joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140006a79
Capabilities:
Access the windows event log
Print debug messages

Disassembly:
test cl, 0x11
je 0x140006b89
push rbp
push rsi
push rdi
sub rsp, 0x60
mov rax, qword [0x14003a008]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov rbp, r8
mov qword [rsp + 0x98], rbx
mov rsi, rdx
mov edi, ecx
call fcn.140006970
mov ecx, 0x800
call fcn.140025364
mov rbx, rax
test rax, rax
je 0x140006b6d
mov r9, rbp
mov r8, rsi
mov edx, 0x3fe
mov rcx, rax
call fcn.1400068a0
lea r8, [0x14002a4f4]
mov edx, 0x400
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
lea rdx, [0x14002a4f8]
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
mov rsi, rax
test rax, rax
je 0x140006b65
mov qword [rsp + 0x50], rbx
mov ecx, 4
lea r8d, [rcx - 3]
test dil, 0xee
je 0x140006b1c
movzx ecx, r8w
jmp 0x140006b29
test edi, 0xefe
je 0x140006b29
mov ecx, 2
xor edx, edx
lea rax, [rsp + 0x50]
mov qword [rsp + 0x40], rdx
xor r9d, r9d
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], edx
mov word [rsp + 0x28], r8w
movzx r8d, di
mov qword [rsp + 0x20], rdx
movzx edx, cx
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_ReportEventW]
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
mov rcx, rbx
call fcn.140024d38
mov rbx, qword [rsp + 0x98]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140024b90
add rsp, 0x60
pop rdi
pop rsi
pop rbp
ret
Function at 0x140006ef0
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x40
mov rax, qword [0x14003a008]
xor rax, rsp
mov qword [rsp + 0x30], rax
xor edi, edi
mov dword [rcx + 0x14384], 0x64
mov qword [rcx], rdi
mov rbx, rcx
mov qword [rcx + 8], rdi
xor edx, edx
mov qword [rcx + 0x10], rdi
mov r8d, 0x11d80
mov qword [rcx + 0x18], rdi
mov dword [rcx + 0x14380], edi
mov dword [rcx + 0x14370], edi
mov qword [rcx + 0x14378], rdi
mov qword [rcx + 0x143a8], rdi
mov dword [rcx + 0x14388], 0x2710
mov qword [rcx + 0x1438c], 0x64
mov dword [rcx + 0x14394], 0x3483
mov qword [rcx + 0x14398], 0x70000
mov qword [rcx + 0x143a0], 0x60
add rcx, 0x20
call sub.VCRUNTIME140.dll_memset
lea rcx, [rbx + 0x11da0]
mov dword [rbx + 0x143b0], edi
xor edx, edx
mov dword [rbx + 0x143b4], 1
mov r8d, 0x25d0
mov dword [rbx + 0x143b8], 1
call sub.VCRUNTIME140.dll_memset
lea rdx, [rbx + 0x143c4]
mov dword [rbx + 0x145cc], edi
mov ecx, 0x208
mov qword [rbx + 0x143bc], rdi
mov dword [rbx + 0x145d0], 0x91
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
movsxd rax, dword [rbx + 0x145cc]
imul rcx, rax, 0x104
add rcx, 0x143c4
add rcx, rbx
je 0x140007006
mov edx, 0x104
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strnlen]
mov rdi, rax
mov ecx, dword [0x14002a880]
lea r8, [rsp + 0x20]
movsd xmm0, qword [0x14002a878]
mov r9d, 0xf
mov dword [rsp + 0x28], ecx
mov edx, 0x104
movzx ecx, word [0x14002a884]
mov word [rsp + 0x2c], cx
movzx ecx, byte [0x14002a886]
mov byte [rsp + 0x2e], cl
movsxd rcx, dword [rbx + 0x145cc]
add rbx, 0x143c4
imul rcx, rcx, 0x104
movsd qword [rsp + 0x20], xmm0
add rcx, rbx
add rcx, rdi
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy_s]
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.140024b90
mov rbx, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret
Function at 0x14000b490
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x60
mov r9d, 0x64
mov edi, r8d
mov rbx, rdx
lea r8, [0x14003f960]
mov rsi, rcx
xor ecx, ecx
lea edx, [r9 + 1]
call qword [sym.imp.USER32.dll_LoadStringW]
mov r9d, 0x64
lea r8, [0x14003bb10]
xor ecx, ecx
lea edx, [r9 + 5]
call qword [sym.imp.USER32.dll_LoadStringW]
mov rcx, rbx
call fcn.14000b3d0
xor ebp, ebp
mov qword [0x14003bb08], rbx
mov qword [rsp + 0x58], rbp
lea r8, [0x14003f960]
mov qword [rsp + 0x50], rbx
lea rdx, [0x14003bb10]
mov qword [rsp + 0x48], rbp
mov r9d, 0x20000
mov qword [rsp + 0x40], rbp
xor ecx, ecx
mov dword [rsp + 0x38], 0x190
mov dword [rsp + 0x30], 0x190
mov dword [rsp + 0x28], 0x80000000
mov dword [rsp + 0x20], 0x80000000
call qword [sym.imp.USER32.dll_CreateWindowExW]
mov qword [0x14003f940], rax
test rax, rax
je 0x14000b5d6
mov edx, edi
mov rcx, rax
call qword [sym.imp.USER32.dll_ShowWindow]
mov rcx, qword [0x14003f940]
call qword [sym.imp.USER32.dll_UpdateWindow]
mov rcx, qword [0x14003f940]
mov r8, rsi
mov edx, 0xffffffeb
call qword [sym.imp.USER32.dll_SetWindowLongPtrW]
cmp byte [0x14003bc5d], bpl
jne 0x14000b5cf
cmp dword [0x14003bc60], ebp
jne 0x14000b5cf
xor r8d, r8d
lea r9, str.QuitEvent
xor ecx, ecx
lea edx, [r8 + 1]
call qword [sym.imp.KERNEL32.dll_CreateEventW]
xor r9d, r9d
mov qword [rsp + 0x28], rbp
lea r8, [0x14000ac30]
mov qword [0x14003f928], rax
xor edx, edx
mov dword [rsp + 0x20], ebp
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [0x14003bbf8], rax
mov rax, qword [0x14003f940]
mov rbx, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x78]
mov rsi, qword [rsp + 0x80]
add rsp, 0x60
pop rdi
ret
Function at 0x14000bce0
Capabilities:
Accept command line arguments

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x30
mov rax, qword [0x14003a008]
xor rax, rsp
mov qword [rsp + 0x28], rax
mov rbx, rcx
mov edi, r9d
mov ecx, 0x800
call qword [sym.imp.KERNEL32.dll_SetDefaultDllDirectories]
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov rcx, rax
lea rdx, [rsp + 0x20]
call qword [sym.imp.SHELL32.dll_CommandLineToArgvW]
cmp dword [rsp + 0x20], 1
jne 0x14000bd32
mov r9d, edi
mov rcx, rbx
call fcn.14000b730
jmp 0x14000bd37
call fcn.140005760
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.140024b90
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret

Function at 0x14000e6c0
Capabilities:
Acquire debug privileges

Disassembly:
push rsi
push rdi
push r14
sub rsp, 0x50
mov rax, qword [0x14003a008]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov r14, rcx
xor edx, edx
lea rcx, str.advapi32
mov r8d, 0x800
xor dil, dil
call qword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov rsi, rax
test rax, rax
je 0x14000e82d
mov qword [rsp + 0x78], rbx
lea rdx, str.LookupPrivilegeValueA
mov rcx, rax
mov qword [rsp + 0x80], rbp
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x14002af68]
mov rcx, rsi
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbp, rax
test rbx, rbx
je 0x14000e817
test rax, rax
je 0x14000e817
mov rcx, rbx
call qword [fcn.140006c70]
lea r8, [rsp + 0x30]
xor ecx, ecx
lea rdx, str.SeDebugPrivilege
call rbx
test eax, eax
je 0x14000e7f2
mov rax, qword [rsp + 0x30]
mov rcx, rbp
mov qword [rsp + 0x3c], rax
mov dword [rsp + 0x38], 1
mov dword [rsp + 0x44], 2
call qword [fcn.140006c70]
xor eax, eax
lea r8, [rsp + 0x38]
mov qword [rsp + 0x28], rax
xor edx, edx
mov rcx, r14
mov qword [rsp + 0x20], rax
lea r9d, [rax + 0x10]
call rbp
test eax, eax
je 0x14000e7d6
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x514
je 0x14000e7ba
mov dil, 1
jmp 0x14000e817
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov rcx, rax
lea rdx, str.error:_token_does_not_have_the_specified_privilege._n
call fcn.14000e4e0
jmp 0x14000e817
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, 2
mov ebx, eax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
lea rdx, str.error:_failed_to_adjust_token_privileges___u_._n
jmp 0x14000e80c
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, 2
mov ebx, eax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
lea rdx, str.error:_failed_to_lookup_privilege_value___u_._n
mov r8d, ebx
mov rcx, rax
call fcn.14000e4e0
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rbp, qword [rsp + 0x80]
mov rbx, qword [rsp + 0x78]
movzx eax, dil
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.140024b90
add rsp, 0x50
pop r14
pop rdi
pop rsi
ret
Function at 0x14000e950
Capabilities:
Get file version info

Disassembly:
mov qword [rsp + 0x20], rbp
push rdi
sub rsp, 0x150
mov rax, qword [0x14003a008]
xor rax, rsp
mov qword [rsp + 0x140], rax
mov rdi, rcx
test rcx, rcx
jne 0x14000e98d
mov r8d, 0x104
lea rdx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea rdi, [rsp + 0x30]
lea rdx, [rsp + 0x2c]
mov rcx, rdi
call qword [sym.imp.VERSION.dll_GetFileVersionInfoSizeA]
mov ebp, eax
test eax, eax
jne 0x14000e9a8
xor eax, eax
jmp 0x14000ea33
mov qword [rsp + 0x168], rbx
mov rcx, rbp
mov qword [rsp + 0x170], rsi
xor ebx, ebx
call fcn.140025364
mov r9, rax
mov r8d, ebp
xor edx, edx
mov rcx, rdi
mov rsi, rax
call qword [sym.imp.VERSION.dll_GetFileVersionInfoA]
test eax, eax
je 0x14000ea13
lea r9, [rsp + 0x28]
mov qword [rsp + 0x20], rbx
lea r8, [rsp + 0x20]
mov dword [rsp + 0x28], ebx
lea rdx, [0x140028f3c]
mov rcx, rsi
call qword [sym.imp.VERSION.dll_VerQueryValueW]
test eax, eax
je 0x14000ea13
mov rcx, qword [rsp + 0x20]
mov ebx, dword [rcx + 8]
mov ecx, dword [rcx + 0xc]
shl rbx, 0x20
or rbx, rcx
test rsi, rsi
je 0x14000ea20
mov rcx, rsi
call fcn.140024d38
mov rsi, qword [rsp + 0x170]
mov rax, rbx
mov rbx, qword [rsp + 0x168]
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.140024b90
mov rbp, qword [rsp + 0x178]
add rsp, 0x150
pop rdi
ret

Function at 0x14000ee60
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x40
mov rax, qword [0x14003a008]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov rdi, rcx
lea r9, [rsp + 0x28]
xor ebx, ebx
lea rcx, [0x140028c20]
xor r8d, r8d
mov dword [rsp + 0x20], ebx
xor edx, edx
call qword [sym.imp.SHELL32.dll_SHGetKnownFolderPath]
test eax, eax
je 0x14000eece
lea r9d, [rbx + 0x10]
xor r8d, r8d
lea rdx, str.SHGetKnownFolderPath_FOLDERID_ProgramData__failed.
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
mov qword [rdi + 0x18], 7
lea rdx, [0x140028e8c]
mov qword [rdi + 0x10], rbx
xor r8d, r8d
mov word [rdi], bx
jmp 0x14000eefd
mov rdx, qword [rsp + 0x28]
mov qword [rdi + 0x18], 7
mov qword [rdi + 0x10], rbx
mov word [rdi], bx
cmp word [rdx], bx
je 0x14000eefa
or rbx, 0xffffffffffffffff
nop dword [rax + rax]
inc rbx
cmp word [rdx + rbx*2], 0
jne 0x14000eef0
mov r8, rbx
mov rcx, rdi
call fcn.14000c920
mov rax, rdi
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.140024b90
mov rbx, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret
Function at 0x14000efe0
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x60
mov rax, qword [0x14003a008]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov rbx, rcx
lea r9, [rsp + 0x28]
xor edi, edi
lea rcx, [0x140028c10]
xor r8d, r8d
mov dword [rsp + 0x20], edi
xor edx, edx
call qword [sym.imp.SHELL32.dll_SHGetKnownFolderPath]
test eax, eax
je 0x14000f059
lea r9d, [rdi + 0x10]
xor r8d, r8d
lea rdx, str.SHGetKnownFolderPath_FOLDERID_Documents__failed.
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
mov qword [rbx + 0x18], 7
lea rdx, [0x140028e8c]
mov qword [rbx + 0x10], rdi
xor r8d, r8d
mov rcx, rbx
mov word [rbx], di
call fcn.14000c920
jmp 0x14000f127
mov rdx, qword [rsp + 0x28]
mov qword [rsp + 0x48], 7
mov qword [rsp + 0x40], rdi
mov word [rsp + 0x30], di
cmp word [rdx], di
jne 0x14000f07b
mov r8, rdi
jmp 0x14000f08a
or r8, 0xffffffffffffffff
nop
inc r8
cmp word [rdx + r8*2], di
jne 0x14000f080
lea rcx, [rsp + 0x30]
call fcn.14000c920
mov qword [rbx + 0x18], 7
lea rdx, [rsp + 0x30]
mov qword [rbx + 0x10], rdi
mov rcx, rbx
mov word [rbx], di
call fcn.14000cba0
mov rax, qword [rsp + 0x48]
cmp rax, 8
jb 0x14000f127
mov rcx, qword [rsp + 0x30]
inc rax
movabs rdx, 0x7fffffffffffffff
cmp rax, rdx
jbe 0x14000f0d9
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
add rax, rax
cmp rax, 0x1000
jb 0x14000f122
test byte [rsp + 0x30], 0x1f
je 0x14000f0f2
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rax, qword [rcx - 8]
cmp rax, rcx
jb 0x14000f102
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
sub rcx, rax
cmp rcx, 8
jae 0x14000f112
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
cmp rcx, 0x27
jbe 0x14000f11f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rax
call fcn.140025050
mov rax, rbx
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.140024b90
mov rbx, qword [rsp + 0x78]
add rsp, 0x60
pop rdi
ret
Function at 0x14000f210
Capabilities:
Create directory

Disassembly:
mov r11, rsp
push rdi
sub rsp, 0x60
mov qword [r11 - 0x40], 0xfffffffffffffffe
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rsi
mov rax, qword [0x14003a008]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov rbx, rcx
xor esi, esi
mov dword [rsp + 0x20], esi
lea rcx, [r11 - 0x38]
call fcn.14000f150
nop
lea rdi, [rsp + 0x30]
cmp qword [rsp + 0x48], 8
cmovae rdi, qword [rsp + 0x30]
mov rcx, rdi
call fcn.14000edd0
test al, al
jne 0x14000f291
xor r8d, r8d
mov rdx, rdi
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHCreateDirectoryExW]
test eax, eax
je 0x14000f291
mov rcx, rbx
call fcn.14000efe0
nop
lea rcx, [rsp + 0x30]
call fcn.140005a90
jmp 0x14000f332
mov qword [rbx + 0x18], 7
mov qword [rbx + 0x10], rsi
cmp qword [rbx + 0x18], 8
jb 0x14000f2a9
mov rax, qword [rbx]
jmp 0x14000f2ac
mov rax, rbx
mov word [rax], si
lea rdx, [rsp + 0x30]
mov rcx, rbx
call fcn.14000cba0
nop
mov rax, qword [rsp + 0x48]
cmp rax, 8
jb 0x14000f332
inc rax
mov rcx, qword [rsp + 0x30]
movabs rdx, 0x7fffffffffffffff
cmp rax, rdx
jbe 0x14000f2e6
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
add rax, rax
cmp rax, 0x1000
jb 0x14000f32d
test cl, 0x1f
je 0x14000f2fd
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rax, qword [rcx - 8]
cmp rax, rcx
jb 0x14000f30d
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
sub rcx, rax
cmp rcx, 8
jae 0x14000f31d
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
cmp rcx, 0x27
jbe 0x14000f32a
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rax
call fcn.140025050
mov rax, rbx
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.140024b90
mov rbx, qword [rsp + 0x78]
mov rsi, qword [rsp + 0x80]
add rsp, 0x60
pop rdi
ret

Function at 0x14000f360
Capabilities:
Read .ini file

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x440
mov rax, qword [0x14003a008]
xor rax, rsp
mov qword [rsp + 0x430], rax
movzx eax, r8b
lea rdi, str.True
test al, al
lea r8, str.False
mov rbx, rdx
lea rcx, [rsp + 0x230]
cmovne r8, rdi
lea rdx, [0x140029d34]
call fcn.140010610
lea rax, [0x14002af08]
mov rdx, rbx
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x30]
lea r8, [rsp + 0x230]
mov dword [rsp + 0x20], 0xff
lea rcx, str.Setting
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
xor eax, eax
lea r8, [rsp + 0x30]
mov edx, eax
nop dword [rax + rax]
movzx ecx, word [r8 + rdx*2]
inc rdx
cmp cx, word [rdi + rdx*2 - 2]
jne 0x14000f409
cmp rdx, 5
jne 0x14000f3f0
mov al, 1
jmp 0x14000f43b
lea rdx, [rsp + 0x30]
lea r8, [0x14002b1f0]
nop word [rax + rax]
movzx ecx, word [rdx + rax*2]
inc rax
cmp cx, word [r8 + rax*2 - 2]
jne 0x14000f439
cmp rax, 5
jne 0x14000f420
mov al, 1
jmp 0x14000f43b
xor al, al
mov rcx, qword [rsp + 0x430]
xor rcx, rsp
call fcn.140024b90
mov rbx, qword [rsp + 0x450]
add rsp, 0x440
pop rdi
ret
Function at 0x140012260
Capabilities:
Compare security identifiers

Disassembly:
push rdi
sub rsp, 0x150
mov rax, qword [0x14003a008]
xor rax, rsp
mov qword [rsp + 0x140], rax
xor dil, dil
mov qword [rsp + 0x30], 0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea r8, [rsp + 0x30]
mov edx, 8
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x1400122a8
xor al, al
jmp 0x140012322
mov rcx, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
mov r9d, pe_nt_image_headers64
mov qword [rsp + 0x20], rax
lea r8, [rsp + 0x40]
mov dword [rsp + 0x38], pe_nt_image_headers64
mov edx, 1
call qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
je 0x1400122a4
mov qword [rsp + 0x160], rbx
call fcn.1400121d0
mov rbx, rax
test rax, rax
je 0x14001230b
mov rdx, qword [rsp + 0x40]
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_EqualSid]
test eax, eax
mov rcx, rbx
setne dil
call qword [sym.imp.ADVAPI32.dll_FreeSid]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbx, qword [rsp + 0x160]
movzx eax, dil
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.140024b90
add rsp, 0x150
pop rdi
ret
Function at 0x1400126e0
Capabilities:
Create process on windows
Impersonate user

Disassembly:
push rbp
push rsi
push rdi
push r14
sub rsp, 0x78
mov rax, qword [0x14003a008]
xor rax, rsp
mov qword [rsp + 0x68], rax
mov r14, qword [rsp + 0xc0]
mov rbp, r9
mov rsi, r8
mov rdi, rdx
call fcn.140012630
test al, al
jne 0x14001271a
xor al, al
jmp 0x140012854
call qword [sym.imp.USER32.dll_GetShellWindow]
test rax, rax
je 0x140012713
mov qword [rsp + 0x70], r15
lea rdx, [rsp + 0x50]
xor r15d, r15d
mov rcx, rax
mov dword [rsp + 0x50], r15d
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov r8d, dword [rsp + 0x50]
test r8d, r8d
jne 0x140012751
xor al, al
jmp 0x14001284f
xor edx, edx
mov qword [rsp + 0xa0], rbx
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
test rax, rax
jne 0x140012776
xor dil, dil
jmp 0x140012843
lea r8, [rsp + 0x60]
mov qword [rsp + 0x60], r15
mov edx, 2
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x14001279a
xor dil, dil
jmp 0x14001282a
mov rcx, qword [rsp + 0x60]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
mov r9d, 2
xor r8d, r8d
mov dword [rsp + 0x20], 1
mov edx, 0x18b
mov qword [rsp + 0x58], r15
call qword [sym.imp.ADVAPI32.dll_DuplicateTokenEx]
test eax, eax
je 0x140012817
cmp qword [rsi + 0x18], 8
jb 0x1400127d8
mov rsi, qword [rsi]
cmp qword [rdi + 0x18], 8
jb 0x1400127e2
mov rdi, qword [rdi]
mov rcx, qword [rsp + 0x58]
mov r9, rdi
mov qword [rsp + 0x40], r14
xor r8d, r8d
mov qword [rsp + 0x38], rbp
xor edx, edx
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x28], r15
mov dword [rsp + 0x20], r15d
call qword [sym.imp.ADVAPI32.dll_CreateProcessWithTokenW]
test eax, eax
je 0x140012817
mov dil, 1
jmp 0x14001281a
xor dil, dil
mov rcx, qword [rsp + 0x58]
test rcx, rcx
je 0x14001282a
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x60]
test rcx, rcx
je 0x14001283a
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbx, qword [rsp + 0xa0]
movzx eax, dil
mov r15, qword [rsp + 0x70]
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.140024b90
add rsp, 0x78
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x140012870
Capabilities:
Create process on windows

Disassembly:
mov r11, rsp
push rbx
sub rsp, 0xb0
mov rax, qword [0x14003a008]
xor rax, rsp
mov qword [rsp + 0x70], rax
mov qword [r11 - 0x10], rbp
mov rbp, qword [rsp + 0xe0]
mov qword [r11 - 0x18], rsi
mov rsi, r8
mov qword [r11 - 0x20], rdi
mov rdi, rdx
mov qword [r11 - 0x28], r14
lea rdx, [r11 - 0x50]
mov qword [r11 - 0x30], r15
mov r14, r9
xor r15d, r15d
mov qword [r11 - 0x50], r15
call qword [sym.imp.WTSAPI32.dll_WTSQueryUserToken]
test eax, eax
je 0x14001296b
mov rcx, qword [rsp + 0x68]
test rcx, rcx
je 0x140012970
mov rdx, rcx
mov qword [rsp + 0x60], r15
lea rcx, [rsp + 0x60]
xor r8d, r8d
call qword [sym.imp.USERENV.dll_CreateEnvironmentBlock]
test eax, eax
je 0x14001296b
xor bl, bl
cmp qword [rsi + 0x18], 8
jb 0x1400128fc
mov rsi, qword [rsi]
cmp qword [rdi + 0x18], 8
jb 0x140012906
mov rdi, qword [rdi]
mov rax, qword [rsp + 0x60]
xor r9d, r9d
mov rcx, qword [rsp + 0x68]
mov r8, rdi
mov qword [rsp + 0x50], rbp
xor edx, edx
mov qword [rsp + 0x48], r14
mov qword [rsp + 0x40], rsi
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], 0x400
mov dword [rsp + 0x28], r15d
mov qword [rsp + 0x20], r15
call qword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
test eax, eax
je 0x140012954
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov bl, 1
mov rcx, qword [rsp + 0x60]
test rcx, rcx
je 0x140012964
call qword [sym.imp.USERENV.dll_DestroyEnvironmentBlock]
mov rcx, qword [rsp + 0x68]
jmp 0x140012972
mov rcx, qword [rsp + 0x68]
xor bl, bl
mov r15, qword [rsp + 0x88]
mov r14, qword [rsp + 0x90]
mov rdi, qword [rsp + 0x98]
mov rsi, qword [rsp + 0xa0]
mov rbp, qword [rsp + 0xa8]
test rcx, rcx
je 0x1400129a5
call qword [sym.imp.KERNEL32.dll_CloseHandle]
movzx eax, bl
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.140024b90
add rsp, 0xb0
pop rbx
ret
Function at 0x140013790
Capabilities:
Get common file path
Get startup folder

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x250
mov rax, qword [0x14003a008]
xor rax, rsp
mov qword [rsp + 0x240], rax
xor ebx, ebx
lea rdx, [rsp + 0x30]
mov rdi, rcx
mov dword [rsp + 0x20], ebx
xor ecx, ecx
lea r9d, [rbx + 1]
lea r8d, [rbx + 0x23]
call qword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
mov qword [rdi + 0x18], 7
mov qword [rdi + 0x10], rbx
mov word [rdi], bx
cmp word [rsp + 0x30], bx
je 0x1400137fa
lea rax, [rsp + 0x30]
or rbx, 0xffffffffffffffff
nop dword [rax]
inc rbx
cmp word [rax + rbx*2], 0
jne 0x1400137f0
mov r8, rbx
lea rdx, [rsp + 0x30]
mov rcx, rdi
call fcn.14000c920
mov rax, rdi
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.140024b90
mov rbx, qword [rsp + 0x268]
add rsp, 0x250
pop rdi
ret
Function at 0x140016db0
Capabilities:
Write file on windows

Disassembly:
mov rax, rsp
push rbp
mov rbp, rsp
sub rsp, 0x70
mov qword [rbp - 0x40], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov rax, qword [0x14003a008]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov rdi, rcx
cmp qword [rcx + 0x68], 0
je 0x140016f6e
cmp byte [rcx + 0x71], 0
je 0x140016f6e
mov rax, qword [rcx]
mov rbx, qword [rax + 0x18]
mov rcx, rbx
call qword [fcn.140006c70]
or edx, 0xffffffff
mov rcx, rdi
call rbx
cmp eax, 0xffffffff
jne 0x140016e19
xor al, al
jmp 0x140016f70
mov qword [rbp - 0x18], 0xf
mov qword [rbp - 0x20], 0
mov byte [rbp - 0x30], 0
xor r8d, r8d
lea edx, [r8 + 8]
lea rcx, [rbp - 0x30]
call fcn.140016ca0
nop
mov rcx, qword [rbp - 0x30]
mov r9, qword [rbp - 0x18]
nop word [rax + rax]
lea rdx, [rbp - 0x30]
cmp r9, 0x10
cmovae rdx, rcx
lea r8, [rbp - 0x30]
cmovae r8, rcx
mov r9, qword [rbp - 0x20]
add r9, rdx
lea rax, [rbp - 0x38]
mov qword [rsp + 0x20], rax
lea rdx, [rdi + 0x74]
mov rcx, qword [rdi + 0x68]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x140016e8d
sub eax, 1
jne 0x140016f02
jmp 0x140016e91
mov byte [rdi + 0x71], 0
lea rax, [rbp - 0x30]
mov rcx, qword [rbp - 0x30]
mov r9, qword [rbp - 0x18]
cmp r9, 0x10
cmovae rax, rcx
mov rbx, qword [rbp - 0x38]
sub rbx, rax
je 0x140016edf
lea rax, [rbp - 0x30]
cmp r9, 0x10
cmovae rax, rcx
mov r9, qword [rdi + 0x80]
mov r8, rbx
mov edx, 1
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov r9, qword [rbp - 0x18]
mov rcx, qword [rbp - 0x30]
cmp rbx, rax
jne 0x140016f0f
cmp byte [rdi + 0x71], 0
je 0x140016f13
test rbx, rbx
jne 0x140016e50
xor r8d, r8d
lea edx, [rbx + 8]
lea rcx, [rbp - 0x30]
call fcn.140010030
jmp 0x140016e3e
sub eax, 2
mov r9, qword [rbp - 0x18]
mov rcx, qword [rbp - 0x30]
je 0x140016f13
xor bl, bl
jmp 0x140016f15
mov bl, 1
cmp r9, 0x10
jb 0x140016f69
lea rax, [r9 + 1]
cmp rax, 0x1000
jb 0x140016f64
test byte [rbp - 0x30], 0x1f
je 0x140016f34
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rax, qword [rcx - 8]
cmp rax, rcx
jb 0x140016f44
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
sub rcx, rax
cmp rcx, 8
jae 0x140016f54
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
cmp rcx, 0x27
jbe 0x140016f61
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rax
call fcn.140025050
movzx eax, bl
jmp 0x140016f70
mov al, 1
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.140024b90
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret