joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140005cac
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xc0
mov rbx, r9
mov r15, r8
mov r12d, edx
mov r13, rcx
call fcn.140005374
xor ebp, ebp
lea edi, [rbp + 0x3f]
lea rcx, [rsp + 0x81]
xor edx, edx
mov r8, rdi
mov byte [rsp + 0x80], bpl
call sub.msvcrt.dll_memset
lea rcx, [rsp + 0x41]
mov r8, rdi
xor edx, edx
mov byte [rsp + 0x40], bpl
call sub.msvcrt.dll_memset
mov edx, r12d
mov rcx, r13
call fcn.1400053e8
lea r14d, [rbp + 0x40]
cmp r12d, 0x800e
mov edi, eax
mov eax, 0x80
mov r9, r15
cmove r14d, eax
lea rax, [rsp + 0x80]
mov rcx, r13
mov qword [rsp + 0x38], rax
lea eax, [rbp + 0x14]
mov r8d, r14d
mov dword [rsp + 0x30], eax
mov qword [rsp + 0x28], rbx
mov dword [rsp + 0x20], eax
call fcn.1400055f0
mov ebx, dword [rsp + 0x118]
cmp ebx, 1
jne 0x140005d7c
lea rdx, [rsp + 0x80]
lea rcx, [rsp + 0x40]
mov r8, rdi
call sub.msvcrt.dll_memcpy
lea eax, [rbx - 1]
test eax, eax
je 0x140005df7
mov rbx, rdi
mov esi, eax
lea rax, [rsp + 0x40]
mov r9, r15
mov r8d, r14d
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x80]
mov dword [rsp + 0x30], edi
mov qword [rsp + 0x28], rax
mov edx, r12d
mov rcx, r13
mov dword [rsp + 0x20], 0x14
call fcn.1400055f0
test edi, edi
mov ebp, eax
je 0x140005ddc
xor edx, edx
mov r8, rbx
mov cl, byte [rsp + rdx + 0x80]
add rdx, 1
xor byte [rsp + rdx + 0x3f], cl
sub r8, 1
jne 0x140005dc7
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x80]
mov r8, rbx
call sub.msvcrt.dll_memcpy
sub rsi, 1
jne 0x140005d88
mov rcx, qword [rsp + 0x120]
lea rdx, [rsp + 0x40]
mov r8, rdi
call sub.msvcrt.dll_memcpy
lea r11, [rsp + 0xc0]
mov eax, ebp
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x140005e30
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], r8
mov qword [rax + 8], rcx
push rbp
push rsi
push rdi
sub rsp, 0xfa0
or qword [rax - 0xe88], 0xffffffffffffffff
xor edi, edi
mov rbx, r8
mov word [rax - 0xe80], di
mov word [rax - 0x41e], di
mov word [rax - 0x820], di
lea rax, [rax - 0xe80]
mov r8, rdx
lea rcx, [rsp + 0x130]
lea rdx, [0x14001b038]
mov rsi, r9
mov qword [rsp + 0x540], rax
call fcn.14000b1c8
lea rcx, [rsp + 0x130]
mov word [rsp + 0x30], di
call fcn.14000b260
cmp eax, edi
je 0x140005fc8
mov rbp, qword [rsp + 0xfe0]
lea rcx, [rsp + 0x130]
call fcn.14000b174
cmp eax, edi
je 0x140005f95
cmp word [rsp + 0x574], 0x53
je 0x140005ee1
cmp word [rsp + 0x574], 0x73
jne 0x140005ef4
cmp word [rsp + 0x576], 0x2d
lea rdx, [rsp + 0x574]
je 0x140005efc
mov rdx, qword [rsp + 0xfe8]
lea rcx, [rsp + 0x30]
mov r8d, 0x80
call fcn.140009ff4
mov rcx, qword [rsp + 0xfc0]
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea rdx, [rsp + 0x798]
mov r9, rsi
mov r8, rbx
mov qword [rsp + 0x20], rbp
call fcn.140005e30
cmp eax, edi
jne 0x140005fc3
mov rcx, rbx
call sub.msvcrt.dll_wcslen
lea rcx, [rsp + 0x798]
mov rbx, rax
call sub.msvcrt.dll_wcslen
lea rcx, [rbx + rax + 1]
mov rbx, qword [rsp + 0xfd0]
cmp rcx, 0x104
jae 0x140005f81
lea rcx, [rsp + 0x798]
mov r8, rsi
mov rdx, rbx
call fcn.14000a2f4
jmp 0x140005f84
mov word [rsi], di
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x140005fab
mov word [rsi], di
lea rcx, [rsp + 0x130]
call fcn.14000b260
cmp eax, edi
je 0x140005fc8
jmp 0x140005eb6
mov edi, 1
lea rdx, [rsp + 0x30]
mov rcx, rbp
lea r8d, [rdi + 0x7f]
call fcn.140009ff4
jmp 0x140005fc8
mov edi, 1
mov rcx, qword [rsp + 0x130]
cmp rcx, 0xffffffffffffffff
je 0x140005fdc
call qword [sym.imp.KERNEL32.dll_FindClose]
mov eax, edi
mov rbx, qword [rsp + 0xfc8]
add rsp, 0xfa0
pop rdi
pop rsi
pop rbp
ret
Function at 0x140005ff4
Capabilities:
Get file size
Read file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x20], r9
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x100
xor r13d, r13d
mov r15, r8
mov r14, rcx
and word [rax - 0xb8], r13w
mov rbx, rdx
lea rcx, [rax - 0xb6]
lea r8d, [r13 + 0x7e]
xor edx, edx
call sub.msvcrt.dll_memset
movdqu xmm5, xmmword [rbx]
movdqu xmmword [rsp + 0x70], xmm5
mov rdx, qword [rsp + 0x78]
mov r9, qword [rsp + 0x70]
mov rax, rdx
mov r12, rdx
movzx r10d, dl
shr rax, 0x30
shr r12, 0x38
movzx ebp, al
mov dword [rsp + 0x68], r12d
mov rax, rdx
shr rax, 0x28
mov dword [rsp + 0x60], ebp
movzx esi, al
mov rax, rdx
shr rax, 0x20
mov dword [rsp + 0x58], esi
movzx edi, al
mov rax, rdx
shr rax, 0x18
mov dword [rsp + 0x50], edi
movzx ebx, al
mov rax, rdx
shr rax, 0x10
mov dword [rsp + 0x48], ebx
movzx r11d, al
mov rax, rdx
mov rdx, r9
mov dword [rsp + 0x40], r11d
shr rax, 8
shr rdx, 0x30
movzx r8d, al
mov rax, r9
mov dword [rsp + 0x38], r8d
mov dword [rsp + 0x30], r10d
mov dword [rsp + 0x28], edx
shr rax, 0x20
lea r8, str._8.8X__4.4X__4.4X__2.2X_2.2X__2.2X_2.2X_2.2X_2.2X_2.2X_2.2X
lea edx, [r13 + 0x40]
movzx ecx, ax
mov dword [rsp + 0x20], ecx
lea rcx, [rsp + 0x80]
call sub.msvcrt.dll__snwprintf
xor ebp, ebp
cmp dword [r14 + 0x2f0], ebp
mov ebx, ebp
mov rdi, rbp
jle 0x140006164
mov rsi, qword [rsp + 0x158]
cmp rdi, rbp
jl 0x140006126
cmp ebx, dword [r14 + 0x2f0]
jge 0x140006126
mov rax, qword [r14 + 0x2d8]
mov ecx, dword [rax + rdi*4]
mov rax, qword [r14 + 0x2e0]
lea rdx, [rax + rcx*2]
jmp 0x140006129
mov rdx, rbp
lea rax, [0x14001a8d0]
lea r8, [rsp + 0x80]
mov r9, r15
mov qword [rsp + 0x28], rax
mov rcx, r14
mov qword [rsp + 0x20], rsi
call fcn.140005e30
cmp eax, ebp
mov r13d, eax
jne 0x140006164
add ebx, 1
add rdi, 1
cmp ebx, dword [r14 + 0x2f0]
jl 0x140006101
cmp r13d, ebp
je 0x1400061f3
xor edx, edx
mov rcx, r15
call fcn.140009ab0
cmp rax, 0xffffffffffffffff
mov rbx, rax
je 0x1400061f0
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileSize]
lea rcx, [r14 + 0xa8]
mov edx, eax
mov edi, eax
call fcn.14000b474
cmp edi, 0x32
jbe 0x1400061e2
mov rdx, qword [r14 + 0xa8]
lea r9, [rsp + 0x140]
mov r8d, edi
mov rcx, rbx
mov dword [rsp + 0x140], ebp
mov qword [rsp + 0x20], rbp
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov rdx, qword [r14 + 0xa8]
lea rcx, [r14 + 8]
mov r8d, 0xa0
mov r13d, eax
call sub.msvcrt.dll_memcpy
jmp 0x1400061e5
mov r13d, ebp
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1400061f3
mov r13d, ebp
mov eax, r13d
mov rbx, qword [rsp + 0x148]
add rsp, 0x100
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x140009b10
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov rdi, rcx
mov rcx, rdx
mov rbx, rdx
call sub.msvcrt.dll_wcslen
and qword [rsp + 0x20], 0
lea r9, [rsp + 0x50]
lea r8d, [rax + rax]
mov rdx, rbx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret

Function at 0x140009d50
Capabilities:
Get file size
Read file on windows
Write clipboard data

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
sub rsp, 0x30
mov rbx, rcx
xor edi, edi
call qword [sym.imp.USER32.dll_EmptyClipboard]
xor edx, edx
mov rcx, rbx
call fcn.140009ab0
cmp rax, 0xffffffffffffffff
mov rbx, rax
je 0x140009e0e
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov ecx, 0x2000
mov r12d, eax
mov esi, eax
lea rdx, [r12 + 2]
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
cmp rax, rdi
mov rbp, rax
je 0x140009dfb
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GlobalLock]
lea r9, [rsp + 0x58]
mov r8d, r12d
mov rcx, rbx
mov rdx, rax
mov qword [rsp + 0x20], rdi
mov r13, rax
call qword [sym.imp.KERNEL32.dll_ReadFile]
cmp eax, edi
je 0x140009dfb
shr rsi, 1
mov rcx, rbp
mov word [r13 + rsi*2], di
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
lea ecx, [rdi + 0xd]
mov rdx, rbp
call qword [sym.imp.USER32.dll_SetClipboardData]
jmp 0x140009e03
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x140009e16
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
call qword [sym.imp.USER32.dll_CloseClipboard]
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
mov eax, edi
add rsp, 0x30
pop r13
pop r12
pop rdi
ret

Function at 0x14000a350
Capabilities:
Get common file path

Disassembly:
push rbx
sub rsp, 0x20
cmp word [0x1400216d0], 0
mov rbx, rcx
jne 0x14000a37b
lea rcx, [0x1400216d0]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
mov dword [0x1400218dc], eax
lea rdx, [0x1400216d0]
mov rcx, rbx
call fcn.14001916a
mov eax, dword [0x1400218dc]
add rsp, 0x20
pop rbx
ret

Function at 0x14000a398
Capabilities:
Get common file path

Disassembly:
push rbx
sub rsp, 0x20
cmp word [0x1400218e0], 0
mov rbx, rcx
jne 0x14000a3c3
lea rcx, [0x1400218e0]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov dword [0x140021aec], eax
lea rdx, [0x1400218e0]
mov rcx, rbx
call fcn.14001916a
mov eax, dword [0x140021aec]
add rsp, 0x20
pop rbx
ret
Function at 0x14000a560
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
sub rsp, 0x60
cmp dword [0x140021d28], 0
mov rdi, rdx
mov rbx, rcx
mov r13d, 0x400
jne 0x14000a648
mov ebp, InitCommonControls
lea r12, [0x140021d30]
mov ecx, r13d
lea edx, [rbp + 2]
mov r9d, ebp
mov r8, r12
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
mov rcx, r12
call sub.msvcrt.dll__wtoi
mov r9d, ebp
mov r8, r12
mov edx, ebp
mov ecx, r13d
mov dword [0x140021d04], eax
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
mov rcx, r12
call sub.msvcrt.dll__wtoi
lea rsi, [0x140021d50]
lea edx, [rbp - 2]
mov r8, rsi
mov r9d, ebp
mov ecx, r13d
mov dword [0x140021d08], eax
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
mov qword [0x140021d10], rsi
lea rsi, [0x140021d70]
lea edx, [rbp - 1]
mov r9d, ebp
mov r8, rsi
mov ecx, r13d
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
mov r9d, ebp
mov r8, r12
mov edx, 0x1010
mov ecx, r13d
mov qword [0x140021d18], rsi
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
mov rcx, r12
call sub.msvcrt.dll__wtoi
mov dword [0x140021d28], 1
mov dword [0x140021d20], eax
lea rdx, [0x140021d00]
lea rcx, [rsp + 0x30]
mov r8d, 0x28
call sub.msvcrt.dll_memcpy
and dword [rsp + 0x30], 0
lea r9, [rsp + 0x30]
mov r8, rdi
xor edx, edx
mov ecx, r13d
mov dword [rsp + 0x28], 0x20
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_GetNumberFormatW]
lea r11, [rsp + 0x60]
mov rax, rbx
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r13
pop r12
pop rdi
ret

Function at 0x14000a6a4
Capabilities:
Create process on windows

Disassembly:
sub rsp, 0x38
lea r9, [0x14001a8d0]
mov r8, rdx
lea rdx, str.open
mov dword [rsp + 0x28], 5
mov qword [rsp + 0x20], r9
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
xor ecx, ecx
cmp rax, 0x20
seta cl
mov eax, ecx
add rsp, 0x38
ret
Function at 0x14000b260
Capabilities:
Enumerate files on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
sub rsp, 0x20
or rsi, 0xffffffffffffffff
mov rbx, rcx
cmp qword [rcx], rsi
jne 0x14000b2d5
lea rax, [rcx + 8]
lea rdx, [rcx + 8]
movzx ecx, word [rcx + 8]
jmp 0x14000b2aa
cmp cx, 0x5c
je 0x14000b29f
cmp cx, 0x2f
jne 0x14000b2a3
lea rdx, [rax + 2]
add rax, 2
mov cx, word [rax]
test cx, cx
jne 0x14000b293
mov qword [rbx + 0x410], rdx
lea rcx, [rbx + 8]
lea rdx, [rbx + 0x418]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
xor edi, edi
cmp rax, rsi
mov qword [rbx], rax
setne dil
jmp 0x14000b2fc
lea rdx, [rcx + 0x418]
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
mov edi, eax
jne 0x14000b300
cmp qword [rbx], rsi
je 0x14000b2fc
mov rcx, qword [rbx]
call qword [sym.imp.KERNEL32.dll_FindClose]
mov qword [rbx], rsi
test edi, edi
je 0x14000b34a
lea r12, [rbx + 0xa6a]
lea rsi, [rbx + 0x668]
lea rbp, [rbx + 0x444]
mov rcx, r12
call sub.msvcrt.dll_wcslen
mov rcx, rbp
mov rbx, rax
call sub.msvcrt.dll_wcslen
lea r9, [rbx + rax + 1]
cmp r9, 0x200
jae 0x14000b346
mov r8, rsi
mov rdx, rbp
mov rcx, r12
call fcn.14000a2f4
jmp 0x14000b34a
and word [rsi], 0
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov eax, edi
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r12
ret

Function at 0x14000bc58
Capabilities:
Read .ini file

Disassembly:
push rbx
sub rsp, 0x30
and word [rdx], 0
lea rax, [0x140020f50]
mov rbx, rdx
mov r9, rdx
mov qword [rsp + 0x28], rax
mov rdx, rcx
mov dword [rsp + 0x20], r8d
lea r8, [0x14001a8d0]
lea rcx, [0x140021160]
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
mov rax, rbx
add rsp, 0x30
pop rbx
ret

Function at 0x14000bc9c
Capabilities:
Read .ini file

Disassembly:
mov qword [rsp + 8], rbx
push rdi
mov eax, 0x2040
call fcn.140019520
sub rsp, rax
and word [rsp + 0x30], 0
mov rbx, rcx
mov rdi, rdx
lea rcx, [rsp + 0x32]
lea r8d, [rax - 0x40]
xor edx, edx
call sub.msvcrt.dll_memset
lea r11, [0x140020f50]
lea r9, [rsp + 0x30]
mov qword [rsp + 0x28], r11
lea r8, [0x14001a8d0]
lea rcx, [0x140021160]
mov rdx, rbx
mov dword [rsp + 0x20], 0x1000
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
cmp word [rsp + 0x30], 0
je 0x14000bd17
lea rdx, [rsp + 0x30]
mov rcx, rdi
call fcn.14001916a
mov eax, 1
jmp 0x14000bd19
xor eax, eax
mov rbx, qword [rsp + 0x2050]
add rsp, 0x2040
pop rdi
ret
Function at 0x14000bd2c
Capabilities:
Read .ini file

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
mov eax, 0x2040
call fcn.140019520
sub rsp, rax
and word [rsp + 0x30], 0
mov ebx, r8d
mov rdi, rcx
mov rsi, rdx
lea r8d, [rax - 0x40]
lea rcx, [rsp + 0x32]
xor edx, edx
call sub.msvcrt.dll_memset
lea rbp, [0x140020f50]
lea r9, [rsp + 0x30]
lea r8, [0x14001a8d0]
lea rcx, [0x140021160]
mov rdx, rdi
mov qword [rsp + 0x28], rbp
mov dword [rsp + 0x20], 0x1000
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
cmp word [rsp + 0x30], 0
je 0x14000bda8
test ebx, ebx
jne 0x14000bda8
xor eax, eax
jmp 0x14000bdbe
lea rcx, [0x140021160]
mov r9, rbp
mov r8, rsi
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
lea r11, [rsp + 0x2040]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret

Function at 0x14000c218
Capabilities:
Check if file exists
Get file attributes
Read .ini file

Disassembly:
push rbx
sub rsp, 0x230
lea rcx, [rsp + 0x22]
xor ebx, ebx
xor edx, edx
mov r8d, 0x208
mov word [rsp + 0x20], bx
call sub.msvcrt.dll_memset
lea rdx, [rsp + 0x20]
mov r8d, 0x104
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea rcx, [rsp + 0x20]
mov dx, 0x2e
call sub.msvcrt.dll_wcsrchr
cmp rax, rbx
je 0x14000c263
mov word [rax], bx
lea rdx, str._lng.ini
lea rcx, [rsp + 0x20]
call sub.msvcrt.dll_wcscat
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x14000c320
lea rdx, [rsp + 0x20]
lea rcx, [0x140020f50]
call fcn.14001916a
lea rdx, str.general
lea rcx, [0x140021160]
call fcn.14001916a
lea r9, [0x140020f50]
lea rdx, [0x14001b300]
lea rcx, [0x140021160]
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
lea rdx, [0x1400211f0]
lea rcx, str.charset
cmp eax, 1
sete bl
mov dword [0x140020e14], ebx
mov ebx, 0x3f
mov r8d, ebx
call fcn.14000bc58
lea rdx, [0x140021270]
lea rcx, str.TranslatorName
mov r8d, ebx
call fcn.14000bc58
lea rdx, [0x1400212f0]
lea rcx, str.TranslatorURL
mov r8d, 0xff
call fcn.14000bc58
add rsp, 0x230
pop rbx
ret
Function at 0x14000d410
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov qword [rsp + 0x10], rbx
mov dword [rsp + 0x18], r8d
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
mov ebx, r8d
mov r12, rdx
mov rbp, rcx
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov rcx, qword [rbp + 0x310]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x1004
mov esi, eax
mov dword [rsp + 0x60], eax
call qword [sym.imp.USER32.dll_SendMessageW]
xor edi, edi
test eax, eax
mov r13, rax
jle 0x14000d586
test ebx, ebx
je 0x14000d492
mov eax, 0x51eb851f
imul edi
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0x64
cmp edi, edx
jne 0x14000d492
call qword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, esi
cmp eax, 0x1f4
ja 0x14000d586
mov eax, dword [r12 + 0x18]
lea ebx, [rdi + rax]
cmp ebx, r13d
jl 0x14000d4ae
test byte [r12 + 0x20], 0x20
je 0x14000d586
sub ebx, r13d
and qword [rsp + 0x78], 0
lea rdx, [rsp + 0x78]
mov r8d, ebx
mov rcx, rbp
call fcn.14000d15c
test eax, eax
je 0x14000d575
xor esi, esi
cmp dword [rbp + 0x360], esi
jle 0x14000d571
mov r15, qword [rsp + 0x78]
mov rax, qword [rbp]
mov edx, esi
mov rcx, rbp
call qword [rax + pe_nt_image_headers64]
test eax, eax
je 0x14000d562
mov rax, qword [r15]
mov r8, qword [rbp + 0x90]
mov edx, esi
mov rcx, r15
call qword [rax]
test byte [r12 + 0x20], 0xc
mov r14, rax
je 0x14000d549
cmp dword [rsp + 0x70], 0
je 0x14000d52d
mov rdx, qword [r12 + 0x28]
xor r8d, r8d
mov rcx, rax
call fcn.140009c7c
test eax, eax
js 0x14000d562
mov eax, ebx
jmp 0x14000d589
mov rcx, qword [r12 + 0x28]
call sub.msvcrt.dll_wcslen
mov rdx, qword [r12 + 0x28]
mov rcx, r14
mov r8, rax
call sub.msvcrt.dll__wcsnicmp
jmp 0x14000d55e
test byte [r12 + 0x20], 2
je 0x14000d562
mov rcx, qword [r12 + 0x28]
mov rdx, rax
call sub.msvcrt.dll__wcsicmp
test eax, eax
je 0x14000d529
add esi, 1
cmp esi, dword [rbp + 0x360]
jl 0x14000d4df
mov esi, dword [rsp + 0x60]
add edi, 1
cmp edi, r13d
jge 0x14000d586
mov ebx, dword [rsp + 0x70]
jmp 0x14000d463
or eax, 0xffffffff
mov rbx, qword [rsp + 0x68]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret

Function at 0x14000ddf8
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rdi
mov eax, 0x8040
call fcn.140019520
sub rsp, rax
mov rdi, rcx
mov rbx, rdx
lea r8d, [rax - 0x41]
lea rcx, [rsp + 0x41]
xor edx, edx
mov byte [rsp + 0x40], 0
call sub.msvcrt.dll_memset
and qword [rsp + 0x38], 0
and qword [rsp + 0x30], 0
lea rax, [rsp + 0x40]
or r9d, 0xffffffff
mov r8, rbx
xor edx, edx
mov ecx, 0xfde9
mov dword [rsp + 0x28], 0x7fff
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
lea rcx, [rsp + 0x40]
call sub.msvcrt.dll_strlen
and qword [rsp + 0x20], 0
lea r9, [rsp + 0x8060]
lea rdx, [rsp + 0x40]
mov r8, rax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rbx, qword [rsp + 0x8050]
add rsp, 0x8040
pop rdi
ret
Function at 0x14000de94
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rdi
mov eax, 0x2040
call fcn.140019520
sub rsp, rax
mov rdi, rcx
mov rbx, rdx
lea r8d, [rax - 0x41]
lea rcx, [rsp + 0x41]
xor edx, edx
mov byte [rsp + 0x40], 0
call sub.msvcrt.dll_memset
and qword [rsp + 0x38], 0
and qword [rsp + 0x30], 0
lea rax, [rsp + 0x40]
or r9d, 0xffffffff
mov r8, rbx
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x28], 0x1fff
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
lea rcx, [rsp + 0x40]
call sub.msvcrt.dll_strlen
and qword [rsp + 0x20], 0
lea r9, [rsp + 0x2060]
lea rdx, [rsp + 0x40]
mov r8, rax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rbx, qword [rsp + 0x2050]
add rsp, 0x2040
pop rdi
ret
Function at 0x140013570
Capabilities:
Create process on windows

Disassembly:
push rbx
sub rsp, 0x2a0
mov edx, 1
mov rbx, rcx
call fcn.140013bdc
and word [rsp + 0x90], 0
lea rcx, [rsp + 0x92]
xor edx, edx
mov r8d, 0x208
call sub.msvcrt.dll_memset
lea rdx, [rsp + 0x90]
mov r8d, 0x104
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
xor edx, edx
lea rcx, [rsp + 0x24]
lea r8d, [rdx + 0x6c]
call sub.msvcrt.dll_memset
and qword [rsp + 0x40], 0
lea rax, str.RunAs
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x90]
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x70
mov dword [rsp + 0x24], 0x40
mov dword [rsp + 0x50], 5
mov qword [rsp + 0x38], rax
call qword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
je 0x14001361d
mov rcx, qword [rbx + 0x210]
call qword [sym.imp.USER32.dll_DestroyWindow]
add rsp, 0x2a0
pop rbx
ret

Function at 0x140013888
Capabilities:
Delete file
Get common file path
Open clipboard

Disassembly:
push rbx
sub rsp, 0x450
mov rbx, rcx
call qword [sym.imp.USER32.dll_GetFocus]
cmp rax, qword [rbx + 0x700]
jne 0x14001394d
mov rcx, qword [rbx + 0x700]
and dword [rsp + 0x468], 0
and dword [rsp + 0x460], 0
lea r9, [rsp + 0x460]
lea r8, [rsp + 0x468]
mov edx, 0xb0
call qword [sym.imp.USER32.dll_SendMessageW]
mov r11d, dword [rsp + 0x468]
mov rcx, qword [rbx + 0x700]
xor r8d, r8d
cmp dword [rsp + 0x460], r11d
jg 0x14001393a
or r9, 0xffffffffffffffff
mov edx, 0xb1
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, qword [rbx + 0x700]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x301
call qword [sym.imp.USER32.dll_SendMessageW]
movsxd r9, dword [rsp + 0x460]
movsxd r8, dword [rsp + 0x468]
mov rcx, qword [rbx + 0x700]
mov edx, 0xb1
jmp 0x140013942
xor r9d, r9d
mov edx, 0x301
call qword [sym.imp.USER32.dll_SendMessageW]
jmp 0x140013a03
lea rdx, [rsp + 0x240]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
jne 0x140013977
lea rcx, [rsp + 0x240]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
and word [rsp + 0x30], 0
lea r9, [rsp + 0x30]
lea rdx, [0x14001be2c]
lea rcx, [rsp + 0x240]
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_GetTempFileNameW]
mov rdx, qword [rbx + 0x6e0]
mov eax, 1
mov dword [rsp + 0x28], eax
lea r8, [rsp + 0x30]
lea r9d, [rax + 1]
mov rcx, rbx
mov dword [rsp + 0x20], eax
call fcn.14001351c
test eax, eax
je 0x140013a03
mov rcx, qword [rbx + 0x210]
call qword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x1400139e0
lea rcx, [rsp + 0x30]
call fcn.140009d50
jmp 0x1400139e6
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x1400139f8
mov rcx, qword [rbx + 0x210]
mov edx, eax
call fcn.140009b50
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
add rsp, 0x450
pop rbx
ret
Function at 0x140015a20
Capabilities:
Acquire debug privileges

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rbx, rcx
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea r9, [rsp + 0x60]
mov r8d, 0x28
mov rcx, rbx
mov rdx, rax
call fcn.1400159b0
test eax, eax
jne 0x140015a58
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x140015aef
mov rcx, rbx
call fcn.140015970
test eax, eax
je 0x140015a89
mov rcx, qword [rbx]
lea rdx, str.LookupPrivilegeValueW
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140015a89
lea r8, [rsp + 0x34]
lea rdx, str.SeDebugPrivilege
xor ecx, ecx
call rax
mov rdi, qword [rsp + 0x60]
mov rcx, rbx
mov dword [rsp + 0x30], 1
mov dword [rsp + 0x3c], 2
call fcn.140015970
test eax, eax
je 0x140015ada
mov rcx, qword [rbx]
lea rdx, str.AdjustTokenPrivileges
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140015ada
and qword [rsp + 0x28], 0
and qword [rsp + 0x20], 0
lea r8, [rsp + 0x30]
xor r9d, r9d
xor edx, edx
mov rcx, rdi
call rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [rsp + 0x60]
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, ebx
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret

Function at 0x140015afc
Capabilities:
Link many functions at runtime

Disassembly:
push rbx
sub rsp, 0x20
cmp dword [0x140021574], 0
jne 0x140015bca
lea rcx, str.kernel32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
mov rbx, rax
je 0x140015bca
lea rdx, [0x14001c1f8]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
mov qword [0x140020bc0], rax
je 0x140015bca
lea rdx, str.Module32First
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
mov qword [0x140020bb0], rax
je 0x140015bca
lea rdx, str.Module32Next
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
mov qword [0x140020ba8], rax
je 0x140015bca
lea rdx, str.Process32First
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
mov qword [0x140020980], rax
je 0x140015bca
lea rdx, str.Process32Next
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [0x140021574]
mov edx, 1
test rax, rax
mov qword [0x140020988], rax
cmovne ecx, edx
mov dword [0x140021574], ecx
add rsp, 0x20
pop rbx
ret