joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1800e6d50
Capabilities:
Check if file exists
Get file attributes
Move file

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x20
mov rax, qword [rcx]
mov rsi, qword [rdx]
mov rdi, rdx
mov rbx, rcx
cmp rsi, rax
je 0x1800e6dd4
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x38]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], rsi
call fcn.18001b990
test eax, eax
je 0x1800e6dd4
cmp byte [rsi], 0
je 0x1800e6de6
lea rcx, [rsp + 0x30]
mov rdx, rdi
call fcn.180016d90
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1800e6de6
mov rdx, rdi
mov rcx, rbx
call fcn.1800c3ab0
test al, al
jne 0x1800e6dcc
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret
mov rcx, rbx
call fcn.1800c3b60
mov al, 1
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret
mov rdx, rdi
mov rcx, rbx
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
jmp 0x1800e6e10
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x20
mov rbx, qword [rcx]
mov rax, qword [rdx]
mov rdi, rdx
mov rsi, rcx
cmp rax, rbx
je 0x1800e6efd
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x38]
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x38], rax
call fcn.18001b990
test eax, eax
je 0x1800e6efd
cmp byte [rbx], 0
je 0x1800e6eeb
lea rcx, [rsp + 0x30]
mov rdx, rsi
call fcn.180016d90
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1800e6eeb
mov rax, qword [rdi]
mov rcx, qword [rsi]
cmp rcx, rax
je 0x1800e6ead
mov qword [rsp + 0x38], rcx
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x38]
mov qword [rsp + 0x30], rax
call fcn.180019ca0
test eax, eax
je 0x1800e6ead
mov rcx, rdi
call fcn.1800c3b60
test al, al
je 0x1800e6eeb
lea rcx, [rsp + 0x30]
mov rdx, rdi
call fcn.180016d90
lea rcx, [rsp + 0x38]
mov rdx, rsi
mov rbx, qword [rax]
call fcn.180016d90
mov rdx, rbx
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
setne al
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret
xor al, al
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
mov al, 1
add rsp, 0x20
pop rdi
ret
Function at 0x1800e6e10
Capabilities:
Check if file exists
Get file attributes
Move file

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x20
mov rax, qword [rcx]
mov rsi, qword [rdx]
mov rdi, rdx
mov rbx, rcx
cmp rsi, rax
je 0x1800e6dd4
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x38]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], rsi
call fcn.18001b990
test eax, eax
je 0x1800e6dd4
cmp byte [rsi], 0
je 0x1800e6de6
lea rcx, [rsp + 0x30]
mov rdx, rdi
call fcn.180016d90
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1800e6de6
mov rdx, rdi
mov rcx, rbx
call fcn.1800c3ab0
test al, al
jne 0x1800e6dcc
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret
mov rcx, rbx
call fcn.1800c3b60
mov al, 1
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret
mov rdx, rdi
mov rcx, rbx
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
jmp 0x1800e6e10
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x20
mov rbx, qword [rcx]
mov rax, qword [rdx]
mov rdi, rdx
mov rsi, rcx
cmp rax, rbx
je 0x1800e6efd
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x38]
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x38], rax
call fcn.18001b990
test eax, eax
je 0x1800e6efd
cmp byte [rbx], 0
je 0x1800e6eeb
lea rcx, [rsp + 0x30]
mov rdx, rsi
call fcn.180016d90
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1800e6eeb
mov rax, qword [rdi]
mov rcx, qword [rsi]
cmp rcx, rax
je 0x1800e6ead
mov qword [rsp + 0x38], rcx
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x38]
mov qword [rsp + 0x30], rax
call fcn.180019ca0
test eax, eax
je 0x1800e6ead
mov rcx, rdi
call fcn.1800c3b60
test al, al
je 0x1800e6eeb
lea rcx, [rsp + 0x30]
mov rdx, rdi
call fcn.180016d90
lea rcx, [rsp + 0x38]
mov rdx, rsi
mov rbx, qword [rax]
call fcn.180016d90
mov rdx, rbx
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
setne al
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret
xor al, al
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
mov al, 1
add rsp, 0x20
pop rdi
ret
Function at 0x1800e6f20
Capabilities:
Get file attributes

