joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14006cfd4
Capabilities:
Send data
Send data on socket

Disassembly:
mov rax, rsp
push rbp
push rsi
push rdi
push r12
push r14
sub rsp, 0x80
mov qword [rax - 0x48], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
mov rsi, rcx
mov ecx, WSAAsyncSelect
lea eax, [rcx - 0x54]
mul rcx
lea r12, [rcx - 0x65]
cmovo rax, r12
mov rcx, rax
call qword [sym.imp.msvcrt.dll_void____ptr64___cdecl_operator_new___unsigned_long_long_unsigned___int64__]
mov rdi, rax
xor edx, edx
mov r8d, 0x640
mov rcx, rax
call qword [sym.imp.msvcrt.dll_memset]
nop
lea ebx, [r12 + 2]
mov dword [rsp + 0xb0], ebx
lea rax, [rsp + 0xb0]
mov qword [rdi + 8], rax
mov dword [rdi + 4], 2
mov dword [rdi], 4
mov dword [rsi + 0x87c], ebx
mov qword [rsi + 0x880], rdi
lea r14, [rsi + 0x878]
and dword [r14], 0
lea rbp, [rsi + 0x858]
mov rdx, r14
mov rcx, rbp
call qword [sym.imp.Secur32.dll_ApplyControlToken]
test eax, eax
js 0x14006d164
and qword [rdi + 8], 0
mov dword [rdi + 4], 2
and dword [rdi], 0
mov dword [rsi + 0x87c], ebx
mov qword [rsi + 0x880], rdi
and dword [r14], 0
lea rcx, [rsi + 0x848]
lea rax, [rsp + 0xb8]
mov r9d, 0xc11c
xor r8d, r8d
mov rdx, rbp
cmp byte [rsi + 8], r8b
je 0x14006d0e2
and qword [rsp + 0x40], r8
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r14
and qword [rsp + 0x28], r8
mov dword [rsp + 0x20], reloc.SHELL32.dll_ILFindLastID
call qword [sym.imp.Secur32.dll_AcceptSecurityContext]
jmp 0x14006d115
and qword [rsp + 0x58], 0
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x48], r14
mov qword [rsp + 0x40], rbp
and dword [rsp + 0x38], 0
and qword [rsp + 0x30], 0
mov dword [rsp + 0x28], reloc.SHELL32.dll_ILFindLastID
and dword [rsp + 0x20], 0
call qword [sym.imp.Secur32.dll_InitializeSecurityContextW]
test eax, eax
js 0x14006d164
mov r14, qword [rdi + 8]
mov ebp, dword [rdi]
test r14, r14
je 0x14006d167
test ebp, ebp
je 0x14006d167
xor ebx, ebx
mov r8d, ebp
mov rdx, r14
jmp 0x14006d149
cmp eax, r12d
je 0x14006d159
add ebx, eax
cmp ebx, ebp
je 0x14006d159
mov r8d, ebp
sub r8d, ebx
movsxd rdx, ebx
add rdx, r14
xor r9d, r9d
mov rcx, qword [rsi]
call qword [sym.imp.WS2_32.dll_send]
test eax, eax
jne 0x14006d132
mov rcx, r14
call qword [sym.imp.Secur32.dll_FreeContextBuffer]
jmp 0x14006d167
mov ebx, r12d
mov rcx, rdi
call qword [sym.imp.msvcrt.dll_void___cdecl_operator_delete___void____ptr64_]
mov eax, ebx
mov rbx, qword [rsp + 0xc0]
add rsp, 0x80
pop r14
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x14006fbc0
Capabilities:
Get socket status

Disassembly:
sub rsp, 0x268
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x250], rax
mov r9, qword [rcx + 0x20]
mov rax, qword [rcx + 0x30]
xor r10d, r10d
mov qword [rsp + 0x48], r9
mov qword [rsp + 0x30], 0xa
mov dword [rsp + 0x40], 1
mov ecx, dword [rax + 0x20c]
lea rax, [rsp + 0x30]
lea rdx, [rsp + 0x40]
test cl, 1
lea r8, [rsp + 0x40]
mov qword [rsp + 0x20], rax
cmove rdx, r10
test cl, 2
lea ecx, [r9 + 1]
cmove r8, r10
xor r9d, r9d
call qword [sym.imp.WS2_32.dll_select]
mov rcx, qword [rsp + 0x250]
xor rcx, rsp
call fcn.140001010
add rsp, 0x268
ret
Function at 0x1400737f4
Capabilities:
Capture screenshot

Disassembly:
mov rax, rsp
push rbp
push r14
push r15
lea rbp, [rax - 0x5f]
sub rsp, 0x90
mov qword [rbp + 7], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov rdi, rcx
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetDC]
mov rsi, rax
mov ecx, 1
call qword [sym.imp.USER32.dll_GetSystemMetrics]
mov r14d, eax
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetSystemMetrics]
mov r15d, eax
mov rcx, rsi
call qword [sym.imp.GDI32.dll_CreateCompatibleDC]
mov qword [rdi + 0x18], rax
xor ebx, ebx
cmp qword [rdi + 0x20], rbx
jne 0x14007386a
mov r8d, r14d
mov edx, r15d
mov rcx, rsi
call qword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
mov qword [rdi + 0x20], rax
mov rdx, qword [rdi + 0x20]
mov rcx, qword [rdi + 0x18]
call qword [sym.imp.GDI32.dll_SelectObject]
mov qword [rdi + 0x28], rax
mov dword [rsp + 0x40], 0xcc0020
mov dword [rsp + 0x38], ebx
mov dword [rsp + 0x30], ebx
mov qword [rsp + 0x28], rsi
mov dword [rsp + 0x20], r14d
mov r9d, r15d
xor r8d, r8d
xor edx, edx
mov rcx, qword [rdi + 0x18]
call qword [sym.imp.GDI32.dll_BitBlt]
mov rdx, rsi
xor ecx, ecx
call qword [sym.imp.USER32.dll_ReleaseDC]
mov qword [rbp + 0x67], rbx
lea rcx, [rbp + 0x67]
call qword [sym.imp.msvcrt.dll__time64]
lea rsi, vtable.micro::utils::QString.0
mov qword [rbp + 0xf], rsi
mov qword [rbp + 0x17], rbx
lea r8, str._Y__m__d__H__M__S
lea rdx, [rbp + 0xf]
mov rcx, qword [rbp + 0x67]
call fcn.1400ea534
test al, al
je 0x14007392b
lea rbx, [rdi + 0x20]
lea r8, [rbp + 0xf]
mov rdx, rdi
lea rcx, [rbp + 0x2f]
call fcn.140011d2c
lea r8, str..jpg
mov rdx, rax
lea rcx, [rbp + 0x1f]
call fcn.140008a10
nop
mov rdx, rax
mov rcx, rbx
call fcn.1400f51b0
nop
mov qword [rbp + 0x1f], rsi
lea rcx, [rbp + 0x1f]
call fcn.1400e712c
mov bl, 1
mov qword [rbp + 0xf], rsi
lea rcx, [rbp + 0xf]
call fcn.1400e712c
mov al, bl
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
Function at 0x1400748b4
Capabilities:
Create thread

