joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400375d0
Capabilities:
Accept command line arguments

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x50
mov rax, qword [0x140131088]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov rdi, rcx
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
xor ebx, ebx
mov qword [rsp + 0x38], 7
mov qword [rsp + 0x30], rbx
mov word [rsp + 0x20], bx
cmp word [rax], bx
jne 0x140037611
mov r8d, ebx
jmp 0x14003761f
or r8, 0xffffffffffffffff
inc r8
cmp word [rax + r8*2], bx
jne 0x140037615
mov rdx, rax
lea rcx, [rsp + 0x20]
call fcn.140008a20
mov r9d, 5
lea rdx, [0x1400ef1a8]
xor r8d, r8d
lea rcx, [rsp + 0x20]
call fcn.140008900
mov r8, qword [rsp + 0x38]
cmp rax, 0xffffffffffffffff
setne bl
mov byte [rdi + 0xe8], bl
cmp r8, 8
jb 0x140037670
mov rdx, qword [rsp + 0x20]
lea rcx, [rsp + 0x20]
inc r8
call fcn.140008b70
movzx eax, bl
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.14009d860
mov rbx, qword [rsp + 0x68]
add rsp, 0x50
pop rdi
ret

Function at 0x140038460
Capabilities:
Hide graphical window

Disassembly:
push rdi
sub rsp, 0x60
mov qword [rsp + 0x40], 0xfffffffffffffffe
mov qword [rsp + 0x70], rbx
mov rbx, rcx
lea rdi, [rcx + 0x70]
mov qword [rsp + 0x48], rdi
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax]
mov byte [rsp + 0x50], 1
mov eax, dword [rbx + 0xc]
mov dword [rsp + 0x30], eax
lea rax, str._dnd__Resetting__old_mState_ld
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x1e0
lea r9, str.CDNDProxyWnd::reset
lea r8, str...includes_sunloginincludedragdropDNDProxyWnd.cpp
mov edx, 8
lea rcx, [0x1401399a0]
call fcn.14007a380
mov edx, 1
mov rcx, rbx
call fcn.140038580
mov rcx, qword [rbx + 0xa8]
test rcx, rcx
je 0x1400384f1
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
mov qword [rbx + 0xa8], 0
mov rcx, qword [rbx + 0xb0]
test rcx, rcx
je 0x14003850e
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
mov qword [rbx + 0xb0], 0
mov rcx, qword [rbx + 0xb8]
test rcx, rcx
je 0x14003852b
mov qword [rbx + 0xb8], 0
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax]
mov byte [rbx + 8], 0
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov edx, 1
mov rcx, qword [rbx + 0xe0]
call qword [sym.imp.USER32.dll_KillTimer]
xor edx, edx
mov rcx, qword [rbx + 0xe0]
call qword [sym.imp.USER32.dll_ShowWindow]
nop
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rbx, qword [rsp + 0x70]
add rsp, 0x60
pop rdi
ret
Function at 0x1400388e0
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rdi, rcx
mov rcx, qword [rcx + 0x18]
test rcx, rcx
je 0x1400388fc
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rbx, [rdi + 0x14]
mov r9, rdi
mov qword [rsp + 0x28], rbx
lea r8, [0x140038860]
xor edx, edx
mov dword [rsp + 0x20], 0
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rdi + 0x18], rax
lea r9, str.CDNDProxyWnd::Run
mov eax, dword [rbx]
mov edx, 8
mov dword [rsp + 0x30], eax
lea r8, str...includes_sunloginincludedragdropDNDProxyWnd.cpp
lea rax, str._dnd__CDNDProxyWnd::Run__thread_id:__ld
mov qword [rsp + 0x28], rax
lea rcx, [0x1401399a0]
mov dword [rsp + 0x20], 0x295
call fcn.14007a380
mov rbx, qword [rsp + 0x50]
mov al, 1
add rsp, 0x40
pop rdi
ret

Function at 0x14003f570
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x30
mov rbx, rcx
mov edx, 0x3e8
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x14003f5db
cmp eax, 0x102
jne 0x14003f5d0
mov rax, qword [rbx + 8]
movzx ecx, byte [rax + 0x1d0]
test cl, cl
jne 0x14003f5d0
movups xmm0, xmmword [rbx]
lea rcx, [rsp + 0x20]
movaps xmmword [rsp + 0x20], xmm0
call fcn.1400425d0
mov rcx, qword [rbx + 8]
mov r9b, 1
add rcx, 0x20
xor r8d, r8d
mov rdx, rax
mov r10, qword [rcx]
add rsp, 0x30
pop rbx
jmp qword [r10 + reloc.OLEAUT32.dll_VariantClear]
mov rcx, qword [rbx]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rcx, qword [rbx]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbx, qword [rbx + 8]
mov rcx, qword [rbx + 0x1c8]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov qword [rbx + 0x18], 0
add rsp, 0x30
pop rbx
ret
add rcx, 0x30
jmp 0x14003f570
Function at 0x140040290
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
lea rax, str._drag__CDragServer::Stop_start
mov rdi, rcx
mov qword [rsp + 0x28], rax
lea r9, str.CDragServer::Stop
lea r8, str...includes_sunloginincludedragdropDragServer.cpp
mov dword [rsp + 0x20], 0x1f5
mov edx, 8
lea rcx, [0x1401399a0]
call fcn.14007a380
lea rcx, [rdi + 0x60]
call fcn.140041e40
lea rax, str._drag__CDragServer::Stop_ipc
mov edx, 8
mov qword [rsp + 0x28], rax
lea r9, str.CDragServer::Stop
lea r8, str...includes_sunloginincludedragdropDragServer.cpp
mov dword [rsp + 0x20], 0x1f7
lea rcx, [0x1401399a0]
call fcn.14007a380
mov rbx, qword [rdi + 0xd0]
xor esi, esi
test rbx, rbx
je 0x14004035a
lea rcx, [rbx + 0x60]
call fcn.14006d210
mov rcx, qword [rbx + 0x6c8]
test rcx, rcx
je 0x14004033a
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
mov qword [rbx + 0x6c8], rsi
mov rcx, qword [rdi + 0xd0]
test rcx, rcx
je 0x140040353
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
mov qword [rdi + 0xd0], rsi
lea rax, str._drag__CDragServer::Stop_process
mov edx, 8
mov qword [rsp + 0x28], rax
lea r9, str.CDragServer::Stop
lea r8, str...includes_sunloginincludedragdropDragServer.cpp
mov dword [rsp + 0x20], 0x1fd
lea rcx, [0x1401399a0]
call fcn.14007a380
mov rbx, qword [rdi + 0xd8]
test rbx, rbx
je 0x1400403ec
cmp byte [rdi + 0xe9], sil
je 0x1400403ec
movzx eax, byte [rbx + 0x1d0]
test al, al
jne 0x1400403ec
mov rcx, qword [rbx + 0x1c8]
mov edx, 0x7d0
mov byte [rbx + 0x1d0], 1
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x1400403e8
mov rcx, qword [rbx + 0x18]
test rcx, rcx
je 0x1400403e8
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rcx, qword [rbx + 0x18]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbx + 0x18], rsi
lea rax, str._drag__CDragServer::Stop_finish
mov edx, 8
mov qword [rsp + 0x28], rax
lea r9, str.CDragServer::Stop
lea r8, str...includes_sunloginincludedragdropDragServer.cpp
mov dword [rsp + 0x20], 0x204
lea rcx, [0x1401399a0]
call fcn.14007a380
mov rbx, qword [rsp + 0x40]
mov eax, 1
mov dword [rdi + 0x40], esi
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret

Function at 0x140041cd0
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x30
mov rbx, rcx
mov edx, 0x3e8
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x14003f5db
cmp eax, 0x102
jne 0x14003f5d0
mov rax, qword [rbx + 8]
movzx ecx, byte [rax + 0x1d0]
test cl, cl
jne 0x14003f5d0
movups xmm0, xmmword [rbx]
lea rcx, [rsp + 0x20]
movaps xmmword [rsp + 0x20], xmm0
call fcn.1400425d0
mov rcx, qword [rbx + 8]
mov r9b, 1
add rcx, 0x20
xor r8d, r8d
mov rdx, rax
mov r10, qword [rcx]
add rsp, 0x30
pop rbx
jmp qword [r10 + reloc.OLEAUT32.dll_VariantClear]
mov rcx, qword [rbx]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rcx, qword [rbx]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbx, qword [rbx + 8]
mov rcx, qword [rbx + 0x1c8]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov qword [rbx + 0x18], 0
add rsp, 0x30
pop rbx
ret
add rcx, 0x30
jmp 0x14003f570
Function at 0x140043b20
Capabilities:
Send data
Send data on socket

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov rdi, rcx
mov ebx, edx
mov rcx, qword [rcx + 0x178]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov rcx, qword [rdi + 0x160]
mov dword [rsp + 0x48], ebx
cmp rcx, 0xffffffffffffffff
je 0x140043b85
xor r9d, r9d
mov dword [rsp + 0x28], reloc.WS2_32.dll_recv
lea rax, [rdi + 0x168]
lea rdx, [rsp + 0x48]
mov qword [rsp + 0x20], rax
lea r8d, [r9 + 4]
call qword [sym.imp.WS2_32.dll_sendto]
cmp eax, 4
jl 0x140043b85
mov al, 1
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
xor al, al
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret

Function at 0x140044ab0
Capabilities:
Log keystrokes

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
mov rbp, rsp
sub rsp, 0x60
cmp byte [rcx + 0x40], 0
mov rbx, rcx
jne 0x140044bd5
cmp dword [rcx + 0x38], 0
jle 0x140044bd5
cmp dword [rcx + 0x3c], 0
jle 0x140044bd5
xor eax, eax
mov qword [rsp + 0x78], rdi
mov edi, 0x1b
mov qword [rbp - 0x30], rax
mov qword [rbp - 0x28], rax
mov ecx, edi
xor edx, edx
mov qword [rbp - 0x20], rax
mov qword [rbp - 0x18], rax
mov qword [rbp - 0x10], rax
mov dword [rbp - 0x30], 1
mov word [rbp - 0x28], di
call qword [sym.imp.USER32.dll_MapVirtualKeyW]
lea r8d, [rdi + 0xd]
mov dword [rbp - 0x24], 0
lea rdx, [rbp - 0x30]
mov word [rbp - 0x26], ax
lea ecx, [rdi - 0x1a]
call qword [sym.imp.USER32.dll_SendInput]
mov edx, 0xfffffed4
mov ecx, edx
call qword [sym.imp.USER32.dll_SetCursorPos]
mov eax, dword [rbx + 0x3c]
mov dl, 2
mov r9d, dword [rbx + 0x38]
mov dword [rbp + 0x10], 0xfffffed4
mov dword [rbp + 0x14], 0xfffffed4
mov rcx, qword [rbp + 0x10]
mov dword [rsp + 0x20], eax
call fcn.140044c80
lea ecx, [rdi - 0x16]
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, [rbp + 0x10]
call qword [sym.imp.USER32.dll_GetCursorPos]
mov eax, dword [rbx + 0x3c]
mov dl, 4
mov r9d, dword [rbx + 0x38]
mov rcx, qword [rbp + 0x10]
mov dword [rsp + 0x20], eax
call fcn.140044c80
xor eax, eax
xor edx, edx
mov qword [rbp - 0x30], rax
mov ecx, edi
mov qword [rbp - 0x28], rax
mov dword [rbp - 0x30], 1
mov word [rbp - 0x28], di
mov qword [rbp - 0x20], rax
mov qword [rbp - 0x18], rax
mov qword [rbp - 0x10], rax
call qword [sym.imp.USER32.dll_MapVirtualKeyW]
lea r8d, [rdi + 0xd]
mov dword [rbp - 0x24], 2
lea rdx, [rbp - 0x30]
mov word [rbp - 0x26], ax
lea ecx, [rdi - 0x1a]
call qword [sym.imp.USER32.dll_SendInput]
mov rdi, qword [rsp + 0x78]
xor eax, eax
mov rbx, qword [rsp + 0x80]
add rsp, 0x60
pop rbp
ret
Function at 0x1400454b0
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], r8
push rdi
sub rsp, 0x50
cmp byte [0x140139106], 0
mov rdi, r9
mov esi, edx
mov rbx, rcx
je 0x1400454ee
mov dword [r9], 0
xor eax, eax
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x50
pop rdi
ret
cmp byte [rcx + 0x18], 0
je 0x1400454d5
mov dword [r9], 1
cmp qword [rcx + 0x20], 0
je 0x1400455a0
cmp dword [rcx + 0x28], 0
jne 0x140045514
call qword [sym.imp.KERNEL32.dll_GetTickCount]
jmp 0x140045524
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, eax
sub ecx, dword [rbx + 0x28]
cmp ecx, 0x32
jb 0x1400455a0
mov rcx, qword [rsp + 0x70]
mov edx, dword [rsp + 0x74]
mov dword [rbx + 0x28], eax
mov rax, qword [rbx + 0x2c]
mov qword [rbx + 0x2c], rcx
cmp eax, ecx
jne 0x140045544
shr rax, 0x20
cmp eax, edx
je 0x1400455a0
mov dword [rsp + 0x40], edx
lea r9, str.CDropTarget::DragOver
mov dword [rsp + 0x38], ecx
lea rax, str.__s__x_d__y_d
mov qword [rsp + 0x30], r9
lea r8, str...includes_sunloginincludedragdropDropTarget.cpp
mov qword [rsp + 0x28], rax
lea rcx, [0x1401399a0]
mov edx, 8
mov dword [rsp + 0x20], 0xd4
call fcn.14007a380
mov rcx, qword [rbx + 0x20]
mov edx, esi
mov r8, qword [rsp + 0x70]
mov rax, qword [rcx]
call qword [rax + 0x20]
cmp eax, 0xffffffff
jne 0x1400455a0
mov dword [rdi], 0
mov rbx, qword [rsp + 0x60]
xor eax, eax
mov rsi, qword [rsp + 0x68]
add rsp, 0x50
pop rdi
ret
Function at 0x14004b1e0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
sub rsp, 0x20
mov rbx, rdx
mov rbp, rcx
xor edx, edx
mov rcx, rbx
lea r8d, [rdx + 2]
call fcn.1400b0354
test eax, eax
je 0x14004b212
mov eax, 0xfffffffd
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop rbp
ret
mov rcx, rbx
call fcn.1400afd5c
test eax, eax
js 0x14004b202
jne 0x14004b22d
xor eax, eax
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop rbp
ret
mov qword [rsp + 0x30], rsi
movsxd rsi, eax
mov rcx, rsi
mov qword [rsp + 0x38], rdi
call fcn.14009e2ac
mov rdi, rax
test rax, rax
jne 0x14004b24f
lea eax, [rdi - 2]
jmp 0x14004b29d
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call fcn.1400b0354
mov r9, rbx
mov r8, rsi
mov edx, 1
mov rcx, rdi
call fcn.1400b10b0
cmp rax, rsi
je 0x14004b283
mov rcx, rdi
call fcn.14009de9c
mov eax, 0xfffffffd
jmp 0x14004b29d
mov r8, rax
mov rdx, rdi
mov rcx, rbp
call fcn.14004b2c0
mov rcx, rdi
mov ebx, eax
call fcn.14009de9c
mov eax, ebx
mov rsi, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop rbp
ret
Function at 0x14004f120
Capabilities:
Check if file exists

Disassembly:
mov rax, rsp
push rsi
push rdi
push r14
sub rsp, 0x90
mov qword [rax - 0x70], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbp
mov rax, qword [0x140131088]
xor rax, rsp
mov qword [rsp + 0x80], rax
mov rbx, rcx
xor dil, dil
xor edx, edx
xor ecx, ecx
mov r8d, 0x80000000
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov r14, rax
test rax, rax
je 0x14004f31e
mov r8d, 1
mov rdx, rbx
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov rbp, rax
test rax, rax
je 0x14004f315
lea r9, [rsp + 0x30]
xor r8d, r8d
xor edx, edx
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_QueryServiceConfigW]
test eax, eax
jne 0x14004f30c
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x14004f30c
mov ebx, dword [rsp + 0x30]
mov edx, ebx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov rsi, rax
lea r9, [rsp + 0x30]
mov r8d, ebx
mov rdx, rax
mov rcx, rbp
call qword [sym.imp.ADVAPI32.dll_QueryServiceConfigW]
test eax, eax
je 0x14004f2fe
mov rdx, qword [rsi + 0x10]
mov qword [rsp + 0x58], 7
xor ebx, ebx
mov qword [rsp + 0x50], rbx
mov word [rsp + 0x40], bx
cmp word [rdx], bx
jne 0x14004f20a
mov r8d, ebx
jmp 0x14004f21a
or r8, 0xffffffffffffffff
nop
inc r8
cmp word [rdx + r8*2], bx
jne 0x14004f210
lea rcx, [rsp + 0x40]
call fcn.140008a20
nop
mov r9d, 4
xor r8d, r8d
lea rdx, str..exe
lea rcx, [rsp + 0x40]
call fcn.140008900
cmp eax, 0xffffffff
je 0x14004f286
add eax, 4
movsxd r9, eax
xor r8d, r8d
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x40]
call fcn.140008ff0
mov rdx, rax
lea rcx, [rsp + 0x40]
call fcn.14002dea0
mov r8, qword [rsp + 0x78]
cmp r8, 8
jb 0x14004f286
inc r8
mov rdx, qword [rsp + 0x60]
lea rcx, [rsp + 0x60]
call fcn.140008b70
mov r9d, 1
xor r8d, r8d
lea rdx, [0x1400ee384]
lea rcx, [rsp + 0x40]
call fcn.140008900
cmp eax, 0xffffffff
je 0x14004f2c4
movsxd rdx, eax
mov qword [rsp + 0x20], rbx
lea r9, [0x1400e6c40]
mov r8d, 1
lea rcx, [rsp + 0x40]
call fcn.14002f290
lea rcx, [rsp + 0x40]
cmp qword [rsp + 0x58], 8
cmovae rcx, qword [rsp + 0x40]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
setne dil
mov r8, qword [rsp + 0x58]
cmp r8, 8
jb 0x14004f2fe
inc r8
mov rdx, qword [rsp + 0x40]
lea rcx, [rsp + 0x40]
call fcn.140008b70
test rsi, rsi
je 0x14004f30c
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, rbp
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
movzx eax, dil
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.14009d860
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
Function at 0x14004f350
Capabilities:
Create process on windows
Terminate process

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
sub rsp, 0x310
mov qword [rsp + 0x70], 0xfffffffffffffffe
mov rax, qword [0x140131088]
xor rax, rsp
mov qword [rsp + 0x300], rax
mov ebp, r9d
mov rdi, rdx
mov rbx, rcx
xor edx, edx
lea r8d, [rdx + 0x68]
lea rcx, [rsp + 0x80]
call fcn.1400a1560
mov dword [rsp + 0x80], WSAGetLastError
mov rcx, rbx
lea rdx, [rsp + 0xf0]
sub rdx, rbx
nop
movzx eax, word [rcx]
mov word [rdx + rcx], ax
lea rcx, [rcx + 2]
test ax, ax
jne 0x14004f3b0
lea rcx, [rsp + 0xf0]
call qword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
call fcn.140007ac0
mov rcx, rax
test rax, rax
jne 0x14004f3e6
mov ecx, 0x80004005
call fcn.140009900
int3
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x50], rax
lea r14, [0x1400ee384]
or rsi, 0xffffffffffffffff
mov rax, rsi
inc rax
cmp word [r14 + rax*2], 0
jne 0x14004f403
mov r8d, eax
mov rdx, r14
lea rcx, [rsp + 0x50]
call fcn.14002f050
test rbx, rbx
jne 0x14004f427
xor eax, eax
jmp 0x14004f43a
mov rax, rsi
nop word [rax + rax]
inc rax
cmp word [rbx + rax*2], 0
jne 0x14004f430
mov r8d, eax
mov rdx, rbx
lea rcx, [rsp + 0x50]
call fcn.14002f050
mov rax, rsi
nop dword [rax]
inc rax
cmp word [r14 + rax*2], 0
jne 0x14004f450
mov r8d, eax
mov rdx, r14
lea rcx, [rsp + 0x50]
call fcn.14002f050
test rdi, rdi
je 0x14004f4ba
lea rdx, [0x1400f20dc]
mov rax, rsi
nop word [rax + rax]
inc rax
cmp word [rdx + rax*2], 0
jne 0x14004f480
mov r8d, eax
lea rcx, [rsp + 0x50]
call fcn.14002f050
mov rax, rsi
nop word [rax + rax]
inc rax
cmp word [rdi + rax*2], 0
jne 0x14004f4a0
mov r8d, eax
mov rdx, rdi
lea rcx, [rsp + 0x50]
call fcn.14002f050
lea rax, [rsp + 0x58]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x80]
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0xf0]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x20
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
mov rbx, qword [rsp + 0x50]
mov rdx, rbx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x14004f544
imul edx, ebp, 0x3e8
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov edi, eax
xor edx, edx
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test edi, edi
sete dil
jmp 0x14004f547
xor dil, dil
lea rdx, [rbx - 0x18]
lock xadd dword [rdx + 0x10], esi
sub esi, 1
jg 0x14004f55f
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
movzx eax, dil
mov rcx, qword [rsp + 0x300]
xor rcx, rsp
call fcn.14009d860
add rsp, 0x310
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x14004f590
Capabilities:
Create process on windows
Terminate process

Disassembly:
mov rax, rsp
push r14
sub rsp, 0xb0
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov esi, r9d
mov rbp, rdx
mov rbx, rcx
call fcn.14004f770
test al, al
je 0x14004f5da
mov r9d, esi
mov rdx, rbp
mov rcx, rbx
call fcn.14004f350
jmp 0x14004f74d
call fcn.140007ac0
mov rcx, rax
test rax, rax
jne 0x14004f5f2
mov ecx, 0x80004005
call fcn.140009900
int3
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0xe0], rax
lea r14, [0x1400ee384]
or rdi, 0xffffffffffffffff
mov rax, rdi
inc rax
cmp word [r14 + rax*2], 0
jne 0x14004f612
mov r8d, eax
mov rdx, r14
lea rcx, [rsp + 0xe0]
call fcn.14002f050
test rbx, rbx
jne 0x14004f639
xor eax, eax
jmp 0x14004f64a
mov rax, rdi
nop dword [rax]
inc rax
cmp word [rbx + rax*2], 0
jne 0x14004f640
mov r8d, eax
mov rdx, rbx
lea rcx, [rsp + 0xe0]
call fcn.14002f050
mov rax, rdi
inc rax
cmp word [r14 + rax*2], 0
jne 0x14004f660
mov r8d, eax
mov rdx, r14
lea rcx, [rsp + 0xe0]
call fcn.14002f050
xor edx, edx
lea r8d, [rdx + 0x6c]
lea rcx, [rsp + 0x44]
call fcn.1400a1560
mov dword [rsp + 0x40], reloc.WS2_32.dll_WSASetLastError
mov dword [rsp + 0x44], 0x4040
mov rbx, qword [rsp + 0xe0]
mov qword [rsp + 0x58], rbx
lea rax, str.runas
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x68], 0
mov dword [rsp + 0x70], 1
mov qword [rsp + 0x60], rbp
lea rcx, [rsp + 0x40]
call qword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
setne al
test al, al
je 0x14004f72e
imul edx, esi, 0x3e8
mov rcx, qword [rsp + 0xa8]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov esi, eax
mov rcx, qword [rsp + 0xa8]
test rcx, rcx
je 0x14004f726
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rcx, qword [rsp + 0xa8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0xa8], 0
test esi, esi
sete sil
jmp 0x14004f731
xor sil, sil
lea rdx, [rbx - 0x18]
lock xadd dword [rdx + 0x10], edi
sub edi, 1
jg 0x14004f749
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
movzx eax, sil
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop r14
ret
Function at 0x14004f770
Capabilities:
Get token membership

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x80
mov rax, qword [0x140131088]
xor rax, rsp
mov qword [rsp + 0x78], rax
xor ebx, ebx
mov word [rsp + 0x74], 0x500
lea rax, [rsp + 0x68]
mov dword [rsp + 0x60], ebx
mov qword [rsp + 0x50], rax
lea rcx, [rsp + 0x70]
mov dword [rsp + 0x48], ebx
mov r9d, 0x220
mov dword [rsp + 0x40], ebx
lea r8d, [rbx + 0x20]
mov dword [rsp + 0x38], ebx
mov dl, 2
mov dword [rsp + 0x30], ebx
mov edi, ebx
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], ebx
mov qword [rsp + 0x68], rbx
mov dword [rsp + 0x70], ebx
call qword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
je 0x14004f7f7
mov rdx, qword [rsp + 0x68]
lea r8, [rsp + 0x60]
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
test eax, eax
jne 0x14004f7ff
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov rcx, qword [rsp + 0x68]
test rcx, rcx
je 0x14004f80f
call qword [sym.imp.ADVAPI32.dll_FreeSid]
test edi, edi
je 0x14004f817
xor al, al
jmp 0x14004f81e
cmp dword [rsp + 0x60], ebx
setne al
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.14009d860
mov rbx, qword [rsp + 0x90]
add rsp, 0x80
pop rdi
ret

Function at 0x140053260
Capabilities:
Read clipboard data

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x30
mov rbx, qword [rcx + 0x18]
mov r14d, r8d
mov rdi, rdx
mov rbp, rcx
mov dword [rsp + 0x20], 0
cmp rbx, qword [rcx + 0x20]
je 0x1400532bb
nop word [rax + rax]
mov rsi, qword [rbx]
mov rcx, rsi
mov rax, qword [rsi]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
cmp eax, r14d
je 0x1400532ec
add rbx, 8
cmp rbx, qword [rbp + 0x20]
jne 0x1400532a0
mov qword [rdi + 0x18], reloc.WS2_32.dll_ntohs
mov qword [rdi + 0x10], 0
mov byte [rdi], 0
mov rbx, qword [rsp + 0x40]
mov rax, rdi
mov rdi, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop r14
ret
mov rax, qword [rsi]
mov rcx, rsi
call qword [rax + reloc.WS2_32.dll_recv]
mov ecx, eax
call qword [sym.imp.USER32.dll_GetClipboardData]
mov r8, rax
test rax, rax
je 0x1400532bb
mov rax, qword [rsi]
mov rdx, rdi
mov rcx, rsi
call qword [rax + 0x20]
jmp 0x1400532ce