joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18003bc4c
Capabilities:
Read file on windows

Disassembly:
push rbx
sub rsp, 0x40
and qword [rsp + 0x30], 0
and dword [rsp + 0x28], 0
mov r8d, 3
xor r9d, r9d
mov edx, 0x80000000
mov dword [rsp + 0x20], r8d
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbx, rax
test rax, rax
je 0x18003bcd2
cmp rax, 0xffffffffffffffff
je 0x18003bce6
and dword [rsp + 0x60], 0
and dword [rsp + 0x58], 0
and qword [rsp + 0x20], 0
lea r9, [rsp + 0x58]
lea rdx, [rsp + 0x60]
mov r8d, 4
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x18003bcd2
cmp dword [rsp + 0x58], 4
jne 0x18003bcd2
cmp dword [rsp + 0x60], 0x21726152
jne 0x18003bcd2
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
jmp 0x18003bce8
cmp rbx, 0xffffffffffffffff
je 0x18003bce6
test rbx, rbx
je 0x18003bce6
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
add rsp, 0x40
pop rbx
ret

Function at 0x18003bcf0
Capabilities:
Link many functions at runtime

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
mov eax, 0x80e0
call fcn.18006e000
sub rsp, rax
mov rax, qword [0x1800a1658]
xor rax, rsp
mov qword [rsp + 0x80d0], rax
mov rsi, rcx
lea rcx, str.unrar64.dll
mov ebp, r9d
mov rdi, r8
call fcn.18003baf0
mov rbx, rax
test rax, rax
jne 0x18003bd3e
mov eax, 0x453
jmp 0x18003be3e
lea rdx, str.RAROpenArchiveEx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.RARCloseArchive
mov rcx, rbx
mov qword [0x1800a7740], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.RARReadHeaderEx
mov rcx, rbx
mov qword [0x1800a7748], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.RARProcessFileW
mov rcx, rbx
mov qword [0x1800a7750], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.RARSetPassword
mov rcx, rbx
mov qword [0x1800a7758], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, qword [0x1800a7740]
mov qword [0x1800a7760], rax
test rbx, rbx
je 0x18003be39
cmp qword [0x1800a7748], 0
je 0x18003be39
cmp qword [0x1800a7750], 0
je 0x18003be39
cmp qword [0x1800a7758], 0
je 0x18003be39
test rax, rax
je 0x18003be39
and qword [rsp + 0x20], 0
lea rcx, [rsp + 0x28]
xor edx, edx
mov r8d, 0xa8
call fcn.18005a150
and qword [rsp + 0x50], 0
and qword [rsp + 0x58], 0
lea rax, [rsp + 0xd0]
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x28], rsi
mov dword [rsp + 0x40], 0x4000
mov dword [rsp + 0x30], ebp
mov qword [rsp + 0x64], rax
call rbx
mov r11, rax
mov eax, dword [rsp + 0x34]
test eax, eax
jne 0x18003be3e
mov qword [rdi], r11
jmp 0x18003be3e
mov eax, 0x454
mov rcx, qword [rsp + 0x80d0]
xor rcx, rsp
call fcn.180059b00
mov rbx, qword [rsp + 0x8108]
add rsp, 0x80e0
pop rdi
pop rsi
pop rbp
ret
Function at 0x18003c7ac
Capabilities:
Check if file exists
Move file

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
sub rsp, 0x20
mov rax, qword [rcx + 0x30]
mov rdi, qword [rcx]
mov r12, rcx
mov rbx, qword [rax]
mov ebp, 1
mov rsi, qword [r12 + 0x30]
test rdi, rdi
je 0x18003c7e7
cmp rdi, qword [r12]
je 0x18003c7ec
call fcn.1800592a8
cmp rbx, rsi
je 0x18003c8f4
test rdi, rdi
jne 0x18003c804
call fcn.1800592a8
xor r11d, r11d
jmp 0x18003c807
mov r11, qword [rdi]
cmp rbx, qword [r11 + 0x30]
jne 0x18003c812
call fcn.1800592a8
cmp qword [rbx + 0x60], 8
jb 0x18003c81f
mov rcx, qword [rbx + 0x48]
jmp 0x18003c823
lea rcx, [rbx + 0x48]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x18003c89c
test rdi, rdi
jne 0x18003c83c
call fcn.1800592a8
xor r11d, r11d
jmp 0x18003c83f
mov r11, qword [rdi]
cmp rbx, qword [r11 + 0x30]
jne 0x18003c84a
call fcn.1800592a8
cmp qword [rbx + 0x38], 8
jb 0x18003c857
mov rsi, qword [rbx + 0x20]
jmp 0x18003c85b
lea rsi, [rbx + 0x20]
test rdi, rdi
jne 0x18003c86a
call fcn.1800592a8
xor r11d, r11d
jmp 0x18003c86d
mov r11, qword [rdi]
cmp rbx, qword [r11 + 0x30]
jne 0x18003c878
call fcn.1800592a8
cmp qword [rbx + 0x60], 8
jb 0x18003c885
mov rcx, qword [rbx + 0x48]
jmp 0x18003c889
lea rcx, [rbx + 0x48]
mov r8d, 1
mov rdx, rsi
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
jne 0x18003c89e
xor ebp, ebp
test rdi, rdi
jne 0x18003c8a8
call fcn.1800592a8
cmp byte [rbx + 0x69], 0
je 0x18003c8b8
call fcn.1800592a8
jmp 0x18003c7d7
mov rax, qword [rbx + 0x10]
cmp byte [rax + 0x69], 0
jne 0x18003c8d3
mov rbx, rax
mov rax, qword [rax]
cmp byte [rax + 0x69], 0
je 0x18003c8c2
jmp 0x18003c7d7
mov rax, qword [rbx + 8]
jmp 0x18003c8e6
cmp rbx, qword [rax + 0x10]
jne 0x18003c8ec
mov rbx, rax
mov rax, qword [rax + 8]
cmp byte [rax + 0x69], 0
je 0x18003c8d9
mov rbx, rax
jmp 0x18003c7d7
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
mov eax, ebp
mov rbp, qword [rsp + 0x38]
add rsp, 0x20
pop r12
ret
Function at 0x18003cd78
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x20
xor eax, eax
xor esi, esi
mov rbp, r8
mov qword [rcx], rax
mov qword [rcx + 8], rax
mov eax, dword [rcx + 0x10]
shl eax, 2
mov r10, rdx
mov rbx, rcx
cmp eax, esi
mov r9d, esi
jle 0x18003cde6
mov eax, r9d
inc r9d
cdq
and edx, 3
add eax, edx
mov ecx, eax
and eax, 3
sub eax, edx
sar ecx, 2
movsxd rdx, eax
movsxd rax, ecx
lea rcx, [rbx + rax]
mov al, byte [r10]
inc r10
mov byte [rcx + rdx*4], al
mov eax, dword [rbx + 0x10]
shl eax, 2
cmp r9d, eax
jl 0x18003cdb2
mov edx, dword [rbx + 0x18]
mov rcx, rbx
call fcn.18003ceec
mov edi, dword [rbx + 0x18]
lea r14, [0x1800a35c0]
jmp 0x18003ce41
mov r9, rsi
movzx edx, byte [r11 + r9]
mov ecx, edx
and edx, 0xf
shr ecx, 4
shl rcx, 4
add rcx, rdx
mov al, byte [rcx + r14]
mov byte [r11 + r9], al
inc r9
cmp r9, 4
jl 0x18003ce00
add r11, 4
sub r8, 1
jne 0x18003cdfd
mov edx, edi
mov rcx, rbx
call fcn.18003ceec
mov rcx, rbx
call fcn.18003d02c
mov rcx, rbx
dec edi
call fcn.18003cfa4
cmp edi, 1
mov r11, rbx
mov r8d, 4
jge 0x18003cdfd
mov r9, rsi
movzx edx, byte [r11 + r9]
mov ecx, edx
and edx, 0xf
shr ecx, 4
shl rcx, 4
add rcx, rdx
mov al, byte [rcx + r14]
mov byte [r11 + r9], al
inc r9
cmp r9, 4
jl 0x18003ce5c
add r11, 4
sub r8, 1
jne 0x18003ce59
xor edx, edx
mov rcx, rbx
call fcn.18003ceec
mov eax, dword [rbx + 0x10]
shl eax, 2
cmp eax, esi
jle 0x18003ced0
mov eax, esi
inc esi
cdq
and edx, 3
add eax, edx
mov ecx, eax
and eax, 3
sub eax, edx
sar ecx, 2
movsxd rdx, eax
movsxd rax, ecx
lea rcx, [rbx + rax]
mov al, byte [rcx + rdx*4]
mov byte [rbp], al
mov eax, dword [rbx + 0x10]
inc rbp
shl eax, 2
cmp esi, eax
jl 0x18003ce9f
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret

Function at 0x18003ceec
Capabilities:
Encode data using xor

Disassembly:
movsxd rax, edx
mov r11d, 4
add rax, rax
mov r10, r11
lea rdx, [rcx + rax*8 + 0x3c]
xor r8d, r8d
mov r9, rdx
mov al, byte [r9]
add r9, r11
xor byte [rcx + r8], al
inc r8
cmp r8, r11
jl 0x18003cf06
inc rdx
add rcx, r11
sub r10, 1
jne 0x18003cf00
repz ret
Function at 0x18003dda8
Capabilities:
Decode data using base64 via dword translation table

Disassembly:
mov r11, rsp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x60
mov qword [rsp + 0x28], 0xfffffffffffffffe
mov qword [r11 + 0x18], rbx
mov qword [r11 + 0x20], rbp
mov rax, qword [0x1800a1658]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov r12, rdx
mov rbx, rcx
and dword [rsp + 0x20], 0
xor esi, esi
xor eax, eax
or r14, 0xffffffffffffffff
mov rcx, r14
mov rdi, rdx
repne scasb al, byte [rdi]
not rcx
sub rcx, 1
mov r13, rcx
mov qword [r11 - 0x38], 0xf
mov qword [r11 - 0x40], rax
mov byte [rsp + 0x38], al
je 0x18003df9a
lea rdi, [0x1800825b0]
movsx rax, byte [r12 + rsi]
mov cl, byte [rax + rdi]
inc rsi
cmp rsi, r13
jae 0x18003de2e
cmp cl, r14b
je 0x18003de19
cmp cl, r14b
je 0x18003df9a
movsx rax, byte [r12 + rsi]
mov bpl, byte [rax + rdi]
inc rsi
cmp rsi, r13
jae 0x18003de4d
cmp bpl, r14b
je 0x18003de37
cmp bpl, r14b
je 0x18003df9a
mov r8b, bpl
sar r8b, 4
and r8b, 3
shl cl, 2
or r8b, cl
mov edx, 1
lea rcx, [rsp + 0x30]
call fcn.18000707c
jmp 0x18003de7f
lea rdi, [0x1800825b0]
mov al, byte [r12 + rsi]
inc rsi
cmp al, 0x3d
je 0x18003df5e
movsx rax, al
mov dil, byte [rax + rdi]
cmp rsi, r13
jae 0x18003dea0
cmp dil, r14b
je 0x18003de78
cmp dil, r14b
je 0x18003df9a
mov r8b, dil
sar r8b, 2
and r8b, 0xf
shl bpl, 4
or r8b, bpl
mov ebp, 1
mov rdx, rbp
lea rcx, [rsp + 0x30]
call fcn.18000707c
lea rdx, [0x1800825b0]
mov al, byte [r12 + rsi]
add rsi, rbp
cmp al, 0x3d
je 0x18003df22
movsx rax, al
mov cl, byte [rax + rdx]
cmp rsi, r13
jae 0x18003def0
cmp cl, r14b
je 0x18003ded4
cmp cl, r14b
je 0x18003df9a
shl dil, 6
or dil, cl
mov r8b, dil
mov rdx, rbp
lea rcx, [rsp + 0x30]
call fcn.18000707c
cmp rsi, r13
lea rdi, [0x1800825b0]
jb 0x18003de19
jmp 0x18003df9a
mov qword [rbx + 0x20], sendto
and qword [rbx + 0x18], 0
mov byte [rbx + 8], 0
mov r9, r14
xor r8d, r8d
lea rdx, [rsp + 0x30]
mov rcx, rbx
call fcn.180007178
nop
cmp qword [rsp + 0x50], 0x10
jb 0x18003df59
mov rcx, qword [rsp + 0x38]
call fcn.180058ed8
mov rax, rbx
jmp 0x18003dfd4
mov qword [rbx + 0x20], sendto
and qword [rbx + 0x18], 0
mov byte [rbx + 8], 0
mov r9, r14
xor r8d, r8d
lea rdx, [rsp + 0x30]
mov rcx, rbx
call fcn.180007178
nop
cmp qword [rsp + 0x50], 0x10
jb 0x18003df95
mov rcx, qword [rsp + 0x38]
call fcn.180058ed8
mov rax, rbx
jmp 0x18003dfd4
mov qword [rbx + 0x20], sendto
and qword [rbx + 0x18], 0
mov byte [rbx + 8], 0
mov r9, r14
xor r8d, r8d
lea rdx, [rsp + 0x30]
mov rcx, rbx
call fcn.180007178
nop
cmp qword [rsp + 0x50], 0x10
jb 0x18003dfd1
mov rcx, qword [rsp + 0x38]
call fcn.180058ed8
mov rax, rbx
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.180059b00
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x40]
mov rbp, qword [r11 + 0x48]
mov rsp, r11
pop r14
pop r13
pop r12
pop rdi
pop rsi
ret
Function at 0x18003e060
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x90
xor r11d, r11d
mov rdi, rcx
mov dword [rsp], 0x2ac3268c
mov dword [rsp + 4], 0x33747d9a
mov dword [rsp + 8], 0xd1de98ac
mov dword [rsp + 0xc], 0x6eee320c
lea ebx, [r11 + 0x20]
lea rsi, [0x180000000]
mov r9d, dword [r11 + rsi + 0x824e0]
xor r9d, dword [rsp + r11 + 4]
xor r9d, dword [rsp + r11 + 0xc]
xor r9d, dword [rsp + r11 + 8]
mov eax, r9d
mov ecx, r9d
mov edx, r9d
shr ecx, 0x10
shr eax, 0x18
shr edx, 8
movzx eax, al
movzx r10d, byte [rax + rsi + 0x823d0]
movzx eax, cl
movzx ecx, byte [rax + rsi + 0x823d0]
shl r10d, 8
movzx eax, dl
movzx edx, byte [rax + rsi + 0x823d0]
or r10d, ecx
movzx eax, r9b
movzx r9d, byte [rax + rsi + 0x823d0]
shl r10d, 8
or r10d, edx
shl r10d, 8
or r10d, r9d
mov ecx, r10d
mov eax, r10d
rol ecx, 0xd
ror eax, 9
xor ecx, eax
xor ecx, dword [rsp + r11]
xor ecx, r10d
mov dword [rsp + r11 + 0x10], ecx
mov dword [r11 + rdi], ecx
add r11, 4
sub rbx, 1
jne 0x18003e0a2
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret
Function at 0x18003e150
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
sub rsp, 0xb0
mov rbp, rcx
mov rdi, r8
mov rbx, rdx
lea rcx, [rsp + 0x20]
xor edx, edx
mov r8d, 0x90
call fcn.18005a150
movzx eax, byte [rbx + 1]
movzx r11d, byte [rbx]
movzx ecx, byte [rbx + 4]
shl r11d, 8
mov esi, 0x20
shl ecx, 8
or r11d, eax
movzx eax, byte [rbx + 2]
shl r11d, 8
lea r12, [0x1800823d0]
or r11d, eax
movzx eax, byte [rbx + 3]
shl r11d, 8
or r11d, eax
movzx eax, byte [rbx + 5]
or ecx, eax
movzx eax, byte [rbx + 6]
mov dword [rsp + 0x20], r11d
shl ecx, 8
or ecx, eax
movzx eax, byte [rbx + 7]
shl ecx, 8
or ecx, eax
movzx eax, byte [rbx + 9]
mov dword [rsp + 0x24], ecx
movzx ecx, byte [rbx + 8]
shl ecx, 8
or ecx, eax
movzx eax, byte [rbx + 0xa]
shl ecx, 8
or ecx, eax
movzx eax, byte [rbx + 0xb]
shl ecx, 8
or ecx, eax
movzx eax, byte [rbx + 0xd]
mov dword [rsp + 0x28], ecx
movzx ecx, byte [rbx + 0xc]
shl ecx, 8
or ecx, eax
movzx eax, byte [rbx + 0xe]
shl ecx, 8
or ecx, eax
movzx eax, byte [rbx + 0xf]
lea rbx, [rsp + 0x28]
shl ecx, 8
or ecx, eax
lea rax, [rsp + 0x28]
sub rbp, rax
mov dword [rsp + 0x2c], ecx
mov r9d, dword [rbx + rbp]
xor r9d, dword [rbx - 4]
xor r9d, dword [rbx]
add rbx, 4
xor r9d, dword [rbx]
mov eax, r9d
mov ecx, r9d
mov edx, r9d
shr ecx, 0x10
shr eax, 0x18
shr edx, 8
movzx eax, al
movzx r10d, byte [rax + r12]
movzx eax, cl
movzx ecx, byte [rax + r12]
shl r10d, 8
movzx eax, dl
movzx edx, byte [rax + r12]
or r10d, ecx
movzx eax, r9b
movzx r9d, byte [rax + r12]
shl r10d, 8
or r10d, edx
shl r10d, 8
or r10d, r9d
mov ecx, r10d
mov eax, r10d
ror ecx, 0xe
rol eax, 0xa
xor ecx, eax
mov eax, r10d
ror eax, 8
xor ecx, eax
mov eax, r10d
rol eax, 2
xor ecx, eax
xor ecx, dword [rbx - 0xc]
xor ecx, r10d
sub rsi, 1
mov dword [rbx + 4], ecx
jne 0x18003e233
mov ecx, dword [rsp + 0xac]
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov eax, ecx
shr eax, 0x18
mov byte [rdi], al
mov eax, ecx
shr ecx, 8
shr eax, 0x10
mov byte [rdi + 2], cl
mov ecx, dword [rsp + 0xa8]
mov byte [rdi + 1], al
mov al, byte [rsp + 0xac]
mov byte [rdi + 3], al
mov eax, ecx
shr eax, 0x18
mov byte [rdi + 4], al
mov eax, ecx
shr ecx, 8
shr eax, 0x10
mov byte [rdi + 6], cl
mov ecx, dword [rsp + 0xa4]
mov byte [rdi + 5], al
mov al, byte [rsp + 0xa8]
mov byte [rdi + 7], al
mov eax, ecx
shr eax, 0x18
mov byte [rdi + 8], al
mov eax, ecx
shr ecx, 8
shr eax, 0x10
mov byte [rdi + 0xa], cl
mov ecx, dword [rsp + 0xa0]
mov byte [rdi + 9], al
mov al, byte [rsp + 0xa4]
mov byte [rdi + 0xb], al
mov eax, ecx
shr eax, 0x18
mov byte [rdi + 0xc], al
mov eax, ecx
shr eax, 0x10
shr ecx, 8
mov byte [rdi + 0xd], al
mov al, byte [rsp + 0xa0]
mov byte [rdi + 0xe], cl
mov byte [rdi + 0xf], al
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop r12
ret
Function at 0x18003ea9c
Capabilities:
Delete file

Disassembly:
mov rax, rsp
push rdi
sub rsp, 0x80
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
lea r9, str..________.dirty
mov r8d, 1
mov rdx, rcx
lea rcx, [rax - 0x48]
call fcn.180001b2c
mov rsi, qword [rsp + 0x70]
mov rbx, qword [rsi]
mov qword [rsp + 0x30], rbx
mov rax, qword [rsp + 0x40]
mov rdi, rax
mov qword [rsp + 0x28], rax
test rdi, rdi
je 0x18003eaf5
cmp rdi, rax
je 0x18003eafa
call fcn.1800592a8
cmp rbx, rsi
je 0x18003eb53
test rdi, rdi
jne 0x18003eb0e
call fcn.1800592a8
xor r11d, r11d
jmp 0x18003eb11
mov r11, qword [rdi]
cmp rbx, qword [r11 + 0x30]
jne 0x18003eb1c
call fcn.1800592a8
cmp qword [rbx + 0x38], 8
jb 0x18003eb29
mov rcx, qword [rbx + 0x20]
jmp 0x18003eb2d
lea rcx, [rbx + 0x20]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea rcx, [rsp + 0x28]
call fcn.18000c920
mov rsi, qword [rsp + 0x70]
mov rax, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x28]
jmp 0x18003eaeb
lea rcx, [rsp + 0x40]
call fcn.180007f70
nop
mov rcx, qword [rsp + 0x40]
call fcn.180058ed8
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret
Function at 0x18003f134
Capabilities:
Check if file exists
Copy file
Get common file path
Move file

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x270
mov rax, qword [0x1800a1658]
xor rax, rsp
mov qword [rsp + 0x260], rax
mov rbx, r8
mov rsi, rdx
lea rcx, [rsp + 0x52]
xor edi, edi
xor edx, edx
mov r8d, 0x206
mov word [rsp + 0x50], di
call fcn.18005a150
lea rcx, [rsp + 0x50]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
lea rdx, str.drivers
lea rcx, [rsp + 0x50]
call qword [sym.imp.SHLWAPI.dll_PathAppendW]
lea rcx, [rsp + 0x50]
call fcn.18003ea9c
lea rcx, [rsp + 0x50]
mov rdx, rbx
call qword [sym.imp.SHLWAPI.dll_PathAppendW]
lea rcx, [rsp + 0x50]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
cmp eax, edi
jne 0x18003f1df
lea rdx, [rsp + 0x50]
xor r8d, r8d
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CopyFileW]
neg eax
sbb edi, edi
not edi
and edi, 8
jmp 0x18003f267
lea rcx, [rsp + 0x50]
mov rdx, rsi
call fcn.180002794
cmp eax, edi
jne 0x18003f267
lea rdx, [rsp + 0x50]
xor r8d, r8d
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CopyFileW]
cmp eax, edi
jne 0x18003f267
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x20]
call fcn.18003ea5c
cmp qword [rsp + 0x40], 8
lea rdx, [rsp + 0x28]
cmovae rdx, qword [rsp + 0x28]
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_MoveFileW]
cmp eax, edi
je 0x18003f250
lea rdx, [rsp + 0x50]
xor r8d, r8d
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CopyFileW]
neg eax
sbb edi, edi
not edi
and edi, 8
jmp 0x18003f255
mov edi, 9
cmp qword [rsp + 0x40], 8
jb 0x18003f267
mov rcx, qword [rsp + 0x28]
call fcn.180058ed8
mov eax, edi
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.180059b00
lea r11, [rsp + 0x270]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x180042c90
Capabilities:
Terminate thread

Disassembly:
sub rsp, 0x28
mov rcx, qword [0x1800a4ce0]
test rcx, rcx
je 0x180042cc0
mov edx, 1
call qword [sym.imp.KERNEL32.dll_TerminateThread]
mov rcx, qword [0x1800a4ce0]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
and qword [0x1800a4ce0], 0
add rsp, 0x28
ret

Function at 0x18004386c
Capabilities:
Read clipboard data

Disassembly:
mov rax, rsp
push rbp
push rsi
push rdi
sub rsp, 0x60
mov qword [rsp + 0x50], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
mov rdi, rcx
mov qword [rax - 0x20], rcx
xor ebp, ebp
mov dword [rax - 0x58], ebp
mov qword [rcx + 0x20], 7
mov qword [rcx + 0x18], rbp
mov word [rcx + 8], bp
mov dword [rax - 0x58], 1
mov ecx, edx
call qword [sym.imp.USER32.dll_GetClipboardData]
mov rsi, rax
cmp rax, rbp
je 0x180043925
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GlobalSize]
mov rbx, rax
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GlobalLock]
mov qword [rsp + 0x48], 7
mov qword [rsp + 0x40], rbp
mov word [rsp + 0x30], bp
mov r8d, ebx
shr r8, 1
dec r8
mov rdx, rax
lea rcx, [rsp + 0x28]
call fcn.180007618
nop
or r9, 0xffffffffffffffff
xor r8d, r8d
lea rdx, [rsp + 0x28]
mov rcx, rdi
call fcn.1800074f8
nop
cmp qword [rsp + 0x48], 8
jb 0x18004391c
mov rcx, qword [rsp + 0x30]
call fcn.180058ed8
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov rax, rdi
mov rbx, qword [rsp + 0x90]
add rsp, 0x60
pop rdi
pop rsi
pop rbp
ret
Function at 0x180044910
Capabilities:
Open clipboard

Disassembly:
mov rax, rsp
push rdi
sub rsp, 0x280
mov qword [rsp + 0x28], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov rax, qword [0x1800a1658]
xor rax, rsp
mov qword [rsp + 0x270], rax
mov ebx, edx
mov rdi, rcx
xor r9d, r9d
lea r8, [0x18007a0e0]
lea rdx, str.SoftwareWOW6432Nodeprojonepodlp_smprule_
mov rcx, 0xffffffff80000002
call fcn.180005684
xor esi, esi
cmp eax, esi
je 0x180044ac1
cmp ebx, 1
jne 0x1800449bb
cmp dword [0x1800a4cd0], esi
je 0x180044ac1
call fcn.180003584
sub rax, qword [0x1800a4cd8]
cmp rax, 0xbb8
jbe 0x180044ac1
mov rcx, rdi
call qword [sym.imp.USER32.dll_OpenClipboard]
cmp eax, esi
je 0x1800449b0
call fcn.180044474
call fcn.180043aec
call qword [sym.imp.USER32.dll_CloseClipboard]
mov dword [0x1800a4cd0], esi
jmp 0x180044ac1
cmp ebx, 2
jne 0x180044ac1
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov rbx, rax
mov rcx, rax
call qword [sym.imp.USER32.dll_IsWindow]
cmp eax, esi
je 0x180044ac1
cmp rbx, qword [0x1800a0080]
je 0x180044ac1
mov qword [0x1800a0080], rbx
mov dword [rsp + 0x20], esi
lea rdx, [rsp + 0x20]
mov rcx, rbx
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov ebx, dword [rsp + 0x20]
cmp ebx, esi
je 0x180044a9f
mov word [rsp + 0x60], si
xor edx, edx
mov r8d, 0x206
lea rcx, [rsp + 0x62]
call fcn.18005a150
mov r8d, 0x104
lea rdx, [rsp + 0x60]
mov ecx, ebx
call fcn.18000417c
cmp eax, esi
je 0x180044ac1
lea rcx, [rsp + 0x60]
call fcn.180058fdc
mov r8, rax
lea rdx, [rsp + 0x60]
lea rcx, [0x1800a0088]
call fcn.180007618
xor r9d, r9d
xor r8d, r8d
mov edx, dword [rsp + 0x20]
lea rcx, [rsp + 0x30]
call fcn.18000f010
nop
or r9, 0xffffffffffffffff
xor r8d, r8d
mov rdx, rax
lea rcx, [0x1800a00b0]
call fcn.180007178
nop
cmp qword [rsp + 0x50], 0x10
jb 0x180044ac1
mov rcx, qword [rsp + 0x38]
call fcn.180058ed8
jmp 0x180044ac1
lea rcx, [0x18007a0d8]
call fcn.180058fdc
mov r8, rax
lea rdx, [0x18007a0d8]
lea rcx, [0x1800a0088]
call fcn.180007618
mov rcx, qword [rsp + 0x270]
xor rcx, rsp
call fcn.180059b00
lea r11, [rsp + 0x280]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x180045894
Capabilities:
Check if file exists

Disassembly:
mov rax, rsp
push rbp
push rsi
push rdi
sub rsp, 0x280
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rax + 0x20], rbx
mov rax, qword [0x1800a1658]
xor rax, rsp
mov qword [rsp + 0x270], rax
mov rsi, r8
mov rdi, rdx
mov rbx, rcx
xor ebp, ebp
mov word [rsp + 0x60], bp
xor edx, edx
mov r8d, 0x206
lea rcx, [rsp + 0x62]
call fcn.18005a150
mov r9d, 0x104
lea r8, [rsp + 0x60]
mov rdx, rbx
mov rcx, qword [0x1800a4f98]
call fcn.180002ab4
lea rcx, [rsp + 0x60]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
cmp eax, ebp
jne 0x180045935
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov rcx, rax
mov qword [rsp + 0x20], rdi
lea r9, str.gb0R_
lea r8d, [rbp + 0x10]
lea rdx, [0x180083948]
call fcn.180002cb8
jmp 0x1800459b5
lea r9, [0x180081a98]
cmp rsi, rbp
cmovne r9, rsi
lea r8, [rsp + 0x60]
lea rdx, str.__s___s
lea rcx, [rsp + 0x38]
call fcn.180005488
nop
lea rcx, [rsp + 0x40]
cmp qword [rsp + 0x58], 8
cmovae rcx, qword [rsp + 0x40]
xor edx, edx
lea r8d, [rdx + 1]
call fcn.180003750
cmp rax, rbp
jne 0x1800459a3
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov rcx, rax
mov qword [rsp + 0x20], rdi
lea r9, [0x18007a720]
mov r8d, sendto
lea rdx, [0x180083948]
call fcn.180002cb8
nop
cmp qword [rsp + 0x58], 8
jb 0x1800459b5
mov rcx, qword [rsp + 0x40]
call fcn.180058ed8
mov rcx, qword [rsp + 0x270]
xor rcx, rsp
call fcn.180059b00
mov rbx, qword [rsp + 0x2b8]
add rsp, 0x280
pop rdi
pop rsi
pop rbp
ret

Function at 0x180045d8c
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rcx
push rsi
push rdi
push r12
sub rsp, 0x40
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rsp + 0x68], rbx
mov rsi, r8
mov r12d, edx
mov rdi, rcx
mov ecx, 0x20
call fcn.1800592c8
mov rbx, rax
mov qword [rsp + 0x78], rax
test rax, rax
je 0x180045df6
mov rcx, qword [rdi + 0x18]
test rcx, rcx
jne 0x180045dd6
and qword [rax + 0x18], rcx
jmp 0x180045df8
cmp rcx, rdi
jne 0x180045de9
mov rax, qword [rcx]
mov rdx, rbx
call qword [rax]
mov qword [rbx + 0x18], rax
jmp 0x180045df8
mov rax, qword [rcx]
xor edx, edx
call qword [rax]
mov qword [rbx + 0x18], rax
jmp 0x180045df8
xor ebx, ebx
mov qword [rsp + 0x28], rsi
mov dword [rsp + 0x20], r12d
mov r9, rbx
lea r8, [0x180045c94]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rbx, rax
mov rcx, qword [rdi + 0x18]
test rcx, rcx
je 0x180045e34
mov r8, qword [rcx]
cmp rcx, rdi
setne dl
call qword [r8 + 0x18]
and qword [rdi + 0x18], 0
mov rax, rbx
jmp 0x180045e5a
mov rbx, qword [rsp + 0x68]
add rsp, 0x40
pop r12
pop rdi
pop rsi
ret