Disassembly:
mov qword [rsp + 8], rcx
push rbx
push rbp
push rsi
push rdi
sub rsp, 0x68
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov rsi, rcx
mov bpl, 1
mov rdx, rcx
lea rcx, [rsp + 0xa8]
call fcn.180016d90
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
xor ebx, ebx
test al, 0x10
je 0x1800e7084
cmp eax, 0xffffffff
je 0x1800e7084
mov qword [rsp + 0x40], rbx
mov dword [rsp + 0x48], ebx
mov dword [rsp + 0x50], ebx
lea rax, [0x1802bfb7c]
mov qword [rsp + 0xa0], rax
lea rdx, [rsp + 0xa0]
lea rcx, [rsp + 0x98]
call fcn.18001a440
nop
lea rax, [rsp + 0x98]
mov qword [rsp + 0x20], rax
lea r8d, [rbx + 3]
lea rdx, [rsp + 0x40]
mov rcx, rsi
call fcn.1800e5690
nop
mov rcx, qword [rsp + 0x98]
add rcx, 0xfffffffffffffff0
lea rax, [0x1802bccb0]
cmp rcx, rax
je 0x1800e6fe4
or eax, 0xffffffff
lock xadd dword [rcx], eax
dec eax
cmp eax, 0xffffffff
jne 0x1800e6fe4
call fcn.1800a0c6c
mov eax, dword [rsp + 0x50]
lea edi, [rax - 1]
mov rbx, qword [rsp + 0x40]
test edi, edi
js 0x1800e702d
movsxd rax, edi
lea rsi, [rbx + rax*8]
nop dword [rax + rax]
mov rcx, rsi
call fcn.1800e6f20
test al, al
je 0x1800e7016
test bpl, bpl
je 0x1800e7016
mov bpl, 1
jmp 0x1800e7019
xor bpl, bpl
sub rsi, 8
dec edi
jns 0x1800e7000
mov eax, dword [rsp + 0x50]
mov rsi, qword [rsp + 0x90]
test eax, eax
jle 0x1800e707a
mov edi, eax
lea rsi, [0x1802bccb0]
nop word [rax + rax]
mov rax, qword [rbx]
mov qword [rsp + 0x38], rax
lea rcx, [rax - 0x10]
cmp rcx, rsi
je 0x1800e7064
or eax, 0xffffffff
lock xadd dword [rcx], eax
dec eax
cmp eax, 0xffffffff
jne 0x1800e7064
call fcn.1800a0c6c
add rbx, 8
dec rdi
jne 0x1800e7040
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x90]
mov rcx, rbx
call fcn.1800a09c8
xor ebx, ebx
mov rcx, rsi
call fcn.1800c3b60
test al, al
je 0x1800e7097
test bpl, bpl
mov al, 1
jne 0x1800e709a
movzx eax, bl
add rsp, 0x68
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x1800e70b0
Capabilities:
Get file attributes

Disassembly:
mov rax, rsp
mov byte [rax + 0x10], dl
mov qword [rax + 8], rcx
push rbp
push rsi
push rdi
sub rsp, 0x70
mov qword [rax - 0x48], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
movzx ebp, dl
mov rbx, rcx
mov sil, 1
xor edi, edi
test r8b, r8b
je 0x1800e723c
mov rdx, rcx
lea rcx, [rax - 0x40]
call fcn.180016d90
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
test al, 0x10
je 0x1800e723c
cmp eax, 0xffffffff
je 0x1800e723c
mov qword [rsp + 0x50], rdi
mov dword [rsp + 0x58], edi
mov dword [rsp + 0x60], edi
lea rax, [0x1802bfb78]
mov qword [rsp + 0x30], rax
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0xa8]
call fcn.18001a440
nop
lea rax, [rsp + 0xa8]
mov qword [rsp + 0x20], rax
lea r8d, [rdi + 3]
lea rdx, [rsp + 0x50]
mov rcx, rbx
call fcn.1800e5690
nop
mov rcx, qword [rsp + 0xa8]
add rcx, 0xfffffffffffffff0
lea rax, [0x1802bccb0]
cmp rcx, rax
je 0x1800e717d
or eax, 0xffffffff
lock xadd dword [rcx], eax
dec eax
cmp eax, 0xffffffff
jne 0x1800e717d
call fcn.1800a0c6c
mov eax, dword [rsp + 0x60]
lea edi, [rax - 1]
mov rbx, qword [rsp + 0x50]
mov qword [rsp + 0x38], rbx
test edi, edi
js 0x1800e71d9
movsxd rax, edi
lea rbp, [rbx + rax*8]
movzx ebx, byte [rsp + 0x98]
mov r8b, 1
movzx edx, bl
mov rcx, rbp
call fcn.1800e70b0
test al, al
je 0x1800e71bd
test sil, sil
je 0x1800e71bd
mov sil, 1
jmp 0x1800e71c0
xor sil, sil
sub rbp, 8
dec edi
jns 0x1800e71a1
mov rbx, qword [rsp + 0x38]
mov eax, dword [rsp + 0x60]
movzx ebp, byte [rsp + 0x98]
test eax, eax
jle 0x1800e722a
mov edi, eax
lea rbp, [0x1802bccb0]
nop word [rax + rax]
mov rax, qword [rbx]
mov qword [rsp + 0x38], rax
lea rcx, [rax - 0x10]
cmp rcx, rbp
je 0x1800e7214
or eax, 0xffffffff
lock xadd dword [rcx], eax
dec eax
cmp eax, 0xffffffff
jne 0x1800e7214
call fcn.1800a0c6c
add rbx, 8
dec rdi
jne 0x1800e71f0
mov rbx, qword [rsp + 0x50]
movzx ebp, byte [rsp + 0x98]
mov rcx, rbx
call fcn.1800a09c8
mov rbx, qword [rsp + 0x90]
xor edi, edi
mov r8d, edi
test bpl, bpl
sete r8b
mov edx, edi
test bpl, bpl
setne dl
mov rcx, rbx
call fcn.1800c4180
test al, al
je 0x1800e7261
test sil, sil
mov al, 1
jne 0x1800e7265
movzx eax, dil
mov rbx, qword [rsp + 0xa0]
add rsp, 0x70
pop rdi
pop rsi
pop rbp
ret
Function at 0x1800ea670
Capabilities:
Print debug messages
Terminate thread

Disassembly:
push rbp
push rsi
push rdi
sub rsp, 0x70
mov qword [rsp + 0x60], 0xfffffffffffffffe
mov qword [rsp + 0x98], rbx
mov edi, edx
mov rbx, rcx
lea rsi, [rcx + 0x20]
mov qword [rsp + 0x50], rsi
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
nop
mov rax, qword [rbx + 0x10]
test rax, rax
je 0x1800ea7fc
mov byte [rbx + 0x75], 1
mov rcx, qword [rbx + 0x58]
call qword [sym.imp.KERNEL32.dll_SetEvent]
test edi, edi
je 0x1800ea6ca
mov edx, edi
mov rcx, rbx
call fcn.1800d29f0
mov rax, qword [rbx + 0x10]
test rax, rax
je 0x1800ea7fc
lea rax, str.___killing_thread_by_force___
mov qword [rsp + 0xa0], rax
lea rdx, [rsp + 0xa0]
lea rcx, [rsp + 0x90]
call fcn.18001a440
nop
or edi, 0xffffffff
lea rbp, [0x1802bccb0]
mov rcx, qword [0x180421b30]
test rcx, rcx
je 0x1800ea725
mov rax, qword [rcx]
lea rdx, [rsp + 0x90]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
jmp 0x1800ea7ad
mov rax, qword [rsp + 0x90]
mov qword [rsp + 0xa8], rax
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x28], rax
lea rcx, [rax - 0x10]
cmp rcx, rbp
je 0x1800ea751
mov eax, 1
lock xadd dword [rcx], eax
lea r8, [0x1802c0924]
lea rdx, [rsp + 0xa8]
lea rcx, [rsp + 0x20]
call fcn.1800eb4b0
nop
mov rdx, rax
lea rcx, [rsp + 0x30]
call fcn.180016d90
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
nop
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x48], rax
lea rcx, [rax - 0x10]
cmp rcx, rbp
je 0x1800ea7ad
mov eax, edi
lock xadd dword [rcx], eax
dec eax
cmp eax, 0xffffffff
jne 0x1800ea7ad
call fcn.1800a0c6c
nop
mov rax, qword [rsp + 0x90]
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x68], rax
lea rcx, [rax - 0x10]
cmp rcx, rbp
je 0x1800ea7d9
lock xadd dword [rcx], edi
lea eax, [rdi - 1]
cmp eax, 0xffffffff
jne 0x1800ea7d9
call fcn.1800a0c6c
mov rax, qword [rbx + 0x10]
test rax, rax
je 0x1800ea7ee
xor edx, edx
mov rcx, qword [rbx + 0x10]
call qword [sym.imp.KERNEL32.dll_TerminateThread]
xor eax, eax
mov qword [rbx + 0x10], rax
mov qword [rbx + 0x18], rax
xor bl, bl
jmp 0x1800ea7fe
mov bl, 1
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
movzx eax, bl
mov rbx, qword [rsp + 0x98]
add rsp, 0x70
pop rdi
pop rsi
pop rbp
ret

Function at 0x1800ea820
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x30
mov rbx, rcx
add rcx, 0x20
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov byte [rbx + 0x75], 0
mov rax, qword [rbx + 0x10]
test rax, rax
jne 0x1800ea88c
mov edx, dword [rbx + 0x68]
lea rax, [rsp + 0x40]
lea r8, [0x1800c2540]
mov qword [rsp + 0x28], rax
mov r9, rbx
xor ecx, ecx
mov dword [rsp + 0x20], 0
call fcn.1800a339c
mov edx, dword [rbx + 0x60]
mov qword [rbx + 0x10], rax
mov eax, dword [rsp + 0x40]
mov rcx, qword [rbx + 0x10]
mov qword [rbx + 0x18], rax
call fcn.1800c2420
mov rcx, qword [rbx + 0x50]
call qword [sym.imp.KERNEL32.dll_SetEvent]
lea rcx, [rbx + 0x20]
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
Function at 0x1800ec100
Capabilities:
Get common file path

Disassembly:
push rbx
mov eax, 0x2040
call fcn.1800b28e0
sub rsp, rax
mov qword [rsp + 0x38], 0xfffffffffffffffe
mov rbx, rcx
xor r8d, r8d
mov dword [rsp + 0x30], r8d
cmp edx, 0x10
ja case.default.0x1800ec140
movsxd rax, edx
lea rcx, [0x180000000]
mov edx, dword [rcx + rax*4 + 0xec2e0]
add rdx, rcx
jmp rdx
mov r8d, 0x28
jmp case.0x1800ec140.2
mov r8d, 5
jmp case.0x1800ec140.2
mov r8d, 0x1a
jmp case.0x1800ec140.2
mov r8d, 0x23
jmp case.0x1800ec140.2
mov r8d, 0x2e
jmp case.0x1800ec140.2
mov r8d, 0x26
jmp case.0x1800ec140.2
mov r8d, 0x2a
jmp case.0x1800ec140.2
mov r8d, SafeArrayGetDim
jmp case.0x1800ec140.2
mov r8d, SafeArrayGetDim
jmp case.0x1800ec140.2
mov r8d, 0x27
mov edx, r8d
mov rcx, rbx
call fcn.1800c3e80
jmp 0x1800ec2d4
mov word [rsp + 0x40], r8w
lea rdx, [rsp + 0x40]
mov ecx, 0x800
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rdx, [rsp + 0x28]
lea rcx, [rsp + 0x2060]
call fcn.18001a640
nop
lea rdx, [rsp + 0x2060]
mov rcx, rbx
call fcn.1800e7430
nop
mov rcx, qword [rsp + 0x2060]
add rcx, 0xfffffffffffffff0
lea rax, [0x1802bccb0]
cmp rcx, rax
je 0x1800ec2d4
or eax, 0xffffffff
lock xadd dword [rcx], eax
dec eax
cmp eax, 0xffffffff
jne 0x1800ec2d4
call fcn.1800a0c6c
jmp 0x1800ec2d4
mov word [rsp + 0x1040], r8w
mov edx, 0x800
lea rcx, [rsp + 0x1040]
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
lea rax, [rsp + 0x1040]
mov qword [rsp + 0x20], rax
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x2068]
call fcn.18001a640
nop
lea rdx, [rsp + 0x2068]
mov rcx, rbx
call fcn.1800e7430
nop
mov rcx, qword [rsp + 0x2068]
add rcx, 0xfffffffffffffff0
lea rax, [0x1802bccb0]
cmp rcx, rax
je 0x1800ec2d4
or eax, 0xffffffff
lock xadd dword [rcx], eax
dec eax
cmp eax, 0xffffffff
jne 0x1800ec2d4
call fcn.1800a0c6c
jmp 0x1800ec2d4
mov rax, qword [0x180421b38]
test rax, rax
jne 0x1800ec2b1
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov qword [0x180421b38], rax
mov rdx, rax
mov rcx, rbx
call fcn.1800c3dd0
jmp 0x1800ec2d4
xor edx, edx
mov rcx, rbx
call fcn.1800c3dd0
jmp 0x1800ec2d4
lea rax, [0x1802bccc0]
mov qword [rbx], rax
mov rax, rbx
add rsp, 0x2040
pop rbx
ret

Function at 0x1800ee470
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
xor edx, edx
add rcx, 0xf8
call fcn.180171ca0
movsxd rcx, eax
mov rax, qword [rbx + 0xe8]
add rax, 0x38
cmp ecx, dword [rax + 0x10]
jae 0x1800ee50e
mov rax, qword [rax]
mov rdx, qword [rax + rcx*8]
test rdx, rdx
je 0x1800ee50e
lea rcx, [rsp + 0x30]
add rdx, 0x30
call fcn.1800e7ad0
mov rcx, qword [rax]
cmp byte [rcx], 0
je 0x1800ee4db
lea rcx, [rsp + 0x38]
mov rdx, rax
call fcn.180016d90
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1800ee4db
mov bl, 1
jmp 0x1800ee4dd
xor bl, bl
mov rcx, qword [rsp + 0x30]
lea rax, [0x1802bccb0]
add rcx, 0xfffffffffffffff0
cmp rcx, rax
je 0x1800ee505
or edx, 0xffffffff
lock xadd dword [rcx], edx
dec edx
cmp edx, 0xffffffff
jne 0x1800ee505
call fcn.1800a0c6c
movzx eax, bl
add rsp, 0x20
pop rbx
ret
xor al, al
add rsp, 0x20
pop rbx
ret
Function at 0x1800f8db0
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
mov qword [rsp + 8], rcx
push rbx
push rsi
push rdi
sub rsp, 0x30
mov qword [rsp + 0x28], 0xfffffffffffffffe
mov rbx, rcx
mov dword [rsp + 0x20], 0
lea rax, [0x1802bccc0]
mov qword [rcx], rax
mov dword [rsp + 0x20], 1
xor ecx, ecx
call qword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x1800f8e76
mov ecx, SafeArrayGetDim
call qword [sym.imp.USER32.dll_GetClipboardData]
mov rdi, rax
test rax, rax
je 0x1800f8e70
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GlobalLock]
mov rsi, rax
test rax, rax
je 0x1800f8e70
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GlobalSize]
shr rax, 1
mov qword [rsp + 0x58], rsi
mov r8, rax
lea rdx, [rsp + 0x58]
lea rcx, [rsp + 0x60]
call fcn.18001a9f0
mov rax, qword [rbx]
mov rcx, qword [rsp + 0x60]
mov qword [rbx], rcx
lea rcx, [rax - 0x10]
lea rax, [0x1802bccb0]
cmp rcx, rax
je 0x1800f8e67
or eax, 0xffffffff
lock xadd dword [rcx], eax
dec eax
cmp eax, 0xffffffff
jne 0x1800f8e67
call fcn.1800a0c6c
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
call qword [sym.imp.USER32.dll_CloseClipboard]
mov rax, rbx
add rsp, 0x30
pop rdi
pop rsi
pop rbx
ret

Function at 0x1800f8e90
Capabilities:
Write clipboard data

Disassembly:
push rsi
sub rsp, 0x20
mov rsi, rcx
call qword [sym.imp.USER32.dll_EmptyClipboard]
test eax, eax
je 0x1800f8f1c
mov rax, qword [rsi]
lea rcx, [rsp + 0x38]
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x38], rax
call fcn.18001b380
mov rbx, rax
add rbx, 4
je 0x1800f8f17
lea rdx, [rbx + 2]
mov ecx, 0x2042
mov qword [rsp + 0x40], rdi
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov rdi, rax
test rax, rax
je 0x1800f8f12
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GlobalLock]
test rax, rax
je 0x1800f8f12
mov r8, rbx
mov rdx, rax
mov rcx, rsi
call fcn.1800d5160
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov rdx, rdi
mov ecx, SafeArrayGetDim
call qword [sym.imp.USER32.dll_SetClipboardData]
mov rdi, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rsi
jmp qword [sym.imp.USER32.dll_CloseClipboard]

Function at 0x1800f9270
Capabilities:
Log keystrokes via polling

Disassembly:
sub rsp, 0x58
bt ecx, 0x10
jb 0x1800f92cb
lea eax, [rcx - 0x61]
cmp ax, 0x19
ja 0x1800f9287
sub cx, 0x20
movdqa xmm0, xmmword [0x180393ad0]
movdqa xmm1, xmmword [0x180393ae0]
mov dword [rsp + 0x40], 0xdb005b
mov dword [rsp + 0x44], 0xdd005d
xor eax, eax
movdqu xmmword [rsp + 0x20], xmm0
movdqu xmmword [rsp + 0x30], xmm1
cmp cx, word [rsp + rax*2 + 0x20]
jne 0x1800f92c1
movzx ecx, word [rsp + rax*2 + 0x22]
add rax, 2
cmp rax, 0x14
jl 0x1800f92b5
movsx ecx, cx
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
shr eax, 0xf
and eax, 1
add rsp, 0x58
ret
Function at 0x1800f92f0
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
call fcn.1800459a0
xor ebx, ebx
lea ecx, [rbx + 1]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
shr eax, 0xf
test al, 1
mov eax, reloc.OLEAUT32.dll_SafeArrayGetDim
lea ecx, [rax - 0xe]
cmovne ebx, eax
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
shr eax, 0xf
test al, 1
je 0x1800f932d
or ebx, 0x20
mov ecx, 4
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
shr eax, 0xf
test al, 1
je 0x1800f9342
or ebx, 0x40
mov eax, dword [0x1804236f0]
and eax, 0xffffff8f
or eax, ebx
mov rbx, qword [rsp + 0x30]
mov dword [0x1804236f0], eax
mov dword [rdi], eax
mov rax, rdi
add rsp, 0x20
pop rdi
ret
Function at 0x18010ea40
Capabilities:
Open clipboard

Disassembly:
push rbx
sub rsp, 0x20
add edx, 0xffffeffe
mov rbx, rcx
cmp edx, 7
ja case.0x18010ea6c.4103
lea rcx, [0x180000000]
movsxd rax, edx
mov edx, dword [rcx + rax*4 + 0x10eae4]
add rdx, rcx
jmp rdx
mov rcx, rbx
call fcn.1801115b0
mov rcx, rbx
call fcn.18010f7a0
mov rcx, rbx
add rsp, 0x20
pop rbx
jmp fcn.18010f660
mov rcx, rbx
call fcn.1801115b0
mov rcx, rbx
add rsp, 0x20
pop rbx
jmp fcn.18010f7a0
mov rcx, rbx
call fcn.1801115b0
mov rcx, rbx
add rsp, 0x20
pop rbx
jmp fcn.18010f700
mov rcx, rbx
add rsp, 0x20
pop rbx
jmp fcn.18010db50
mov rcx, rbx
add rsp, 0x20
pop rbx
jmp fcn.180111470
mov rcx, rbx
add rsp, 0x20
pop rbx
jmp fcn.1801113e0
add rsp, 0x20
pop rbx
ret

Function at 0x18010f7a0
Capabilities:
Open clipboard

Disassembly:
sub rsp, 0x28
cmp dword [rcx + 0x1ec], 0
jne 0x18010f7ff
lea rdx, [rsp + 0x30]
call fcn.18010bf70
mov rax, qword [rsp + 0x30]
cmp byte [rax], 0
je 0x18010f7d7
xor ecx, ecx
call qword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x18010f7d7
lea rcx, [rsp + 0x30]
call fcn.1800f8e90
mov rcx, qword [rsp + 0x30]
lea rax, [0x1802bccb0]
add rcx, 0xfffffffffffffff0
cmp rcx, rax
je 0x18010f7ff
or eax, 0xffffffff
lock xadd dword [rcx], eax
dec eax
cmp eax, 0xffffffff
jne 0x18010f7ff
call fcn.1800a0c6c
add rsp, 0x28
ret

Function at 0x1801156b0
Capabilities:
Log keystrokes via polling

Disassembly:
sub rsp, 0x28
test dl, dl
je 0x180115729
mov ecx, 0x26
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
shr eax, 0xf
test al, 1
jne 0x180115722
mov ecx, 0x21
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
shr eax, 0xf
test al, 1
jne 0x180115722
mov ecx, 0x10028
call fcn.1800f9270
test al, al
jne 0x180115722
mov ecx, 0x10022
call fcn.1800f9270
test al, al
jne 0x180115722
mov ecx, 0x10024
call fcn.1800f9270
test al, al
jne 0x180115722
mov ecx, 0x10023
call fcn.1800f9270
test al, al
jne 0x180115722
mov ecx, SafeArrayGetDim
call fcn.1800f9270
test al, al
je 0x180115729
mov al, 1
add rsp, 0x28
ret
xor al, al
add rsp, 0x28
ret

Function at 0x180118b80
Capabilities:
Log keystrokes via polling

Disassembly:
sub rsp, 0x28
test dl, dl
je 0x180118bcf
mov ecx, 0x26
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
shr eax, 0xf
test al, 1
jne 0x180118bc8
mov ecx, 0x25
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
shr eax, 0xf
test al, 1
jne 0x180118bc8
mov ecx, 0x10028
call fcn.1800f9270
test al, al
jne 0x180118bc8
mov ecx, 0x10027
call fcn.1800f9270
test al, al
je 0x180118bcf
mov al, 1
add rsp, 0x28
ret
xor al, al
add rsp, 0x28
ret
Function at 0x18014c240
Capabilities:
Get file attributes

Disassembly:
mov rax, rsp
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x70
mov qword [rax - 0x50], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
mov r13d, r9d
mov r12, rdx
mov r15, rcx
mov ebp, dword [rdx + 0x10]
dec ebp
js 0x18014c3ed
movsxd r14, ebp
shl r14, 3
mov esi, 0xfffffffc
cmp ebp, dword [r12 + 0x10]
jae 0x18014c294
mov rdx, qword [r12]
add rdx, r14
jmp 0x18014c29b
lea rdx, [0x180416eb8]
lea rcx, [rsp + 0xa8]
call fcn.1800e7430
nop
mov rbx, qword [rsp + 0xa8]
cmp byte [rbx], 0
jne 0x18014c2bf
lea rdi, [0x1802bcf68]
jmp 0x18014c327
mov qword [rsp + 0x20], rbx
lea rcx, [rsp + 0x20]
call fcn.18001b380
or rdi, 0xffffffffffffffff
inc rdi
cmp byte [rbx + rdi], 0
jne 0x18014c2d2
add rdi, 4
and rdi, rsi
mov qword [rsp + 0x28], rbx
lea r8, [rax + 3]
add r8, rdi
lea rdx, [rsp + 0x28]
lea rcx, [rsp + 0x50]
call fcn.180012500
mov rbx, qword [rax]
mov qword [rsp + 0xa8], rbx
movsxd rdi, edi
add rdi, rbx
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], rbx
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x38]
call fcn.18001c460
mov qword [rsp + 0x40], rdi
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
test al, 0x10
je 0x18014c3be
cmp eax, 0xffffffff
je 0x18014c3be
cmp dword [r15 + 0x60], 0
jbe 0x18014c371
mov rcx, qword [r15 + 0x118]
mov eax, dword [rcx + 0x49c]
sub eax, dword [rcx + 0x24]
sub eax, dword [r15 + 0x5c]
add eax, r13d
cdq
idiv dword [r15 + 0x14c]
cmp eax, dword [r15 + 0x148]
jb 0x18014c374
or eax, 0xffffffff
lea rcx, [r15 + 0x18]
lea r8, [rsp + 0xa8]
mov edx, eax
call fcn.180015e50
lea rcx, [r15 + 0x38]
call fcn.180171dd0
lea rdx, [rsp + 0x58]
lea rcx, [r15 + 0x38]
call fcn.180173f30
mov r8b, 1
mov rdx, rax
lea rcx, [r15 + 0x38]
call fcn.18016cd80
lea rcx, [r15 - 0xd8]
call fcn.18014cbf0
mov esi, 0xfffffffc
lea rcx, [rbx - 0x10]
lea rax, [0x1802bccb0]
cmp rcx, rax
je 0x18014c3e1
or eax, 0xffffffff
lock xadd dword [rcx], eax
dec eax
cmp eax, 0xffffffff
jne 0x18014c3e1
call fcn.1800a0c6c
sub r14, 8
dec ebp
jns 0x18014c284
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret