joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400270a4
Capabilities:
Link many functions at runtime

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x40
mov ebp, r8d
mov r13, rdx
mov r14, rcx
call fcn.14001e304
xor ebx, ebx
mov rdi, rax
cmp qword [0x1400b5f88], rbx
jne 0x1400271aa
lea rcx, str.USER32.DLL
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rsi, rax
test rax, rax
je 0x14002727f
lea rdx, [0x1400394c0]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14002727f
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
lea rdx, [0x1400394b0]
mov rcx, rsi
mov qword [0x1400b5f88], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
lea rdx, [0x140039498]
mov rcx, rsi
mov qword [0x1400b5f90], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
lea rdx, str.GetUserObjectInformationA
mov rcx, rsi
mov qword [0x1400b5f98], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
mov r11, rax
mov qword [0x1400b5fa8], rax
test rax, rax
je 0x1400271a1
lea rdx, str.GetProcessWindowStation
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
mov qword [0x1400b5fa0], rax
jmp 0x1400271b1
mov rax, qword [0x1400b5fa0]
jmp 0x1400271b8
mov rax, qword [0x1400b5fa0]
mov r11, qword [0x1400b5fa8]
cmp rax, rdi
je 0x140027220
cmp r11, rdi
je 0x140027220
mov rcx, rax
call sub.KERNEL32.dll_DecodePointer
mov rcx, qword [0x1400b5fa8]
mov rsi, rax
call sub.KERNEL32.dll_DecodePointer
mov r12, rax
test rsi, rsi
je 0x140027220
test rax, rax
je 0x140027220
call rsi
test rax, rax
je 0x14002721a
lea rcx, [rsp + 0x88]
mov r9d, reloc.OLEAUT32.dll_VariantTimeToDosDateTime
lea r8, [rsp + 0x30]
mov qword [rsp + 0x20], rcx
lea edx, [r9 - 0xb]
mov rcx, rax
call r12
test eax, eax
je 0x14002721a
test byte [rsp + 0x38], 1
jne 0x140027220
bts ebp, 0x15
jmp 0x14002725e
mov rcx, qword [0x1400b5f90]
cmp rcx, rdi
je 0x14002725e
call sub.KERNEL32.dll_DecodePointer
test rax, rax
je 0x14002725e
call rax
mov rbx, rax
test rax, rax
je 0x14002725e
mov rcx, qword [0x1400b5f98]
cmp rcx, rdi
je 0x14002725e
call sub.KERNEL32.dll_DecodePointer
test rax, rax
je 0x14002725e
mov rcx, rbx
call rax
mov rbx, rax
mov rcx, qword [0x1400b5f88]
call sub.KERNEL32.dll_DecodePointer
test rax, rax
je 0x14002727f
mov r9d, ebp
mov r8, r13
mov rdx, r14
mov rcx, rbx
call rax
jmp 0x140027281
xor eax, eax
mov rbx, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x78]
add rsp, 0x40
pop r14
pop r13
pop r12
pop rdi
pop rsi
ret
Function at 0x1400448d0
Capabilities:
Set console window title

Disassembly:
sub rsp, 0x28
mov rcx, qword [0x14045e9b0]
test rcx, rcx
je 0x14004491c
xor edx, edx
mov qword [rsp + 0x20], rbx
call fcn.140321bb0
mov rbx, rax
test rax, rax
je 0x140044917
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetConsoleTitleW]
cmp dword [0x14045b3f8], 0
jne 0x140044917
mov rcx, rbx
mov rbx, qword [rsp + 0x20]
add rsp, 0x28
jmp fcn.140005660
mov rbx, qword [rsp + 0x20]
add rsp, 0x28
ret
Function at 0x1400675a0
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
sub rsp, 0x28
cmp dword [0x14045b480], 0
je 0x140067634
test byte [0x140420a38], 1
je 0x140067634
cmp dword [0x140469ca0], 0
je 0x140067634
lea rcx, [0x140469ca0]
call fcn.140067670
call fcn.140065dc0
cmp dword [0x140469ca4], 0
jne 0x1400675f2
cmp dword [0x140469ca0], 0
je 0x1400675fe
mov dword [0x140469ca4], 0
jmp 0x1400675fe
lea rcx, [0x140469ca0]
call fcn.140065ae0
cmp dword [0x1404334f0], 0
jne 0x140067624
mov eax, dword [0x14045b5c8]
test al, 2
jne 0x140067615
test al, 1
je 0x140067624
mov dword [0x14045eb68], 1
add rsp, 0x28
ret
lea rcx, [0x140469ca0]
add rsp, 0x28
jmp fcn.1403221f0
add rsp, 0x28
ret

Function at 0x1400727e0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x40
mov rax, qword [0x14041f010]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov r15, rdx
mov r14, rcx
mov edx, reloc.WSOCK32.dll_ioctlsocket
mov r9, rcx
lea rcx, [rsp + 0x20]
lea r8d, [rdx - 0xb]
call fcn.14000bd5c
cmp rax, 1
jne 0x1400728a6
mov edx, dword [rsp + 0x28]
lea rax, str.VimCrypt01_
mov r8, qword [rsp + 0x20]
lea r9, str.sodium_init
xor ebx, ebx
nop
mov rcx, qword [rax]
cmp r8, qword [rcx]
jne 0x14007284d
cmp edx, dword [rcx + 8]
je 0x1400728c9
inc ebx
add rax, 0x68
cmp rax, r9
jl 0x140072840
lea rdx, str.VimCrypt
mov rax, 0xffffffffffffffff
inc rax
cmp byte [rdx + rax], 0
jne 0x140072866
cmp eax, 0xc
jg 0x1400728a6
movsxd r8, eax
lea rcx, [rsp + 0x20]
call fcn.140032120
test eax, eax
jne 0x1400728a6
lea rcx, str.E821:_File_is_encrypted_with_unknown_method
call qword [case.0x1400407ae.0]
mov rbx, rax
call fcn.140182a30
test eax, eax
jne 0x1400728a6
mov rcx, rbx
call fcn.140182400
xor eax, eax
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.140001200
mov rbx, qword [rsp + 0x80]
add rsp, 0x40
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
test ebx, ebx
js 0x1400728a6
movsxd rax, ebx
mov edx, 1
imul rcx, rax, 0x68
lea rax, [0x140433820]
mov esi, dword [rcx + rax + 0x10]
add esi, dword [rcx + rax + 0x14]
add esi, dword [rcx + rax + 0x18]
lea ebp, [rsi + 0xc]
movsxd rcx, ebp
call fcn.140032b90
mov rdi, rax
test rax, rax
je 0x1400728a6
mov r8d, reloc.WSOCK32.dll_ioctlsocket
lea rdx, [rsp + 0x20]
mov rcx, rax
call fcn.140003740
cmp ebp, 0xc
jle 0x14007294c
movsxd rdx, esi
lea rcx, [rdi + 0xc]
mov r9, r14
mov r8d, 1
call fcn.14000bd5c
cmp rax, 1
je 0x14007294c
cmp dword [0x14045b3f8], 0
jne 0x1400728a6
mov rcx, rdi
call fcn.140005660
jmp 0x1400728a6
mov r8, rdi
mov rdx, r15
mov ecx, ebx
call fcn.140072980
cmp dword [0x14045b3f8], 0
mov rbx, rax
jne 0x14007296d
mov rcx, rdi
call fcn.140005660
mov rax, rbx
jmp 0x1400728a8
Function at 0x140090e90
Capabilities:
Check for time delay via gettickcount

Disassembly:
sub rsp, 0x38
cmp dword [0x140421fcc], 0
mov rcx, qword [0x14046a618]
jl 0x140090eb6
mov edx, dword [rcx + 0x38]
mov dword [0x140421fcc], 0xffffffff
call fcn.14008f590
test byte [0x14045b5b8], 4
je 0x140090f67
mov rax, qword [0x14046a608]
cmp qword [rax], 0
je 0x140090f62
add rcx, 0x38
mov edx, 1
call fcn.140095f60
mov edx, dword [0x14045b40c]
test edx, edx
jne 0x140090f2a
xor eax, eax
cmp dword [0x14045b4d8], eax
setne al
test eax, eax
jne 0x140090f2a
mov rdx, qword [0x14046a608]
cmp qword [rdx], 0
je 0x140090f62
mov rax, qword [0x14046a5f0]
mov rcx, qword [rax]
test rcx, rcx
cmove rcx, rdx
mov edx, 1
mov r8d, edx
add rsp, 0x38
jmp fcn.140331460
test edx, edx
mov qword [rsp + 0x30], rbx
lea rax, str.E565:_Not_allowed_to_change_text_or_change_window
lea rcx, str.E11:_Invalid_in_command_line_window__:q_CR__closes_the_window
cmove rcx, rax
call qword [case.0x1400407ae.0]
mov rbx, rax
call fcn.140182a30
test eax, eax
jne 0x140090f5d
mov rcx, rbx
call fcn.140182400
mov rbx, qword [rsp + 0x30]
add rsp, 0x38
ret
movsd xmm0, qword [rcx + 0x38]
mov edx, 1
mov eax, dword [rcx + 0x40]
mov ecx, edx
movsd qword [rsp + 0x20], xmm0
mov dword [rsp + 0x28], eax
call fcn.140198af0
cmp eax, 1
jne 0x140090fa5
mov edx, eax
lea rcx, [rsp + 0x20]
call fcn.140095f60
mov dword [0x14045f35c], 1
add rsp, 0x38
ret
mov ecx, 4
add rsp, 0x38
jmp fcn.14018aca0

Function at 0x140090fc0
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
cmp dword [0x140421fcc], 0
mov ebx, ecx
mov rcx, qword [0x14046a618]
mov esi, dword [rcx + 0xd8]
mov edi, dword [rcx + 0xe4]
jl 0x140090fff
mov edx, dword [rcx + 0x38]
mov dword [0x140421fcc], 0xffffffff
call fcn.14008f590
movsd xmm0, qword [rcx + 0x38]
mov edx, 1
mov eax, dword [rcx + 0x40]
mov ecx, edx
movsd qword [rsp + 0x20], xmm0
mov dword [rsp + 0x28], eax
call fcn.140094ea0
cmp eax, 1
jne 0x1400910b5
test ebx, ebx
je 0x14009103d
lea rcx, [0x14046a080]
call fcn.140058110
mov ecx, eax
call fcn.14018ea90
mov rax, qword [0x14046a618]
cmp esi, dword [rax + 0xd8]
jne 0x140091054
cmp edi, dword [rax + 0xe4]
je 0x14009108c
cmp dword [0x14045b548], 0
jne 0x14009108c
cmp dword [0x14045b4f4], 0
jne 0x14009108c
cmp dword [rax + 0x33c], 0xa
jge 0x14009108c
cmp dword [0x14045b4d4], 0xa
mov dword [rax + 0x33c], 0xa
jge 0x14009108c
mov dword [0x14045b4d4], 0xa
mov edx, 1
lea rcx, [rsp + 0x20]
call fcn.140095f60
mov dword [0x14045f35c], 1
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
mov ecx, 4
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
jmp fcn.14018aca0
Function at 0x1400910e0
Capabilities:
Check for time delay via gettickcount

Disassembly:
sub rsp, 0x38
cmp dword [0x140421fcc], 0
mov rcx, qword [0x14046a618]
jl 0x140091106
mov edx, dword [rcx + 0x38]
mov dword [0x140421fcc], 0xffffffff
call fcn.14008f590
test byte [0x14045b5b8], 4
je 0x1400911cb
mov rax, qword [0x14046a608]
cmp qword [rax], 0
je 0x1400911c6
add rcx, 0x38
mov edx, 1
call fcn.140095f60
mov edx, dword [0x14045b40c]
test edx, edx
jne 0x14009118e
xor eax, eax
cmp dword [0x14045b4d8], eax
setne al
test eax, eax
jne 0x14009118e
mov r9, qword [0x14046a608]
cmp qword [r9], 0
je 0x1400911c6
mov rdx, qword [0x14046a5f0]
mov rcx, qword [r9]
cmp rcx, rdx
je 0x14009117a
test rcx, rcx
je 0x14009117a
mov rax, qword [rcx]
mov r9, rcx
mov rcx, rax
cmp rax, rdx
jne 0x140091167
mov edx, 1
mov rcx, r9
mov r8d, edx
add rsp, 0x38
jmp fcn.140331460
test edx, edx
mov qword [rsp + 0x30], rbx
lea rax, str.E565:_Not_allowed_to_change_text_or_change_window
lea rcx, str.E11:_Invalid_in_command_line_window__:q_CR__closes_the_window
cmove rcx, rax
call qword [case.0x1400407ae.0]
mov rbx, rax
call fcn.140182a30
test eax, eax
jne 0x1400911c1
mov rcx, rbx
call fcn.140182400
mov rbx, qword [rsp + 0x30]
add rsp, 0x38
ret
movsd xmm0, qword [rcx + 0x38]
mov edx, 1
mov eax, dword [rcx + 0x40]
movsd qword [rsp + 0x20], xmm0
mov dword [rsp + 0x28], eax
lea ecx, [rdx - 2]
call fcn.140198af0
cmp eax, 1
jne 0x14009120a
mov edx, eax
lea rcx, [rsp + 0x20]
call fcn.140095f60
mov dword [0x14045f35c], 1
add rsp, 0x38
ret
mov ecx, 4
add rsp, 0x38
jmp fcn.14018aca0

Function at 0x140091220
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
cmp dword [0x140421fcc], 0
mov esi, ecx
mov rcx, qword [0x14046a618]
mov edi, dword [rcx + 0xd8]
mov ebx, dword [rcx + 0xe4]
jl 0x14009125f
mov edx, dword [rcx + 0x38]
mov dword [0x140421fcc], 0xffffffff
call fcn.14008f590
cmp dword [rcx + 0x38], 1
movsd xmm0, qword [rcx + 0x38]
mov eax, dword [rcx + 0x40]
movsd qword [rsp + 0x20], xmm0
mov dword [rsp + 0x28], eax
jle 0x140091328
mov edx, 1
call fcn.140095130
mov rcx, qword [0x14046a618]
mov ecx, dword [rcx + 0x44]
call fcn.14018ea90
call fcn.14019a210
test esi, esi
je 0x1400912b0
lea rcx, [0x14046a080]
call fcn.140058110
mov ecx, eax
call fcn.14018ea90
mov rax, qword [0x14046a618]
cmp edi, dword [rax + 0xd8]
jne 0x1400912c7
cmp ebx, dword [rax + 0xe4]
je 0x1400912ff
cmp dword [0x14045b548], 0
jne 0x1400912ff
cmp dword [0x14045b4f4], 0
jne 0x1400912ff
cmp dword [rax + 0x33c], 0xa
jge 0x1400912ff
cmp dword [0x14045b4d4], 0xa
mov dword [rax + 0x33c], 0xa
jge 0x1400912ff
mov dword [0x14045b4d4], 0xa
mov edx, 1
lea rcx, [rsp + 0x20]
call fcn.140095f60
mov dword [0x14045f35c], 1
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
mov ecx, 4
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
jmp fcn.14018aca0
Function at 0x1400cea90
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov rdx, qword [rcx + 8]
mov r8, rcx
test rdx, rdx
je 0x1400ceac1
mov rax, qword [0x14046a608]
test rax, rax
je 0x1400ceac1
nop dword [rax + rax]
cmp rax, rdx
je 0x1400ceb59
mov rax, qword [rax]
test rax, rax
jne 0x1400ceab0
mov r9, qword [0x14046a5e8]
cmp dword [r8 + 0x10], 0
jne 0x1400cead9
mov eax, dword [r8 + 0x14]
mov dword [0x14045b480], eax
mov rdx, qword [r8]
test rdx, rdx
je 0x1400cebb5
mov rax, r9
test r9, r9
je 0x1400ceafe
nop dword [rax]
cmp rax, rdx
je 0x1400ceb46
mov rax, qword [rax + 0x18]
test rax, rax
jne 0x1400ceaf0
mov rax, qword [0x140469978]
test rax, rax
je 0x1400ceb22
nop word [rax + rax]
cmp rax, rdx
je 0x1400cebae
mov rax, qword [rax + 0x18]
test rax, rax
jne 0x1400ceb10
mov rax, qword [0x14046a5f0]
mov rcx, qword [rax + 0x30]
test rcx, rcx
je 0x1400ceb40
cmp rcx, rdx
je 0x1400cebae
mov rcx, qword [rcx + 0x18]
test rcx, rcx
jne 0x1400ceb32
xor eax, eax
test eax, eax
je 0x1400cebb5
mov rax, qword [rdx + 8]
mov qword [0x14045b410], rax
mov qword [0x14046a618], rdx
ret
mov rcx, qword [0x14046a5f0]
mov rax, qword [0x14046a5e8]
mov qword [0x14046a5f0], rdx
mov qword [rcx + 0x20], rax
mov rax, qword [0x14046a5f8]
mov qword [rcx + 0x28], rax
mov rax, qword [0x140469c60]
mov qword [rcx + 8], rax
mov rax, qword [rdx + 0x28]
mov r9, qword [rdx + 0x20]
mov qword [0x14046a5f8], rax
mov rax, qword [rdx + 8]
mov qword [0x140469c60], rax
mov qword [0x14046a5e8], r9
jmp 0x1400ceac8
mov eax, 1
jmp 0x1400ceb42
mov rax, qword [0x14046a618]
cmp dword [rax + 0x160], 0
je 0x1400cebcd
mov rcx, r9
jmp fcn.1403307f0
ret
Function at 0x1400e0c00
Capabilities:
Create directory

Disassembly:
mov qword [rsp + 0x10], rbx
push rsi
sub rsp, 0x20
xor edx, edx
mov rsi, rcx
call fcn.140321bb0
mov rbx, rax
test rax, rax
je 0x1400e0c55
mov rcx, rax
mov qword [rsp + 0x30], rdi
call fcn.140018de0
cmp dword [0x14045b3f8], 0
mov edi, eax
jne 0x1400e0c3c
mov rcx, rbx
call fcn.140005660
test edi, edi
mov rdi, qword [rsp + 0x30]
jne 0x1400e0c55
mov eax, 1
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rsi
ret
lea rcx, str.E739:_Cannot_create_directory:__s
call qword [case.0x1400407ae.0]
mov rcx, rax
mov rdx, rsi
call fcn.1401860c0
mov rbx, qword [rsp + 0x38]
xor eax, eax
add rsp, 0x20
pop rsi
ret

Function at 0x1400e2090
Capabilities:
Check for time delay via gettickcount

Disassembly:
push r15
sub rsp, 0x40
mov qword [rsp + 0x58], rbp
xor r15d, r15d
mov qword [rsp + 0x60], rsi
mov ebp, edx
mov qword [rsp + 0x38], rdi
mov esi, ecx
mov qword [rsp + 0x20], r14
mov edi, r15d
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov r14d, eax
test ebp, ebp
je 0x1400e20f6
mov eax, dword [0x14045b974]
mov dword [0x140465078], 1
test eax, eax
je 0x1400e2120
cmp dword [0x140464664], r15d
jne 0x1400e2120
mov rcx, qword [0x1404687e0]
call fcn.1402ab4a0
mov dword [0x140464664], 1
jmp 0x1400e2120
cmp dword [0x140464664], edi
je 0x1400e2120
cmp dword [0x140465078], edi
jne 0x1400e2120
mov rcx, qword [0x1404687e8]
call fcn.1402ab4a0
mov dword [0x140464664], r15d
mov dword [0x140465078], r15d
call fcn.1402ac330
mov eax, dword [0x14045b41c]
test eax, eax
jne 0x1400e21d4
mov qword [rsp + 0x30], r12
lea r12d, [rax + 0x14]
mov qword [rsp + 0x28], r13
mov r13d, 0x3e8
mov qword [rsp + 0x50], rbx
nop dword [rax]
cmp edi, esi
jge 0x1400e21c5
mov ebx, esi
sub ebx, edi
cmp ebx, r13d
cmovg ebx, r13d
call fcn.1402bef50
test eax, eax
jle 0x1400e216d
cmp eax, ebx
cmovl ebx, eax
cmp qword [0x140468020], r15
je 0x1400e217d
cmp ebx, r12d
cmovg ebx, r12d
cmp qword [0x140467ff0], r15
je 0x1400e218d
cmp ebx, r12d
cmovg ebx, r12d
mov edx, 1
mov ecx, ebx
call fcn.1402c60f0
mov ecx, r15d
cmp qword [0x140468020], rcx
setne cl
call fcn.1402c5ec0
call fcn.140123b50
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [0x14045b41c]
mov edi, eax
sub edi, r14d
test ecx, ecx
je 0x1400e2150
mov rbx, qword [rsp + 0x50]
mov r12, qword [rsp + 0x30]
mov r13, qword [rsp + 0x28]
mov eax, dword [0x14045b41c]
mov r14, qword [rsp + 0x20]
mov rdi, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x60]
test eax, eax
je 0x1400e2218
cmp dword [0x1404431ac], 0xffffffff
je 0x1400e2211
cmp dword [0x1404601b4], r15d
jne 0x1400e2218
cmp qword [0x140460020], r15
jne 0x1400e2211
cmp qword [0x140460190], r15
je 0x1400e2218
xor ecx, ecx
call fcn.14011f670
test ebp, ebp
mov rbp, qword [rsp + 0x58]
je 0x1400e224b
cmp dword [0x140464664], r15d
mov dword [0x140465078], r15d
je 0x1400e224b
mov rcx, qword [0x1404687e8]
call fcn.1402ab4a0
mov dword [0x140464664], r15d
mov dword [0x140465078], r15d
add rsp, 0x40
pop r15
ret
Function at 0x140100080
Capabilities:
Get file attributes

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r15
sub rsp, 0x50
xor edx, edx
mov rsi, rcx
xor edi, edi
call fcn.140321bb0
mov rbp, rax
test rax, rax
je 0x140100238
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp dword [0x14045b3f8], edi
mov ebx, eax
jne 0x1401000be
mov rcx, rbp
call fcn.140005660
cmp ebx, 0xffffffff
je 0x140100238
shr ebx, 4
bt ebx, 0
jae 0x140100238
mov rcx, rsi
call fcn.1401e1160
test eax, eax
jne 0x140100238
mov rcx, rsi
call fcn.14028ad70
mov r15, rax
test rax, rax
jne 0x140100103
lea eax, [r15 - 1]
add rsp, 0x50
pop r15
pop rdi
pop rsi
pop rbp
pop rbx
ret
mov dword [rsp + 0x28], edi
lea rcx, [rsp + 0x30]
xor r9d, r9d
mov qword [rsp + 0x20], rdi
xor r8d, r8d
mov rdx, r15
call fcn.140100260
cmp eax, 1
jne 0x140100215
mov esi, dword [rsp + 0x30]
lea ebp, [rax - 2]
mov qword [rsp + 0x90], r14
mov r14, qword [rsp + 0x40]
test esi, esi
jle 0x140100196
mov qword [rsp + 0x80], r12
mov rbx, r14
mov r12d, esi
nop
mov rax, qword [rbx]
lea r8, [0x1403bf2f0]
mov rcx, qword [0x14046a2b0]
mov r9, r15
mov edx, 0x400
mov qword [rsp + 0x20], rax
call fcn.14028ab80
mov rcx, qword [0x14046a2b0]
call fcn.140100080
test eax, eax
lea rbx, [rbx + 8]
cmovne edi, ebp
sub r12, 1
jne 0x140100150
mov r12, qword [rsp + 0x80]
test r14, r14
je 0x1401001d8
test esi, esi
jle 0x1401001c2
mov rbx, r14
mov rcx, qword [rbx]
test rcx, rcx
je 0x1401001b8
cmp dword [0x14045b3f8], 0
jne 0x1401001b8
call fcn.140005660
add rbx, 8
sub rsi, 1
jne 0x1401001a2
test r14, r14
je 0x1401001d8
cmp dword [0x14045b3f8], 0
jne 0x1401001d8
mov rcx, r14
call fcn.140005660
xor edx, edx
mov rcx, r15
call fcn.140321bb0
mov r14, qword [rsp + 0x90]
mov rbx, rax
test rax, rax
je 0x140100211
mov rcx, rax
call fcn.140019eac
cmp dword [0x14045b3f8], 0
mov esi, eax
jne 0x14010020d
mov rcx, rbx
call fcn.140005660
test esi, esi
je 0x14010021a
mov edi, ebp
jmp 0x14010021a
mov edi, 0xffffffff
cmp dword [0x14045b3f8], 0
jne 0x140100244
mov rcx, r15
call fcn.140005660
mov eax, edi
add rsp, 0x50
pop r15
pop rdi
pop rsi
pop rbp
pop rbx
ret
mov rcx, rsi
call fcn.1401e0f20
neg eax
sbb edi, edi
mov eax, edi
add rsp, 0x50
pop r15
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x1401023c0
Capabilities:
Delete file
Get common file path

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x460
mov rax, qword [0x14041f010]
xor rax, rsp
mov qword [rsp + 0x450], rax
mov ebx, edx
mov edi, ecx
xor esi, esi
lea rdx, [rsp + 0x30]
mov ecx, 0x104
mov word [rsp + 0x240], si
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
jne 0x140102413
mov dword [rsp + 0x30], 0x5c002e
mov word [rsp + 0x34], si
movabs rax, 0x4d00490056
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
lea r9, str.0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ
lea r8d, [rdi + rax]
mov eax, 0x38e38e39
imul r8d
mov eax, 0x38e38e39
sar edx, 3
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
mov ecx, r8d
lea edx, [rdx + rdx*8]
shl edx, 2
sub ecx, edx
movsxd rcx, ecx
movzx ecx, word [r9 + rcx*2]
mov word [rsp + 0x22], cx
imul ecx, r8d, 0x65
xor r8d, r8d
imul ecx
sar edx, 3
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*8]
shl eax, 2
lea rdx, [rsp + 0x20]
sub ecx, eax
movsxd rax, ecx
lea rcx, [rsp + 0x30]
movzx eax, word [r9 + rax*2]
lea r9, [rsp + 0x240]
mov word [rsp + 0x24], ax
call qword [sym.imp.KERNEL32.dll_GetTempFileNameW]
test eax, eax
jne 0x1401024ad
xor eax, eax
jmp 0x14010253c
test ebx, ebx
jne 0x1401024bf
lea rcx, [rsp + 0x240]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
xor edx, edx
lea rcx, [rsp + 0x240]
call fcn.140321f80
mov rcx, qword [0x140469678]
mov rbx, rax
call fcn.140111730
mov rcx, qword [0x140469668]
mov rdi, rax
cmp byte [rcx], 0x2d
jne 0x140102514
lea rdx, str.powershell
mov rcx, rax
call fcn.140001ee0
test rax, rax
jne 0x140102514
lea rdx, str.pwsh
mov rcx, rdi
call fcn.140001ee0
test rax, rax
je 0x14010251c
cmp dword [0x14046a330], esi
je 0x140102539
movzx ecx, byte [rbx]
mov rax, rbx
test cl, cl
je 0x140102539
cmp cl, 0x5c
jne 0x14010252e
mov byte [rax], 0x2f
movzx ecx, byte [rax + 1]
inc rax
test cl, cl
jne 0x140102526
mov rax, rbx
mov rcx, qword [rsp + 0x450]
xor rcx, rsp
call fcn.140001200
lea r11, [rsp + 0x460]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret
Function at 0x140133720
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
movsxd rax, ecx
mov edi, edx
lea rcx, [rax + rax*8]
mov rax, qword [0x140460528]
lea rbx, [rcx*8]
mov rdx, qword [rbx + rax + 0x40]
test rdx, rdx
je 0x140133770
lea rcx, [0x1403c1bf0]
call fcn.140015e6c
mov rcx, qword [0x140460528]
mov rcx, qword [rbx + rcx + 0x40]
call fcn.1400163cc
mov rax, qword [0x140460528]
mov rcx, qword [rbx + rax + 0x20]
test rcx, rcx
je 0x1401337b9
mov edx, 0x3e8
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x1401337a0
mov rcx, qword [0x140460528]
xor edx, edx
mov rcx, qword [rbx + rcx + 0x20]
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rcx, qword [0x140460528]
mov rcx, qword [rbx + rcx + 0x20]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, qword [0x140460528]
mov rcx, qword [rbx + rax + 0x38]
test rcx, rcx
je 0x1401337cf
call fcn.140013970
mov rax, qword [0x140460528]
mov rcx, qword [rbx + rax + 0x40]
test rcx, rcx
je 0x1401337e5
call fcn.140013970
mov rax, qword [0x140460528]
test edi, edi
je 0x140133845
mov rcx, qword [rbx + rax]
test rcx, rcx
je 0x140133807
cmp dword [0x14045b3f8], 0
jne 0x140133807
call fcn.140005660
mov rax, qword [0x140460528]
mov rcx, qword [rbx + rax + 8]
test rcx, rcx
je 0x140133826
cmp dword [0x14045b3f8], 0
jne 0x140133826
call fcn.140005660
mov rax, qword [0x140460528]
mov rcx, qword [rbx + rax + 0x10]
test rcx, rcx
je 0x140133845
cmp dword [0x14045b3f8], 0
jne 0x140133845
call fcn.140005660
mov rax, qword [0x140460528]
xor ecx, ecx
mov qword [rbx + rax], rcx
mov qword [rbx + rax + 8], rcx
mov qword [rbx + rax + 0x10], rcx
mov qword [rbx + rax + 0x28], rcx
mov dword [rbx + rax + 0x30], ecx
mov dword [rbx + rax + 0x18], ecx
mov qword [rbx + rax + 0x38], rcx
mov qword [rbx + rax + 0x40], rcx
mov qword [rbx + rax + 0x20], rcx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret