joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400b49e0
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
mov r11, rsp
push rbx
push rsi
push rdi
sub rsp, 0x240
xor esi, esi
mov dword [r11 + 0x10], 0xff
lea rax, [r11 + 0x20]
xor edx, edx
mov qword [rsp + 0x38], rax
lea r9, [r11 + 0x10]
mov qword [rsp + 0x30], rsi
lea r8, [rsp + 0x40]
mov qword [rsp + 0x28], rsi
mov rdi, rcx
mov qword [rsp + 0x20], rsi
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
cmp eax, 0x103
je 0x1400b4aec
nop
mov rax, qword [0x140112060]
lea rdx, [rsp + 0x40]
xor r8d, r8d
mov rcx, rdi
mov r9d, dword [rax + 0x110]
lea rax, [rsp + 0x270]
or r9d, 0x20019
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ebx, eax
test eax, eax
jne 0x1400b4af9
mov rcx, qword [rsp + 0x270]
call fcn.1400b49e0
mov rcx, qword [rsp + 0x270]
mov ebx, eax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
jne 0x1400b4af9
lea rdx, [rsp + 0x40]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov ebx, eax
test eax, eax
jne 0x1400b4af9
lea rax, [rsp + 0x278]
mov dword [rsp + 0x268], 0xff
mov qword [rsp + 0x38], rax
lea r9, [rsp + 0x268]
mov qword [rsp + 0x30], rsi
lea r8, [rsp + 0x40]
mov qword [rsp + 0x28], rsi
xor edx, edx
mov rcx, rdi
mov qword [rsp + 0x20], rsi
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
cmp eax, 0x103
jne 0x1400b4a30
xor eax, eax
add rsp, 0x240
pop rdi
pop rsi
pop rbx
ret
mov eax, ebx
add rsp, 0x240
pop rdi
pop rsi
pop rbx
ret
Function at 0x1400b4b10
Capabilities:
Delete registry key
Delete registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x30
mov rsi, r9
mov rdi, r8
mov rbp, rdx
mov r14, rcx
test rdx, rdx
je 0x1400b4c3f
test r8, r8
je 0x1400b4b43
cmp word [r8], 0
jne 0x1400b4b4c
test rsi, rsi
je 0x1400b4c3f
mov rax, qword [0x140112060]
xor r8d, r8d
mov rdx, rdi
mov rcx, rbp
mov r9d, dword [rax + 0x110]
lea rax, [rsp + 0x58]
or r9d, 0x2001f
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ebx, eax
test eax, eax
jne 0x1400b4c44
mov rcx, qword [rsp + 0x58]
test rsi, rsi
jne 0x1400b4c27
call fcn.1400b49e0
mov rcx, qword [rsp + 0x58]
mov ebx, eax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
jne 0x1400b4c46
mov eax, dword [0x14011b6b0]
test al, 1
jne 0x1400b4be8
or eax, 1
lea rcx, str.advapi32
mov dword [0x14011b6b0], eax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, str.RegDeleteKeyExW
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r10, rax
mov qword [0x14011b6b8], rax
jmp 0x1400b4bef
mov r10, qword [0x14011b6b8]
mov rax, qword [0x140112060]
mov r8d, dword [rax + 0x110]
test r8d, r8d
je 0x1400b4c17
test r10, r10
je 0x1400b4c17
xor r9d, r9d
mov rdx, rdi
mov rcx, rbp
call r10
mov ebx, eax
jmp 0x1400b4c44
mov rdx, rdi
mov rcx, rbp
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov ebx, eax
jmp 0x1400b4c44
mov rdx, rsi
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov rcx, qword [rsp + 0x58]
mov ebx, eax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x1400b4c44
mov ebx, 0x57
test ebx, ebx
setne dl
mov r8d, ebx
mov rcx, r14
call fcn.14004d5e0
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x60]
add rsp, 0x30
pop r14
pop rdi
pop rsi
ret

Function at 0x1400bcd00
Capabilities:
Read file on windows

Disassembly:
sub rsp, 0x38
mov rcx, qword [rcx + 0x40]
lea r9, [rsp + 0x40]
xor eax, eax
mov dword [rsp + 0x40], eax
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [rsp + 0x40]
add rsp, 0x38
ret
Function at 0x1400c0080
Capabilities:
Get file attributes

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x270
mov rdi, rdx
mov rbx, rcx
test rcx, rcx
je 0x1400c0172
cmp word [rcx], 0
je 0x1400c0172
mov r8d, 4
lea rdx, [0x140101c80]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncmp]
test eax, eax
je 0x1400c00c5
mov rax, rbx
mov r8, rbx
jmp 0x1400c00d1
lea rax, [rbx + 8]
mov r8, rax
test rax, rax
je 0x1400c0110
movzx edx, word [rax]
test dx, dx
je 0x1400c0110
mov r9d, 0x3f
nop
lea rcx, [0x1400fe568]
movzx eax, r9w
nop dword [rax + rax]
cmp dx, ax
je 0x1400c0137
movzx eax, word [rcx + 2]
add rcx, 2
test ax, ax
jne 0x1400c00f0
movzx edx, word [r8 + 2]
add r8, 2
test dx, dx
jne 0x1400c00e0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
test rdi, rdi
je 0x1400c0120
mov dword [rdi], eax
cmp eax, 0xffffffff
setne al
mov rbx, qword [rsp + 0x280]
add rsp, 0x270
pop rdi
ret
lea rdx, [rsp + 0x20]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp rax, 0xffffffffffffffff
je 0x1400c0172
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_FindClose]
test rdi, rdi
je 0x1400c015f
mov eax, dword [rsp + 0x20]
mov dword [rdi], eax
mov al, 1
mov rbx, qword [rsp + 0x280]
add rsp, 0x270
pop rdi
ret
mov rbx, qword [rsp + 0x280]
xor al, al
add rsp, 0x270
pop rdi
ret

Function at 0x1400c08b0
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
push rdi
mov eax, 0x10020
call fcn.1400ddab0
sub rsp, rax
mov rdi, rdx
lea rcx, str.ComSpec
lea rdx, [rsp + 0x20]
mov r8d, 0x7fff
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov ebx, eax
test eax, eax
je 0x1400c090b
lea r8d, [rax + 1]
mov rcx, rdi
add r8, r8
lea rdx, [rsp + 0x20]
call sub.VCRUNTIME140.dll_memcpy
mov eax, ebx
mov rbx, qword [rsp + 0x10030]
add rsp, 0x10020
pop rdi
ret
xor eax, eax
mov word [rdi], ax
mov eax, ebx
mov rbx, qword [rsp + 0x10030]
add rsp, 0x10020
pop rdi
ret
Function at 0x1400c1160
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x50
xor ebx, ebx
mov esi, r9d
mov r15d, r8d
mov r14d, edx
mov r13, rcx
mov r12d, ebx
test rcx, rcx
je 0x1400c119e
xor edx, edx
lea r8d, [rbx + 2]
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rdi, rax
jmp 0x1400c11a5
mov rdi, qword [0x140115790]
test rdi, rdi
je 0x1400c136d
mov qword [rsp + 0x80], rbp
lea rbp, [0x14011b1c8]
test r14d, r14d
jns 0x1400c11ce
movzx eax, r14w
neg ax
movzx edx, ax
jmp 0x1400c1206
test r14d, r14d
mov dword [rsp + 0x44], ebx
mov eax, 1
mov qword [rsp + 0x48], rbp
cmovne eax, r14d
lea r9, [rsp + 0x40]
lea r8, [0x1400c1140]
mov dword [rsp + 0x40], eax
mov edx, SafeArrayDestroy
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_EnumResourceNamesW]
mov rdx, qword [rsp + 0x48]
cmp rdx, rbp
je 0x1400c1338
mov r8d, SafeArrayDestroy
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindResourceW]
test rax, rax
je 0x1400c1338
mov rdx, rax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
je 0x1400c1338
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rbp, rax
test rax, rax
je 0x1400c1338
cmp r15d, 0xffffffff
cmovne esi, r15d
test esi, esi
jne 0x1400c1268
lea ecx, [rsi + 0xb]
call qword [sym.imp.USER32.dll_GetSystemMetrics]
mov esi, eax
movzx eax, word [rbp + 4]
lea r8, [rbp + 6]
mov r11, rbx
mov r9d, ebx
cmp bx, ax
jae 0x1400c1338
mov rdx, r8
mov r10d, eax
mov ebp, 0x100
nop word [rax + rax]
movzx eax, byte [r8]
mov ecx, ebx
test eax, eax
cmove eax, ebp
cmp eax, r9d
jle 0x1400c12a8
cmp r9d, esi
setl cl
jmp 0x1400c12ad
cmp eax, esi
setge cl
test ecx, ecx
je 0x1400c12b7
mov r11, rdx
mov r9d, eax
add rdx, 0xe
add r8, 0xe
sub r10, 1
jne 0x1400c1290
test r11, r11
je 0x1400c1338
movzx edx, word [r11 + 0xc]
lea r8d, [r10 + 3]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rsi, rax
test rax, rax
je 0x1400c1338
mov rdx, rax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
je 0x1400c1338
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rbp, rax
test rax, rax
je 0x1400c1338
mov rdx, rsi
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [rsp + 0x30], ebx
mov r9d, 0x30000
mov edx, eax
mov dword [rsp + 0x28], ebx
mov r8d, 1
mov dword [rsp + 0x20], ebx
mov rcx, rbp
call qword [sym.imp.USER32.dll_CreateIconFromResourceEx]
mov r12, rax
mov rcx, qword [rsp + 0xa0]
mov rbp, qword [rsp + 0x80]
test rcx, rcx
je 0x1400c135a
test r12, r12
je 0x1400c135a
mov qword [rcx], rdi
mov rax, r12
jmp 0x1400c138e
test r13, r13
je 0x1400c1368
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
test r12, r12
jne 0x1400c1355
test r14d, r14d
jle 0x1400c1378
lea ebx, [r14 - 1]
jmp 0x1400c1380
cmp r14d, 0xffffffff
cmovl ebx, r14d
mov r8d, ebx
mov rdx, r13
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ExtractIconW]
lea r11, [rsp + 0x50]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x1400c2b10
Capabilities:
Create new key via cryptacquirecontext
Encrypt data using aes via winapi
Hash data using sha1
Hash data using sha1 via wincrypt
Hash data via wincrypt
Initialize hashing via wincrypt

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
mov dword [rsp + 0x10], edx
push rdi
sub rsp, 0x860
mov rbx, r8
mov rsi, rcx
mov r8d, 0x800
lea rcx, [rsp + 0x60]
xor edx, edx
movzx ebp, r9b
call sub.VCRUNTIME140.dll_memset
mov r9d, reloc.OLEAUT32.dll_SafeArrayGetElement
mov dword [rsp + 0x20], 0xf0000000
xor r8d, r8d
lea rcx, [rsp + 0x50]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x1400c2cfe
mov rcx, qword [rsp + 0x50]
lea rax, [rsp + 0x40]
xor r9d, r9d
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov edx, 0x8004
call qword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
je 0x1400c2cfe
xor edi, edi
test rbx, rbx
je 0x1400c2be0
cmp qword [rbx], rdi
je 0x1400c2be0
mov edx, edi
lea r9, [0x140113950]
mov r8d, edi
lea r10, [0x140102ba0]
mov rax, rbx
cmp rbx, r9
jne 0x1400c2bc5
lea eax, [rdx + rdx*4]
lea rax, [r10 + rax*2]
jmp 0x1400c2bc8
mov rax, qword [rax]
movzx eax, word [rax]
inc edx
mov word [rsp + r8*2 + 0x60], ax
mov r8d, edx
cmp qword [rbx + rdx*8], rdi
lea rax, [rbx + rdx*8]
jne 0x1400c2bb7
lea rcx, [rsp + 0x60]
mov rax, 0xffffffffffffffff
nop dword [rax]
cmp word [rcx + rax*2 + 2], di
lea rax, [rax + 1]
jne 0x1400c2bf0
mov rcx, qword [rsp + 0x40]
lea r8d, [rax + rax]
xor r9d, r9d
lea rdx, [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
je 0x1400c2cfe
xor edx, edx
lea rcx, [rsp + 0x60]
mov r8d, 0x800
call sub.VCRUNTIME140.dll_memset
mov eax, dword [rsp + 0x890]
mov r9d, eax
shl r9d, 0x10
cmp eax, 0x80
jne 0x1400c2c48
mov edi, 0x660e
jmp 0x1400c2c57
cmp eax, 0xc0
setne dil
add edi, 0x660f
mov r8, qword [rsp + 0x40]
lea rax, [rsp + 0x48]
mov rcx, qword [rsp + 0x50]
mov edx, edi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_CryptDeriveKey]
test eax, eax
je 0x1400c2cfe
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
test eax, eax
je 0x1400c2cfe
mov rcx, qword [rsp + 0x48]
xor r9d, r9d
xor edx, edx
lea r8d, [r9 + 1]
test bpl, bpl
je 0x1400c2cc5
mov eax, dword [rsp + 0x878]
add eax, 0x10
mov dword [rsp + 0x30], eax
lea rax, [rsp + 0x878]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rsi
call qword [0x140115730]
jmp 0x1400c2cdd
lea rax, [rsp + 0x878]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rsi
call qword [0x140115728]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
mov rcx, qword [rsp + 0x50]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov eax, dword [rsp + 0x878]
jmp 0x1400c2d00
xor eax, eax
lea r11, [rsp + 0x860]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x1400c3450
Capabilities:
Write clipboard data

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x30
cmp byte [rdx + 0x23], 0
mov rbx, rdx
mov rdi, rcx
jne 0x1400c346a
mov rbx, qword [rdx + 0x10]
cmp byte [rcx + 0x23], 0
jne 0x1400c3474
mov rdi, qword [rcx + 0x10]
movzx eax, byte [rbx + 0x21]
test al, 0x10
je 0x1400c34ef
test al, 8
jne 0x1400c34ea
mov rdx, qword [rbx + 8]
mov r8, qword [rbx + 0x10]
shr r8, 1
movzx eax, word [rdx]
movzx ecx, word [rdx + r8*2 - 2]
cmp ax, 0x20
je 0x1400c34b8
cmp ax, 9
je 0x1400c34b8
cmp cx, 0x20
je 0x1400c34b8
cmp cx, 9
je 0x1400c34b8
cmp ax, 0x30
je 0x1400c34b8
cmp ax, 0x2b
jne 0x1400c34ea
xor r9d, r9d
mov byte [rsp + 0x20], 1
mov rcx, rdi
call fcn.1400c3f40
test eax, eax
je 0x1400c3516
mov r8b, reloc.OLEAUT32.dll_SafeArrayGetDim
mov rdx, qword [rbx]
mov rcx, rdi
call fcn.140001470
mov eax, 1
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
mov r8b, reloc.OLEAUT32.dll_SafeArrayGetElement
jmp 0x1400c34cf
test al, 0x20
je 0x1400c354e
mov rcx, rdi
test al, 8
jne 0x1400c353a
mov r8, qword [rbx + 0x10]
xor r9d, r9d
mov rdx, qword [rbx + 8]
shr r8, 1
mov byte [rsp + 0x20], 1
call fcn.1400c3f40
test eax, eax
jne 0x1400c3523
xor eax, eax
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
movsd xmm0, qword [rbx]
mov r8b, 0x20
movsd qword [rsp + 0x40], xmm0
mov rcx, rdi
mov rdx, qword [rsp + 0x40]
jmp 0x1400c34d5
movsd xmm0, qword [rbx]
mov r8b, 0x28
movsd qword [rsp + 0x40], xmm0
mov rdx, qword [rsp + 0x40]
jmp 0x1400c34d5
test al, 1
je 0x1400c3567
mov rdx, rbx
mov rcx, rdi
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
jmp fcn.1400c3c70
test al, 2
je 0x1400c358c
mov rbx, qword [rbx]
mov rcx, rbx
mov rax, qword [rbx]
call qword [rax + VariantCopy]
mov rdx, rbx
mov rcx, rdi
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
jmp fcn.1400c4490
cmp byte [rbx + 0x23], 0
jne 0x1400c3598
mov rax, qword [rbx + 0x10]
jmp 0x1400c359b
mov rax, rbx
test byte [rax + 0x21], 4
je 0x1400c35a9
mov rdx, rbx
call fcn.14004e8c0
mov r8, qword [rbx + 0x10]
xor r9d, r9d
mov rdx, qword [rbx + 8]
mov rcx, rdi
shr r8, 1
mov byte [rsp + 0x20], 1
call fcn.1400c3f40
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
Function at 0x1400c35d0
Capabilities:
Write clipboard data

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov r8d, dword [rdx + 0x10]
mov rbx, rdx
mov rdi, rcx
sub r8d, 1
je 0x1400c36b5
sub r8d, 1
je 0x1400c36a1
sub r8d, 2
je 0x1400c368f
sub r8d, 1
je 0x1400c362f
cmp r8d, 1
jne 0x1400c3670
mov rbx, qword [rdx]
mov rcx, rbx
mov rax, qword [rbx]
call qword [rax + VariantCopy]
mov rdx, rbx
mov rcx, rdi
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
jmp fcn.1400c4490
mov rdx, qword [rdx + 8]
test rdx, rdx
je 0x1400c3670
mov rax, qword [rbx]
cmp word [rax], 0x30
jne 0x1400c36b5
xor r9d, r9d
mov byte [rsp + 0x20], 1
mov rdx, rax
lea r8, [r9 - 1]
call fcn.1400c3f40
test eax, eax
jne 0x1400c3664
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
mov rdx, qword [rbx + 8]
mov r8b, reloc.OLEAUT32.dll_SafeArrayGetDim
mov rcx, rdi
jmp 0x1400c36b8
mov rdx, qword [rbx]
xor r9d, r9d
mov byte [rsp + 0x20], 1
lea r8, [r9 - 1]
call fcn.1400c3f40
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
mov rdx, qword [rdx]
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
jmp fcn.1400c3450
movsd xmm0, qword [rdx]
mov r8b, 0x28
movsd qword [rsp + 0x48], xmm0
mov rdx, qword [rsp + 0x48]
jmp 0x1400c36bb
mov r8b, reloc.OLEAUT32.dll_SafeArrayGetElement
mov rdx, qword [rdx]
call fcn.140001470
mov rbx, qword [rsp + 0x40]
mov eax, 1
add rsp, 0x30
pop rdi
ret

Function at 0x1400c36d0
Capabilities:
Read clipboard data

Disassembly:
movzx eax, byte [rcx + 0x23]
cmp al, 2
jne 0x1400c36de
mov eax, 1
ret
test al, al
jne 0x1400c36e6
mov rcx, qword [rcx + 0x10]
xor r8d, r8d
xor edx, edx
jmp fcn.1400c36f0
Function at 0x1400c3c70
Capabilities:
Write clipboard data

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
cmp byte [rcx + 0x23], 0
mov rdi, rdx
mov rbx, rcx
jne 0x1400c3c90
mov rbx, qword [rbx + 0x10]
cmp byte [rbx + 0x23], 0
je 0x1400c3c86
cmp byte [rdx + 0x23], 0
jne 0x1400c3c9a
mov rdi, qword [rdx + 0x10]
mov rcx, rdi
call fcn.140001510
cmp byte [rbx + 0x23], 1
jne 0x1400c3d07
cmp rbx, rdi
je 0x1400c3cf7
mov rax, qword [rdi + 0x10]
mov r9b, 1
mov r8, rax
mov byte [rsp + 0x20], 0
shr r8, 1
and eax, 1
add r8, rax
xor edx, edx
mov rcx, rbx
call fcn.1400c3f40
test eax, eax
jne 0x1400c3cde
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
mov r8, qword [rdi + 0x10]
mov rdx, qword [rdi + 8]
add r8, 2
mov rcx, qword [rbx + 8]
call sub.VCRUNTIME140.dll_memcpy
or byte [rbx + 0x21], 1
mov eax, 1
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
mov rdx, qword [rdi + 0x10]
mov rcx, qword [rdi + 8]
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
jmp fcn.1400c3d20
Function at 0x1400c3d20
Capabilities:
Write clipboard data

Disassembly:
push rbx
push rsi
sub rsp, 0x28
mov rsi, rcx
mov rbx, rdx
lea rcx, [0x140119870]
call fcn.140006a00
test eax, eax
jne 0x1400c3d5d
lea r8, [0x1400e0684]
lea rdx, str.Cant_open_clipboard_for_writing.
lea rcx, [0x140118bf0]
add rsp, 0x28
pop rsi
pop rbx
jmp fcn.14004dd50
mov qword [rsp + 0x40], rbp
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x50], r12
mov qword [rsp + 0x58], r14
mov qword [rsp + 0x20], r15
call qword [sym.imp.USER32.dll_EmptyClipboard]
lea r14, [rsi + rbx]
xor r12d, r12d
lea rbx, [rsi + 4]
cmp rbx, r14
ja 0x1400c3e22
mov r15d, dword [rsi]
test r15d, r15d
je 0x1400c3e22
mov rax, rbx
add rbx, 8
cmp rbx, r14
ja 0x1400c3e22
mov edi, dword [rax]
mov rsi, rbx
add rbx, rdi
cmp rbx, r14
ja 0x1400c3e22
mov rdx, r12
test rdi, rdi
mov ecx, 0x42
sete dl
add rdx, rdi
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov rbp, rax
test rax, rax
je 0x1400c3ee0
test rdi, rdi
je 0x1400c3e09
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GlobalLock]
test rax, rax
je 0x1400c3e81
mov r8d, edi
mov rdx, rsi
mov rcx, rax
call sub.VCRUNTIME140.dll_memcpy
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov rsi, rbx
mov rdx, rbp
mov ecx, r15d
call qword [sym.imp.USER32.dll_SetClipboardData]
lea rbx, [rsi + 4]
cmp rbx, r14
jbe 0x1400c3d90
cmp dword [0x14011989c], r12d
je 0x1400c3e5c
cmp qword [0x140119880], r12
je 0x1400c3e48
mov rcx, qword [0x140119870]
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov qword [0x140119880], r12
call qword [sym.imp.USER32.dll_CloseClipboard]
mov dword [0x14011989c], r12d
mov qword [0x140119870], r12
mov eax, 1
mov r14, qword [rsp + 0x58]
mov r12, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x40]
mov r15, qword [rsp + 0x20]
add rsp, 0x28
pop rsi
pop rbx
ret
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_GlobalFree]
cmp dword [0x14011989c], r12d
je 0x1400c3ec4
cmp qword [0x140119880], r12
je 0x1400c3eb0
mov rcx, qword [0x140119870]
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov qword [0x140119880], r12
call qword [sym.imp.USER32.dll_CloseClipboard]
mov dword [0x14011989c], r12d
mov qword [0x140119870], r12
lea r8, [0x1400e0684]
lea rdx, [0x1400e0bd8]
lea rcx, [0x140118bf0]
call fcn.14004dd50
jmp 0x1400c3e61
cmp dword [0x14011989c], r12d
je 0x1400c3f1a
cmp qword [0x140119880], r12
je 0x1400c3f06
mov rcx, qword [0x140119870]
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov qword [0x140119880], r12
call qword [sym.imp.USER32.dll_CloseClipboard]
mov dword [0x14011989c], r12d
mov qword [0x140119870], r12
lea r8, [0x1400e0684]
lea rdx, str.Out_of_memory.
lea rcx, [0x140118bf0]
call fcn.14004dd50
jmp 0x1400c3e61
Function at 0x1400c5110
Capabilities:
Log keystrokes

Disassembly:
push rbx
push rbp
push rsi
push r15
sub rsp, 0x38
mov rbx, rcx
test rcx, rcx
je 0x1400c52ec
xor edx, edx
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
cmp eax, dword [0x140117b88]
mov r15d, eax
je 0x1400c5149
mov rcx, rbx
call fcn.1400c67c0
test al, al
jne 0x1400c52ec
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov rcx, rbx
mov rbp, rax
call qword [sym.imp.USER32.dll_IsIconic]
test eax, eax
je 0x1400c516d
mov edx, 9
mov rcx, rbx
call qword [sym.imp.USER32.dll_ShowWindow]
cmp rbx, rbp
jne 0x1400c517f
mov rax, rbx
add rsp, 0x38
pop r15
pop rsi
pop rbp
pop rbx
ret
cmp byte [0x140116548], 0
jne 0x1400c519c
mov rdx, rbp
mov rcx, rbx
call fcn.1400c5050
test rax, rax
jne 0x1400c52ee
mov qword [rsp + 0x68], rdi
mov qword [rsp + 0x70], r12
xor r12b, r12b
mov qword [rsp + 0x78], r13
xor r13b, r13b
mov qword [rsp + 0x30], r14
test rbp, rbp
je 0x1400c5220
xor edx, edx
mov rcx, rbp
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov r14d, eax
test eax, eax
je 0x1400c5225
cmp dword [0x140117b88], eax
je 0x1400c51fc
mov rcx, rbp
call fcn.1400c67c0
test al, al
jne 0x1400c51fc
mov ecx, dword [0x140117b88]
mov r8d, 1
mov edx, r14d
call qword [sym.imp.USER32.dll_AttachThreadInput]
test eax, eax
setne r12b
test r15d, r15d
je 0x1400c5225
cmp r14d, r15d
je 0x1400c5225
mov r8d, 1
mov edx, r15d
mov ecx, r14d
call qword [sym.imp.USER32.dll_AttachThreadInput]
test eax, eax
setne r13b
jmp 0x1400c5225
mov r14d, dword [rsp + 0x60]
xor edi, edi
nop word [rax + rax]
mov rdx, rbp
mov rcx, rbx
call fcn.1400c5050
mov rsi, rax
test rax, rax
jne 0x1400c5292
inc edi
cmp edi, 5
jl 0x1400c5230
xor r8d, r8d
mov dword [rsp + 0x28], 0xffc3d44d
xor r9d, r9d
mov byte [rsp + 0x20], r8b
mov dl, reloc.OLEAUT32.dll_SafeArrayGetUBound
lea ecx, [rax + 2]
call fcn.140017570
xor r8d, r8d
mov dword [rsp + 0x28], 0xffc3d44d
xor r9d, r9d
mov byte [rsp + 0x20], r8b
mov dl, reloc.OLEAUT32.dll_SafeArrayGetUBound
lea ecx, [rsi + 2]
call fcn.140017570
mov rdx, rbp
mov rcx, rbx
call fcn.1400c5050
mov rsi, rax
mov rdi, qword [rsp + 0x68]
test r12b, r12b
mov r12, qword [rsp + 0x70]
je 0x1400c52b3
mov ecx, dword [0x140117b88]
xor r8d, r8d
mov edx, r14d
call qword [sym.imp.USER32.dll_AttachThreadInput]
test r13b, r13b
mov r13, qword [rsp + 0x78]
je 0x1400c52cc
xor r8d, r8d
mov edx, r15d
mov ecx, r14d
call qword [sym.imp.USER32.dll_AttachThreadInput]
mov r14, qword [rsp + 0x30]
test rsi, rsi
je 0x1400c52ec
mov rcx, rbx
call qword [sym.imp.USER32.dll_BringWindowToTop]
mov rax, rsi
add rsp, 0x38
pop r15
pop rsi
pop rbp
pop rbx
ret
xor eax, eax
add rsp, 0x38
pop r15
pop rsi
pop rbp
pop rbx
ret
Function at 0x1400c5460
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov esi, edx
mov rbx, rcx
test r8b, r8b
je 0x1400c5480
call fcn.1400870a0
jmp 0x1400c5490
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 0x10]
call qword [sym.imp.USER32.dll_PostMessageW]
xor edi, edi
test esi, esi
cmovns edi, esi
test edi, edi
je 0x1400c5509
mov qword [rsp + 0x30], rbp
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov esi, dword gs:[0x48]
mov ebp, eax
cmp dword [0x140117b88], esi
jne 0x1400c54c9
mov edx, 1
mov ecx, 0x8000012f
call fcn.1400018c0
jmp 0x1400c54d4
mov ecx, 0xa
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rcx, rbx
call qword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x1400c54f1
call qword [sym.imp.KERNEL32.dll_GetTickCount]
lea ecx, [rdi + rbp]
sub ecx, eax
cmp ecx, 5
jg 0x1400c54b0
mov rbp, qword [rsp + 0x30]
mov rax, rbx
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
mov rsi, qword [rsp + 0x40]
mov rax, rbx
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret