joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1401d93e0
Capabilities:
Manipulate console buffer

Disassembly:
sub rsp, 0x28
cmp dword [0x140454df0], 0
je 0x1401d93fc
mov dword [0x140454df0], 2
add rsp, 0x28
ret
cmp dword [0x14045b94c], 0
je 0x1401d944f
mov rcx, qword [0x140454e60]
call qword [sym.imp.KERNEL32.dll_GetLargestConsoleWindowSize]
mov ecx, eax
mov edx, eax
shr ecx, 0x10
movsx ecx, cx
cmp dword [0x140420f60], ecx
jle 0x1401d9432
mov ecx, eax
shr ecx, 0x10
movsx ecx, cx
mov dword [0x140420f60], ecx
movsx eax, dx
cmp dword [0x140420870], eax
jle 0x1401d9446
movsx eax, dx
mov dword [0x140420870], eax
add rsp, 0x28
jmp fcn.1401d9460
add rsp, 0x28
ret

Function at 0x1401d9460
Capabilities:
Manipulate console buffer

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x60
mov rax, qword [0x14041f010]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov rbx, qword [0x140454e60]
mov edi, dword [0x140420f60]
mov rcx, rbx
mov esi, dword [0x140420870]
call qword [sym.imp.KERNEL32.dll_GetLargestConsoleWindowSize]
movsx ecx, ax
xor ebp, ebp
mov dword [rsp + 0x20], eax
movzx edx, si
cmp esi, ecx
mov dword [rsp + 0x28], ebp
mov r8d, eax
cmovge dx, ax
shr eax, 0x10
dec dx
cwde
mov word [rsp + 0x2c], dx
cmp edi, eax
jge 0x1401d94cc
mov eax, edi
jmp 0x1401d94d4
shr r8d, 0x10
movsx eax, r8w
mov rcx, qword [0x140454e60]
lea rdx, [rsp + 0x38]
dec ax
mov word [rsp + 0x2e], ax
call qword [sym.imp.KERNEL32.dll_GetConsoleScreenBufferInfo]
test eax, eax
je 0x1401d9539
movsx eax, word [rsp + 0x42]
movsx ecx, word [rsp + 0x46]
movsx edx, word [rsp + 0x48]
sub ecx, eax
movsx eax, word [rsp + 0x44]
inc ecx
sub edx, eax
inc edx
cmp edx, edi
jl 0x1401d9518
cmp ecx, esi
jge 0x1401d9539
cmp edx, edi
cmovl dx, di
cmp ecx, esi
mov word [rsp + 0x22], dx
cmovl cx, si
mov word [rsp + 0x20], cx
mov rcx, rbx
mov edx, dword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_SetConsoleScreenBufferSize]
cmp dword [0x140461ff8], ebp
mov word [rsp + 0x20], si
mov word [rsp + 0x22], di
je 0x1401d95a0
cmp dword [0x140462390], ebp
jne 0x1401d95a0
mov edx, ebp
mov dword [rsp + 0x30], ebp
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SetConsoleCursorPosition]
cmp dword [0x1404621ac], ebp
jne 0x1401d9577
mov edx, dword [rsp + 0x20]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SetConsoleScreenBufferSize]
mov rax, qword [rsp + 0x28]
lea r8, [rsp + 0x28]
mov edx, 1
mov qword [rsp + 0x28], rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SetConsoleWindowInfo]
mov dword [0x140462390], 1
jmp 0x1401d95d2
mov rax, qword [rsp + 0x28]
lea r8, [rsp + 0x28]
mov edx, 1
mov qword [rsp + 0x28], rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SetConsoleWindowInfo]
cmp dword [0x1404621ac], ebp
jne 0x1401d95d2
mov edx, dword [rsp + 0x20]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SetConsoleScreenBufferSize]
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.140001200
mov rbx, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x78]
mov rsi, qword [rsp + 0x80]
add rsp, 0x60
pop rdi
ret
Function at 0x1401d9990
Capabilities:
Get file attributes

Disassembly:
push rbx
sub rsp, 0x20
xor edx, edx
call fcn.140321ad0
mov rbx, rax
test rax, rax
jne 0x1401d99ae
lea eax, [rbx - 1]
add rsp, 0x20
pop rbx
ret
mov rcx, rbx
mov qword [rsp + 0x30], rdi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp dword [0x14045b3f8], 0
mov edi, eax
jne 0x1401d99cf
mov rcx, rbx
call fcn.140005660
mov eax, edi
mov rdi, qword [rsp + 0x30]
add rsp, 0x20
pop rbx
ret
Function at 0x1401da2d0
Capabilities:
Manipulate console buffer

Disassembly:
mov r11, rsp
mov qword [r11 + 0x20], rbx
push rsi
push rdi
push r14
sub rsp, 0x60
mov rax, qword [0x14041f010]
xor rax, rsp
mov qword [rsp + 0x58], rax
cmp dword [0x1404621ac], 0
mov r14d, edx
mov rbx, rcx
jne 0x1401da4c3
test rcx, rcx
je 0x1401da4e6
cmp dword [rcx], 0
je 0x1401da4e6
mov qword [r11 + 0x10], rbp
mov qword [r11 + 0x18], r15
test edx, edx
je 0x1401da328
movzx ecx, word [rcx + 0xc]
call fcn.1401da830
mov esi, dword [rbx + 4]
lea rdx, [rsp + 0x40]
mov rcx, qword [0x140454e60]
mov ebp, esi
xor edi, edi
shr ebp, 0x10
mov dword [rsp + 0x30], esi
mov r15d, edi
call qword [sym.imp.KERNEL32.dll_GetConsoleScreenBufferInfo]
test eax, eax
je 0x1401da3d5
movzx ecx, word [rsp + 0x4e]
movzx eax, bp
cmp cx, si
jl 0x1401da389
sub cx, word [rsp + 0x4a]
lea eax, [rsi - 1]
inc cx
mov word [rsp + 0x4e], ax
cmp cx, si
lea r15d, [rdi + 1]
movzx eax, si
cmovle ax, cx
sub si, ax
movzx eax, bp
mov word [rsp + 0x4a], si
movzx edx, word [rsp + 0x50]
cmp dx, bp
jl 0x1401da3b9
sub dx, word [rsp + 0x4c]
movzx ecx, word [rsp + 0x32]
inc dx
cmp dx, ax
cmovg dx, bp
lea eax, [rcx - 1]
sub cx, dx
mov word [rsp + 0x4c], cx
mov word [rsp + 0x50], ax
jmp 0x1401da3be
test r15d, r15d
je 0x1401da3d5
mov rcx, qword [0x140454e60]
lea r8, [rsp + 0x4a]
mov edx, 1
call qword [sym.imp.KERNEL32.dll_SetConsoleWindowInfo]
mov edx, dword [rbx + 4]
mov rcx, qword [0x140454e60]
call qword [sym.imp.KERNEL32.dll_SetConsoleScreenBufferSize]
mov r15, qword [rsp + 0x90]
mov rbp, qword [rsp + 0x88]
test eax, eax
je 0x1401da4e6
movzx edx, word [rbx + 0xc]
mov rcx, qword [0x140454e60]
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
test eax, eax
je 0x1401da4e6
test r14d, r14d
je 0x1401da4c3
mov edx, dword [rbx + 8]
mov rcx, qword [0x140454e60]
call qword [sym.imp.KERNEL32.dll_SetConsoleCursorPosition]
test eax, eax
je 0x1401da4e6
mov rcx, qword [0x140454e60]
lea r8, [rbx + 0xe]
mov edx, 1
call qword [sym.imp.KERNEL32.dll_SetConsoleWindowInfo]
test eax, eax
je 0x1401da4e6
cmp qword [rbx + 0x20], rdi
je 0x1401da4c3
cmp dword [rbx + 0x38], edi
jle 0x1401da4c3
mov rsi, rdi
nop dword [rax]
nop word [rax + rax]
mov rcx, qword [rbx + 0x30]
mov r8d, dword [rbx + 0x28]
mov rdx, qword [rbx + 0x20]
movzx eax, word [rcx + rsi]
mov word [rsp + 0x30], ax
movzx eax, word [rcx + rsi + 2]
mov word [rsp + 0x32], ax
mov rax, qword [rcx + rsi]
mov r9d, dword [rsp + 0x30]
mov rcx, qword [0x140454e60]
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_WriteConsoleOutputW]
test eax, eax
je 0x1401da4e6
inc edi
add rsi, 8
cmp edi, dword [rbx + 0x38]
jl 0x1401da470
mov eax, 1
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140001200
mov rbx, qword [rsp + 0x98]
add rsp, 0x60
pop r14
pop rdi
pop rsi
ret
xor eax, eax
jmp 0x1401da4c8
Function at 0x1401dd980
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x140
mov rax, qword [0x14041f010]
xor rax, rsp
mov qword [rsp + 0x130], rax
mov rbx, qword [0x140467c88]
mov eax, 0x5a4d
cmp word [rbx], ax
jne 0x1401dda4d
movsxd rcx, dword [rbx + 0x3c]
cmp dword [rcx + rbx], 0x4550
jne 0x1401dda4d
mov edx, dword [rcx + rbx + 0x88]
test edx, edx
jne 0x1401dd9da
mov rax, rbx
jmp 0x1401dda4f
cmp dword [rdx + rbx + 0x18], 0
je 0x1401dd9d5
mov eax, dword [rdx + rbx + 0x1c]
mov r8d, dword [rax + rbx]
cmp r8d, edx
jb 0x1401dd9d5
add edx, dword [rcx + rbx + 0x8c]
cmp r8d, edx
jae 0x1401dd9d5
lea rsi, [rbx + r8]
mov edx, 0x2e
mov rcx, rsi
call fcn.1400020d8
mov rdi, rax
test rax, rax
je 0x1401dd9d5
sub rdi, rsi
lea rax, [rdi + 1]
cmp rax, 0x104
ja 0x1401dda4d
mov r8, rdi
lea rcx, [rsp + 0x20]
mov rdx, rsi
call fcn.140013650
cmp rdi, 0x104
jae 0x1401dda74
lea rcx, [rsp + 0x20]
mov byte [rsp + rdi + 0x20], 0
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
jmp 0x1401dda4f
xor eax, eax
mov rcx, qword [rsp + 0x130]
xor rcx, rsp
call fcn.140001200
lea r11, [rsp + 0x140]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret
call fcn.140001328
int3

Function at 0x1401ddad0
Capabilities:
Allocate or change rwx memory
Parse pe header

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x30
mov eax, 0x5a4d
mov rbp, r9
mov esi, r8d
mov rbx, rdx
mov r10, rcx
cmp word [rcx], ax
jne 0x1401ddb9d
movsxd rax, dword [rcx + 0x3c]
cmp dword [rax + rcx], 0x4550
jne 0x1401ddb9d
mov r9d, dword [rax + rcx + 0x90]
test r9d, r9d
je 0x1401ddb9d
mov eax, dword [rcx + r9 + 0x10]
lea r11, [rcx + r9]
test eax, eax
je 0x1401ddb9d
nop dword [rax]
mov ecx, dword [r11]
test ecx, ecx
je 0x1401ddb91
mov edi, eax
add rdi, r10
cmp qword [rdi], 0
je 0x1401ddb91
mov r9d, ecx
sub r9, rdi
add r9, r10
nop dword [rax + rax]
mov rax, qword [r9 + rdi]
test rax, rax
js 0x1401ddb87
add rax, 2
mov r8, rbx
add rax, r10
sub r8, rax
nop word [rax + rax]
movzx edx, byte [rax]
movzx ecx, byte [rax + r8]
sub edx, ecx
jne 0x1401ddb83
inc rax
test ecx, ecx
jne 0x1401ddb70
test edx, edx
je 0x1401ddbb4
add rdi, 8
cmp qword [rdi], 0
jne 0x1401ddb50
mov eax, dword [r11 + 0x24]
add r11, 0x14
test eax, eax
jne 0x1401ddb30
xor eax, eax
mov rbx, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
mov dword [rsp + 0x40], 4
test esi, esi
je 0x1401ddc09
sub esi, 1
je 0x1401ddc00
cmp esi, 1
jne 0x1401ddb9d
mov rbx, qword [rdi]
lea r9, [rsp + 0x20]
lea edx, [rsi + 7]
mov rcx, rdi
lea r8d, [rsi + 3]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov r8d, dword [rsp + 0x20]
lea r9, [rsp + 0x40]
lea edx, [rsi + 7]
mov qword [rdi], rbp
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rax, rbx
jmp 0x1401ddb9f
mov eax, dword [r11 + 0xc]
add rax, r10
jmp 0x1401ddb9f
mov rax, qword [rdi]
jmp 0x1401ddb9f
Function at 0x1401df490
Capabilities:
Set file attributes

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
call fcn.1401d9990
mov ebx, eax
cmp eax, 0xffffffff
je 0x1401df4da
xor edx, edx
mov rcx, rdi
call fcn.140321ad0
mov rdi, rax
test rax, rax
je 0x1401df4da
or ebx, 2
mov rcx, rax
mov edx, ebx
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
cmp dword [0x14045b3f8], 0
jne 0x1401df4da
mov rcx, rdi
call fcn.140005660
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x1401dfad0
Capabilities:
Accept command line arguments

Disassembly:
push rsi
push r12
push r15
sub rsp, 0x50
mov qword [rsp + 0x48], r13
mov r12, rcx
mov rcx, qword [0x1404620f8]
xor r13d, r13d
mov esi, r13d
mov r15d, r13d
test rcx, rcx
je 0x1401dfb04
call qword [sym.imp.KERNEL32.dll_GlobalFree]
mov qword [0x1404620f8], r13
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov rcx, rax
lea rdx, [0x140462100]
call qword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov qword [0x1404620f8], rax
test rax, rax
je 0x1401dfc7e
mov eax, dword [0x140462100]
inc eax
movsxd rcx, eax
shl rcx, 3
call fcn.140005674
mov rsi, rax
test rax, rax
je 0x1401dfc7e
movsxd r15, dword [0x140462100]
mov qword [rsp + 0x40], r14
mov r14d, r13d
mov qword [rax + r15*8], r13
test r15d, r15d
jle 0x1401dfc79
mov qword [rsp + 0x70], rbx
mov rbx, r13
mov qword [rsp + 0x78], rbp
mov qword [rsp + 0x80], rdi
nop dword [rax + rax]
mov rax, qword [0x1404620f8]
mov rdi, 0xffffffffffffffff
mov rbp, qword [rax + rbx*8]
cmp word [rbp + rdi*2 + 2], 0
lea rdi, [rdi + 1]
jne 0x1401dfb92
mov qword [rsp + 0x38], r13
lea r9d, [rdi + 1]
mov qword [rsp + 0x30], r13
mov r8, rbp
mov dword [rsp + 0x28], r13d
xor edx, edx
mov ecx, 0xfde9
mov qword [rsp + 0x20], r13
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
movsxd r13, eax
mov edx, 1
lea ecx, [r13 + 1]
movsxd rcx, ecx
call fcn.140032b90
mov qword [rsi + rbx*8], rax
test rax, rax
je 0x1401dfc17
xor ecx, ecx
lea r9d, [rdi + 1]
mov qword [rsp + 0x38], rcx
mov r8, rbp
mov qword [rsp + 0x30], rcx
xor edx, edx
mov dword [rsp + 0x28], r13d
mov ecx, 0xfde9
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov rax, qword [rsi + rbx*8]
mov byte [r13 + rax], 0
cmp qword [rsi + rbx*8], 0
jne 0x1401dfc55
test rbx, rbx
jle 0x1401dfc42
sub r14d, ebx
nop word [rax + rax]
mov rcx, qword [rsi + rbx*8 - 8]
dec rbx
call fcn.140005660
test rbx, rbx
jg 0x1401dfc30
mov rcx, rsi
call fcn.140005660
xor r13d, r13d
mov esi, r13d
mov r15d, r13d
jmp 0x1401dfc58
xor r13d, r13d
inc r14d
inc rbx
cmp r14d, r15d
jl 0x1401dfb80
mov rdi, qword [rsp + 0x80]
mov rbp, qword [rsp + 0x78]
mov rbx, qword [rsp + 0x70]
mov r14, qword [rsp + 0x40]
mov r13, qword [rsp + 0x48]
mov dword [0x1404621bc], r15d
mov qword [0x1404621b0], rsi
test r15d, r15d
jle 0x1401dfcba
mov rcx, qword [0x140462018]
test rcx, rcx
je 0x1401dfca7
call fcn.140005660
movsxd rcx, r15d
shl rcx, 2
call fcn.140005674
mov qword [0x140462018], rax
mov eax, r15d
test r12, r12
je 0x1401dfcc6
mov qword [r12], rsi
add rsp, 0x50
pop r15
pop r12
pop rsi
ret
Function at 0x1401e0270
Capabilities:
Delete file
Get common file path

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x280
mov rax, qword [0x14041f010]
xor rax, rsp
mov qword [rsp + 0x270], rax
xor edx, edx
mov rsi, rcx
mov ebx, 0xffffffff
call fcn.140321ad0
mov rdi, rax
test rax, rax
je 0x1401e0351
mov rcx, rsi
call fcn.1401d9990
mov ecx, eax
xor esi, esi
shr eax, 4
and eax, 1
cmp ecx, ebx
cmove eax, esi
test eax, eax
je 0x1401e030a
xor edx, edx
mov word [rsp + 0x40], si
mov r8d, 0x226
lea rcx, [rsp + 0x42]
call fcn.140002810
lea r9, [rsp + 0x40]
xor r8d, r8d
lea rdx, [0x1403bf330]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetTempFileNameW]
test eax, eax
je 0x1401e0341
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x1401e033f
xor r9d, r9d
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], esi
mov edx, 0x40000000
mov rcx, rdi
mov dword [rsp + 0x20], 3
lea r8d, [r9 + 3]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
cmp rax, 0xffffffffffffffff
je 0x1401e0341
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ebx, esi
cmp dword [0x14045b3f8], esi
jne 0x1401e0351
mov rcx, rdi
call fcn.140005660
mov eax, ebx
mov rcx, qword [rsp + 0x270]
xor rcx, rsp
call fcn.140001200
lea r11, [rsp + 0x280]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x1401e0380
Capabilities:
Manipulate console buffer

Disassembly:
sub rsp, 0x28
mov eax, dword [0x140420a38]
cmp eax, 0x6010
jne 0x1401e03a2
mov eax, dword [0x14042ec80]
mov ecx, dword [0x14042ec88]
jmp 0x1401e047e
bt eax, 9
jae 0x1401e03b9
mov eax, dword [0x14042ea10]
mov ecx, dword [0x14042ea18]
jmp 0x1401e047e
bt eax, 8
jae 0x1401e03d0
mov eax, dword [0x14042ea10]
mov ecx, dword [0x14042ea18]
jmp 0x1401e047e
test al, 0x10
je 0x1401e03e5
mov eax, dword [0x14042e9e0]
mov ecx, dword [0x14042e9e8]
jmp 0x1401e047e
test al, 8
je 0x1401e042a
mov eax, dword [0x14045fafc]
cmp dword [0x14045fb00], eax
jl 0x1401e0405
mov eax, dword [0x14042ea40]
mov ecx, dword [0x14042ea48]
jmp 0x1401e047e
cmp dword [0x14045fb1c], 0
je 0x1401e041c
mov eax, dword [0x14042eaa0]
mov ecx, dword [0x14042eaa8]
jmp 0x1401e047e
mov eax, dword [0x14042ea70]
mov ecx, dword [0x14042ea78]
jmp 0x1401e047e
cmp dword [0x14045b7a4], 0
je 0x1401e0441
mov eax, dword [0x14042ead0]
mov ecx, dword [0x14042ead8]
jmp 0x1401e047e
cmp dword [0x14045b480], 0
je 0x1401e0472
mov rax, qword [0x14046a318]
cmp byte [rax], 0x65
jne 0x1401e0464
mov eax, dword [0x14042eb00]
mov ecx, dword [0x14042eb08]
jmp 0x1401e047e
mov eax, dword [0x14042e9b0]
mov ecx, dword [0x14042e9b8]
jmp 0x1401e047e
mov eax, dword [0x14042e980]
mov ecx, dword [0x14042e988]
test eax, eax
mov edx, 0x63
cmove ecx, edx
cmp dword [0x140461ff8], 0
je 0x1401e04c2
mov rax, qword [0x1404689c8]
cmp byte [rax], 0
jne 0x1401e04fe
cmp ecx, 0x32
jge 0x1401e04b2
lea rcx, str.e_3_q
add rsp, 0x28
jmp fcn.1401d48e0
lea rcx, str.e_0_q
add rsp, 0x28
jmp fcn.1401d48e0
mov eax, dword [0x140454dec]
lea rdx, [rsp + 0x30]
mov dword [rsp + 0x30], ecx
mov rcx, qword [0x140454e60]
mov dword [rsp + 0x34], eax
call qword [sym.imp.KERNEL32.dll_SetConsoleCursorInfo]
cmp dword [0x140454dec], 0
je 0x1401e04fe
mov edx, dword [0x140461fd8]
mov rcx, qword [0x140454e60]
call qword [sym.imp.KERNEL32.dll_SetConsoleCursorPosition]
add rsp, 0x28
ret

Function at 0x1401e05e0
Capabilities:
Create directory

Disassembly:
push rbx
sub rsp, 0x20
xor edx, edx
call fcn.140321ad0
mov rbx, rax
test rax, rax
jne 0x1401e05fe
lea eax, [rbx - 1]
add rsp, 0x20
pop rbx
ret
mov rcx, rbx
mov qword [rsp + 0x30], rdi
call fcn.140018de0
cmp dword [0x14045b3f8], 0
mov edi, eax
jne 0x1401e061e
mov rcx, rbx
call fcn.140005660
mov eax, edi
mov rdi, qword [rsp + 0x30]
add rsp, 0x20
pop rbx
ret
Function at 0x1401e0690
Capabilities:
Get hostname

Disassembly:
mov qword [rsp + 0x20], rbx
push rsi
sub rsp, 0x250
mov rax, qword [0x14041f010]
xor rax, rsp
mov qword [rsp + 0x240], rax
movsxd rbx, edx
mov rsi, rcx
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x101
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
test eax, eax
je 0x1401e071a
xor edx, edx
mov qword [rsp + 0x270], rdi
lea rcx, [rsp + 0x30]
call fcn.140321ea0
mov rdi, rax
test rax, rax
je 0x1401e0712
lea r8, [rbx - 1]
mov rdx, rax
mov rcx, rsi
call fcn.140013650
cmp dword [0x14045b3f8], 0
mov byte [rsi + rbx - 1], 0
jne 0x1401e0712
mov rcx, rdi
call fcn.140005660
mov rdi, qword [rsp + 0x270]
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.140001200
mov rbx, qword [rsp + 0x278]
add rsp, 0x250
pop rsi
ret

Function at 0x1401e0900
Capabilities:
Get common file path
Set current directory

Disassembly:
push rbx
sub rsp, 0x830
mov rax, qword [0x14041f010]
xor rax, rsp
mov qword [rsp + 0x820], rax
cmp dword [0x14045b9ac], 0
mov rbx, rcx
jne 0x1401e097d
cmp qword [0x140462248], 0
jne 0x1401e0940
call fcn.1401def90
cmp qword [0x140462248], 0
je 0x1401e097d
lea rdx, [rsp + 0x20]
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
test eax, eax
je 0x1401e097d
mov rcx, qword [0x140462248]
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
lea rcx, [rsp + 0x20]
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
mov rax, rbx
jmp 0x1401e097f
xor eax, eax
mov rcx, qword [rsp + 0x820]
xor rcx, rsp
call fcn.140001200
add rsp, 0x830
pop rbx
ret

Function at 0x1401e09a0
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
sub rsp, 0x450
mov rax, qword [0x14041f010]
xor rax, rsp
mov qword [rsp + 0x440], rax
movsxd rbp, edx
mov rsi, rcx
lea rdx, [rsp + 0x20]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
test eax, eax
je 0x1401e0a8e
mov r8d, 0x104
lea rdx, [rsp + 0x230]
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetLongPathNameW]
test eax, eax
je 0x1401e0a4b
xor edx, edx
lea rcx, [rsp + 0x230]
call fcn.140321ea0
mov rdi, rax
mov rbx, rbp
mov rax, 0xffffffffffffffff
nop dword [rax + rax]
inc rax
cmp byte [rdi + rax], 0
jne 0x1401e0a20
cmp rax, rbx
jb 0x1401e0a46
test rdi, rdi
je 0x1401e0a4b
cmp dword [0x14045b3f8], 0
jne 0x1401e0a4b
mov rcx, rdi
call fcn.140005660
jmp 0x1401e0a4b
test rdi, rdi
jne 0x1401e0a62
xor edx, edx
lea rcx, [rsp + 0x20]
call fcn.140321ea0
mov rdi, rax
test rax, rax
je 0x1401e0a8e
mov rbx, rbp
lea r8, [rbx - 1]
mov rdx, rdi
mov rcx, rsi
call fcn.140013650
cmp dword [0x14045b3f8], 0
mov byte [rsi + rbx - 1], 0
jne 0x1401e0a87
mov rcx, rdi
call fcn.140005660
mov eax, 1
jmp 0x1401e0a90
xor eax, eax
mov rcx, qword [rsp + 0x440]
xor rcx, rsp
call fcn.140001200
mov rbx, qword [rsp + 0x480]
add rsp, 0x450
pop rdi
pop rsi
pop rbp
ret
Function at 0x1401e0e60
Capabilities:
Set file attributes

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov esi, edx
mov rdi, rcx
xor edx, edx
call fcn.140321ad0
mov rbx, rax
test rax, rax
je 0x1401e0efa
mov edx, esi
mov rcx, rax
call fcn.14001a5d8
cmp dword [0x14045b3f8], 0
mov esi, eax
jne 0x1401e0ea0
mov rcx, rbx
call fcn.140005660
cmp esi, 0xffffffff
je 0x1401e0efa
mov rcx, rdi
call fcn.1401d9990
mov ebx, eax
cmp eax, 0xffffffff
je 0x1401e0ee5
xor edx, edx
mov rcx, rdi
call fcn.140321ad0
mov rdi, rax
test rax, rax
je 0x1401e0ee5
or ebx, 0x20
mov rcx, rax
mov edx, ebx
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
cmp dword [0x14045b3f8], 0
jne 0x1401e0ee5
mov rcx, rdi
call fcn.140005660
mov eax, 1
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov rbx, qword [rsp + 0x30]
xor eax, eax
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret

Function at 0x1401e0f20
Capabilities:
Delete file
Get file attributes
Set file attributes

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
xor edx, edx
mov rdi, rcx
call fcn.140321ad0
mov rsi, rax
test rax, rax
je 0x1401e0f8e
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp dword [0x14045b3f8], 0
mov ebx, eax
jne 0x1401e0f5d
mov rcx, rsi
call fcn.140005660
cmp ebx, 0xffffffff
je 0x1401e0f8e
shr ebx, 4
bt ebx, 0
jae 0x1401e0f8e
mov rcx, rdi
call fcn.1401e1160
test eax, eax
je 0x1401e0f8e
mov rcx, rdi
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
jmp fcn.1401e0180
xor edx, edx
mov rcx, rdi
call fcn.140321ad0
mov rbx, rax
test rax, rax
je 0x1401e0fbf
mov edx, 0x80
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
cmp dword [0x14045b3f8], 0
jne 0x1401e0fbf
mov rcx, rbx
call fcn.140005660
xor edx, edx
mov rcx, rdi
call fcn.140321ad0
mov rdi, rax
test rax, rax
jne 0x1401e0fe4
lea eax, [rdi - 1]
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
neg eax
sbb ebx, ebx
neg ebx
cmp dword [0x14045b3f8], 0
jne 0x1401e1004
mov rcx, rdi
call fcn.140005660
mov rsi, qword [rsp + 0x40]
lea eax, [rbx - 1]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x1401e1020
Capabilities:
Get file attributes

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
xor edx, edx
call fcn.140321ad0
mov rdi, rax
test rax, rax
je 0x1401e106d
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp dword [0x14045b3f8], 0
mov ebx, eax
jne 0x1401e1055
mov rcx, rdi
call fcn.140005660
cmp ebx, 0xffffffff
je 0x1401e106d
shr ebx, 4
and ebx, 1
mov eax, ebx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
mov rbx, qword [rsp + 0x30]
xor eax, eax
add rsp, 0x20
pop rdi
ret
Function at 0x1401f0af0
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
cmp dword [rdx + 0xf0], 0
mov rsi, r8
mov rbx, rdx
mov rdi, rcx
jne 0x1401f0b3b
lea r9, [rdx + 0xf8]
xor r8d, r8d
add rdx, 0x180
xor ecx, ecx
call fcn.140073e00
test eax, eax
je 0x1401f0b3b
mov rcx, rbx
mov dword [rdi], 1
call fcn.1401f0c10
cmp dword [rbx + 0xf0], 0
jne 0x1401f0b52
test rsi, rsi
je 0x1401f0b6d
cmp dword [rsi + 0xf0], 0
je 0x1401f0b6d
inc dword [rbx + 0x100]
lea rcx, [rdi + 0x10]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov qword [rbx + 0x118], 0
lea rcx, [rdi + 8]
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp fcn.1401f0b90
Function at 0x140237300
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push rbx
sub rsp, 0x20
mov dword [0x140463664], 0
mov rbx, rdx
test ecx, ecx
je 0x14023731c
cmp ecx, 0x22
jne 0x140237328
mov rax, qword [0x140463670]
test rax, rax
jne 0x14023738d
lea eax, [rcx - 0x30]
cmp eax, 0xa
jb 0x14023737d
lea eax, [rcx - 0x61]
cmp eax, 0x1a
jae 0x14023733d
lea eax, [rcx - 0x57]
jmp 0x14023737d
lea eax, [rcx - 0x41]
cmp eax, 0x1a
jae 0x140237354
lea eax, [rcx - 0x37]
mov dword [0x140463664], 1
jmp 0x14023737d
cmp ecx, 0x2d
jne 0x14023735e
lea eax, [rcx - 9]
jmp 0x14023737d
cmp dword [0x140469ca0], 0
je 0x14023737b
cmp ecx, 0x2a
jne 0x140237371
lea eax, [rcx - 5]
jmp 0x14023737d
cmp ecx, 0x2b
jne 0x14023737b
lea eax, [rcx - 6]
jmp 0x14023737d
xor eax, eax
cdqe
lea rcx, [0x140463690]
shl rax, 5
add rax, rcx
mov ecx, dword [rax + 8]
mov qword [0x140463668], rax
call fcn.140236150
cmp dword [0x14045b3f8], 0
mov rax, qword [0x140463668]
movups xmm0, xmmword [rbx]
movups xmmword [rax], xmm0
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [rax + 0x10], xmm1
jne 0x1402373c9
mov rcx, rbx
call fcn.140005660
mov rax, qword [0x140463668]
lea rcx, [0x140463b30]
cmp rax, rcx
jne 0x140237429
cmp dword [0x140469ca0], 0
je 0x140237429
cmp dword [0x140469ca4], 0
jne 0x1402373f1
mov dword [0x140469ca4], 0
cmp dword [0x1404334f0], 0
jne 0x140237418
mov eax, dword [0x14045b5c8]
test al, 2
jne 0x140237408
test al, 1
je 0x140237418
mov dword [0x14045eb68], 1
add rsp, 0x20
pop rbx
ret
lea rcx, [0x140469ca0]
add rsp, 0x20
pop rbx
jmp fcn.140322110
add rsp, 0x20
pop rbx
ret