joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140032f20
Capabilities:
Create process on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x2f0
mov rax, qword [0x1400ad368]
xor rax, rsp
mov qword [rsp + 0x2e0], rax
mov rdi, rcx
mov ebx, 0x104
mov edx, ebx
lea rcx, [rsp + 0xd0]
call fcn.1400251f0
lea rax, [rsp + 0xd0]
mov rdx, 0xffffffffffffffff
nop word [rax + rax]
inc rdx
cmp word [rax + rdx*2], 0
jne 0x140032f70
lea rax, [rdx + 1]
xor esi, esi
cmp rax, rbx
jae 0x140032fca
lea rax, [rdx + 0xb]
lea r8, str.eeclnt.exe
lea rcx, [rsp + 0xd0]
cmp rax, rbx
ja 0x140032fa7
mov rdx, rbx
call fcn.140069860
jmp 0x140032fca
lfence
sub rbx, rdx
lea rcx, [rcx + rdx*2]
mov r9d, 0x103
sub r9, rdx
mov rdx, rbx
call fcn.14005a91c
mov word [rsp + 0x2d6], si
xorps xmm0, xmm0
lea rax, str.runas
movups xmmword [rsp + 0x60], xmm0
mov qword [rsp + 0x60], rax
lea rax, [rsp + 0xd0]
movups xmmword [rsp + 0x50], xmm0
lea rcx, [rsp + 0x50]
mov qword [rsp + 0x68], rax
movups xmmword [rsp + 0x70], xmm0
mov dword [rsp + 0x50], 0x70
movups xmmword [rsp + 0x80], xmm0
mov dword [rsp + 0x54], 0x440
movups xmmword [rsp + 0x90], xmm0
movups xmmword [rsp + 0xa0], xmm0
movups xmmword [rsp + 0xb0], xmm0
call qword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
je 0x1400330d3
nop dword [rax + rax]
mov rcx, qword [rdi + 8]
test rcx, rcx
je 0x1400330c5
mov rax, qword [rcx]
lea rdx, [rsp + 0xc0]
mov qword [rsp + 0x40], rsi
xor r9d, r9d
mov qword [rsp + 0x38], rdx
xor r8d, r8d
mov qword [rsp + 0x30], rsi
xor edx, edx
mov rax, qword [rax + 0x20]
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rsi
call qword [case.0x14001a4f5.0]
mov ebx, eax
cmp eax, 4
je 0x14003308b
cmp eax, 1
jne 0x1400330a5
mov rcx, qword [rsp + 0xb8]
mov edx, 0x3e8
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
je 0x140033040
mov rcx, qword [rsp + 0xb8]
call qword [0x1400ad090]
test ebx, ebx
je 0x1400330c1
cmp ebx, 3
je 0x1400330c1
cmp ebx, 0xc
jne 0x1400330d3
mov al, 1
jmp 0x1400330d5
mov rcx, qword [rsp + 0xb8]
call qword [0x1400ad090]
xor al, al
mov rcx, qword [rsp + 0x2e0]
xor rcx, rsp
call fcn.140050ca0
lea r11, [rsp + 0x2f0]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x140033100
Capabilities:
Compare security identifiers

Disassembly:
push rbp
push rdi
push r14
lea rbp, [rsp - 0x47]
sub rsp, 0xa0
mov rax, qword [0x1400ad368]
xor rax, rsp
mov qword [rbp + 0x2f], rax
mov edi, dword [0x1400b0ec0]
mov r14, rcx
mov qword [rsp + 0x90], r15
mov r15d, edx
test edi, edi
jne 0x14003330b
call qword [0x1400ad2a8]
test eax, eax
je 0x14003314f
mov edi, 1
jmp 0x140033305
mov qword [rsp + 0xc0], rbx
mov qword [rsp + 0xd0], r12
mov qword [rsp + 0x98], r13
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea r8, [rbp + 0xf]
mov edx, 8
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
mov edi, 2
test eax, eax
je 0x1400332ed
mov r12, qword [rbp + 0xf]
lea rax, [rbp + 0x17]
xor ebx, ebx
mov dword [rbp + 0x27], 0
mov rcx, r12
mov word [rbp + 0x2b], 0x500
lea r9d, [rdi + 2]
mov qword [rbp + 0x1f], rbx
lea r8, [rbp + 0x1b]
mov qword [rsp + 0x20], rax
lea edx, [rdi + 0x10]
xor r13b, r13b
call qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
je 0x1400332e3
cmp dword [rbp + 0x17], 4
jb 0x1400332e3
cmp dword [rbp + 0x1b], 3
jne 0x1400332e3
lea rax, [rbp + 7]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov edx, edi
mov rcx, r12
call qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
jne 0x1400332e3
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x1400332cd
mov ecx, dword [rbp + 7]
mov qword [rsp + 0xc8], rsi
call fcn.1400575d4
mov rsi, rax
test rax, rax
je 0x1400332c5
mov r9d, dword [rbp + 7]
lea rax, [rbp + 7]
mov r8, rsi
mov qword [rsp + 0x20], rax
mov edx, edi
mov rcx, r12
call qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
je 0x1400332bd
lea rax, [rbp + 0x1f]
mov r9d, 0x220
mov qword [rsp + 0x50], rax
lea r8d, [rdi + 0x1e]
mov dword [rsp + 0x48], ebx
lea rcx, [rbp + 0x27]
mov dword [rsp + 0x40], ebx
movzx edx, dil
mov dword [rsp + 0x38], ebx
mov dword [rsp + 0x30], ebx
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], ebx
call qword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
je 0x1400332bd
cmp dword [rsi], ebx
jbe 0x1400332b3
nop dword [rax]
mov rdx, qword [rbp + 0x1f]
mov ecx, ebx
add rcx, rcx
mov rcx, qword [rsi + rcx*8 + 8]
call qword [sym.imp.ADVAPI32.dll_EqualSid]
test eax, eax
jne 0x1400332b0
inc ebx
cmp ebx, dword [rsi]
jb 0x140033290
jmp 0x1400332b3
mov r13b, 1
mov rcx, qword [rbp + 0x1f]
call qword [sym.imp.ADVAPI32.dll_FreeSid]
mov rcx, rsi
call fcn.1400575c0
mov rsi, qword [rsp + 0xc8]
mov rcx, qword [rbp + 0xf]
call qword [0x1400ad090]
test r13b, r13b
je 0x1400332ed
mov edi, 3
jmp 0x1400332ed
mov rcx, qword [rbp + 0xf]
call qword [0x1400ad090]
mov r12, qword [rsp + 0xd0]
mov rbx, qword [rsp + 0xc0]
mov r13, qword [rsp + 0x98]
mov dword [0x1400b0ec0], edi
mov rcx, qword [r14]
test r15b, 2
je 0x140033320
lea eax, [rdi - 2]
cmp eax, 1
ja 0x140033320
mov rcx, qword [r14 + 8]
test r15b, 4
je 0x14003332f
cmp edi, 2
jne 0x14003332f
mov rcx, qword [r14 + 8]
test r15b, 8
mov r15, qword [rsp + 0x90]
je 0x140033348
cmp edi, 4
jne 0x140033348
mov rax, qword [r14 + 8]
jmp 0x14003334b
mov rax, rcx
mov rcx, qword [rbp + 0x2f]
xor rcx, rsp
call fcn.140050ca0
add rsp, 0xa0
pop r14
pop rdi
pop rbp
ret
Function at 0x1400345d0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov edi, r8d
mov rsi, rdx
mov rbp, rcx
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
je 0x140034648
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rbx, rax
test rax, rax
je 0x140034648
mov rdx, rsi
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, eax
add rcx, rbx
and edi, 0xf
jbe 0x140034635
nop
cmp rbx, rcx
jae 0x140034648
movzx eax, word [rbx]
lea rbx, [rbx + rax*2]
add rbx, 2
add edi, 0xffffffff
jne 0x140034620
cmp rbx, rcx
jae 0x140034648
cmp word [rbx], 0
je 0x140034648
lfence
mov rax, rbx
jmp 0x14003464a
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x140049e10
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
cmp byte [rcx + 0x478], 0
movzx edi, dl
mov rbx, rcx
je 0x140049e3c
cmp word [rcx + 0x436], 0
jne 0x140049e3c
cmp byte [rcx + 0x469], 0
je 0x140049e67
mov r8, qword [0x1400b0e60]
mov r9, 0xffffffffffffffff
nop word [rax + rax]
inc r9
cmp word [r8 + r9*2], 0
jne 0x140049e50
mov rdx, qword [rcx + 0x450]
call fcn.14004a010
movzx eax, word [rbx + 0x438]
xor ecx, ecx
inc ax
mov word [rbx + 0x436], cx
mov word [rbx + 0x438], ax
mov byte [rbx + 0x478], cl
cmp byte [rbx], cl
je 0x140049e94
test dil, dil
jne 0x140049e94
mov word [rbx + 4], cx
cmp word [rbx + 0x476], ax
jg 0x140049ed7
mov rax, qword [0x1400b0dd0]
cmp byte [rax + 0x4b1], cl
jne 0x140049ed0
cmp dword [rax + 0x38], 2
jne 0x140049ed0
mov rax, qword [rbx + 0x440]
cmp dword [rax + 0x18], ecx
je 0x140049ed0
mov rcx, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp fcn.140049320
mov word [rbx + 0x438], cx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x14004a010
Capabilities:
Write file on windows

Disassembly:
push rbx
push r12
push r13
push r14
push r15
sub rsp, 0x40
cmp byte [rcx + 0x469], 0
mov r14, r9
mov r12, r8
mov r15, rdx
mov r13, rcx
jne 0x14004a05a
xor ebx, ebx
xor r9d, r9d
mov r8d, r14d
mov qword [rsp + 0x20], rbx
mov rdx, r12
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_WriteConsoleW]
add rsp, 0x40
pop r15
pop r14
pop r13
pop r12
pop rbx
ret
mov rax, qword gs:[0x58]
mov qword [rsp + 0x78], rbp
lea rbp, [r9*2 + 2]
mov edx, 4
mov qword [rsp + 0x80], rsi
mov rcx, qword [rax]
mov eax, dword [rdx + rcx]
cmp dword [0x1400b0efc], eax
jg 0x14004a18c
mov rcx, qword [0x1400ae070]
lea rsi, [0x1400ae060]
cmp rcx, rbp
jae 0x14004a107
mov rdx, qword [0x1400ae078]
mov qword [rsp + 0x88], rdi
mov rax, rdx
mov rdi, rbp
sub rax, rcx
sub rdi, rcx
cmp rdi, rax
ja 0x14004a0ee
cmp rdx, 0x10
mov qword [0x1400ae070], rbp
mov rbx, rsi
mov r8, rdi
cmovae rbx, qword [0x1400ae060]
xor edx, edx
add rbx, rcx
mov rcx, rbx
call fcn.1400538a0
mov byte [rbx + rdi], 0
jmp 0x14004a0ff
lfence
mov r9, rdi
mov rdx, rdi
mov rcx, rsi
call fcn.140002e00
mov rdi, qword [rsp + 0x88]
cmp qword [0x1400ae078], 0x10
mov rax, rsi
mov ecx, dword [r13 + 0x46c]
mov r9d, r14d
cmovae rax, qword [0x1400ae060]
mov r8, r12
xor ebx, ebx
xor edx, edx
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], ebp
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov rbp, qword [rsp + 0x78]
test eax, eax
je 0x14004a176
cmp qword [0x1400ae078], 0x10
lea r9, [rsp + 0x70]
mov r8d, eax
mov qword [rsp + 0x20], rbx
cmovae rsi, qword [0x1400ae060]
mov rcx, r15
mov rdx, rsi
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rsi, qword [rsp + 0x80]
add rsp, 0x40
pop r15
pop r14
pop r13
pop r12
pop rbx
ret
lea rcx, [0x1400b0efc]
call fcn.140050e58
cmp dword [0x1400b0efc], 0xffffffff
jne 0x14004a08f
lea rcx, [0x14007ecf0]
call fcn.1400511a0
lea rcx, [0x1400b0efc]
call fcn.140050df8
jmp 0x14004a08f
Function at 0x14004b440
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
mov eax, 0x2050
call fcn.14007bbc0
sub rsp, rax
mov rax, qword [0x1400ad368]
xor rax, rsp
mov qword [rsp + 0x2040], rax
mov rsi, rcx
lea rdi, [rcx + 0x24]
mov rcx, qword [rcx + 0x10]
lea r9, [rsp + 0x30]
xor ebp, ebp
lea rdx, [rsp + 0x40]
mov r8d, 0x2000
mov dword [rsp + 0x30], ebp
mov qword [rsp + 0x20], rbp
call qword [sym.imp.KERNEL32.dll_ReadFile]
lea rbx, [rbp - 1]
test eax, eax
je 0x14004b4e1
xor edx, edx
lea r8, [rsp + 0x40]
xor ecx, ecx
mov r9d, ebx
test rdi, rdi
je 0x14004b4d0
mov dword [rsp + 0x28], 0x2000
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov word [rdi + 0x3ffe], bp
jmp 0x14004b4e4
mov dword [rsp + 0x28], ebp
mov qword [rsp + 0x20], rbp
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
jmp 0x14004b4e4
mov word [rdi], bp
inc rbx
cmp word [rdi + rbx*2], bp
jne 0x14004b4e4
mov dword [rsi + 0x1c], ebx
mov dword [rsi + 0x18], ebx
mov rcx, qword [rsp + 0x2040]
xor rcx, rsp
call fcn.140050ca0
lea r11, [rsp + 0x2050]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret

Function at 0x14004c330
Capabilities:
Manipulate console buffer

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x50
mov rax, qword [0x1400ad368]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov eax, dword [rcx + 0x18]
mov rbx, rcx
mov ecx, dword [rcx + 0x1c]
movzx edi, dx
mov r8d, ecx
cmp eax, ecx
jne 0x14004c366
inc eax
mov dword [rbx + 0x18], eax
jmp 0x14004c447
cmp dword [rbx + 0x4044], 0x32
je 0x14004c447
cmp eax, ecx
je 0x14004c447
mov rcx, qword [rbx + 8]
lea rdx, [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_GetConsoleScreenBufferInfo]
movsxd rcx, dword [rbx + 0x1c]
lea rdx, [rbx + 0x24]
mov eax, dword [rbx + 0x18]
sub eax, ecx
movsxd r8, eax
lea eax, [rcx + 1]
movsxd r9, eax
lea rdx, [rdx + rcx*2]
lea rcx, [rbx + 0x24]
lea rcx, [rcx + r9*2]
add r8, r8
je 0x14004c3f4
test rcx, rcx
jne 0x14004c3c8
call fcn.14005e998
mov dword [rax], 0x16
call fcn.1400577f0
jmp 0x14004c3f4
test rdx, rdx
je 0x14004c3b6
mov eax, 0x2000
sub rax, r9
add rax, rax
cmp rax, r8
jae 0x14004c3ef
call fcn.14005e998
mov dword [rax], 0x22
call fcn.1400577f0
jmp 0x14004c3f4
call fcn.140053490
movsxd rax, dword [rbx + 0x1c]
lea r9, [rsp + 0x20]
mov dword [rsp + 0x20], 0xffffffff
mov ecx, 0x20
mov word [rbx + rax*2 + 0x24], cx
mov rcx, rbx
mov eax, dword [rsp + 0x20]
inc dword [rbx + 0x18]
mov r8d, dword [rbx + 0x18]
mov dword [rsp + 0x20], eax
movsxd rax, dword [rbx + 0x1c]
sub r8d, eax
add rax, 0x12
lea rdx, [rbx + rax*2]
call fcn.14004e140
mov edx, dword [rsp + 0x20]
mov rcx, qword [rbx + 8]
call qword [sym.imp.KERNEL32.dll_SetConsoleCursorPosition]
mov r8d, dword [rbx + 0x1c]
movsxd rdx, r8d
lea eax, [r8 + 1]
add rdx, 0x12
mov dword [rbx + 0x1c], eax
xor r9d, r9d
mov word [rbx + rdx*2], di
lea rdx, [rbx + rdx*2]
mov rcx, rbx
lea r8d, [r9 + 1]
call fcn.14004e140
mov edx, 1
mov rcx, rbx
call fcn.14004e080
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.140050ca0
mov rbx, qword [rsp + 0x68]
add rsp, 0x50
pop rdi
ret
Function at 0x14004c4a0
Capabilities:
Manipulate console buffer

Disassembly:
mov r8, rcx
mov rcx, qword [rcx + 0x4060]
test rcx, rcx
je 0x14004c502
movsxd rdx, dword [r8 + 0x4078]
cmp rdx, rcx
jl 0x14004c4c5
lea edx, [rcx - 1]
mov dword [r8 + 0x4078], edx
mov rax, qword [r8 + 0x4058]
movsxd r9, dword [r8 + 0x1c]
movsxd rcx, edx
mov rdx, qword [rax + rcx*8]
mov rax, 0xffffffffffffffff
nop
inc rax
cmp word [rdx + rax*2], 0
jne 0x14004c4e0
cmp r9, rax
jae 0x14004c502
cmp r9d, dword [r8 + 0x18]
jne 0x14004c502
movzx edx, word [rdx + r9*2]
mov rcx, r8
jmp fcn.14004c330
mov eax, dword [r8 + 0x1c]
cmp dword [r8 + 0x18], eax
jle 0x14004c51f
inc eax
mov edx, 1
mov rcx, r8
mov dword [r8 + 0x1c], eax
jmp fcn.14004e080
ret
Function at 0x14004dfa0
Capabilities:
Manipulate console buffer

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
movsxd rcx, dword [rcx + 0x1c]
mov eax, dword [rbx + 0x18]
sub eax, ecx
je 0x14004e078
movsxd r8, eax
mov r9, rcx
lea eax, [rcx + 1]
movsxd rdx, eax
lea rcx, [rbx + 0x24]
lea rcx, [rcx + r9*2]
lea rdx, [rdx + 0x12]
lea rdx, [rbx + rdx*2]
add r8, r8
je 0x14004e01c
test rcx, rcx
jne 0x14004dff0
call fcn.14005e998
mov dword [rax], 0x16
call fcn.1400577f0
jmp 0x14004e01c
test rdx, rdx
je 0x14004dfde
mov eax, 0x2000
sub rax, r9
add rax, rax
cmp rax, r8
jae 0x14004e017
call fcn.14005e998
mov dword [rax], 0x22
call fcn.1400577f0
jmp 0x14004e01c
call fcn.140053490
movsxd rax, dword [rbx + 0x18]
lea r9, [rsp + 0x30]
mov dword [rsp + 0x30], 0xffffffff
mov ecx, 0x20
mov word [rbx + rax*2 + 0x22], cx
mov rcx, rbx
mov eax, dword [rsp + 0x30]
mov r8d, dword [rbx + 0x18]
mov dword [rsp + 0x30], eax
movsxd rax, dword [rbx + 0x1c]
sub r8d, eax
add rax, 0x12
lea rdx, [rbx + rax*2]
call fcn.14004e140
mov edx, dword [rsp + 0x30]
mov rcx, qword [rbx + 8]
call qword [sym.imp.KERNEL32.dll_SetConsoleCursorPosition]
mov eax, dword [rbx + 0x18]
xor edx, edx
test eax, eax
lea ecx, [rax - 1]
cmove ecx, edx
mov dword [rbx + 0x18], ecx
add rsp, 0x20
pop rbx
ret

Function at 0x14004e080
Capabilities:
Manipulate console buffer

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x40
mov rax, qword [0x1400ad368]
xor rax, rsp
mov qword [rsp + 0x38], rax
movzx ebx, dx
mov rdi, rcx
mov rcx, qword [rcx + 8]
lea rdx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetConsoleScreenBufferInfo]
movzx r9d, word [rsp + 0x24]
movsx r11d, word [rsp + 0x20]
add r9w, bx
movsx ecx, r9w
mov eax, ecx
mov word [rsp + 0x24], r9w
cdq
idiv r11d
mov r10d, eax
mov eax, ecx
movzx ecx, word [rsp + 0x26]
cdq
idiv r11d
xor eax, eax
cmp ax, r9w
jle 0x14004e0f4
lea r9d, [r11 + rdx]
dec r10w
mov word [rsp + 0x24], r9w
jmp 0x14004e103
cmp r9w, r11w
jl 0x14004e112
movzx r9d, dx
mov word [rsp + 0x24], dx
add cx, r10w
mov word [rsp + 0x26], cx
cmp r9w, r11w
jge 0x14004e127
cmp cx, word [rsp + 0x22]
jge 0x14004e127
mov edx, dword [rsp + 0x24]
mov rcx, qword [rdi + 8]
call qword [sym.imp.KERNEL32.dll_SetConsoleCursorPosition]
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.140050ca0
mov rbx, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret
Function at 0x14004e140
Capabilities:
Manipulate console buffer

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r15
sub rsp, 0x78
mov rax, qword [0x1400ad368]
xor rax, rsp
mov qword [rsp + 0x68], rax
test r9, r9
mov dword [rsp + 0x30], 0xffffffff
mov eax, dword [rsp + 0x30]
lea rbx, [rsp + 0x34]
mov r12, rdx
movsxd r15, r8d
mov rbp, rcx
mov dword [rsp + 0x34], eax
mov rcx, qword [rcx + 8]
lea rdx, [rsp + 0x50]
cmovne rbx, r9
mov edi, 0xffffffff
call qword [sym.imp.KERNEL32.dll_GetConsoleScreenBufferInfo]
mov rcx, qword [rbp + 8]
lea rdx, [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_GetConsoleScreenBufferInfo]
test rbx, rbx
je 0x14004e1c2
cmp di, word [rbx]
jne 0x14004e1bc
cmp di, word [rbx + 2]
jne 0x14004e1bc
mov eax, dword [rsp + 0x3c]
mov dword [rbx], eax
jmp 0x14004e1c2
mov eax, dword [rbx]
mov dword [rsp + 0x3c], eax
movsx r10d, word [rsp + 0x38]
movzx r8d, r15w
add r8w, word [rsp + 0x3c]
xor esi, esi
movzx edi, word [rsp + 0x3e]
movsx ecx, r8w
mov eax, ecx
cdq
idiv r10d
mov r9d, eax
mov eax, ecx
cdq
idiv r10d
cmp si, r8w
jle 0x14004e1fc
dec r9w
lea r8d, [r10 + rdx]
jmp 0x14004e206
cmp r8w, r10w
jl 0x14004e214
movzx r8d, dx
add di, r9w
cmp r8w, r10w
jge 0x14004e295
cmp di, word [rsp + 0x3a]
jge 0x14004e295
mov rsi, r15
mov qword [rsp + 0x70], r14
add rsi, rsi
mov rcx, rsi
call fcn.1400575d4
mov r14, rax
test rax, rax
je 0x14004e271
test r15d, r15d
jle 0x14004e24c
movzx eax, word [rsp + 0x58]
mov rdi, r14
shr rsi, 1
mov rcx, rsi
rep stosw word [rdi], ax
mov r9d, dword [rbx]
lea rax, [rsp + 0x30]
mov rcx, qword [rbp + 8]
mov r8d, r15d
mov rdx, r14
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_WriteConsoleOutputAttribute]
mov rcx, r14
call fcn.1400575c0
mov r9d, dword [rbx]
lea rax, [rsp + 0x30]
mov rcx, qword [rbp + 8]
mov r8d, r15d
mov rdx, r12
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_WriteConsoleOutputCharacterW]
mov r14, qword [rsp + 0x70]
jmp 0x14004e2f1
mov edx, dword [rbx]
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_SetConsoleCursorPosition]
mov rcx, qword [rbp + 8]
lea r9, [rsp + 0x30]
mov r8d, r15d
mov qword [rsp + 0x20], rsi
mov rdx, r12
call qword [sym.imp.KERNEL32.dll_WriteConsoleW]
sub di, word [rsp + 0x52]
movzx eax, word [rbx + 2]
inc di
sub word [rbp + 0x4032], di
movzx ecx, word [rbx + 2]
sub word [rsp + 0x56], di
cmp ax, cx
jne 0x14004e2e3
sub cx, di
mov word [rbx + 2], cx
mov edx, dword [rsp + 0x54]
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_SetConsoleCursorPosition]
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.140050ca0
add rsp, 0x78
pop r15
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x14004e720
Capabilities:
Manipulate console buffer

Disassembly:
push rsi
sub rsp, 0x40
movsxd rax, dword [rcx + 0x4078]
mov rsi, rcx
cmp rax, qword [rcx + 0x4060]
jge 0x14004e82c
mov r9d, dword [rcx + 0x4030]
lea rax, [rsp + 0x50]
mov r8d, dword [rcx + 0x18]
mov edx, 0x20
mov rcx, qword [rcx + 8]
mov qword [rsp + 0x58], rbx
mov qword [rsp + 0x60], rbp
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], r14
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_FillConsoleOutputCharacterW]
mov edx, dword [rsi + 0x4030]
mov rcx, qword [rsi + 8]
call qword [sym.imp.KERNEL32.dll_SetConsoleCursorPosition]
movsxd rcx, dword [rsi + 0x4078]
xor edi, edi
mov qword [rsi + 0x18], rdi
mov rbx, 0xffffffffffffffff
mov rax, qword [rsi + 0x4058]
mov r8, qword [rax + rcx*8]
mov rax, rbx
nop word [rax + rax]
inc rax
cmp word [r8 + rax*2], di
jne 0x14004e7b0
lfence
mov edx, 0x2000
lea rcx, [rsi + 0x24]
cmp rax, rdx
jae 0x14004e7d2
call fcn.140069780
jmp 0x14004e7e4
mov r9d, 0x1fff
call fcn.14005a91c
mov word [rsi + 0x4022], di
inc rbx
cmp word [rsi + rbx*2 + 0x24], di
jne 0x14004e7e4
movsx edi, bx
lea r9, [rsi + 0x4030]
mov r8d, edi
lea rdx, [rsi + 0x24]
mov rcx, rsi
call fcn.14004e140
movzx edx, bx
mov rcx, rsi
call fcn.14004e080
mov r14, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x58]
mov dword [rsi + 0x18], edi
mov dword [rsi + 0x1c], edi
mov rdi, qword [rsp + 0x38]
add rsp, 0x40
pop rsi
ret
Function at 0x14004e970
Capabilities:
Manipulate console buffer

Disassembly:
push rbx
push rdi
push r15
sub rsp, 0x40
movzx ebx, dl
xor r15d, r15d
mov edx, dword [rcx + 0x40b8]
mov rdi, rcx
cmp edx, 0xffffffff
jne 0x14004e9d5
movsxd rax, dword [rcx + 0x1c]
mov word [rcx + rax*2 + 0x24], r15w
call fcn.140037330
cmp qword [rdi + 0x40a0], r15
je 0x14004e9cb
lea rcx, [rdi + 0x24]
call fcn.140069074
mov qword [rsp + 0x70], rax
test rax, rax
je 0x14004e9cb
lea rcx, [rdi + 0x4090]
xor edx, edx
lea r8, [rsp + 0x70]
call fcn.14004af20
mov dword [rdi + 0x40b8], r15d
mov edx, r15d
mov rcx, qword [rdi + 0x40a0]
test rcx, rcx
je 0x14004eb04
mov qword [rsp + 0x68], rbp
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x30], r14
test bl, bl
jne 0x14004ea00
lea eax, [rdx + 1]
cdq
idiv ecx
jmp 0x14004ea07
test edx, edx
cmovle edx, ecx
dec edx
mov r9d, dword [rdi + 0x4030]
lea rax, [rsp + 0x60]
mov r8d, dword [rdi + 0x18]
mov rcx, qword [rdi + 8]
mov dword [rdi + 0x40b8], edx
mov edx, 0x20
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_FillConsoleOutputCharacterW]
mov edx, dword [rdi + 0x4030]
mov rcx, qword [rdi + 8]
call qword [sym.imp.KERNEL32.dll_SetConsoleCursorPosition]
mov qword [rdi + 0x18], r15
mov rsi, 0xffffffffffffffff
mov rax, qword [rdi + 0x4098]
mov r8, qword [rax]
mov rax, rsi
nop dword [rax]
inc rax
cmp word [r8 + rax*2], r15w
jne 0x14004ea60
lfence
mov edx, 0x2000
lea rcx, [rdi + 0x24]
cmp rax, rdx
jae 0x14004ea82
call fcn.140069780
jmp 0x14004ea95
mov r9d, 0x1fff
call fcn.14005a91c
mov word [rdi + 0x4022], r15w
movsxd rax, dword [rdi + 0x40b8]
test eax, eax
je 0x14004eac0
mov r8, qword [rdi + 0x4098]
lea rcx, [rdi + 0x24]
mov edx, 0x2000
mov r8, qword [r8 + rax*8]
call fcn.140047f20
nop dword [rax]
inc rsi
cmp word [rdi + rsi*2 + 0x24], r15w
jne 0x14004eac0
movsx ebx, si
lea r9, [rdi + 0x4030]
mov r8d, ebx
lea rdx, [rdi + 0x24]
mov rcx, rdi
call fcn.14004e140
movzx edx, si
mov rcx, rdi
call fcn.14004e080
mov r14, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x68]
mov dword [rdi + 0x18], ebx
mov dword [rdi + 0x1c], ebx
add rsp, 0x40
pop r15
pop rdi
pop rbx
ret
Function at 0x14007084c
Capabilities:
Read file on windows

Disassembly:
sub rsp, 0x28
mov rdx, rcx
test rcx, rcx
jne 0x140070829
call fcn.14005e998
mov dword [rax], 0x16
call fcn.1400577f0
or eax, 0xffffffff
jmp 0x140070846
sub dword [rcx + 0x10], 1
jns 0x140070838
add rsp, 0x28
jmp 0x140078800
mov rax, qword [rcx]
movzx ecx, byte [rax]
inc rax
mov qword [rdx], rax
mov eax, ecx
add rsp, 0x28
ret
jmp 0x140070808
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push r14
sub rsp, 0x20
mov rdi, rcx
test rcx, rcx
jne 0x140078832
call fcn.14005e998
mov dword [rax], 0x16
call fcn.1400577f0
jmp 0x14007894f
mov eax, dword [rcx + 0x14]
shr eax, 0xd
test al, 1
je 0x14007894f
mov eax, dword [rcx + 0x14]
shr eax, 0xc
test al, 1
jne 0x14007894f
mov eax, dword [rcx + 0x14]
shr eax, 1
test al, 1
je 0x140078861
lock or dword [rcx + 0x14], 0x10
jmp 0x14007894f
lock or dword [rcx + 0x14], 1
mov eax, dword [rcx + 0x14]
test eax, 0x4c0
jne 0x140078875
call fcn.140078974
mov rbx, qword [rdi + 8]
mov rcx, rdi
mov qword [rdi], rbx
call fcn.1400701e4
mov r8d, dword [rdi + 0x20]
mov ecx, eax
mov rdx, rbx
call fcn.140079768
mov dword [rdi + 0x10], eax
lea ecx, [rax + 1]
cmp ecx, 1
jbe 0x14007893d
mov eax, dword [rdi + 0x14]
or esi, 0xffffffff
test al, 6
jne 0x140078908
mov rcx, rdi
call fcn.1400701e4
cmp eax, esi
je 0x1400788f3
mov rcx, rdi
call fcn.1400701e4
cmp eax, 0xfffffffe
je 0x1400788f3
mov rcx, rdi
call fcn.1400701e4
movsxd rbx, eax
lea r14, [0x1400b0620]
mov rcx, rdi
sar rbx, 6
call fcn.1400701e4
and eax, 0x3f
lea rcx, [rax + rax*8]
mov rax, qword [r14 + rbx*8]
lea rdx, [rax + rcx*8]
jmp 0x1400788fa
lea rdx, [0x1400ad810]
mov al, byte [rdx + 0x38]
and al, 0x82
cmp al, 0x82
jne 0x140078908
lock or dword [rdi + 0x14], 0x20
cmp dword [rdi + 0x20], 0x200
jne 0x14007892c
mov eax, dword [rdi + 0x14]
shr eax, 6
test al, 1
je 0x14007892c
mov eax, dword [rdi + 0x14]
shr eax, 8
test al, 1
jne 0x14007892c
mov dword [rdi + 0x20], 0x1000
mov rax, qword [rdi]
add dword [rdi + 0x10], esi
movzx esi, byte [rax]
inc rax
mov qword [rdi], rax
jmp 0x140078952
neg eax
sbb eax, eax
and eax, 8
add eax, 8
lock or dword [rdi + 0x14], eax
and dword [rdi + 0x10], 0
or esi, 0xffffffff
mov rbx, qword [rsp + 0x30]
mov eax, esi
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x40]
add rsp, 0x20
pop r14
ret