joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1800bbc40
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rdi
push rbp
mov rbp, rsp
sub rsp, 0x60
mov rax, qword [0x18016ffc0]
xor rax, rsp
mov qword [rbp - 0x10], rax
movzx edi, dl
mov rbx, rcx
mov qword [rbp - 0x40], rcx
lea rax, vtable.ByteTag.0
mov qword [rcx], rax
mov rax, qword [0x1801745b0]
test rax, rax
jne 0x1800bbd8f
lea rdx, str.48_8D_15_________48_89_10_88_48___48_89_03_48_8B_C3_48_8B_5C_24__
lea rcx, [0x1800cc6b0]
call fcn.1800bf760
mov rcx, rax
movsxd rax, dword [rax + 3]
add rax, 7
add rax, rcx
mov qword [0x1801745b0], rax
jne 0x1800bbd8f
mov byte [rbp - 0x38], 0xa7
mov byte [rbp - 0x37], 0x9f
mov byte [rbp - 0x36], 0x93
mov byte [rbp - 0x35], 0x8d
mov byte [rbp - 0x34], 0xbd
mov byte [rbp - 0x33], 0x8b
mov byte [rbp - 0x32], 0x8c
mov byte [rbp - 0x31], 0xba
mov byte [rbp - 0x30], 0x99
mov byte [rbp - 0x2f], 0x8f
mov byte [rbp - 0x2e], 0x8d
mov byte [rbp - 0x2d], 0x9c
mov byte [rbp - 0x2c], 0x94
mov byte [rbp - 0x2b], 0xd2
mov byte [rbp - 0x2a], 0x80
mov byte [rbp - 0x29], 0x9d
mov byte [rbp - 0x28], 0x92
mov byte [rbp - 0x27], 0x98
mov byte [rbp - 0x26], 0x96
mov byte [rbp - 0x25], 0x8c
mov byte [rbp - 0x24], 0x8c
mov byte [rbp - 0x23], 0x88
mov byte [rbp - 0x22], 0x9e
mov byte [rbp - 0x21], 0xdc
mov byte [rbp - 0x20], 0x93
mov byte [rbp - 0x1f], 0x91
mov byte [rbp - 0x1e], 0x8b
mov byte [rbp - 0x1d], 0x20
mov byte [rbp - 0x1c], 0x76
mov byte [rbp - 0x1b], 0x6d
mov byte [rbp - 0x1a], 0x71
mov byte [rbp - 0x19], 0x6f
mov byte [rbp - 0x18], 0x6c
mov byte [rbp - 0x17], 0x68
mov byte [rbp - 0x16], 0x60
mov byte [rbp - 0x15], 0x29
mov byte [rbp - 0x14], 0x28
mov byte [rbp - 0x13], 0x2b
xor eax, eax
mov byte [rbp - 0x12], al
movzx eax, byte [rbp - 0x38]
xor edx, edx
lea r8, [rbp - 0x38]
nop dword [rax]
lea ecx, [rdx - 0x1b]
movzx eax, byte [r8]
xor cl, al
movsxd rax, edx
mov byte [rbp + rax - 0x38], cl
inc edx
lea r8, [r8 + 1]
cmp edx, 0x26
jb 0x1800bbd60
mov byte [rbp - 0x12], 0
lea rcx, [rbp - 0x38]
call fcn.1800be830
mov rax, qword [0x1801745b0]
xorps xmm0, xmm0
movups xmmword [rbx], xmm0
mov qword [rbx], rax
mov byte [rbx + 8], dil
mov rax, rbx
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.1800c2730
mov rbx, qword [rsp + 0x78]
mov rdi, qword [rsp + 0x80]
add rsp, 0x60
pop rbp
ret
Function at 0x1800bbe50
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
mov rbp, rsp
sub rsp, 0x70
movaps xmmword [rsp + 0x60], xmm6
mov rax, qword [0x18016ffc0]
xor rax, rsp
mov qword [rbp - 0x18], rax
movaps xmm6, xmm1
mov rbx, rcx
mov qword [rbp - 0x50], rcx
lea rax, vtable.DoubleTag.0
mov qword [rcx], rax
mov rax, qword [0x1801745a8]
test rax, rax
jne 0x1800bbfaf
lea rdx, str.48_8D_0D_________F2_0F_11_40___48_89_08_48_89_03_48_8B_C3_48_8B_5C_24___48_83_C4_30
lea rcx, [0x1800cc6b0]
call fcn.1800bf760
mov rcx, rax
movsxd rax, dword [rax + 3]
add rax, 7
add rax, rcx
mov qword [0x1801745a8], rax
jne 0x1800bbfaf
mov byte [rbp - 0x48], 0xa1
mov byte [rbp - 0x47], 0x89
mov byte [rbp - 0x46], 0x92
mov byte [rbp - 0x45], 0x8a
mov byte [rbp - 0x44], 0x85
mov byte [rbp - 0x43], 0x8f
mov byte [rbp - 0x42], 0xbf
mov byte [rbp - 0x41], 0x8d
mov byte [rbp - 0x40], 0x8a
mov byte [rbp - 0x3f], 0xb8
mov byte [rbp - 0x3e], 0x9b
mov byte [rbp - 0x3d], 0x91
mov byte [rbp - 0x3c], 0x93
mov byte [rbp - 0x3b], 0x9e
mov byte [rbp - 0x3a], 0x96
mov byte [rbp - 0x39], 0xd4
mov byte [rbp - 0x38], 0x86
mov byte [rbp - 0x37], 0x9f
mov byte [rbp - 0x36], 0x90
mov byte [rbp - 0x35], 0x96
mov byte [rbp - 0x34], 0x98
mov byte [rbp - 0x33], 0x8e
mov byte [rbp - 0x32], 0x8e
mov byte [rbp - 0x31], 0x8e
mov byte [rbp - 0x30], 0x98
mov byte [rbp - 0x2f], 0xde
mov byte [rbp - 0x2e], 0x91
mov byte [rbp - 0x2d], 0x6f
mov byte [rbp - 0x2c], 0x75
mov byte [rbp - 0x2b], 0x22
mov byte [rbp - 0x2a], 0x74
mov byte [rbp - 0x29], 0x6b
mov byte [rbp - 0x28], 0x77
mov byte [rbp - 0x27], 0x6d
mov byte [rbp - 0x26], 0x6e
mov byte [rbp - 0x25], 0x66
mov byte [rbp - 0x24], 0x6e
mov byte [rbp - 0x23], 0x2b
mov byte [rbp - 0x22], 0x2a
mov byte [rbp - 0x21], 0x2d
xor eax, eax
mov byte [rbp - 0x20], al
movzx eax, byte [rbp - 0x48]
xor edx, edx
lea r8, [rbp - 0x48]
nop dword [rax]
nop word [rax + rax]
lea ecx, [rdx - 0x1b]
movzx eax, byte [r8]
xor cl, al
movsxd rax, edx
mov byte [rbp + rax - 0x48], cl
inc edx
lea r8, [r8 + 1]
cmp edx, 0x28
jb 0x1800bbf80
mov byte [rbp - 0x20], 0
lea rcx, [rbp - 0x48]
call fcn.1800be830
mov rax, qword [0x1801745a8]
xorps xmm0, xmm0
movups xmmword [rbx], xmm0
mov qword [rbx], rax
movsd qword [rbx + 8], xmm6
mov rax, rbx
mov rcx, qword [rbp - 0x18]
xor rcx, rsp
call fcn.1800c2730
mov rbx, qword [rsp + 0x88]
movaps xmm6, xmmword [rsp + 0x60]
add rsp, 0x70
pop rbp
ret
Function at 0x1800bbfe0
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
mov rbp, rsp
sub rsp, 0x70
movaps xmmword [rsp + 0x60], xmm6
mov rax, qword [0x18016ffc0]
xor rax, rsp
mov qword [rbp - 0x20], rax
movaps xmm6, xmm1
mov rbx, rcx
mov qword [rbp - 0x50], rcx
lea rax, vtable.FloatTag.0
mov qword [rcx], rax
mov rax, qword [0x1801745a0]
test rax, rax
jne 0x1800bc12f
lea rdx, str.48_8D_05_________48_89_06_8B_47_08_89_46_08_48_8B_03_C6_40_28_05
lea rcx, [0x1800cc6b0]
call fcn.1800bf760
mov rcx, rax
movsxd rax, dword [rax + 3]
add rax, 7
add rax, rcx
mov qword [0x1801745a0], rax
jne 0x1800bc12f
mov byte [rbp - 0x48], 0xa3
mov byte [rbp - 0x47], 0x8a
mov byte [rbp - 0x46], 0x88
mov byte [rbp - 0x45], 0x89
mov byte [rbp - 0x44], 0x9d
mov byte [rbp - 0x43], 0xbe
mov byte [rbp - 0x42], 0x8a
mov byte [rbp - 0x41], 0x8b
mov byte [rbp - 0x40], 0xbb
mov byte [rbp - 0x3f], 0x9a
mov byte [rbp - 0x3e], 0x8e
mov byte [rbp - 0x3d], 0x92
mov byte [rbp - 0x3c], 0x9d
mov byte [rbp - 0x3b], 0x97
mov byte [rbp - 0x3a], 0xd3
mov byte [rbp - 0x39], 0x87
mov byte [rbp - 0x38], 0x9c
mov byte [rbp - 0x37], 0x91
mov byte [rbp - 0x36], 0x99
mov byte [rbp - 0x35], 0x99
mov byte [rbp - 0x34], 0x8d
mov byte [rbp - 0x33], 0x8f
mov byte [rbp - 0x32], 0x89
mov byte [rbp - 0x31], 0x99
mov byte [rbp - 0x30], 0xdd
mov byte [rbp - 0x2f], 0x90
mov byte [rbp - 0x2e], 0x90
mov byte [rbp - 0x2d], 0x74
mov byte [rbp - 0x2c], 0x21
mov byte [rbp - 0x2b], 0x75
mov byte [rbp - 0x2a], 0x6c
mov byte [rbp - 0x29], 0x76
mov byte [rbp - 0x28], 0x6e
mov byte [rbp - 0x27], 0x6f
mov byte [rbp - 0x26], 0x69
mov byte [rbp - 0x25], 0x6f
mov byte [rbp - 0x24], 0x28
mov byte [rbp - 0x23], 0x2b
mov byte [rbp - 0x22], 0x2a
xor eax, eax
mov byte [rbp - 0x21], al
movzx eax, byte [rbp - 0x48]
xor edx, edx
lea r8, [rbp - 0x48]
nop dword [rax]
lea ecx, [rdx - 0x1b]
movzx eax, byte [r8]
xor cl, al
movsxd rax, edx
mov byte [rbp + rax - 0x48], cl
inc edx
lea r8, [r8 + 1]
cmp edx, 0x27
jb 0x1800bc100
mov byte [rbp - 0x21], 0
lea rcx, [rbp - 0x48]
call fcn.1800be830
mov rax, qword [0x1801745a0]
xorps xmm0, xmm0
movups xmmword [rbx], xmm0
mov qword [rbx], rax
movss dword [rbx + 8], xmm6
mov rax, rbx
mov rcx, qword [rbp - 0x20]
xor rcx, rsp
call fcn.1800c2730
mov rbx, qword [rsp + 0x88]
movaps xmm6, xmmword [rsp + 0x60]
add rsp, 0x70
pop rbp
ret
Function at 0x1800bc160
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rdi
push rbp
mov rbp, rsp
sub rsp, 0x60
mov rax, qword [0x18016ffc0]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov rdi, rdx
mov rbx, rcx
mov qword [rbp - 0x40], rcx
lea rax, vtable.Int64Tag.0
mov qword [rcx], rax
mov rax, qword [0x180174580]
test rax, rax
jne 0x1800bc2af
lea rdx, str.48_8D_05_________48_89_47_40_48_89_77_48_C6_47_68_04_48_8B_CD_E8________
lea rcx, [0x1800cc6b0]
call fcn.1800bf760
mov rcx, rax
movsxd rax, dword [rax + 3]
add rax, 7
add rax, rcx
mov qword [0x180174580], rax
jne 0x1800bc2af
mov byte [rbp - 0x38], 0xac
mov byte [rbp - 0x37], 0x88
mov byte [rbp - 0x36], 0x93
mov byte [rbp - 0x35], 0xde
mov byte [rbp - 0x34], 0xdd
mov byte [rbp - 0x33], 0xbe
mov byte [rbp - 0x32], 0x8a
mov byte [rbp - 0x31], 0x8b
mov byte [rbp - 0x30], 0xbb
mov byte [rbp - 0x2f], 0x9a
mov byte [rbp - 0x2e], 0x8e
mov byte [rbp - 0x2d], 0x92
mov byte [rbp - 0x2c], 0x9d
mov byte [rbp - 0x2b], 0x97
mov byte [rbp - 0x2a], 0xd3
mov byte [rbp - 0x29], 0x87
mov byte [rbp - 0x28], 0x9c
mov byte [rbp - 0x27], 0x91
mov byte [rbp - 0x26], 0x99
mov byte [rbp - 0x25], 0x99
mov byte [rbp - 0x24], 0x8d
mov byte [rbp - 0x23], 0x8f
mov byte [rbp - 0x22], 0x89
mov byte [rbp - 0x21], 0x99
mov byte [rbp - 0x20], 0xdd
mov byte [rbp - 0x1f], 0x90
mov byte [rbp - 0x1e], 0x90
mov byte [rbp - 0x1d], 0x74
mov byte [rbp - 0x1c], 0x21
mov byte [rbp - 0x1b], 0x75
mov byte [rbp - 0x1a], 0x6c
mov byte [rbp - 0x19], 0x76
mov byte [rbp - 0x18], 0x6e
mov byte [rbp - 0x17], 0x6f
mov byte [rbp - 0x16], 0x69
mov byte [rbp - 0x15], 0x6f
mov byte [rbp - 0x14], 0x28
mov byte [rbp - 0x13], 0x2b
mov byte [rbp - 0x12], 0x2a
xor eax, eax
mov byte [rbp - 0x11], al
movzx eax, byte [rbp - 0x38]
xor edx, edx
lea r8, [rbp - 0x38]
nop dword [rax]
lea ecx, [rdx - 0x1b]
movzx eax, byte [r8]
xor cl, al
movsxd rax, edx
mov byte [rbp + rax - 0x38], cl
inc edx
lea r8, [r8 + 1]
cmp edx, 0x27
jb 0x1800bc280
mov byte [rbp - 0x11], 0
lea rcx, [rbp - 0x38]
call fcn.1800be830
mov rax, qword [0x180174580]
xorps xmm0, xmm0
movups xmmword [rbx], xmm0
mov qword [rbx], rax
mov qword [rbx + 8], rdi
mov rax, rbx
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.1800c2730
mov rbx, qword [rsp + 0x78]
mov rdi, qword [rsp + 0x80]
add rsp, 0x60
pop rbp
ret
Function at 0x1800bc2e0
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rdi
push rbp
mov rbp, rsp
sub rsp, 0x60
mov rax, qword [0x18016ffc0]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov edi, edx
mov rbx, rcx
mov qword [rbp - 0x40], rcx
lea rax, vtable.IntTag.0
mov qword [rcx], rax
mov rax, qword [0x180174588]
test rax, rax
jne 0x1800bc42f
lea rdx, str.48_8D_15_________48_89_10_89_48_08_48_89_03_48_8B_C3_48_8B_5C_24__
lea rcx, [0x1800cc6b0]
call fcn.1800bf760
mov rcx, rax
movsxd rax, dword [rax + 3]
add rax, 7
add rax, rcx
mov qword [0x180174588], rax
jne 0x1800bc42f
mov byte [rbp - 0x38], 0xac
mov byte [rbp - 0x37], 0x88
mov byte [rbp - 0x36], 0x93
mov byte [rbp - 0x35], 0xbc
mov byte [rbp - 0x34], 0x88
mov byte [rbp - 0x33], 0x8d
mov byte [rbp - 0x32], 0xbd
mov byte [rbp - 0x31], 0x98
mov byte [rbp - 0x30], 0x8c
mov byte [rbp - 0x2f], 0x8c
mov byte [rbp - 0x2e], 0x83
mov byte [rbp - 0x2d], 0x95
mov byte [rbp - 0x2c], 0xd1
mov byte [rbp - 0x2b], 0x81
mov byte [rbp - 0x2a], 0x9a
mov byte [rbp - 0x29], 0x93
mov byte [rbp - 0x28], 0x9b
mov byte [rbp - 0x27], 0x97
mov byte [rbp - 0x26], 0x83
mov byte [rbp - 0x25], 0x8d
mov byte [rbp - 0x24], 0x8b
mov byte [rbp - 0x23], 0x9f
mov byte [rbp - 0x22], 0xdb
mov byte [rbp - 0x21], 0x92
mov byte [rbp - 0x20], 0x92
mov byte [rbp - 0x1f], 0x8a
mov byte [rbp - 0x1e], 0xdf
mov byte [rbp - 0x1d], 0x77
mov byte [rbp - 0x1c], 0x6e
mov byte [rbp - 0x1b], 0x70
mov byte [rbp - 0x1a], 0x68
mov byte [rbp - 0x19], 0x6d
mov byte [rbp - 0x18], 0x6b
mov byte [rbp - 0x17], 0x61
mov byte [rbp - 0x16], 0x26
mov byte [rbp - 0x15], 0x29
mov byte [rbp - 0x14], 0x28
xor eax, eax
mov byte [rbp - 0x13], al
movzx eax, byte [rbp - 0x38]
xor edx, edx
lea r8, [rbp - 0x38]
nop dword [rax]
nop dword [rax + rax]
lea ecx, [rdx - 0x1b]
movzx eax, byte [r8]
xor cl, al
movsxd rax, edx
mov byte [rbp + rax - 0x38], cl
inc edx
lea r8, [r8 + 1]
cmp edx, 0x25
jb 0x1800bc400
mov byte [rbp - 0x13], 0
lea rcx, [rbp - 0x38]
call fcn.1800be830
mov rax, qword [0x180174588]
xorps xmm0, xmm0
movups xmmword [rbx], xmm0
mov qword [rbx], rax
mov dword [rbx + 8], edi
mov rax, rbx
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.1800c2730
mov rbx, qword [rsp + 0x78]
mov rdi, qword [rsp + 0x80]
add rsp, 0x60
pop rbp
ret
Function at 0x1800bc460
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
mov rbp, rsp
sub rsp, 0x60
mov rax, qword [0x18016ffc0]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov rbx, rcx
mov qword [rbp - 0x40], rcx
lea rax, vtable.ListTag.0
mov qword [rcx], rax
mov rax, qword [0x1801745b8]
test rax, rax
jne 0x1800bc5af
lea rdx, str.48_8D_0D_________48_89_08_33_C9_48_89_48_08_48_89_48_10_48_89_48_18_88_48_20_48_89_03
lea rcx, [0x1800cc6b0]
call fcn.1800bf760
mov rcx, rax
movsxd rax, dword [rax + 3]
add rax, 7
add rax, rcx
mov qword [0x1801745b8], rax
jne 0x1800bc5af
mov byte [rbp - 0x38], 0xa9
mov byte [rbp - 0x37], 0x8f
mov byte [rbp - 0x36], 0x94
mov byte [rbp - 0x35], 0x9c
mov byte [rbp - 0x34], 0xbd
mov byte [rbp - 0x33], 0x8b
mov byte [rbp - 0x32], 0x8c
mov byte [rbp - 0x31], 0xba
mov byte [rbp - 0x30], 0x99
mov byte [rbp - 0x2f], 0x8f
mov byte [rbp - 0x2e], 0x8d
mov byte [rbp - 0x2d], 0x9c
mov byte [rbp - 0x2c], 0x94
mov byte [rbp - 0x2b], 0xd2
mov byte [rbp - 0x2a], 0x80
mov byte [rbp - 0x29], 0x9d
mov byte [rbp - 0x28], 0x92
mov byte [rbp - 0x27], 0x98
mov byte [rbp - 0x26], 0x96
mov byte [rbp - 0x25], 0x8c
mov byte [rbp - 0x24], 0x8c
mov byte [rbp - 0x23], 0x88
mov byte [rbp - 0x22], 0x9e
mov byte [rbp - 0x21], 0xdc
mov byte [rbp - 0x20], 0x93
mov byte [rbp - 0x1f], 0x91
mov byte [rbp - 0x1e], 0x8b
mov byte [rbp - 0x1d], 0x20
mov byte [rbp - 0x1c], 0x76
mov byte [rbp - 0x1b], 0x6d
mov byte [rbp - 0x1a], 0x71
mov byte [rbp - 0x19], 0x6f
mov byte [rbp - 0x18], 0x6c
mov byte [rbp - 0x17], 0x68
mov byte [rbp - 0x16], 0x60
mov byte [rbp - 0x15], 0x29
mov byte [rbp - 0x14], 0x28
mov byte [rbp - 0x13], 0x2b
xor eax, eax
mov byte [rbp - 0x12], al
movzx eax, byte [rbp - 0x38]
xor edx, edx
lea r8, [rbp - 0x38]
nop dword [rax]
nop word [rax + rax]
lea ecx, [rdx - 0x1b]
movzx eax, byte [r8]
xor cl, al
movsxd rax, edx
mov byte [rbp + rax - 0x38], cl
inc edx
lea r8, [r8 + 1]
cmp edx, 0x26
jb 0x1800bc580
mov byte [rbp - 0x12], 0
lea rcx, [rbp - 0x38]
call fcn.1800be830
mov rax, qword [0x1801745b8]
xorps xmm0, xmm0
xor ecx, ecx
movups xmmword [rbx], xmm0
movups xmmword [rbx + 0x10], xmm0
mov qword [rbx + 0x20], rcx
mov qword [rbx], rax
mov rax, rbx
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.1800c2730
mov rbx, qword [rsp + 0x78]
add rsp, 0x60
pop rbp
ret
Function at 0x1800bc5e0
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rdi
push rbp
mov rbp, rsp
sub rsp, 0x60
mov rax, qword [0x18016ffc0]
xor rax, rsp
mov qword [rbp - 0x10], rax
movzx edi, dx
mov rbx, rcx
mov qword [rbp - 0x40], rcx
lea rax, vtable.ShortTag.0
mov qword [rcx], rax
mov rax, qword [0x180174598]
test rax, rax
jne 0x1800bc72f
lea rdx, str.48_8D_15_________48_89_10_66_89_48___48_89_03_48_8B_C3_48_8B_5C_24__
lea rcx, [0x1800cc6b0]
call fcn.1800bf760
mov rcx, rax
movsxd rax, dword [rax + 3]
add rax, 7
add rax, rcx
mov qword [0x180174598], rax
jne 0x1800bc72f
mov byte [rbp - 0x38], 0xb6
mov byte [rbp - 0x37], 0x8e
mov byte [rbp - 0x36], 0x88
mov byte [rbp - 0x35], 0x9a
mov byte [rbp - 0x34], 0x9d
mov byte [rbp - 0x33], 0xbe
mov byte [rbp - 0x32], 0x8a
mov byte [rbp - 0x31], 0x8b
mov byte [rbp - 0x30], 0xbb
mov byte [rbp - 0x2f], 0x9a
mov byte [rbp - 0x2e], 0x8e
mov byte [rbp - 0x2d], 0x92
mov byte [rbp - 0x2c], 0x9d
mov byte [rbp - 0x2b], 0x97
mov byte [rbp - 0x2a], 0xd3
mov byte [rbp - 0x29], 0x87
mov byte [rbp - 0x28], 0x9c
mov byte [rbp - 0x27], 0x91
mov byte [rbp - 0x26], 0x99
mov byte [rbp - 0x25], 0x99
mov byte [rbp - 0x24], 0x8d
mov byte [rbp - 0x23], 0x8f
mov byte [rbp - 0x22], 0x89
mov byte [rbp - 0x21], 0x99
mov byte [rbp - 0x20], 0xdd
mov byte [rbp - 0x1f], 0x90
mov byte [rbp - 0x1e], 0x90
mov byte [rbp - 0x1d], 0x74
mov byte [rbp - 0x1c], 0x21
mov byte [rbp - 0x1b], 0x75
mov byte [rbp - 0x1a], 0x6c
mov byte [rbp - 0x19], 0x76
mov byte [rbp - 0x18], 0x6e
mov byte [rbp - 0x17], 0x6f
mov byte [rbp - 0x16], 0x69
mov byte [rbp - 0x15], 0x6f
mov byte [rbp - 0x14], 0x28
mov byte [rbp - 0x13], 0x2b
mov byte [rbp - 0x12], 0x2a
xor eax, eax
mov byte [rbp - 0x11], al
movzx eax, byte [rbp - 0x38]
xor edx, edx
lea r8, [rbp - 0x38]
nop dword [rax]
lea ecx, [rdx - 0x1b]
movzx eax, byte [r8]
xor cl, al
movsxd rax, edx
mov byte [rbp + rax - 0x38], cl
inc edx
lea r8, [r8 + 1]
cmp edx, 0x27
jb 0x1800bc700
mov byte [rbp - 0x11], 0
lea rcx, [rbp - 0x38]
call fcn.1800be830
mov rax, qword [0x180174598]
xorps xmm0, xmm0
movups xmmword [rbx], xmm0
mov qword [rbx], rax
mov word [rbx + 8], di
mov rax, rbx
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.1800c2730
mov rbx, qword [rsp + 0x78]
mov rdi, qword [rsp + 0x80]
add rsp, 0x60
pop rbp
ret
Function at 0x1800bfa40
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
mov qword [rsp + 0x10], rbx
push rsi
sub rsp, 0x30
mov rbx, rcx
xor esi, esi
xor ecx, ecx
call qword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
jne 0x1800bfa7e
xorps xmm0, xmm0
mov rax, rbx
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], 0xf
mov byte [rbx], sil
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rsi
ret
mov ecx, 1
mov qword [rsp + 0x40], rdi
call qword [sym.imp.USER32.dll_GetClipboardData]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GlobalLock]
mov rdi, rax
test rax, rax
jne 0x1800bfac7
mov rdi, qword [rsp + 0x40]
xorps xmm0, xmm0
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], rsi
mov rax, rbx
mov qword [rbx + 0x18], 0xf
mov byte [rbx], sil
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rsi
ret
call qword [sym.imp.USER32.dll_CloseClipboard]
xorps xmm0, xmm0
mov r8, 0xffffffffffffffff
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], rsi
inc r8
cmp byte [rdi + r8], sil
jne 0x1800bfae2
mov rdx, rdi
mov rcx, rbx
call fcn.180001d20
mov rdi, qword [rsp + 0x40]
mov rax, rbx
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rsi
ret

Function at 0x1800bfbc0
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov ebx, edx
lea r9, [rsp + 0x38]
mov edx, edx
mov r8d, 0x40
mov rdi, rcx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov r8d, ebx
mov edx, 0x90
mov rcx, rdi
call sub.VCRUNTIME140.dll_memset
mov r8d, dword [rsp + 0x38]
lea r9, [rsp + 0x38]
mov edx, ebx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x1800bfc20
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov edi, r8d
lea r9, [rsp + 0x40]
mov rbx, rdx
mov r8d, 0x40
mov edx, edi
mov rsi, rcx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov r8d, edi
mov rdx, rbx
mov rcx, rsi
call sub.VCRUNTIME140.dll_memcpy
mov r8d, dword [rsp + 0x40]
lea r9, [rsp + 0x40]
mov edx, edi
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x1800bfe30
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push rdi
sub rsp, 0x20
mov rdi, rcx
xor ecx, ecx
call qword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x1800bfee2
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x38], rsi
call qword [sym.imp.USER32.dll_EmptyClipboard]
mov rdx, qword [rdi + 0x10]
lea rbx, [rdi + 0x10]
inc rdx
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov rsi, rax
test rax, rax
jne 0x1800bfe8d
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp qword [sym.imp.USER32.dll_CloseClipboard]
cmp qword [rdi + 0x18], 0xf
jbe 0x1800bfe97
mov rdi, qword [rdi]
mov rbx, qword [rbx]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GlobalLock]
lea r8, [rbx + 1]
mov rdx, rdi
mov rcx, rax
call sub.VCRUNTIME140.dll_memcpy
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov rdx, rsi
mov ecx, 1
call qword [sym.imp.USER32.dll_SetClipboardData]
call qword [sym.imp.USER32.dll_CloseClipboard]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GlobalFree]
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret

Function at 0x1800c07cc
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x20
mov eax, ecx
mov esi, edx
imul rbx, rax, 0x38
add rbx, qword [0x180174f50]
mov r8b, byte [rbx + 0x20]
mov rdx, qword [rbx]
mov rdi, rdx
and r8b, 1
je 0x1800c0803
lea rdi, [rdx - 5]
movzx eax, r8b
lea rcx, [rdx - 5]
test r8b, r8b
lea r9, [rsp + 0x30]
mov r8d, 0x40
cmove rcx, rdx
lea rbp, [rax*2 + 5]
mov rdx, rbp
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x1800c083c
mov eax, 0xa
jmp 0x1800c08c8
test esi, esi
je 0x1800c085e
mov byte [rdi], 0xe9
mov eax, dword [rbx + 8]
sub eax, edi
sub eax, 5
mov dword [rdi + 1], eax
test byte [rbx + 0x20], 1
je 0x1800c087f
mov rax, qword [rbx]
mov word [rax], 0xf9eb
jmp 0x1800c087f
mov eax, dword [rbx + 0x18]
test byte [rbx + 0x20], 1
mov dword [rdi], eax
je 0x1800c0879
movzx eax, word [rbx + 0x1c]
mov word [rdi + 4], ax
mov al, byte [rbx + 0x1e]
mov byte [rdi + 6], al
jmp 0x1800c087f
mov al, byte [rbx + 0x1c]
mov byte [rdi + 4], al
mov r8d, dword [rsp + 0x30]
lea r9, [rsp + 0x30]
mov rdx, rbp
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov r8, rbp
mov rdx, rdi
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_FlushInstructionCache]
and byte [rbx + 0x20], 0xfd
and sil, 1
mov al, sil
shl sil, 2
add al, al
or al, byte [rbx + 0x20]
and al, 0xfb
or al, sil
mov byte [rbx + 0x20], al
xor eax, eax
mov rbx, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret
Function at 0x1800c0cf8
Capabilities:
Resume thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov r8, qword [rcx]
mov rbx, rcx
test r8, r8
je 0x1800c0d5e
xor edi, edi
cmp dword [rcx + 0xc], edi
jbe 0x1800c0d4f
mov rax, qword [rbx]
xor edx, edx
mov r8d, dword [rax + rdi*4]
lea ecx, [rdx + 0x5a]
call qword [sym.imp.KERNEL32.dll_OpenThread]
mov rsi, rax
test rax, rax
je 0x1800c0d45
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
inc edi
cmp edi, dword [rbx + 0xc]
jb 0x1800c0d19
mov r8, qword [rbx]
mov rcx, qword [0x1801748d8]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret