
jne 0x14001fae7
mov eax, 0xffffffff
mov rsi, qword [rsp + 0x80]
mov rbx, qword [rsp + 0x88]
add rsp, 0x70
pop rdi
ret