joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400142f0
Capabilities:
Hide graphical window
Manipulate console buffer

Disassembly:
push rbx
push rdi
push r14
mov eax, 0x1070
call fcn.140063520
sub rsp, rax
mov rax, qword [0x14009b3f8]
xor rax, rsp
mov qword [rsp + 0x1050], rax
lea r14, [rcx + 0x18]
mov rdi, rcx
mov rcx, r14
mov rbx, rdx
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
xor edx, edx
lea rcx, [rsp + 0x850]
mov r8d, 0x800
call fcn.140035c20
cmp byte [rdi + 0x10], 0
je 0x140014394
lea r9, [rdi + 0x458]
mov qword [rsp + 0x20], rbx
lea r8, str.TESTNAME_s__s
mov edx, 0x400
lea rcx, [rsp + 0x850]
call fcn.140001150
lea rcx, [rdi + 0x40]
lea rdx, [rsp + 0x850]
call fcn.140027470
test eax, eax
je 0x140014394
mov byte [rdi + 0x10], 0
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
mov rcx, rax
mov edx, 1
call qword [sym.imp.USER32.dll_ShowWindow]
mov rcx, qword [rdi + 8]
lea rdx, vtable.cLog.0
mov qword [rsp + 0x1068], rsi
mov qword [rsp + 0x1060], r15
mov rax, qword [rcx]
mov rdi, qword [rax + 0x18]
cmp rax, rdx
jne 0x140014536
cmp byte [rcx + 0x1c], 0
je 0x1400143d0
mov rdx, rbx
call qword [rax + 0x60]
jmp 0x140014501
cmp dword [rcx + 0xc28], 0
je 0x140014501
xor r15d, r15d
lea rcx, [rsp + 0x50]
xor edx, edx
mov dword [rsp + 0x30], r15d
mov r8d, 0x800
call fcn.140035c20
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rcx, rax
lea rdx, [rsp + 0x38]
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_GetConsoleScreenBufferInfo]
test eax, eax
je 0x140014501
movzx edx, word [rbx]
lea edi, [r15 + 0x20]
mov qword [rsp + 0x10a0], rbp
mov rcx, rbx
test dx, dx
je 0x140014448
cmp dx, 0xa
jne 0x14001443b
mov word [rcx], di
movzx edx, word [rcx + 2]
add rcx, 2
test dx, dx
jne 0x140014432
movsx ebp, word [rsp + 0x38]
mov edx, 0x1a
mov rcx, rbx
call fcn.1400420dc
cdq
sub eax, edx
sar eax, 1
mov ecx, eax
movsx eax, word [rsp + 0x38]
cdq
sub eax, edx
sar eax, 1
sub eax, ecx
test eax, eax
jle 0x14001447f
movsxd rcx, eax
movzx eax, di
lea rdi, [rsp + 0x50]
rep stosw word [rdi], ax
mov r8, rbx
lea rcx, [rsp + 0x50]
mov edx, 0x400
call fcn.140041f0c
mov edx, 0x400
lea rcx, [rsp + 0x50]
call fcn.1400420dc
movsx ecx, word [rsp + 0x4a]
mov rdi, rax
cmp eax, ecx
jge 0x1400144d1
nop dword [rax]
lea r8, [0x14007a634]
mov edx, 0x400
lea rcx, [rsp + 0x50]
call fcn.140041f0c
movsx eax, word [rsp + 0x4a]
inc edi
cmp edi, eax
jl 0x1400144b0
mov edx, dword [rsp + 0x30]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SetConsoleCursorPosition]
lea r9, [rsp + 0x34]
mov qword [rsp + 0x20], r15
mov r8d, ebp
lea rdx, [rsp + 0x50]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_WriteConsoleW]
mov rbp, qword [rsp + 0x10a0]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov r15, qword [rsp + 0x1060]
mov rsi, qword [rsp + 0x1068]
mov rcx, qword [rsp + 0x1050]
xor rcx, rsp
call fcn.1400303d0
add rsp, 0x1070
pop r14
pop rdi
pop rbx
ret
mov rdx, rbx
call rdi
jmp 0x140014501
Function at 0x140014580
Capabilities:
Hide graphical window
Manipulate console buffer

Disassembly:
push rbx
push rsi
sub rsp, 0x468
mov rax, qword [0x14009b3f8]
xor rax, rsp
mov qword [rsp + 0x450], rax
lea rsi, [rcx + 0x18]
mov rbx, rcx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
xor edx, edx
lea rcx, [rsp + 0x50]
mov r8d, 0x400
call fcn.140035c20
cmp byte [rbx + 0x10], 0
je 0x140014604
lea r8, str.CLEAR
mov edx, 0x200
lea rcx, [rsp + 0x50]
call fcn.140001150
lea rcx, [rbx + 0x40]
lea rdx, [rsp + 0x50]
call fcn.140027470
test eax, eax
je 0x140014604
mov byte [rbx + 0x10], 0
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
mov rcx, rax
mov edx, 1
call qword [sym.imp.USER32.dll_ShowWindow]
mov rbx, qword [rbx + 8]
lea rcx, vtable.cLog.0
mov qword [rsp + 0x488], rbp
mov qword [rsp + 0x490], rdi
mov qword [rsp + 0x460], r14
mov rax, qword [rbx]
mov rdx, qword [rax + 0x10]
cmp rax, rcx
jne 0x140014720
cmp byte [rbx + 0x1c], 0
jne 0x1400146e5
cmp dword [rbx + 0xc28], 0
je 0x1400146e5
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rcx, rax
lea rdx, [rsp + 0x38]
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetConsoleScreenBufferInfo]
test eax, eax
je 0x1400146e5
movsx ebp, word [rbx + 0xc2e]
lea rax, [rsp + 0x34]
movsx ecx, word [rsp + 0x38]
sub ebp, 2
imul ebp, ecx
xor r14d, r14d
mov dword [rsp + 0x30], 0x20000
mov rcx, rdi
mov ebx, dword [rsp + 0x30]
mov r9d, ebx
mov qword [rsp + 0x20], rax
lea edx, [r14 + 0x20]
mov r8d, ebp
call qword [sym.imp.KERNEL32.dll_FillConsoleOutputCharacterW]
test eax, eax
je 0x1400146e5
movzx edx, word [rsp + 0x40]
lea rax, [rsp + 0x34]
mov r9d, ebx
mov qword [rsp + 0x20], rax
mov r8d, ebp
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FillConsoleOutputAttribute]
test eax, eax
je 0x1400146e5
mov word [rsp + 0x32], r14w
mov rcx, rdi
mov edx, dword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_SetConsoleCursorPosition]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov r14, qword [rsp + 0x460]
mov rdi, qword [rsp + 0x490]
mov rbp, qword [rsp + 0x488]
mov rcx, qword [rsp + 0x450]
xor rcx, rsp
call fcn.1400303d0
add rsp, 0x468
pop rsi
pop rbx
ret
mov rcx, rbx
call rdx
jmp 0x1400146e5
Function at 0x140014a30
Capabilities:
Manipulate console buffer

Disassembly:
mov r11, rsp
mov qword [r11 + 0x18], r8
mov qword [r11 + 0x20], r9
push rdi
sub rsp, 0x460
mov rax, qword [0x14009b3f8]
xor rax, rsp
mov qword [rsp + 0x440], rax
cmp dword [rcx + 8], 0
movzx edi, dx
je 0x140014b49
mov qword [r11 - 0x10], rbx
mov ecx, 0xfffffff5
mov qword [r11 - 0x18], rsi
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
xor esi, esi
mov word [rsp + 0x36], di
mov edx, esi
mov word [rsp + 0x34], si
mov rcx, rax
mov dword [rsp + 0x30], esi
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_SetConsoleCursorPosition]
lea rdi, [rsp + 0x488]
call fcn.140001140
mov r9, qword [rsp + 0x480]
lea rdx, [rsp + 0x40]
mov qword [rsp + 0x28], rdi
mov r8d, 0x200
mov qword [rsp + 0x20], rsi
mov rcx, qword [rax]
call fcn.14003de40
test eax, eax
mov ecx, 0xffffffff
cmovs eax, ecx
mov ecx, 0x50
sub ecx, eax
test ecx, ecx
jle 0x140014af3
cdqe
lea rdi, [rsp + 0x40]
mov edx, 0x20
movsxd rcx, ecx
lea rdi, [rdi + rax*2]
movzx eax, dx
rep stosw word [rdi], ax
lea r9, [rsp + 0x38]
mov word [rsp + 0xe0], si
mov r8d, 0x50
mov qword [rsp + 0x20], rsi
lea rdx, [rsp + 0x40]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WriteConsoleW]
mov rax, qword [rsp + 0x480]
mov rsi, qword [rsp + 0x450]
cmp word [rax], 0
je 0x140014b34
call fcn.14004b5f4
mov edx, dword [rsp + 0x34]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SetConsoleCursorPosition]
mov rbx, qword [rsp + 0x458]
mov rcx, qword [rsp + 0x440]
xor rcx, rsp
call fcn.1400303d0
add rsp, 0x460
pop rdi
ret

Function at 0x140014d00
Capabilities:
Manipulate console buffer

Disassembly:
push rbx
sub rsp, 0x60
mov rax, qword [0x14009b3f8]
xor rax, rsp
mov qword [rsp + 0x50], rax
cmp byte [rcx + 0x1c], 0
mov rbx, rcx
jne 0x140014df1
cmp dword [rcx + 0xc28], 0
je 0x140014df1
mov ecx, 0xfffffff5
mov qword [rsp + 0x88], rdi
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rcx, rax
lea rdx, [rsp + 0x38]
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetConsoleScreenBufferInfo]
test eax, eax
je 0x140014de9
movsx ecx, word [rsp + 0x38]
lea rax, [rsp + 0x34]
mov qword [rsp + 0x78], rbp
xor ebp, ebp
mov qword [rsp + 0x80], rsi
movsx esi, word [rbx + 0xc2e]
sub esi, 2
mov dword [rsp + 0x30], 0x20000
mov ebx, dword [rsp + 0x30]
lea edx, [rbp + 0x20]
imul esi, ecx
mov r9d, ebx
mov rcx, rdi
mov qword [rsp + 0x20], rax
mov r8d, esi
call qword [sym.imp.KERNEL32.dll_FillConsoleOutputCharacterW]
test eax, eax
je 0x140014ddc
movzx edx, word [rsp + 0x40]
lea rax, [rsp + 0x34]
mov r9d, ebx
mov qword [rsp + 0x20], rax
mov r8d, esi
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FillConsoleOutputAttribute]
test eax, eax
je 0x140014ddc
mov word [rsp + 0x32], bp
mov rcx, rdi
mov edx, dword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_SetConsoleCursorPosition]
mov rsi, qword [rsp + 0x80]
mov rbp, qword [rsp + 0x78]
mov rdi, qword [rsp + 0x88]
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.1400303d0
add rsp, 0x60
pop rbx
ret
Function at 0x1400153a0
Capabilities:
Manipulate console buffer

Disassembly:
push rbx
sub rsp, 0x870
mov rax, qword [0x14009b3f8]
xor rax, rsp
mov qword [rsp + 0x850], rax
cmp byte [rcx + 0x1c], 0
mov rbx, rdx
je 0x1400153cf
mov rax, qword [rcx]
call qword [rax + 0x60]
jmp 0x140015539
cmp dword [rcx + 0xc28], 0
je 0x140015539
mov qword [rsp + 0x898], rsi
lea rcx, [rsp + 0x50]
mov qword [rsp + 0x860], r14
xor edx, edx
xor r14d, r14d
mov r8d, 0x800
mov dword [rsp + 0x30], r14d
call fcn.140035c20
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rcx, rax
lea rdx, [rsp + 0x38]
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_GetConsoleScreenBufferInfo]
test eax, eax
je 0x140015529
movzx edx, word [rbx]
mov rcx, rbx
mov qword [rsp + 0x890], rbp
mov qword [rsp + 0x868], rdi
lea edi, [r14 + 0x20]
test dx, dx
je 0x140015466
nop dword [rax]
cmp dx, 0xa
jne 0x140015459
mov word [rcx], di
movzx edx, word [rcx + 2]
add rcx, 2
test dx, dx
jne 0x140015450
movsx ebp, word [rsp + 0x38]
mov edx, 0x1a
mov rcx, rbx
call fcn.1400420dc
cdq
sub eax, edx
sar eax, 1
mov ecx, eax
movsx eax, word [rsp + 0x38]
cdq
sub eax, edx
sar eax, 1
sub eax, ecx
test eax, eax
jle 0x14001549d
movsxd rcx, eax
movzx eax, di
lea rdi, [rsp + 0x50]
rep stosw word [rdi], ax
mov r8, rbx
lea rcx, [rsp + 0x50]
mov edx, 0x400
call fcn.140041f0c
mov edx, 0x400
lea rcx, [rsp + 0x50]
call fcn.1400420dc
movsx ecx, word [rsp + 0x4a]
mov rdi, rax
cmp eax, ecx
jge 0x1400154f1
nop word [rax + rax]
lea r8, [0x14007a634]
mov edx, 0x400
lea rcx, [rsp + 0x50]
call fcn.140041f0c
movsx eax, word [rsp + 0x4a]
inc edi
cmp edi, eax
jl 0x1400154d0
mov edx, dword [rsp + 0x30]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SetConsoleCursorPosition]
lea r9, [rsp + 0x34]
mov qword [rsp + 0x20], r14
mov r8d, ebp
lea rdx, [rsp + 0x50]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_WriteConsoleW]
mov rdi, qword [rsp + 0x868]
mov rbp, qword [rsp + 0x890]
mov rsi, qword [rsp + 0x898]
mov r14, qword [rsp + 0x860]
mov rcx, qword [rsp + 0x850]
xor rcx, rsp
call fcn.1400303d0
add rsp, 0x870
pop rbx
ret
Function at 0x140015560
Capabilities:
Manipulate console buffer

Disassembly:
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x870
mov rax, qword [0x14009b3f8]
xor rax, rsp
mov qword [rsp + 0x850], rax
cmp byte [rcx + 0x1c], 0
mov r15d, r9d
mov rsi, qword [rsp + 0x8c0]
mov r14d, r8d
mov ebp, edx
mov rdi, rcx
jne 0x1400156c4
cmp dword [rcx + 0xc28], 0
je 0x1400156c4
xor edx, edx
mov qword [rsp + 0x868], rbx
mov r8d, 0x800
lea rcx, [rsp + 0x50]
call fcn.140035c20
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rcx, rax
lea rdx, [rsp + 0x38]
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetConsoleScreenBufferInfo]
test eax, eax
je 0x1400156bc
movzx ecx, word [rsi]
mov rdx, rsi
mov qword [rsp + 0x860], r12
mov r12d, 0x20
test cx, cx
je 0x140015619
cmp cx, 0xa
jne 0x14001560c
mov word [rdx], r12w
movzx ecx, word [rdx + 2]
add rdx, 2
test cx, cx
jne 0x140015602
mov rax, qword [rdi]
mov r8d, 0x3d
mov edx, 0x1a
mov word [rsp + 0x20], r8w
mov ecx, 0x4c
cmp ebp, 0x32
mov r9d, r15d
mov r8d, r14d
cmovg edx, ecx
mov rcx, rdi
call qword [rax + 0x20]
mov r9, rsi
lea r8, [0x14007a2f0]
mov edx, 0x400
lea rcx, [rsp + 0x50]
call fcn.140001150
mov ecx, 0x28
sub ecx, eax
test ecx, ecx
jle 0x14001567a
cdqe
lea rdi, [rsp + 0x50]
lea rdi, [rdi + rax*2]
movzx eax, r12w
rep stosw word [rdi], ax
mov word [rsp + 0x30], bp
mov rcx, rbx
mov word [rsp + 0x32], r14w
mov edx, dword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_SetConsoleCursorPosition]
lea r9, [rsp + 0x34]
mov qword [rsp + 0x20], 0
mov r8d, SafeArrayLock
lea rdx, [rsp + 0x50]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WriteConsoleW]
mov r12, qword [rsp + 0x860]
mov rbx, qword [rsp + 0x868]
mov rcx, qword [rsp + 0x850]
xor rcx, rsp
call fcn.1400303d0
add rsp, 0x870
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret

Function at 0x1400156f0
Capabilities:
Manipulate console buffer

Disassembly:
push rbp
push rsi
push rdi
push r14
sub rsp, 0x468
mov rax, qword [0x14009b3f8]
xor rax, rsp
mov qword [rsp + 0x450], rax
cmp byte [rcx + 0x1c], 0
mov ebp, r9d
mov r14, qword [rsp + 0x4b0]
mov esi, r8d
mov edi, edx
jne 0x1400157cb
cmp dword [rcx + 0xc28], 0
je 0x1400157cb
xor edx, edx
mov qword [rsp + 0x460], rbx
mov r8d, 0x400
lea rcx, [rsp + 0x50]
call fcn.140035c20
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rcx, rax
lea rdx, [rsp + 0x38]
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetConsoleScreenBufferInfo]
test eax, eax
je 0x1400157c3
mov word [rsp + 0x30], di
mov rcx, rbx
mov word [rsp + 0x32], si
mov edx, dword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_SetConsoleCursorPosition]
mov r9, r14
mov dword [rsp + 0x20], ebp
lea r8, str._s_d__
mov edx, 0x200
lea rcx, [rsp + 0x50]
call fcn.140001150
lea r9, [rsp + 0x34]
mov qword [rsp + 0x20], 0
mov r8d, eax
lea rdx, [rsp + 0x50]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WriteConsoleW]
mov rbx, qword [rsp + 0x460]
mov rcx, qword [rsp + 0x450]
xor rcx, rsp
call fcn.1400303d0
add rsp, 0x468
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400157f0
Capabilities:
Manipulate console buffer

Disassembly:
push rbx
push rbp
push rsi
sub rsp, 0x460
mov rax, qword [0x14009b3f8]
xor rax, rsp
mov qword [rsp + 0x450], rax
cmp byte [rcx + 0x1c], 0
mov ebx, r9d
mov ebp, r8d
mov dword [rsp + 0x30], 0
mov esi, edx
jne 0x1400158d4
cmp dword [rcx + 0xc28], 0
je 0x1400158d4
mov ecx, 0xfffffff5
mov qword [rsp + 0x480], rdi
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rcx, rax
lea rdx, [rsp + 0x38]
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetConsoleScreenBufferInfo]
test eax, eax
je 0x1400158ad
mov r9d, ebx
lea r8, str._3d__
mov edx, 0x200
lea rcx, [rsp + 0x50]
call fcn.140001150
mov word [rsp + 0x34], si
mov rcx, rdi
mov word [rsp + 0x36], bp
mov ebx, eax
mov edx, dword [rsp + 0x34]
call qword [sym.imp.KERNEL32.dll_SetConsoleCursorPosition]
lea r9, [rsp + 0x30]
mov qword [rsp + 0x20], 0
mov r8d, ebx
lea rdx, [rsp + 0x50]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_WriteConsoleW]
mov eax, dword [rsp + 0x30]
mov rdi, qword [rsp + 0x480]
mov rcx, qword [rsp + 0x450]
xor rcx, rsp
call fcn.1400303d0
add rsp, 0x460
pop rsi
pop rbp
pop rbx
ret
xor eax, eax
jmp 0x1400158b9

Function at 0x1400158e0
Capabilities:
Manipulate console buffer

Disassembly:
push rbx
push rbp
push rsi
sub rsp, 0x870
mov rax, qword [0x14009b3f8]
xor rax, rsp
mov qword [rsp + 0x850], rax
cmp byte [rcx + 0x1c], 0
mov rbx, r9
mov ebp, r8d
mov esi, edx
je 0x140015919
mov rax, qword [rcx]
mov rdx, rbx
call qword [rax + 0x60]
jmp 0x1400159dd
cmp dword [rcx + 0xc28], 0
je 0x1400159dd
xor edx, edx
mov qword [rsp + 0x868], rdi
mov r8d, 0x800
lea rcx, [rsp + 0x50]
call fcn.140035c20
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rcx, rax
lea rdx, [rsp + 0x38]
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetConsoleScreenBufferInfo]
test eax, eax
je 0x1400159d5
movzx edx, word [rbx]
mov rcx, rbx
test dx, dx
je 0x140015986
mov eax, 0x20
cmp dx, 0xa
jne 0x140015979
mov word [rcx], ax
movzx edx, word [rcx + 2]
add rcx, 2
test dx, dx
jne 0x140015970
mov word [rsp + 0x30], si
mov rcx, rdi
mov word [rsp + 0x32], bp
mov edx, dword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_SetConsoleCursorPosition]
mov r9, rbx
lea r8, [0x14007a2f0]
mov edx, 0x400
lea rcx, [rsp + 0x50]
call fcn.140001150
lea r9, [rsp + 0x34]
mov qword [rsp + 0x20], 0
mov r8d, eax
lea rdx, [rsp + 0x50]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_WriteConsoleW]
mov rdi, qword [rsp + 0x868]
mov rcx, qword [rsp + 0x850]
xor rcx, rsp
call fcn.1400303d0
add rsp, 0x870
pop rsi
pop rbp
pop rbx
ret
Function at 0x140015a00
Capabilities:
Manipulate console buffer

Disassembly:
mov r11, rsp
push rbx
sub rsp, 0x860
mov rax, qword [0x14009b3f8]
xor rax, rsp
mov qword [rsp + 0x850], rax
cmp byte [rcx + 0x1c], 0
mov rbx, rdx
jne 0x140015b12
cmp dword [rcx + 0xc28], 0
je 0x140015b12
mov qword [r11 + 0x18], rsi
lea rcx, [rsp + 0x50]
xor esi, esi
mov qword [r11 + 0x20], rdi
xor edx, edx
mov dword [rsp + 0x30], esi
mov r8d, 0x800
call fcn.140035c20
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rcx, rax
lea rdx, [rsp + 0x38]
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetConsoleScreenBufferInfo]
test eax, eax
je 0x140015ae9
movzx edx, word [rbx]
mov rcx, rbx
test dx, dx
je 0x140015a9b
lea eax, [rsi + 0x20]
cmp dx, 0xa
jne 0x140015a8e
mov word [rcx], ax
movzx edx, word [rcx + 2]
add rcx, 2
test dx, dx
jne 0x140015a85
movzx eax, word [rsp + 0x48]
mov rcx, rdi
dec ax
mov word [rsp + 0x32], ax
mov edx, dword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_SetConsoleCursorPosition]
mov r9, rbx
lea r8, [0x14007a2f0]
mov edx, 0x400
lea rcx, [rsp + 0x50]
call fcn.140001150
lea r9, [rsp + 0x34]
mov qword [rsp + 0x20], rsi
mov r8d, eax
lea rdx, [rsp + 0x50]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_WriteConsoleW]
mov rsi, qword [rsp + 0x880]
mov rdi, qword [rsp + 0x888]
mov rcx, qword [rsp + 0x850]
xor rcx, rsp
call fcn.1400303d0
add rsp, 0x860
pop rbx
ret
mov rax, qword [rcx]
call qword [rax + 0x60]
jmp 0x140015af9
Function at 0x1400166c0
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x670
mov rax, qword [0x14009b3f8]
xor rax, rsp
mov qword [rsp + 0x660], rax
xor edi, edi
mov rbx, rcx
mov qword [rcx + 0x58], rdi
mov qword [rcx + 0x60], rdi
mov qword [rcx + 0x68], rdi
mov qword [rcx + 0x70], rdi
mov qword [rcx + 0x78], rdi
mov dword [rcx + 0x84], edi
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov r9d, 0x200
lea r8, [rsp + 0x260]
mov rcx, rax
xor edx, edx
call qword [sym.imp.KERNEL32.dll_K32GetModuleBaseNameW]
test eax, eax
je 0x14001676a
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
xor edx, edx
lea ecx, [rdi + 2]
mov esi, eax
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbp, rax
cmp rax, 0xffffffffffffffff
je 0x14001676a
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x238
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
jne 0x1400167a0
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov rcx, qword [rsp + 0x660]
xor rcx, rsp
call fcn.1400303d0
lea r11, [rsp + 0x670]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
lea rdx, [rsp + 0x260]
lea rcx, [rsp + 0x4c]
call fcn.14003f054
test eax, eax
jne 0x1400167e7
mov ecx, dword [rsp + 0x28]
cmp ecx, esi
je 0x1400167e7
cmp dword [rsp + 0x40], esi
je 0x1400167e7
movsxd rax, dword [rbx + 0x84]
mov dword [rbx + rax*4 + 0x58], ecx
mov eax, dword [rbx + 0x84]
cmp eax, 0xa
jge 0x1400167e2
inc eax
mov dword [rbx + 0x84], eax
mov edi, 1
lea rdx, [rsp + 0x20]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x1400167a0
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
jmp 0x14001676c
Function at 0x140018640
Capabilities:
Hide graphical window
Manipulate console buffer

Disassembly:
push rbx
push rdi
sub rsp, 0x468
mov rax, qword [0x14009b3f8]
xor rax, rsp
mov qword [rsp + 0x450], rax
mov rdi, qword [rcx + 0x38]
lea rcx, vtable.cThrdLog.0
mov rax, qword [rdi]
test edx, edx
jne 0x1400186a1
cmp rax, rcx
jne 0x140018696
lea rcx, [rdi + 0x18]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rcx, qword [rdi + 8]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rcx, [rdi + 0x18]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
jmp 0x140018815
mov rcx, rdi
call qword [rax + 0x48]
jmp 0x140018815
mov rdx, qword [rax + 0x50]
cmp rax, rcx
jne 0x140018836
mov qword [rsp + 0x490], rsi
lea rsi, [rdi + 0x18]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
xor edx, edx
lea rcx, [rsp + 0x50]
mov r8d, 0x400
call fcn.140035c20
cmp byte [rdi + 0x10], 0
je 0x14001871b
lea r8, str.CLEAR
mov edx, 0x200
lea rcx, [rsp + 0x50]
call fcn.140001150
lea rcx, [rdi + 0x40]
lea rdx, [rsp + 0x50]
call fcn.140027470
test eax, eax
je 0x14001871b
mov byte [rdi + 0x10], 0
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
mov rcx, rax
mov edx, 1
call qword [sym.imp.USER32.dll_ShowWindow]
mov rbx, qword [rdi + 8]
lea rcx, vtable.cLog.0
mov qword [rsp + 0x488], rbp
mov qword [rsp + 0x460], r14
mov rax, qword [rbx]
mov rdx, qword [rax + 0x10]
cmp rax, rcx
jne 0x14001882f
cmp byte [rbx + 0x1c], 0
jne 0x1400187f4
cmp dword [rbx + 0xc28], 0
je 0x1400187f4
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rcx, rax
lea rdx, [rsp + 0x38]
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetConsoleScreenBufferInfo]
test eax, eax
je 0x1400187f4
movsx ebp, word [rbx + 0xc2e]
lea rax, [rsp + 0x34]
movsx ecx, word [rsp + 0x38]
sub ebp, 2
imul ebp, ecx
xor r14d, r14d
mov dword [rsp + 0x30], 0x20000
mov rcx, rdi
mov ebx, dword [rsp + 0x30]
mov r9d, ebx
mov qword [rsp + 0x20], rax
lea edx, [r14 + 0x20]
mov r8d, ebp
call qword [sym.imp.KERNEL32.dll_FillConsoleOutputCharacterW]
test eax, eax
je 0x1400187f4
movzx edx, word [rsp + 0x40]
lea rax, [rsp + 0x34]
mov r9d, ebx
mov qword [rsp + 0x20], rax
mov r8d, ebp
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FillConsoleOutputAttribute]
test eax, eax
je 0x1400187f4
mov word [rsp + 0x32], r14w
mov rcx, rdi
mov edx, dword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_SetConsoleCursorPosition]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov r14, qword [rsp + 0x460]
mov rsi, qword [rsp + 0x490]
mov rbp, qword [rsp + 0x488]
mov rcx, qword [rsp + 0x450]
xor rcx, rsp
call fcn.1400303d0
add rsp, 0x468
pop rdi
pop rbx
ret
mov rcx, rbx
call rdx
jmp 0x1400187f4
mov rcx, rdi
call rdx
jmp 0x140018815
Function at 0x140024df0
Capabilities:
Acquire debug privileges

Disassembly:
push rbx
sub rsp, 0x50
mov rax, qword [0x14009b3f8]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov rbx, rcx
mov dword [rcx + 8], 0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea r8, [rsp + 0x30]
mov edx, 0xf01ff
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x140024e4d
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rbx + 8], eax
mov eax, 1
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1400303d0
add rsp, 0x50
pop rbx
ret
lea r8, [rsp + 0x3c]
xor ecx, ecx
lea rdx, str.SeDebugPrivilege
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
test eax, eax
je 0x140024e2c
mov rcx, qword [rsp + 0x30]
lea r8, [rsp + 0x38]
mov qword [rsp + 0x28], 0
xor r9d, r9d
xor edx, edx
mov qword [rsp + 0x20], 0
mov dword [rsp + 0x38], 1
mov dword [rsp + 0x44], 2
call qword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
test eax, eax
je 0x140024e2c
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1400303d0
add rsp, 0x50
pop rbx
ret