Disassembly:
push rbx
sub rsp, 0x50
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov rbx, rcx
cmp byte [rcx + 0x98], 0
jne 0x140074a65
mov rax, qword [rcx]
xor edx, edx
call qword [rax + 0x368]
test al, al
je 0x140074ad8
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 0xb]
mov rcx, qword [rbx + 0xb08]
call qword [sym.imp.USER32.dll_SendMessageW]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x1009
mov rcx, qword [rbx + 0xb08]
call qword [sym.imp.USER32.dll_SendMessageW]
xor r9d, r9d
lea edx, [r9 + 0xb]
lea r8d, [r9 + 1]
mov rcx, qword [rbx + 0xb08]
call qword [sym.imp.USER32.dll_SendMessageW]
mov byte [rbx + 0x8c8], 0
and dword [rbx + 0xb70], 0
mov edx, 0x421
mov rcx, qword [rbx + 8]
call qword [sym.imp.USER32.dll_GetDlgItem]
mov rcx, rax
lea rdx, [0x140123250]
call qword [sym.imp.USER32.dll_SetWindowTextW]
mov edx, 0x426
mov rcx, qword [rbx + 8]
call qword [sym.imp.USER32.dll_GetDlgItem]
mov rcx, rax
mov edx, 1
call qword [sym.imp.USER32.dll_EnableWindow]
lea rdx, [rbx + 0xa20]
lea rcx, [rsp + 0x38]
call fcn.1400ea694
nop
lea rcx, [rbx + 0x8d0]
lea rdx, [rsp + 0x38]
call fcn.1400e7b9c
nop
lea rax, vtable.micro::utils::QString.0
mov qword [rsp + 0x38], rax
lea rcx, [rsp + 0x38]
call fcn.1400e712c
lea rdx, [rbx + 0x9e0]
lea rcx, [rbx + 0x8e0]
call fcn.1400e7b9c
lea rdx, [rbx + 0xab8]
lea rcx, [rbx + 0x8f0]
call fcn.1400e7b9c
cmp byte [rbx + 0x98], 0
jne 0x140074ad6
mov rcx, qword [rbx + 0x80]
call qword [sym.imp.KERNEL32.DLL_SetEvent]
mov rcx, qword [rbx + 0x70]
call qword [sym.imp.KERNEL32.DLL_ResetEvent]
lea rax, [rbx + 0xa0]
mov qword [rsp + 0x28], rax
and dword [rsp + 0x20], 0
lea r9, [rbx + 0x58]
lea r8, [method.micro::utils::QArray_void____ptr64_.virtual_0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.DLL_CreateThread]
mov qword [rbx + 0x60], rax
test rax, rax
je 0x140074ad6
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.DLL_WaitForSingleObject]
test eax, eax
je 0x140074a54
cmp eax, 0x102
jne 0x140074ad6
mov byte [rbx + 0x98], 1
jmp 0x140074ad6
mov rcx, qword [rbx + 0x60]
call qword [sym.imp.KERNEL32.DLL_CloseHandle]
and qword [rbx + 0x60], 0
jmp 0x140074ad6
mov edx, 0x421
cmp byte [rcx + 0x99], 0
mov rcx, qword [rcx + 8]
je 0x140074aac
lea r8, [0x140123250]
call qword [sym.imp.USER32.dll_SetDlgItemTextW]
cmp byte [rbx + 0x98], 0
je 0x140074ad6
cmp byte [rbx + 0x99], 0
je 0x140074ad6
mov byte [rbx + 0x99], 0
mov rcx, qword [rbx + 0x80]
call qword [sym.imp.KERNEL32.DLL_SetEvent]
jmp 0x140074ad6
lea r8, [0x140123260]
call qword [sym.imp.USER32.dll_SetDlgItemTextW]
cmp byte [rbx + 0x98], 0
je 0x140074ad6
mov byte [rbx + 0x99], 1
mov rcx, qword [rbx + 0x80]
call qword [sym.imp.KERNEL32.DLL_ResetEvent]
mov al, 1
add rsp, 0x50
pop rbx
ret
Function at 0x140075f5c
Capabilities:
Delete file
Write file on windows

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x6778]
mov eax, 0x6878
call fcn.140001a50
sub rsp, rax
mov qword [rsp + 0x58], 0xfffffffffffffffe
mov rax, qword [section..data]
xor rax, rsp
mov qword [rbp + 0x6760], rax
mov r15, r9
mov qword [rsp + 0x50], r9
mov qword [rsp + 0x30], r8
mov rdi, rcx
lea rcx, [rsp + 0x38]
call fcn.14002e0cc
lea rdx, [0x14010ea73]
xor ebx, ebx
cmp qword [rax + 8], rbx
cmovne rdx, qword [rax + 8]
lea rcx, [rsp + 0x60]
call qword [sym.imp.msvcrt.dll_strcpy]
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x140075fdf
call qword [sym.imp.msvcrt.dll_void___cdecl_operator_delete___void____ptr64_]
mov esi, 1
lea rcx, [rsp + 0x60]
call qword [sym.imp.msvcrt.dll_strlen]
mov rcx, qword [rdi + 0x38]
test rcx, rcx
je 0x14007601b
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], ebx
mov r9d, esi
mov r8, rax
lea rdx, [rsp + 0x60]
call fcn.14009b780
mov rsi, rax
test rax, rax
jne 0x140076036
lea esi, [rax + 1]
mov rax, qword [rdi + 0x30]
cmp dword [rax + 0x220], 0xffffffdb
jne 0x140076193
mov rcx, rdi
call fcn.1400762a4
jmp 0x140075fe4
mov r13, rbx
lea rax, vtable.micro::files::QFile.0
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], rbx
lea rdx, [0x14012da68]
cmp qword [r15 + 8], rbx
cmovne rdx, qword [r15 + 8]
mov r8d, 0x1000
lea rcx, [rsp + 0x38]
call fcn.1400e82c4
cmp qword [rsp + 0x40], rbx
je 0x140076179
mov r15b, bl
mov r14, qword [rsp + 0x30]
xor ecx, ecx
call qword [sym.imp.msvcrt.dll__time64]
mov r12, rax
lea rdx, [rbp + 0x760]
mov rcx, rsi
call fcn.14009b82c
cmp rax, 0xffffffffffffffdb
jne 0x1400760bf
mov rcx, qword [rsi + 0x18]
mov rdx, qword [rcx]
mov rcx, qword [rdx + 0x60]
cmp dword [rcx + 0x94], ebx
je 0x1400760bf
mov rdx, r12
call fcn.140099304
cdqe
test rax, rax
je 0x140076088
cmp eax, 0xffffffdb
jne 0x1400760ce
mov rcx, rdi
call fcn.1400762a4
jmp 0x14007607d
test eax, eax
jle 0x14007613f
movsxd r12, eax
add r13, r12
mov dword [rsp + 0x30], ebx
mov qword [rsp + 0x20], rbx
lea r9, [rsp + 0x30]
mov r8d, eax
lea rdx, [rbp + 0x760]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.DLL_WriteFile]
mov rcx, qword [rdi + 8]
test rcx, rcx
je 0x140076136
mov rax, qword [rcx]
mov r8, r14
mov rdx, r13
call qword [rax + 0x28]
mov rcx, qword [rdi + 8]
mov rax, qword [rcx]
mov rdx, r12
call qword [rax + 0x40]
mov rcx, qword [rdi + 8]
mov rax, qword [rcx]
call qword [rax + 0x48]
movzx r15d, r15b
test al, al
mov eax, 1
cmovne r15d, eax
test r15b, r15b
je 0x14007607d
test r15b, r15b
lea r14, [0x14012da68]
je 0x14007616c
lea rcx, [rsp + 0x38]
call fcn.1400e8500
mov rax, qword [rsp + 0x50]
cmp qword [rax + 8], rbx
cmovne r14, qword [rax + 8]
mov rcx, r14
call qword [sym.imp.KERNEL32.DLL_DeleteFileW]
mov rcx, rsi
call fcn.14009c794
mov ebx, 1
lea rax, vtable.micro::files::QFile.0
mov qword [rsp + 0x38], rax
lea rcx, [rsp + 0x38]
call fcn.1400e8500
mov al, bl
jmp 0x140076195
xor al, al
mov rcx, qword [rbp + 0x6760]
xor rcx, rsp
call fcn.140001010
add rsp, 0x6878
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
Function at 0x1400762a4
Capabilities:
Get socket status

Disassembly:
sub rsp, 0x268
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x250], rax
mov r9, qword [rcx + 0x20]
mov rax, qword [rcx + 0x30]
xor r10d, r10d
mov qword [rsp + 0x48], r9
mov qword [rsp + 0x30], 0xa
mov dword [rsp + 0x40], 1
mov ecx, dword [rax + 0x20c]
lea rdx, [rsp + 0x40]
lea r8, [rsp + 0x40]
test cl, 1
cmove rdx, r10
test cl, 2
cmove r8, r10
cmp r9, 0xffffffffffffffff
setne al
xor r9d, r9d
movzx ecx, al
lea rax, [rsp + 0x30]
inc ecx
mov qword [rsp + 0x20], rax
call qword [sym.imp.WS2_32.dll_select]
mov rcx, qword [rsp + 0x250]
xor rcx, rsp
call fcn.140001010
add rsp, 0x268
ret
Function at 0x14007ca64
Capabilities:
Log keystrokes via polling

Disassembly:
sub rsp, 0x138
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x120], rax
lea rcx, [rsp + 0x20]
call qword [sym.imp.USER32.dll_GetKeyboardState]
test eax, eax
je 0x14007caa5
test byte [rsp + 0x32], 0x80
je 0x14007ca9a
mov eax, 1
jmp 0x14007caa5
movzx eax, byte [rsp + 0xc5]
shr eax, 7
mov rcx, qword [rsp + 0x120]
xor rcx, rsp
call fcn.140001010
add rsp, 0x138
ret
Function at 0x14007f250
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x20
movsxd rbx, r8d
mov r15, rdx
mov rsi, rcx
lea eax, [rbx + 1]
mov ecx, 0x2002
mov r14d, r9d
movsxd rdx, eax
call qword [sym.imp.KERNEL32.DLL_GlobalAlloc]
mov rdi, rax
test rax, rax
je 0x14007f32a
mov rcx, rax
call qword [sym.imp.KERNEL32.DLL_GlobalLock]
mov rbp, rax
test rax, rax
je 0x14007f32a
mov r8, rbx
mov rdx, r15
mov rcx, rax
call qword [sym.imp.msvcrt.dll_memcpy]
mov rcx, rdi
mov byte [rbx + rbp], 0
call qword [sym.imp.KERNEL32.DLL_GlobalUnlock]
mov ebx, 1
mov ebp, 0x8002
test r14d, r14d
jne 0x14007f2e3
mov rcx, qword [rsi + 0x18]
xor r9d, r9d
mov r8d, ebx
mov edx, ebp
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, qword [rsi + 0x18]
call qword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x14007f30a
call qword [sym.imp.USER32.dll_EmptyClipboard]
mov rdx, rdi
mov ecx, ebx
call qword [sym.imp.USER32.dll_SetClipboardData]
call qword [sym.imp.USER32.dll_CloseClipboard]
jmp 0x14007f313
mov rcx, rdi
call qword [sym.imp.KERNEL32.DLL_GlobalFree]
test r14d, r14d
jne 0x14007f32a
mov rcx, qword [rsi + 0x18]
xor r9d, r9d
xor r8d, r8d
mov edx, ebp
call qword [sym.imp.USER32.dll_SendMessageW]
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop rdi
ret
Function at 0x14007f344
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
xor r14d, r14d
movsxd r13, r9d
mov r12, rdx
mov qword [rax - 0x30], r14
mov qword [rax - 0x38], r14
mov rsi, rcx
mov r8, rdx
mov dword [rax - 0x40], r14d
mov r9d, r13d
xor edx, edx
xor ecx, ecx
mov qword [rax - 0x48], r14
call qword [sym.imp.KERNEL32.DLL_WideCharToMultiByte]
mov r15, r13
mov ebp, 0x2002
movsxd rbx, eax
add r15, r15
mov ecx, ebp
mov rdx, r15
mov dword [rsp + 0x88], ebx
call qword [sym.imp.KERNEL32.DLL_GlobalAlloc]
mov rdx, rbx
mov ecx, ebp
mov rdi, rax
call qword [sym.imp.KERNEL32.DLL_GlobalAlloc]
mov rbx, rax
test rdi, rdi
je 0x14007f4d7
mov rcx, rdi
test rax, rax
je 0x14007f4d1
call qword [sym.imp.KERNEL32.DLL_GlobalLock]
mov rbp, rax
test rax, rax
je 0x14007f4e5
mov rcx, rbx
call qword [sym.imp.KERNEL32.DLL_GlobalLock]
mov r14, rax
test rax, rax
je 0x14007f4e5
mov r8, r15
mov rdx, r12
mov rcx, rbp
call qword [sym.imp.msvcrt.dll_memcpy]
and qword [rsp + 0x38], 0
mov eax, dword [rsp + 0x88]
and qword [rsp + 0x30], 0
mov dword [rsp + 0x28], eax
mov r9d, r13d
mov r8, r12
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], r14
call qword [sym.imp.KERNEL32.DLL_WideCharToMultiByte]
mov rcx, rdi
call qword [sym.imp.KERNEL32.DLL_GlobalUnlock]
mov rcx, rbx
call qword [sym.imp.KERNEL32.DLL_GlobalUnlock]
mov ebp, dword [rsp + 0x90]
mov r15d, 1
mov r14d, 0x8002
test ebp, ebp
jne 0x14007f470
mov rcx, qword [rsi + 0x18]
xor r9d, r9d
mov r8d, r15d
mov edx, r14d
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, qword [rsi + 0x18]
call qword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x14007f4a6
call qword [sym.imp.USER32.dll_EmptyClipboard]
mov rdx, rdi
mov ecx, reloc.WS2_32.dll_listen
call qword [sym.imp.USER32.dll_SetClipboardData]
mov rdx, rbx
mov ecx, r15d
call qword [sym.imp.USER32.dll_SetClipboardData]
call qword [sym.imp.USER32.dll_CloseClipboard]
jmp 0x14007f4b8
mov rcx, rdi
call qword [sym.imp.KERNEL32.DLL_GlobalFree]
mov rcx, rbx
call qword [sym.imp.KERNEL32.DLL_GlobalFree]
test ebp, ebp
jne 0x14007f4e5
mov rcx, qword [rsi + 0x18]
xor r9d, r9d
xor r8d, r8d
mov edx, r14d
call qword [sym.imp.USER32.dll_SendMessageW]
jmp 0x14007f4e5
call qword [sym.imp.KERNEL32.DLL_GlobalFree]
test rbx, rbx
je 0x14007f4e5
mov rcx, rbx
call qword [sym.imp.KERNEL32.DLL_GlobalFree]
lea r11, [rsp + 0x40]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret

Function at 0x14007f6bc
Capabilities:
Create thread

Disassembly:
sub rsp, 0x38
lea rax, [rsp + 0x48]
mov r9, rcx
lea r8, [0x14007f504]
mov qword [rsp + 0x28], rax
and dword [rsp + 0x20], 0
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.DLL_CreateThread]
add rsp, 0x38
ret
Function at 0x140088708
Capabilities:
Shutdown system

Disassembly:
mov rax, rsp
push rbp
lea rbp, [rax - 0xd8]
sub rsp, 0x1d0
mov qword [rsp + 0x50], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rdi
mov rbx, rcx
lea rdi, vtable.micro::utils::QString.0
mov qword [rsp + 0x30], rdi
and qword [rsp + 0x38], 0
mov edx, 0x24
lea rcx, [rsp + 0x30]
call fcn.1400e7ab4
or r8d, 0xffffffff
lea rdx, [0x140127bc8]
lea rcx, [rsp + 0x40]
call fcn.1400e6fc8
nop
lea r8, [rbx + 0x10]
mov qword [rsp + 0x28], rbx
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x30]
mov rdx, qword [0x1401847b0]
lea rcx, [rsp + 0x60]
call fcn.1400377f4
nop
mov qword [rsp + 0x40], rdi
lea rcx, [rsp + 0x40]
call fcn.1400e712c
lea rcx, [rsp + 0x60]
call fcn.1400ef56c
mov ebx, 1
cmp rax, rbx
jne 0x1400887cd
call fcn.140088674
test al, al
je 0x1400887cd
mov edx, 0x80020003
lea ecx, [rbx + 5]
call qword [sym.imp.USER32.dll_ExitWindowsEx]
test eax, eax
jne 0x1400887cf
xor bl, bl
lea rax, vtable.mc::MyAskDialog.0
mov qword [rsp + 0x60], rax
lea rcx, [rsp + 0x60]
call fcn.1400ef0d0
nop
mov qword [rsp + 0x30], rdi
lea rcx, [rsp + 0x30]
call fcn.1400e712c
mov al, bl
lea r11, [rsp + 0x1d0]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov rsp, r11
pop rbp
ret

Function at 0x14008880c
Capabilities:
Shutdown system

Disassembly:
mov rax, rsp
push rbp
lea rbp, [rax - 0xd8]
sub rsp, 0x1d0
mov qword [rsp + 0x50], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rdi
mov rbx, rcx
lea rdi, vtable.micro::utils::QString.0
mov qword [rsp + 0x30], rdi
and qword [rsp + 0x38], 0
mov edx, 0x25
lea rcx, [rsp + 0x30]
call fcn.1400e7ab4
or r8d, 0xffffffff
lea rdx, [0x140127bd8]
lea rcx, [rsp + 0x40]
call fcn.1400e6fc8
nop
lea r8, [rbx + 0x10]
mov qword [rsp + 0x28], rbx
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x30]
mov rdx, qword [0x1401847b0]
lea rcx, [rsp + 0x60]
call fcn.1400377f4
nop
mov qword [rsp + 0x40], rdi
lea rcx, [rsp + 0x40]
call fcn.1400e712c
lea rcx, [rsp + 0x60]
call fcn.1400ef56c
mov ebx, 1
cmp rax, rbx
jne 0x1400888d3
call fcn.140088674
test al, al
je 0x1400888d3
mov edx, 0x80020003
mov ecx, 0x400005
call qword [sym.imp.USER32.dll_ExitWindowsEx]
test eax, eax
jne 0x1400888d5
xor bl, bl
lea rax, vtable.mc::MyAskDialog.0
mov qword [rsp + 0x60], rax
lea rcx, [rsp + 0x60]
call fcn.1400ef0d0
nop
mov qword [rsp + 0x30], rdi
lea rcx, [rsp + 0x30]
call fcn.1400e712c
mov al, bl
lea r11, [rsp + 0x1d0]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov rsp, r11
pop rbp
ret
Function at 0x140088914
Capabilities:
Shutdown system

Disassembly:
mov rax, rsp
push rbp
lea rbp, [rax - 0xd8]
sub rsp, 0x1d0
mov qword [rsp + 0x50], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov rbx, rcx
lea rsi, vtable.micro::utils::QString.0
mov qword [rsp + 0x30], rsi
xor edi, edi
mov qword [rsp + 0x38], rdi
lea edx, [rdi + 0x26]
lea rcx, [rsp + 0x30]
call fcn.1400e7ab4
or r8d, 0xffffffff
lea rdx, str.LogOff
lea rcx, [rsp + 0x40]
call fcn.1400e6fc8
nop
lea r8, [rbx + 0x10]
mov qword [rsp + 0x28], rbx
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x30]
mov rdx, qword [0x1401847b0]
lea rcx, [rsp + 0x60]
call fcn.1400377f4
nop
mov qword [rsp + 0x40], rsi
lea rcx, [rsp + 0x40]
call fcn.1400e712c
lea rcx, [rsp + 0x60]
call fcn.1400ef56c
cmp rax, 1
jne 0x1400889cd
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_ExitWindowsEx]
test eax, eax
setne dil
lea rax, vtable.mc::MyAskDialog.0
mov qword [rsp + 0x60], rax
lea rcx, [rsp + 0x60]
call fcn.1400ef0d0
nop
mov qword [rsp + 0x30], rsi
lea rcx, [rsp + 0x30]
call fcn.1400e712c
mov al, dil
lea r11, [rsp + 0x1d0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret

Function at 0x140088a10
Capabilities:
Lock the desktop

Disassembly:
mov rax, rsp
push rbp
lea rbp, [rax - 0xd8]
sub rsp, 0x1d0
mov qword [rsp + 0x50], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov rbx, rcx
lea rsi, vtable.micro::utils::QString.0
mov qword [rsp + 0x30], rsi
xor edi, edi
mov qword [rsp + 0x38], rdi
lea edx, [rdi + 0x27]
lea rcx, [rsp + 0x30]
call fcn.1400e7ab4
or r8d, 0xffffffff
lea rdx, [0x140127c00]
lea rcx, [rsp + 0x40]
call fcn.1400e6fc8
nop
lea r8, [rbx + 0x10]
mov qword [rsp + 0x28], rbx
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x30]
mov rdx, qword [0x1401847b0]
lea rcx, [rsp + 0x60]
call fcn.1400377f4
nop
mov qword [rsp + 0x40], rsi
lea rcx, [rsp + 0x40]
call fcn.1400e712c
lea rcx, [rsp + 0x60]
call fcn.1400ef56c
cmp rax, 1
jne 0x140088ac5
call qword [sym.imp.USER32.dll_LockWorkStation]
test eax, eax
setne dil
lea rax, vtable.mc::MyAskDialog.0
mov qword [rsp + 0x60], rax
lea rcx, [rsp + 0x60]
call fcn.1400ef0d0
nop
mov qword [rsp + 0x30], rsi
lea rcx, [rsp + 0x30]
call fcn.1400e712c
mov al, dil
lea r11, [rsp + 0x1d0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret
Function at 0x14008a650
Capabilities:
Write file on windows

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r14
push r15
mov rbp, rsp
sub rsp, 0x40
mov eax, dword [rcx + 0x70]
mov rbx, rdx
mov r15, rcx
mov dword [rbp + 0x58], eax
mov rax, qword [rdx]
lea rdx, [rbp + 0x58]
mov r8d, 4
mov rcx, rbx
call qword [rax + 0x20]
xor r12d, r12d
mov edi, r12d
cmp dword [rbp + 0x58], r12d
jle 0x14008a7df
mov r14d, r12d
mov rax, qword [r15 + 0x80]
mov rcx, qword [rbx + 8]
lea r9, [rbp + 0x48]
mov rsi, qword [r14 + rax]
mov r8d, reloc.SHELL32.dll_ILFindLastID
mov dword [rbp + 0x48], r12d
lea rdx, [rsi + 8]
mov qword [rsp + 0x20], r12
call qword [sym.imp.KERNEL32.DLL_WriteFile]
mov rcx, qword [rbx + 8]
lea rdx, [rsi + 0x18]
lea r9, [rbp + 0x48]
mov r8d, 4
mov dword [rbp + 0x48], r12d
mov qword [rsp + 0x20], r12
call qword [sym.imp.KERNEL32.DLL_WriteFile]
mov rcx, qword [rbx + 8]
lea rdx, [rsi + 0x30]
lea r9, [rbp + 0x48]
mov r8d, 4
mov dword [rbp + 0x48], r12d
mov qword [rsp + 0x20], r12
call qword [sym.imp.KERNEL32.DLL_WriteFile]
mov rcx, qword [rsi]
mov word [rbp + 0x40], r12w
mov dword [rbp + 0x50], r12d
test rcx, rcx
jne 0x14008a718
mov eax, r12d
jmp 0x14008a71e
call qword [sym.imp.SHELL32.dll_ILGetSize]
mov rcx, qword [rbx + 8]
lea r9, [rbp + 0x50]
lea rdx, [rbp + 0x40]
mov r8d, 2
mov word [rbp + 0x40], ax
mov dword [rbp + 0x50], r12d
mov qword [rsp + 0x20], r12
call qword [sym.imp.KERNEL32.DLL_WriteFile]
test eax, eax
je 0x14008a766
movzx r8d, word [rbp + 0x40]
mov rdx, qword [rsi]
mov rcx, qword [rbx + 8]
lea r9, [rbp + 0x50]
mov dword [rbp + 0x50], r12d
mov qword [rsp + 0x20], r12
call qword [sym.imp.KERNEL32.DLL_WriteFile]
mov rax, qword [rsi + 0x28]
mov dword [rbp + 0x40], r12d
test rax, rax
je 0x14008a778
mov eax, dword [rax - 8]
jmp 0x14008a77b
mov eax, r12d
mov rcx, qword [rbx + 8]
add eax, eax
lea r9, [rbp + 0x40]
lea rdx, [rbp - 0x10]
mov r8d, 4
mov dword [rbp - 0x10], eax
mov dword [rbp + 0x40], r12d
mov qword [rsp + 0x20], r12
call qword [sym.imp.KERNEL32.DLL_WriteFile]
test eax, eax
je 0x14008a7d0
cmp qword [rsi + 0x28], r12
mov r8d, dword [rbp - 0x10]
mov rcx, qword [rbx + 8]
lea rdx, [0x14012da68]
lea r9, [rbp + 0x40]
mov dword [rbp + 0x40], r12d
cmovne rdx, qword [rsi + 0x28]
mov qword [rsp + 0x20], r12
call qword [sym.imp.KERNEL32.DLL_WriteFile]
inc edi
add r14, 8
cmp edi, dword [rbp + 0x58]
jl 0x14008a694
add rsp, 0x40
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret