joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1401a3100
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rax, qword [rcx]
xor edi, edi
mov rdx, qword [0x14046a618]
mov rbx, rcx
mov dword [rax + 8], edi
mov rax, qword [rcx]
mov dword [rax + 0x14], 1
mov eax, dword [rdx + 0x448]
test eax, eax
mov ecx, dword [0x140469204]
cmovne ecx, eax
mov eax, dword [0x1404250c8]
and ecx, 0xffffffcf
cmp eax, 2
jne 0x1401a3170
cmp ecx, 4
je 0x1401a3174
test cl, 5
je 0x1401a3160
cmp dword [0x14045b480], edi
je 0x1401a3160
cmp dword [0x140421818], 0x16
je 0x1401a3174
test cl, 6
je 0x1401a318b
test byte [0x140420a38], 0x10
jne 0x1401a3174
jmp 0x1401a318b
test eax, eax
je 0x1401a318b
call fcn.14018a2f0
test eax, eax
jne 0x1401a3184
mov rax, qword [rbx]
cmp dword [rax], edi
jne 0x1401a3192
mov rdx, qword [0x14046a618]
mov dword [rdx + 0x44], 0x7fffffff
mov rax, qword [rbx]
mov edx, edi
mov ecx, dword [rbx + 0x28]
cmp dword [rax], edi
sete dl
dec ecx
call fcn.140094ea0
test eax, eax
jne 0x1401a31dd
cmp dword [0x14045b404], edi
mov rax, qword [rbx]
mov dword [0x14045b99c], edi
mov qword [rax], rdi
mov qword [rax + 0xc], rdi
jne 0x1401a31fa
xor ecx, ecx
call fcn.140122f90
mov ecx, 0x40
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp fcn.14018aca0
test byte [0x140469aec], 4
je 0x1401a31fa
cmp dword [0x14046a358], edi
je 0x1401a31fa
mov rax, qword [rbx]
cmp dword [rax], edi
jne 0x1401a31fa
call fcn.14011dae0
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x1401a8b70
Capabilities:
Check for time delay via gettickcount

Disassembly:
sub rsp, 0x28
xor eax, eax
cmp dword [0x14045b404], eax
mov qword [rcx], rax
mov qword [rcx + 0xc], rax
mov dword [0x14045b99c], eax
jne 0x1401a8ba0
xor ecx, ecx
call fcn.140122f90
mov ecx, 0x40
add rsp, 0x28
jmp fcn.14018aca0
add rsp, 0x28
ret
Function at 0x1401b7810
Capabilities:
Set console window title

Disassembly:
push rsi
sub rsp, 0x40
xor esi, esi
cmp dword [0x140462250], esi
je 0x1401b7870
mov rcx, qword [0x140454dd8]
lea rdx, [rsp + 0x50]
mov dword [0x140462020], esi
call qword [sym.imp.KERNEL32.dll_GetConsoleMode]
mov ecx, dword [rsp + 0x50]
mov edx, dword [0x140462270]
and ecx, 0xffffffbf
and edx, 0x40
or ecx, 0x10
or edx, dword [rsp + 0x50]
and edx, 0xffffffef
cmp dword [0x140462020], esi
cmovne edx, ecx
mov rcx, qword [0x140454dd8]
mov dword [rsp + 0x50], edx
bts edx, 7
call qword [sym.imp.KERNEL32.dll_SetConsoleMode]
lea rcx, [0x14045ba10]
call qword [sym.imp.KERNEL32.dll_SetConsoleTitleA]
call fcn.1402ab1b0
mov rax, qword [str.aleph]
test rax, rax
je 0x1401b79c1
mov qword [rsp + 0x58], rbx
mov qword [rsp + 0x60], rbp
lea rbp, [0x140448d10]
mov qword [rsp + 0x68], rdi
mov rbx, rbp
mov qword [rsp + 0x38], r14
lea rdi, [0x1403b051f]
mov qword [rsp + 0x30], r15
movabs r14, 0x2e8ba2e8ba2e8ba3
lea r15, [0x140448d48]
nop dword [rax]
cmp byte [rax], 0x74
jne 0x1401b7997
cmp byte [rax + 1], 0x5f
jne 0x1401b7997
test byte [rbx], 8
je 0x1401b7906
mov rax, qword [rbx + 8]
mov rcx, qword [rax]
cmp rcx, rdi
je 0x1401b7906
test rcx, rcx
je 0x1401b7906
cmp dword [0x14045b3f8], esi
jne 0x1401b7906
call fcn.140005660
test byte [rbx], 0x80
je 0x1401b7926
mov rcx, qword [rbx + 0x28]
cmp rcx, rdi
je 0x1401b7926
test rcx, rcx
je 0x1401b7926
cmp dword [0x14045b3f8], esi
jne 0x1401b7926
call fcn.140005660
mov rax, qword [rbx + 8]
movups xmm0, xmmword [0x14045b4b0]
mov qword [rax], rdi
and qword [rbx], 0xffffffffffffff77
mov eax, dword [0x140420ac8]
dec eax
mov qword [rbx + 0x28], rdi
movsxd rcx, eax
mov rax, qword [0x140420ad8]
movups xmmword [rsp + 0x20], xmm0
lea rdx, [rcx + rcx*2]
psrldq xmm0, 8
add rdx, rdx
movd ecx, xmm0
add ecx, dword [rax + rdx*8]
mov rax, r14
mov dword [rsp + 0x28], ecx
mov rcx, rbx
movups xmm0, xmmword [rsp + 0x20]
sub rcx, rbp
imul rcx
sar rdx, 4
mov rax, rdx
shr rax, 0x3f
add rax, rdx
cdqe
imul rcx, rax, 0x58
movups xmmword [rcx + r15], xmm0
mov rax, qword [rbx + 0x48]
add rbx, 0x58
test rax, rax
jne 0x1401b78d0
mov r15, qword [rsp + 0x30]
mov r14, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x58]
mov edx, dword [0x140464fd4]
mov r8, qword [0x140464e90]
test edx, edx
jle 0x1401b7a17
nop dword [rax]
nop word [rax + rax]
dec edx
movsxd rax, edx
mov dword [0x140464fd4], edx
lea rcx, [rax + rax*2]
mov rcx, qword [r8 + rcx*8 + 8]
test rcx, rcx
je 0x1401b7a13
cmp dword [0x14045b3f8], esi
jne 0x1401b7a13
call fcn.140005660
mov edx, dword [0x140464fd4]
mov r8, qword [0x140464e90]
test edx, edx
jg 0x1401b79e0
test r8, r8
je 0x1401b7a33
cmp dword [0x14045b3f8], esi
jne 0x1401b7a2c
mov rcx, r8
call fcn.140005660
mov qword [0x140464e90], rsi
mov dword [0x140465080], 1
mov dword [0x140465004], esi
add rsp, 0x40
pop rsi
ret
Function at 0x1401bff90
Capabilities:
Get geographical location

Disassembly:
sub rsp, 0x48
mov rax, qword [0x14041f010]
xor rax, rsp
mov qword [rsp + 0x38], rax
lea rcx, str.LANG
call fcn.140013e0c
test rax, rax
jne 0x1401c0229
lea r9d, [rax + 0x14]
mov ecx, 0x400
lea r8, [rsp + 0x20]
lea edx, [rax + 3]
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
cmp eax, 2
jb 0x1401c0229
mov r8d, 2
lea rdx, [0x1403c7d90]
lea rcx, [rsp + 0x20]
call fcn.14001d5e0
test eax, eax
je 0x1401c0229
mov qword [rsp + 0x50], rbx
lea rdx, [0x1403c86f8]
mov r8d, 3
mov qword [rsp + 0x58], rsi
lea rcx, [rsp + 0x20]
call fcn.14001d5e0
test eax, eax
je 0x1401c00c3
mov r8d, 3
lea rdx, [0x1403c86fc]
lea rcx, [rsp + 0x20]
call fcn.14001d5e0
test eax, eax
je 0x1401c00c3
mov r8d, 3
lea rdx, [0x1403c8700]
lea rcx, [rsp + 0x20]
call fcn.14001d5e0
test eax, eax
je 0x1401c00b0
mov r8d, 3
lea rdx, [0x1403c8704]
lea rcx, [rsp + 0x20]
call fcn.14001d5e0
test eax, eax
je 0x1401c00b0
mov r8d, 2
lea rdx, [0x1403c8708]
lea rcx, [rsp + 0x20]
call fcn.14001d5e0
test eax, eax
jne 0x1401c00a9
movzx eax, word [0x1403c2484]
mov word [rsp + 0x20], ax
movzx eax, byte [0x1403c2486]
mov byte [rsp + 0x22], al
jmp 0x1401c00d9
mov byte [rsp + 0x22], 0
jmp 0x1401c00d9
mov eax, dword [str.zh_CN]
mov dword [rsp + 0x20], eax
movzx eax, word [0x1403c24fc]
jmp 0x1401c00d4
mov eax, dword [str.zh_TW]
mov dword [rsp + 0x20], eax
movzx eax, word [0x1403c2514]
mov word [rsp + 0x24], ax
mov rbx, 0xffffffffffffffff
lea rax, [rsp + 0x20]
mov rcx, rbx
nop dword [rax + rax]
inc rcx
cmp byte [rax + rcx], 0
jne 0x1401c00f0
add rcx, 6
mov qword [rsp + 0x40], rdi
mov edx, 1
call fcn.140032b90
mov rsi, rax
test rax, rax
je 0x1401c0174
lea r9, [rsp + 0x20]
mov rcx, rax
lea r8, str.LANG
lea rdx, str._s_s
call fcn.140001010
xor edx, edx
mov rcx, rsi
call fcn.140321ad0
cmp dword [0x14045b3f8], 0
mov rdi, rax
jne 0x1401c014d
mov rcx, rsi
call fcn.140005660
test rdi, rdi
je 0x1401c0174
mov rcx, rdi
call fcn.140019ea4
mov rcx, rdi
call qword [case.0x140040788.5]
cmp dword [0x14045b3f8], 0
jne 0x1401c0174
mov rcx, rdi
call fcn.140005660
cmp byte [rsp + 0x20], 0
mov rsi, qword [rsp + 0x58]
je 0x1401c021f
lea rdx, str.VIMRUNTIME
lea rcx, str.LANG
call fcn.14001d4c4
test eax, eax
jne 0x1401c021f
lea rax, [rsp + 0x20]
inc rbx
cmp byte [rax + rbx], 0
jne 0x1401c01a4
lea rcx, [rbx + 6]
mov edx, 1
call fcn.140032b90
mov rdi, rax
test rax, rax
je 0x1401c021f
lea r8, [rsp + 0x20]
mov rdx, rax
sub r8, rax
nop
movzx ecx, byte [r8 + rdx]
mov byte [rdx], cl
lea rdx, [rdx + 1]
test cl, cl
jne 0x1401c01d0
lea rcx, str._lang
mov rdx, rdi
sub rdx, rcx
add rdx, rbx
nop
movzx eax, byte [rcx]
mov byte [rdx + rcx], al
lea rcx, [rcx + 1]
test al, al
jne 0x1401c01f0
mov rdx, rdi
lea rcx, [0x1403bedb8]
call qword [case.0x140040788.3]
cmp dword [0x14045b3f8], 0
jne 0x1401c021f
mov rcx, rdi
call fcn.140005660
mov rdi, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.140001200
add rsp, 0x48
ret
Function at 0x1401cfb00
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x260
mov rax, qword [0x14041f010]
xor rax, rsp
mov qword [rsp + 0x250], rax
xor r14d, r14d
xor edx, edx
mov ebp, r14d
call fcn.140321ad0
mov rbx, rax
test rax, rax
je 0x1401cfc3c
movzx ecx, word [rax]
mov rsi, rax
call fcn.140012590
test eax, eax
je 0x1401cfb6c
cmp word [rbx + 2], 0x3a
jne 0x1401cfb6c
movzx eax, word [rbx + 4]
cmp ax, 0x5c
je 0x1401cfb66
cmp ax, 0x2f
jne 0x1401cfb6c
lea rsi, [rbx + 6]
jmp 0x1401cfb8f
movzx eax, word [rbx]
cmp ax, 0x5c
je 0x1401cfb7b
cmp ax, 0x2f
jne 0x1401cfb92
movzx ecx, word [rbx + 2]
cmp cx, 0x5c
je 0x1401cfb8b
cmp cx, 0x2f
jne 0x1401cfb92
lea rsi, [rbx + 4]
movzx eax, word [rsi]
test ax, ax
je 0x1401cfc2c
nop dword [rax + rax]
lea rdx, [0x1403c8eb8]
mov rcx, rsi
call fcn.1400185e4
mov rdi, rax
test rax, rax
jne 0x1401cfbd4
mov rax, 0xffffffffffffffff
nop
cmp word [rbx + rax*2 + 2], bp
lea rax, [rax + 1]
jne 0x1401cfbc0
lea rdi, [rbx + rax*2]
mov rsi, rdi
jmp 0x1401cfbd8
lea rsi, [rax + 2]
sub rdi, rbx
sar rdi, 1
cmp rdi, 0x104
jge 0x1401cfc2c
mov r8, rdi
lea rcx, [rsp + 0x40]
mov rdx, rbx
call fcn.14001859c
add rdi, rdi
cmp rdi, 0x208
jae 0x1401cfd6e
lea rcx, [rsp + 0x40]
mov word [rsp + rdi + 0x40], r14w
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1401cfc23
bt eax, 0xa
jb 0x1401cfc67
cmp word [rsi], bp
jne 0x1401cfba0
cmp dword [0x14045b3f8], ebp
jne 0x1401cfc3c
mov rcx, rbx
call fcn.140005660
mov rax, r14
mov rcx, qword [rsp + 0x250]
xor rcx, rsp
call fcn.140001200
lea r11, [rsp + 0x260]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
mov qword [rsp + 0x30], r14
xor r9d, r9d
mov dword [rsp + 0x28], 0x2000000
xor r8d, r8d
xor edx, edx
mov dword [rsp + 0x20], 3
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CreateFileW]
cmp dword [0x14045b3f8], ebp
mov rdi, rax
jne 0x1401cfca0
mov rcx, rbx
call fcn.140005660
cmp rdi, 0xffffffffffffffff
je 0x1401cfc3c
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetFinalPathNameByHandleW]
mov ebx, eax
test eax, eax
je 0x1401cfd47
mov ecx, ebx
mov edx, 1
add rcx, rcx
call fcn.140032b90
mov rbp, rax
test rax, rax
je 0x1401cfd47
xor r9d, r9d
mov r8d, ebx
mov rdx, rax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetFinalPathNameByHandleW]
test eax, eax
je 0x1401cfd47
mov r8d, 8
lea rdx, str._UNC_
mov rcx, rbp
call fcn.140018db4
test eax, eax
jne 0x1401cfd12
lea rcx, [rbp + 0xc]
mov word [rcx], 0x5c
jmp 0x1401cfd32
mov r8d, 4
lea rdx, [0x1403c8ed8]
mov rcx, rbp
call fcn.140018db4
lea rcx, [rbp + 8]
test eax, eax
je 0x1401cfd32
mov rcx, rbp
xor edx, edx
call fcn.140321ea0
mov rcx, rdi
mov r14, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1401cfd59
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test rbp, rbp
je 0x1401cfc3c
cmp dword [0x14045b3f8], 0
jne 0x1401cfc3c
mov rcx, rbp
jmp 0x1401cfc37
call fcn.140001328
int3
Function at 0x1401d07f0
Capabilities:
Get system information on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x80
mov rsi, rcx
xor ebx, ebx
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
lea r8d, [rbx + 0x30]
mov rcx, rsi
lea rdx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x1401d087e
mov edi, dword [rsp + 0x24]
xor edx, edx
mov rax, rsi
mov rcx, rsi
sub rax, qword [rsp + 0x50]
div rdi
sub rdi, rdx
mov edx, edi
call qword [sym.imp.KERNEL32.dll_IsBadReadPtr]
test eax, eax
jne 0x1401d087e
nop dword [rax]
xor eax, eax
test rdi, rdi
je 0x1401d0868
inc rbx
cmp byte [rax + rsi], 0
je 0x1401d0895
inc rax
cmp rax, rdi
jb 0x1401d0857
add rsi, rdi
mov edi, dword [rsp + 0x24]
mov edx, edi
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_IsBadReadPtr]
test eax, eax
je 0x1401d0850
xor eax, eax
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret
mov rax, rbx
jmp 0x1401d0880

Function at 0x1401d0920
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
mov eax, 0x1060
call fcn.140031f40
sub rsp, rax
mov rax, qword [0x14041f010]
xor rax, rsp
mov qword [rsp + 0x1050], rax
xor edx, edx
mov dword [rsp + 0x40], 0x1000
call fcn.140321ad0
mov rsi, rax
test rax, rax
je 0x1401d0a96
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1401d0a85
bt eax, 0xa
jae 0x1401d0a85
xor edi, edi
xor r9d, r9d
mov qword [rsp + 0x30], rdi
mov edx, 0x80
mov dword [rsp + 0x28], 0x2200000
mov rcx, rsi
mov dword [rsp + 0x20], 3
lea r8d, [rdi + 3]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbp, rax
cmp rax, 0xffffffffffffffff
je 0x1401d0a7d
mov ecx, dword [rsp + 0x40]
lea rax, [rsp + 0x40]
mov qword [rsp + 0x38], rdi
xor r9d, r9d
mov qword [rsp + 0x30], rax
xor r8d, r8d
mov dword [rsp + 0x28], ecx
lea rax, [rsp + 0x50]
mov rcx, rbp
mov qword [rsp + 0x20], rax
mov edx, 0x900a8
mov qword [rsp + 0x1078], rbx
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov rcx, rbp
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test ebx, ebx
mov rbx, qword [rsp + 0x1078]
je 0x1401d0a7d
cmp dword [0x14045b3f8], edi
jne 0x1401d0a1e
mov rcx, rsi
call fcn.140005660
cmp dword [rsp + 0x50], 0x8000001b
jne 0x1401d0a96
mov r8d, dword [rsp + 0x58]
cmp r8d, 3
jb 0x1401d0a96
movzx eax, word [rsp + 0x54]
lea r9, [rsp + 0x5c]
shr rax, 1
lea rcx, [rsp + 0x5c]
lea r9, [r9 + rax*2]
lea rax, [rsp + 0x5c]
cmp rax, r9
jae 0x1401d0a74
cmp edi, r8d
jge 0x1401d0a74
cmp edi, 2
je 0x1401d0a74
movzx edx, word [rcx]
lea eax, [rdi + 1]
add rcx, 2
test dx, dx
cmovne eax, edi
mov edi, eax
cmp rcx, r9
jb 0x1401d0a53
xor edx, edx
call fcn.140321ea0
jmp 0x1401d0a98
cmp dword [0x14045b3f8], edi
jmp 0x1401d0a8c
cmp dword [0x14045b3f8], 0
jne 0x1401d0a96
mov rcx, rsi
call fcn.140005660
xor eax, eax
mov rcx, qword [rsp + 0x1050]
xor rcx, rsp
call fcn.140001200
lea r11, [rsp + 0x1060]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x1401d24f0
Capabilities:
Enumerate gui resources

Disassembly:
mov r11, rsp
mov qword [r11 + 0x10], rbx
push rdi
sub rsp, 0x50
lea rax, [0x1401cf110]
xor edi, edi
mov qword [r11 - 0x18], rdi
lea rdx, [r11 - 0x38]
mov qword [r11 - 0x28], rdi
lea rcx, [0x1401cf0b0]
mov qword [r11 - 0x38], rax
lea rax, [r11 - 0x28]
mov qword [r11 - 0x30], rax
mov dword [rsp + 0x38], 1
mov dword [rsp + 0x3c], 0x64
call qword [sym.imp.USER32.dll_EnumWindows]
mov eax, dword [rsp + 0x34]
mov r8d, dword [rsp + 0x30]
sub eax, r8d
cmp eax, 1
jge 0x1401d25e0
mov ecx, 1
mov qword [rsp + 0x60], rsi
cmp dword [rsp + 0x3c], ecx
mov eax, r8d
cdq
cmovg ecx, dword [rsp + 0x3c]
sub eax, edx
sar eax, 1
cmp ecx, eax
cmovge eax, ecx
mov rcx, qword [rsp + 0x40]
add eax, r8d
movsxd rsi, eax
movsxd rax, dword [rsp + 0x38]
imul rsi, rax
mov rdx, rsi
call fcn.140005658
mov rbx, rax
test rax, rax
jne 0x1401d259a
mov rbx, qword [rsp + 0x40]
jmp 0x1401d25c2
movsxd rcx, dword [rsp + 0x34]
xor edx, edx
movsxd rax, dword [rsp + 0x38]
imul rcx, rax
sub rsi, rcx
add rcx, rbx
mov r8, rsi
call fcn.140002810
mov qword [rsp + 0x40], rbx
mov edi, 1
mov rsi, qword [rsp + 0x60]
test edi, edi
je 0x1401d25d2
mov r8d, dword [rsp + 0x30]
jmp 0x1401d25e5
mov rax, rbx
mov rbx, qword [rsp + 0x68]
add rsp, 0x50
pop rdi
ret
mov rbx, qword [rsp + 0x40]
movsxd rax, r8d
mov byte [rax + rbx], 0
mov rax, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x68]
add rsp, 0x50
pop rdi
ret
Function at 0x1401d5400
Capabilities:
Write file on windows

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov eax, 0x1068
call fcn.140031f40
sub rsp, rax
mov rax, qword [0x14041f010]
xor rax, rsp
mov qword [rsp + 0x1050], rax
mov ebp, dword [rsp + 0x10d0]
mov rax, 0xffffffffffffffff
mov r15, rcx
mov rdi, r9
mov rcx, rax
mov rbx, r8
mov r12, rdx
nop dword [rax]
inc rcx
cmp word [r9 + rcx*2], 0
jne 0x1401d5450
nop dword [rax + rax]
inc rax
cmp word [r8 + rax*2], 0
jne 0x1401d5460
add rcx, rax
lea rcx, [rcx*2 + 2]
call fcn.140005674
mov rdx, rax
mov qword [rsp + 0x48], rax
sub rdx, rbx
mov r14, rax
nop dword [rax]
movzx ecx, word [rbx]
mov word [rdx + rbx], cx
lea rbx, [rbx + 2]
test cx, cx
jne 0x1401d5490
lea rcx, [rax - 2]
cmp word [rcx + 2], 0
lea rcx, [rcx + 2]
jne 0x1401d54a4
xor edx, edx
movzx eax, word [rdi + rdx*2]
mov word [rcx + rdx*2], ax
lea rdx, [rdx + 1]
test ax, ax
jne 0x1401d54b1
xor r13d, r13d
xor r9d, r9d
mov qword [rsp + 0x30], r13
xor r8d, r8d
mov dword [rsp + 0x28], 0x80
mov edx, 0x40000000
mov rcx, r14
mov dword [rsp + 0x20], 4
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rsi, rax
cmp rax, 0xffffffffffffffff
je 0x1401d5585
mov edi, r13d
test ebp, ebp
jle 0x1401d557c
mov r14d, 0x1000
nop dword [rax + rax]
mov qword [rsp + 0x30], r12
lea r9, [rsp + 0x40]
mov ebx, ebp
mov dword [rsp + 0x28], r13d
sub ebx, edi
mov dword [rsp + 0x20], r13d
cmp ebx, r14d
lea rdx, [rsp + 0x50]
mov rcx, r15
cmova ebx, r14d
mov r8d, ebx
call qword [sym.imp.KERNEL32.dll_BackupRead]
test eax, eax
je 0x1401d5577
cmp dword [rsp + 0x40], ebx
jne 0x1401d5577
lea r9, [rsp + 0x44]
mov qword [rsp + 0x20], r13
mov r8d, ebx
lea rdx, [rsp + 0x50]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x1401d5577
mov eax, dword [rsp + 0x44]
cmp eax, ebx
jne 0x1401d5577
add edi, eax
cmp edi, ebp
jl 0x1401d5510
mov r14, qword [rsp + 0x48]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, r14
call fcn.140005660
mov rcx, qword [rsp + 0x1050]
xor rcx, rsp
call fcn.140001200
add rsp, 0x1068
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x1401d55c0
Capabilities:
Delete file
Get common file path
Move file

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x480
mov rax, qword [0x14041f010]
xor rax, rsp
mov qword [rsp + 0x470], rax
movzx eax, word [rcx]
xor edi, edi
mov qword [rsp + 0x40], rcx
mov rsi, rdx
mov rbx, rcx
mov r9, rcx
mov edx, edi
test ax, ax
je 0x1401d5648
mov r8d, edi
movabs r10, 0x200000000801
nop dword [rax + rax]
sub ax, 0x2f
cmp ax, 0x2d
ja 0x1401d5630
bt r10, rax
jae 0x1401d5630
cmp word [rcx + 2], di
je 0x1401d5630
movsxd r9, edx
inc r9
lea r9, [rbx + r9*2]
inc r8
inc edx
movzx eax, word [rbx + r8*2]
lea rcx, [rbx + r8*2]
test ax, ax
jne 0x1401d5610
mov qword [rsp + 0x40], r9
movsxd rax, edx
add rax, rax
sub rax, r9
add rax, rbx
sar rax, 1
cmp eax, 8
jl 0x1401d5793
cmp word [r9 + 0xc], 0x7e
jne 0x1401d5793
lea r9, [rsp + 0x40]
mov edx, 0x104
lea r8, [rsp + 0x260]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetFullPathNameW]
test eax, eax
je 0x1401d578c
mov rax, qword [rsp + 0x40]
test rax, rax
je 0x1401d578c
lea r9, [rsp + 0x50]
mov word [rax], di
xor r8d, r8d
lea rdx, [0x1403bf330]
lea rcx, [rsp + 0x260]
call qword [sym.imp.KERNEL32.dll_GetTempFileNameW]
test eax, eax
jne 0x1401d56cb
mov eax, 0xfffffffe
jmp 0x1401d57a7
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x1401d56e4
mov eax, 0xfffffffd
jmp 0x1401d57a7
lea rdx, [rsp + 0x50]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
jne 0x1401d5700
mov eax, 0xfffffffc
jmp 0x1401d57a7
mov qword [rsp + 0x30], rdi
xor r9d, r9d
mov dword [rsp + 0x28], 0x80
xor r8d, r8d
mov edx, 0x40000000
mov dword [rsp + 0x20], 1
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CreateFileW]
cmp rax, 0xffffffffffffffff
jne 0x1401d5736
mov eax, 0xfffffffb
jmp 0x1401d57a7
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
jne 0x1401d574a
mov eax, 0xfffffffa
jmp 0x1401d57a7
mov rdx, rsi
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_MoveFileW]
lea rcx, [rsp + 0x50]
test eax, eax
jne 0x1401d5771
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_MoveFileW]
mov eax, 0xfffffff9
jmp 0x1401d57a7
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
mov ecx, 0xfffffff8
cmove edi, ecx
jmp 0x1401d57a5
mov eax, 0xffffffff
jmp 0x1401d57a7
mov rdx, rsi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
sete dil
mov eax, edi
mov rcx, qword [rsp + 0x470]
xor rcx, rsp
call fcn.140001200
lea r11, [rsp + 0x480]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x1401d7540
Capabilities:
Manipulate console buffer

Disassembly:
cmp ecx, 1
jb 0x1401d7637
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
cmp ecx, dword [0x140420870]
mov ebx, edx
mov edi, ecx
ja 0x1401d762d
cmp edx, 1
jb 0x1401d762d
cmp edx, dword [0x140420f60]
ja 0x1401d762d
cmp dword [0x140461ff8], 0
je 0x1401d75ea
call fcn.1401e0640
test eax, eax
je 0x1401d75ea
cmp dword [0x14046996c], 0
jne 0x1401d759f
cmp dword [0x14045b71c], 0x100
jl 0x1401d75ea
movsx edx, word [0x140461fda]
lea rcx, str.e__d__dH
inc edx
mov r8d, 1
call fcn.1401d48e0
mov r8d, edi
lea rcx, str.e__d__dH
mov edx, ebx
call fcn.1401d48e0
dec di
dec bx
mov word [0x140461fd8], di
mov word [0x140461fda], bx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
mov rcx, qword [0x140454e60]
xor eax, eax
mov word [0x140461fd8], ax
mov edx, dword [0x140461fd8]
call qword [sym.imp.KERNEL32.dll_SetConsoleCursorPosition]
mov rcx, qword [0x140454e60]
dec di
dec bx
mov word [0x140461fd8], di
mov word [0x140461fda], bx
mov edx, dword [0x140461fd8]
call qword [sym.imp.KERNEL32.dll_SetConsoleCursorPosition]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x1401d8070
Capabilities:
Enumerate processes
Terminate process

Disassembly:
mov qword [rsp + 0x20], rbp
push rsi
sub rsp, 0x160
mov rax, qword [0x14041f010]
xor rax, rsp
mov qword [rsp + 0x150], rax
mov rbp, rcx
call qword [sym.imp.KERNEL32.dll_GetProcessId]
mov esi, eax
test eax, eax
je 0x1401d8141
xor edx, edx
mov qword [rsp + 0x180], rdi
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x1401d8139
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x130
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32First]
test eax, eax
je 0x1401d8139
mov qword [rsp + 0x178], rbx
cmp dword [rsp + 0x40], esi
jne 0x1401d8116
mov r8d, dword [rsp + 0x28]
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
test rax, rax
je 0x1401d8116
mov edx, 0xffffffff
mov rcx, rax
call fcn.1401d8070
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, [rsp + 0x20]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
jne 0x1401d80e0
mov rbx, qword [rsp + 0x178]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rdi, qword [rsp + 0x180]
mov edx, 0xffffffff
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rcx, qword [rsp + 0x150]
xor rcx, rsp
call fcn.140001200
mov rbp, qword [rsp + 0x188]
add rsp, 0x160
pop rsi
ret