joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400018d8
Capabilities:
Create thread

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x20
mov rsi, qword [str.AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA]
movsxd rcx, dword [rsi + 4]
call sub.msvcrt.dll_malloc
mov rdi, qword [sym.imp.KERNEL32.dll_Sleep]
mov rbx, rax
mov ecx, 0x400
call rdi
mov edx, dword [rsi + 4]
mov rcx, rbx
call fcn.1400017e6
test eax, eax
je 0x1400018a1
mov edx, dword [rsi + 4]
lea r8, [rsi + 8]
mov rcx, rbx
call fcn.14000167f
mov rcx, rbx
call sub.msvcrt.dll_free
xor eax, eax
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret
sub rsp, 0x68
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, 0x26aa
xor edx, edx
mov r9d, 0x5c
div ecx
mov dword [rsp + 0x50], 0x5c
mov dword [rsp + 0x48], 0x65
mov dword [rsp + 0x40], 0x70
mov dword [rsp + 0x38], 0x69
mov dword [rsp + 0x30], 0x70
mov dword [rsp + 0x28], 0x5c
mov dword [rsp + 0x20], 0x2e
mov r8d, 0x5c
lea rcx, [0x14000d040]
mov dword [rsp + 0x58], edx
lea rdx, str._c_c_c_c_c_c_c_c_cnetsvc_d
call fcn.1400016f0
xor eax, eax
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], edx
xor r9d, r9d
lea r8, [0x1400017c8]
xor edx, edx
mov qword [rsp + 0x28], rax
call qword [sym.imp.KERNEL32.dll_CreateThread]
xor ecx, ecx
add rsp, 0x68
jmp 0x140001880

Function at 0x140001ce0
Capabilities:
Write file on windows

Disassembly:
push rsi
push rbx
sub rsp, 0x38
mov rbx, rcx
lea rax, [rsp + 0x58]
mov ecx, 2
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x68], r9
mov qword [rsp + 0x28], rax
call fcn.140007a10
mov r8d, 0x1b
mov edx, 1
lea rcx, str.Mingw_w64_runtime_failure:_n
mov r9, rax
call sub.msvcrt.dll_fwrite
mov rsi, qword [rsp + 0x28]
mov ecx, 2
call fcn.140007a10
mov rdx, rbx
mov rcx, rax
mov r8, rsi
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
nop
nop dword [rax]
Function at 0x140001d50
Capabilities:
Allocate or change rwx memory

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x50
movsxd rsi, dword [0x14000d124]
mov rbx, rcx
test esi, esi
jle 0x140001e80
mov rax, qword [0x14000d128]
xor r9d, r9d
add rax, 0x18
nop word [rax + rax]
mov r8, qword [rax]
cmp rbx, r8
jb 0x140001d9b
mov rdx, qword [rax + 8]
mov edx, dword [rdx + 8]
add r8, rdx
cmp rbx, r8
jb 0x140001e25
add r9d, 1
add rax, 0x28
cmp r9d, esi
jne 0x140001d80
mov rcx, rbx
call fcn.1400027c0
mov rdi, rax
test rax, rax
je 0x140001ea2
mov rax, qword [0x14000d128]
lea rbx, [rsi + rsi*4]
shl rbx, 3
add rax, rbx
mov qword [rax + 0x20], rdi
mov dword [rax], 0
call fcn.140002900
mov edx, dword [rdi + 0xc]
mov r8d, 0x30
lea rcx, [rax + rdx]
mov rax, qword [0x14000d128]
lea rdx, [rsp + 0x20]
mov qword [rax + rbx + 0x18], rcx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x140001e87
mov eax, dword [rsp + 0x44]
lea edx, [rax - 4]
and edx, 0xfffffffb
je 0x140001e1e
lea edx, [rax - 0x40]
and edx, 0xffffffbf
jne 0x140001e30
add dword [0x14000d124], 1
add rsp, 0x50
pop rbx
pop rsi
pop rdi
ret
cmp eax, 2
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x38]
mov r8d, 0x40
mov eax, 4
cmove r8d, eax
add rbx, qword [0x14000d128]
mov qword [rbx + 8], rcx
mov r9, rbx
mov qword [rbx + 0x10], rdx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x140001e1e
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.__VirtualProtect_failed_with_code_0x_x
mov edx, eax
call fcn.140001ce0
nop dword [rax]
xor esi, esi
jmp 0x140001da8
mov rax, qword [0x14000d128]
mov edx, dword [rdi + 8]
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov r8, qword [rax + rbx + 0x18]
call fcn.140001ce0
mov rdx, rbx
lea rcx, str.Address__p_has_no_image_section
call fcn.140001ce0
nop
nop word cs:[rax + rax]
nop dword [rax]

Function at 0x140002430
Capabilities:
Get thread local storage value

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
lea r12, [0x14000d180]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x14000d160]
test rbx, rbx
je 0x14000248c
mov rbp, qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax]
mov ecx, dword [rbx]
call rbp
mov rsi, rax
call rdi
test rsi, rsi
je 0x140002483
test eax, eax
jne 0x140002483
mov rax, qword [rbx + 8]
mov rcx, rsi
call rax
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x140002468
mov rcx, r12
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
Function at 0x1400027c0
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov rdx, qword [0x14000a770]
xor eax, eax
cmp word [rdx], 0x5a4d
jne 0x1400027e0
movsxd r8, dword [rdx + 0x3c]
add r8, rdx
cmp dword [r8], 0x4550
je 0x1400027e8
ret
cmp word [r8 + 0x18], 0x20b
jne 0x1400027e0
movzx eax, word [r8 + 0x14]
sub rcx, rdx
lea rax, [r8 + rax + 0x18]
movzx r8d, word [r8 + 6]
test r8w, r8w
je 0x14000283d
lea edx, [r8 - 1]
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
nop word cs:[rax + rax]
mov r8d, dword [rax + 0xc]
mov rdx, r8
cmp rcx, r8
jb 0x140002834
add edx, dword [rax + 8]
cmp rcx, rdx
jb 0x1400027e0
add rax, 0x28
cmp rax, r9
jne 0x140002820
xor eax, eax
ret

Function at 0x140002840
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x14000a770]
xor ecx, ecx
cmp word [rax], 0x5a4d
jne 0x14000285f
movsxd rdx, dword [rax + 0x3c]
add rax, rdx
cmp dword [rax], 0x4550
je 0x140002868
mov eax, ecx
ret
cmp word [rax + 0x18], 0x20b
jne 0x14000285f
movzx ecx, word [rax + 6]
mov eax, ecx
ret

Function at 0x140002900
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x14000a770]
xor edx, edx
cmp word [rax], 0x5a4d
jne 0x14000291f
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
je 0x140002928
mov rax, rdx
ret
cmp word [rcx + 0x18], 0x20b
cmove rdx, rax
mov rax, rdx
ret
Function at 0x140001070
Capabilities:
Create process on windows
Protect spawned processes with mitigation policies

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0xf0
mov rax, qword [section..data]
xor rax, rsp
mov qword [rbp + 0x4f], rax
xorps xmm0, xmm0
lea rdi, [rbp - 0x29]
xor eax, eax
lea r9, [rbp - 0x49]
movups xmmword [rbp + 0xf], xmm0
mov qword [rbp + 0x3f], rax
mov ecx, 0x70
movups xmmword [rbp - 0x21], xmm0
mov qword [rbp - 0x31], rax
xor ebx, ebx
movups xmmword [rbp - 0x11], xmm0
xor r8d, r8d
lea edx, [rax + 1]
movups xmmword [rbp - 1], xmm0
mov qword [rbp - 0x49], rbx
movups xmmword [rbp + 0x1f], xmm0
movups xmmword [rbp + 0x2f], xmm0
rep stosb byte [rdi], al
movups xmmword [rbp - 0x41], xmm0
lea rdi, [rbp - 0x41]
mov dword [rbp - 0x29], 0x70
mov ecx, 0x18
mov dword [rbp + 0x13], 0x80000
rep stosb byte [rdi], al
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_InitializeProcThreadAttributeList]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, qword [rbp - 0x49]
lea edx, [rbx + 8]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
lea r9, [rbp - 0x49]
xor r8d, r8d
mov rcx, rax
lea edx, [rbx + 1]
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_InitializeProcThreadAttributeList]
test eax, eax
jne 0x140001143
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.____InitializeProcThreadAttributeList_Failed_With_Error_:__d__n
call fcn.140001010
jmp 0x140001226
movabs rax, 0x100000000000
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x28], rbx
lea r9, [rbp + 0x47]
xor edx, edx
mov qword [rbp + 0x47], rax
mov r8d, 0x20007
mov qword [rsp + 0x20], 8
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_UpdateProcThreadAttribute]
test eax, eax
jne 0x140001196
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.____UpdateProcThreadAttribute_Failed_With_Error_:__d__n
call fcn.140001010
jmp 0x140001226
lea rax, [rbp - 0x41]
mov qword [rbp + 0x3f], rdi
mov qword [rsp + 0x48], rax
lea rdx, str.ListModules.exe
lea rax, [rbp - 0x29]
xor r9d, r9d
mov qword [rsp + 0x40], rax
xor r8d, r8d
mov qword [rsp + 0x38], rbx
xor ecx, ecx
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], 0x80000
mov dword [rsp + 0x20], ebx
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x1400011f1
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.____CreateProcessA_Failed_With_Error_:__d__n
call fcn.140001010
jmp 0x140001226
mov rax, qword [rbp - 0x41]
mov rcx, rdi
mov qword [0], rax
mov rax, qword [rbp - 0x39]
mov qword [0], rax
call qword [sym.imp.KERNEL32.dll_DeleteProcThreadAttributeList]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rdi
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
xor eax, eax
mov rcx, qword [rbp + 0x4f]
xor rcx, rsp
call fcn.140001260
lea r11, [rsp + 0xf0]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov rsp, r11
pop rbp
ret
Function at 0x140001b20
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140001b6a
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140001b6a
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140001b6a
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140001b6a
cmp dword [rcx + 0x84], 0xe
jbe 0x140001b6a
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140001b6c
xor al, al
add rsp, 0x28
ret
Function at 0x1400725e1
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 8], rcx
push r15
xor rax, rax
push rax
push rax
push rax
sub rsp, 0x28
call fcn.1400e85c0
mov qword [rsp + 0x28], 0
jmp 0x140072602
mov rax, qword [rsp + 0x50]
cmp rax, qword [rsp + 0x28]
jl 0x1400726fe
push 0
pop rcx
call fcn.1400cf570
and rax, rax
je 0x1400726f3
mov qword [rsp + 0x30], 0xffffffffffffffff
call fcn.14007c23b
mov qword [rsp + 0x30], rax
mov r15, qword [rsp + 0x30]
and r15, r15
jle 0x1400726bc
call fcn.1400d400c
mov rax, rax
push rax
mov r15, qword [0x140b36d18]
cmp r15, qword [rsp]
jne 0x140072679
sub rsp, 8
push qword [rsp + 0x40]
pop rcx
sub rsp, 0x20
call fcn.140070578
add rsp, 0x28
mov r15, rax
and r15, r15
jne 0x140072677
jmp 0x1400726b9
xor r15, r15
cmp r15, qword [rsp]
jne 0x1400726a2
sub rsp, 8
push qword [rsp + 0x40]
pop rcx
sub rsp, 0x20
call fcn.14005bbd7
add rsp, 0x28
mov r15, rax
and r15, r15
jne 0x1400726a0
jmp 0x1400726b9
sub rsp, 8
push 3
pop rcx
sub rsp, 0x20
call fcn.1400cf114
add rsp, 0x28
pop rax
jmp 0x1400726c7
push 5
pop rcx
call fcn.1400cf114
push 0x1b
pop rcx
call sub.USER32.dll_GetKeyState
mov r15, rax
cmp r15, 1
jle 0x1400726e8
mov qword [0x140b36c78], 1
jmp 0x1400726f3
mov qword [0x140b36c78], 0
inc qword [rsp + 0x28]
jno 0x140072602
xor rax, rax
add rsp, 0x40
pop r15
ret
Function at 0x14007c369
Capabilities:
Delete registry key

Disassembly:
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
push r15
mov rax, 7
sub rsp, 8
mov qword [rsp], 0
dec rax
jne 0x14007c37c
sub rsp, 0x28
call fcn.1400e85c0
mov rdx, qword [rsp + 0x70]
lea rcx, [rsp + 0x28]
sub rsp, 0x10
call fcn.1400e8130
add rsp, 0x10
mov rdx, qword [rsp + 0x78]
lea rcx, [rsp + 0x30]
sub rsp, 0x10
call fcn.1400e8130
add rsp, 0x10
push qword [rsp + 0x28]
pop rcx
call fcn.14007c5b5
push qword [rsp + 0x30]
movabs rcx, 0x1401a00e6
pop rdx
call fcn.1400e8340
or rax, rax
je 0x14007c4ad
cmp dword [0x140b36f48], 0
je 0x14007c48b
movabs rax, str.Advapi32.dll
push rax
push 0xffffffffffffffff
pop rcx
pop rdx
call fcn.1400c242c
mov qword [rsp + 0x38], rax
cmp qword [rsp + 0x38], 0
je 0x14007c489
movabs rax, str.RegDeleteKeyExA
push rax
push qword [rsp + 0x40]
pop rcx
pop rdx
call fcn.1400c24b4
mov qword [rsp + 0x40], rax
sub rsp, 8
push 0
movsxd r15, dword [0x140b36f4c]
or r15, 0xf003f
mov rax, r15
push rax
mov rax, qword [0x140b36ec0]
mov rax, rax
push rax
push qword [0x140b36ed0]
push qword [rsp + 0x68]
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call fcn.1400c2e8c
add rsp, 0x30
mov qword [rsp + 0x48], rax
push qword [rsp + 0x38]
pop rcx
call fcn.1400c2318
jmp 0x14007c4a8
mov rax, qword [0x140b36ec0]
mov rax, rax
push rax
push qword [0x140b36ed0]
pop rcx
pop rdx
call sub.ADVAPI32.dll_RegDeleteKeyW
mov qword [rsp + 0x48], rax
jmp 0x14007c572
lea rax, [rsp + 0x58]
mov rax, rax
push rax
push qword [0x140b36ed0]
push qword [rsp + 0x40]
pop rcx
pop rdx
pop r8
call sub.ADVAPI32.dll_RegConnectRegistryW
movsxd rax, eax
mov qword [rsp + 0x50], rax
cmp dword [0x140b36f48], 0
je 0x14007c557
movabs rax, str.Advapi32.dll
push rax
push 0xffffffffffffffff
pop rcx
pop rdx
call fcn.1400c242c
mov qword [rsp + 0x38], rax
cmp qword [rsp + 0x38], 0
je 0x14007c555
push 0
movsxd r15, dword [0x140b36f4c]
or r15, 0xf003f
mov rax, r15
push rax
mov rax, qword [0x140b36ec0]
mov rax, rax
push rax
push qword [rsp + 0x70]
movabs rax, str.RegDeleteKeyExA
push rax
push qword [rsp + 0x60]
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call fcn.1400c3aa0
add rsp, 0x30
mov qword [rsp + 0x48], rax
push qword [rsp + 0x38]
pop rcx
call fcn.1400c2318
jmp 0x14007c572
mov rax, qword [0x140b36ec0]
mov rax, rax
push rax
push qword [rsp + 0x60]
pop rcx
pop rdx
call sub.ADVAPI32.dll_RegDeleteKeyW
mov qword [rsp + 0x48], rax
mov r15, qword [rsp + 0x48]
and r15, r15
jne 0x14007c585
mov rax, 1
jmp 0x14007c588
xor rax, rax
push rax
mov rcx, qword [rsp + 0x38]
sub rsp, 0x28
call fcn.1400e8630
add rsp, 0x28
mov rcx, qword [rsp + 0x30]
sub rsp, 0x28
call fcn.1400e8630
add rsp, 0x28
pop rax
add rsp, 0x60
pop r15
ret
Function at 0x14007c93a
Capabilities:
Get graphical window text

Disassembly:
push r15
xor rax, rax
push rax
sub rsp, 0x28
call fcn.1400e85c0
mov rcx, qword [rsp + 0x60]
call fcn.14007ddec
mov r15, qword [0x140b36f50]
and r15, r15
jne 0x14007c984
push 0
push 0
pop rcx
pop rdx
call sub.USER32.dll_FindWindowW
mov qword [0x140b36f58], rax
mov qword [0x140b36f50], 1
jmp 0x14007c99d
push 2
push qword [0x140b36f58]
pop rcx
pop rdx
call sub.USER32.dll_GetWindow
mov qword [0x140b36f58], rax
mov r15, qword [0x140b36f58]
and r15, r15
je 0x14007ca73
push 0xfffffffffffffff0
push qword [0x140b36f58]
pop rcx
pop rdx
call sub.USER32.dll_GetWindowLongPtrW
mov r15, rax
and r15, 0x10000000
cmp r15, 0x10000000
jne 0x14007ca71
push 0xffffffffffffffec
push qword [0x140b36f58]
pop rcx
pop rdx
call sub.USER32.dll_GetWindowLongPtrW
mov r15, rax
and r15, 0x80
cmp r15, 0x80
je 0x14007ca71
push rcx
sub rsp, 0x28
call fcn.1400e81a0
add rsp, 0x28
pop rcx
push rax
sub rsp, 8
push rcx
sub rsp, 0x28
call fcn.1400e81a0
add rsp, 0x28
pop rcx
push rax
push 0x100
pop rcx
pop rdx
sub rsp, 0x20
call fcn.1400e51e0
add rsp, 0x28
lea rcx, [rsp + 0x30]
pop rdx
call fcn.1400e8260
push 0x100
push qword [rsp + 0x30]
push qword [0x140b36f58]
pop rcx
pop rdx
pop r8
call sub.USER32.dll_GetWindowTextW
push qword [rsp + 0x28]
movabs rcx, 0x14019f0ba
pop rdx
call fcn.1400e8340
or rax, rax
jne 0x14007ca71
jmp 0x14007ca8e
jmp 0x14007ca7e
mov qword [0x140b36f50], 0
mov r15, qword [0x140b36f58]
and r15, r15
jne 0x14007c953
mov rcx, qword [rsp + 0x28]
push rcx
sub rsp, 0x28
call fcn.1400e81a0
add rsp, 0x28
pop rcx
push rax
sub rsp, 0x28
call fcn.1400e81f0
add rsp, 0x28
pop rax
push rax
call fcn.1400e8490
pop rdx
add rax, rdx
jmp 0x14007cac7
push rax
mov rcx, qword [rsp + 0x30]
sub rsp, 0x28
call fcn.1400e8630
add rsp, 0x28
pop rax
add rsp, 0x30
pop r15
ret
Function at 0x14007cae2
Capabilities:
Create process on windows

Disassembly:
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
push rbp
push r15
mov rax, 0x14
sub rsp, 8
mov qword [rsp], 0
dec rax
jne 0x14007caf6
sub rsp, 0x28
call fcn.1400e85c0
mov rdx, qword [rsp + 0xe0]
lea rcx, [rsp + 0x28]
sub rsp, 0x10
call fcn.1400e8130
add rsp, 0x10
lea rax, [rsp + 0x30]
lea rax, [rsp + 0x98]
lea rbp, [rsp + 0x30]
mov dword [rbp], 0x68
mov dword [rbp + 0x3c], 1
mov r15, qword [rsp + 0xe8]
and r15, 2
and r15, r15
je 0x14007cb68
lea rbp, [rsp + 0x30]
mov word [rbp + 0x40], 0
jmp 0x14007cb73
lea rbp, [rsp + 0x30]
mov word [rbp + 0x40], 1
lea rax, [rsp + 0x98]
mov rax, rax
push rax
lea rax, [rsp + 0x38]
mov rax, rax
push rax
push 0
push 0
push 0
push 0
push 0
push 0
push qword [rsp + 0x68]
push 0
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call sub.KERNEL32.dll_CreateProcessW
add rsp, 0x50
mov qword [rsp + 0xb0], rax
cmp qword [rsp + 0xb0], 0
je 0x14007cc42
mov r15, qword [rsp + 0xe8]
and r15, 1
and r15, r15
je 0x14007cc34
lea rbp, [rsp + 0x98]
push qword [rbp + 8]
pop rax
mov qword [rsp + 0xb8], rax
push 1
pop rcx
call fcn.1400cf114
lea rax, [rsp + 0xc0]
mov rax, rax
push rax
push qword [rsp + 0xc0]
pop rcx
pop rdx
call sub.KERNEL32.dll_GetExitCodeThread
movsxd r15, dword [rsp + 0xc0]
cmp r15, 0x103
je 0x14007cc32
jmp 0x14007cc34
jmp 0x14007cbfa
lea rbp, [rsp + 0x98]
mov rax, qword [rbp]
jmp 0x14007cc45
xor rax, rax
push rax
mov rcx, qword [rsp + 0x30]
sub rsp, 0x28
call fcn.1400e8630
add rsp, 0x28
pop rax
add rsp, 0xc8
pop r15
pop rbp
ret

Function at 0x14007cc90
Capabilities:
Acquire debug privileges

Disassembly:
push rbp
push r15
mov rax, 8
sub rsp, 8
mov qword [rsp], 0
dec rax
jne 0x14007cc9a
sub rsp, 0x28
call fcn.1400e85c0
mov byte [rsp + 0x28], 0
lea rax, [rsp + 0x30]
mov rax, rax
push rax
push 0x28
sub rsp, 0x20
call sub.KERNEL32.dll_GetCurrentProcess
add rsp, 0x20
mov rax, rax
push rax
pop rcx
pop rdx
pop r8
call sub.ADVAPI32.dll_OpenProcessToken
and rax, rax
je 0x14007cdad
lea rax, [rsp + 0x38]
lea rax, [rsp + 0x38]
mov rax, rax
push rax
movabs rax, 0x1401a5b7c
push rax
push 0
pop rcx
pop rdx
pop r8
call sub.ADVAPI32.dll_LookupPrivilegeValueW
and rax, rax
je 0x14007cda3
lea rax, [rsp + 0x40]
lea rbp, [rsp + 0x40]
mov dword [rbp], 1
lea rbp, [rsp + 0x38]
movsxd rax, dword [rbp]
push rax
lea rbp, [rsp + 0x48]
push rbp
pop rbp
pop rax
mov dword [rbp + 4], eax
lea rbp, [rsp + 0x38]
movsxd rax, dword [rbp + 4]
push rax
lea rbp, [rsp + 0x48]
push rbp
pop rbp
pop rax
mov dword [rbp + 8], eax
push rbp
pop rbp
mov dword [rbp + 0xc], 2
lea rax, [rsp + 0x60]
mov rax, rax
push rax
lea rax, [rsp + 0x58]
mov rax, rax
push rax
push 0x10
lea rax, [rsp + 0x58]
mov rax, rax
push rax
push 0
push qword [rsp + 0x58]
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call sub.ADVAPI32.dll_AdjustTokenPrivileges
add rsp, 0x30
mov rax, rax
push rax
pop rax
mov byte [rsp + 0x28], al
push qword [rsp + 0x30]
pop rcx
call sub.KERNEL32.dll_CloseHandle
movsx rax, byte [rsp + 0x28]
movsx rax, al
jmp 0x14007cdbc
add rsp, 0x68
pop r15
pop rbp
ret
Function at 0x14007ddec
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x48
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x30], rcx
call sub.KERNEL32.dll_GetLastError
mov qword [rsp + 0x38], rax
mov rcx, qword [0x140b31cb8]
call sub.KERNEL32.dll_TlsGetValue
mov rcx, qword [rsp + 0x30]
mov qword [rax + 0x10], rcx
mov rcx, qword [rsp + 0x38]
call sub.KERNEL32.dll_SetLastError
mov rax, qword [rsp + 0x28]
add rsp, 0x48
ret

Function at 0x14007e890
Capabilities:
Create thread

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rbp
mov qword [r11 + 0x20], rsi
push rdi
sub rsp, 0x30
lea rax, [r11 + 0x18]
mov r9, rdx
mov r8, rcx
mov qword [r11 - 0x10], rax
xor edi, edi
mov edx, 0x1000
xor ecx, ecx
mov dword [rsp + 0x20], edi
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rbp, rax
test rax, rax
je 0x14007e956
lea rcx, [0x140bb1a40]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x140b37110]
jmp 0x14007e91a
lea rsi, [rbx + 0x10]
xor edx, edx
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x14007e917
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbx, qword [rbx]
lea rcx, [0x140b37110]
mov rdx, rsi
call fcn.1400e800c
jmp 0x14007e91a
mov rbx, qword [rbx]
test rbx, rbx
jne 0x14007e8e7
mov rdx, qword [0x140b31ab0]
lea rcx, [0x140b37110]
mov rdi, rdx
inc rdx
mov qword [0x140b31ab0], rdx
lea edx, [rbx + 0x20]
call fcn.1400e8054
lea rcx, [0x140bb1a40]
mov qword [rax], rbp
mov qword [rax + 8], rdi
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x58]
mov rax, rdi
add rsp, 0x30
pop rdi
ret

Function at 0x14007e970
Capabilities:
Terminate thread

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
call fcn.14007e770
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateThread]
lea rcx, [0x140bb1a40]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x140b37110]
jmp 0x14007e9ac
cmp qword [rbx + 0x18], rdi
je 0x14007e9b3
mov rbx, qword [rbx]
test rbx, rbx
jne 0x14007e9a3
jmp 0x14007e9cd
mov rcx, qword [rbx + 0x10]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, [rbx + 0x10]
lea rcx, [0x140b37110]
call fcn.1400e800c
lea rcx, [0x140bb1a40]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
Function at 0x14007ed54
Capabilities:
Enumerate gui resources

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x40
test ecx, ecx
je 0x14007edcb
movsxd rdx, ecx
lea rcx, [0x14007ecb0]
call qword [sym.imp.USER32.dll_EnumWindows]
mov rbx, qword [0x140b37120]
test rbx, rbx
je 0x14007ee3e
mov rdi, qword [rbx]
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [rbx + 0x10], eax
jne 0x14007edc1
cmp byte [rbx + 0x20], 0
je 0x14007edc1
mov rcx, qword [rbx + 0x18]
xor r9d, r9d
mov dword [rsp + 0x30], 3
and dword [rsp + 0x28], 0
and dword [rsp + 0x20], 0
lea rdx, [r9 - 2]
xor r8d, r8d
call qword [sym.imp.USER32.dll_SetWindowPos]
mov rbx, rdi
test rdi, rdi
jne 0x14007ed87
jmp 0x14007ee3e
mov rbx, qword [0x140b37120]
test rbx, rbx
je 0x14007ee3e
mov rdi, qword [rbx]
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [rbx + 0x10], eax
jne 0x14007ee36
cmp byte [rbx + 0x21], 0
je 0x14007edfa
mov rcx, qword [rbx + 0x18]
mov edx, 1
call qword [sym.imp.USER32.dll_EnableWindow]
cmp byte [rbx + 0x20], 0
je 0x14007ee26
mov rcx, qword [rbx + 0x18]
mov dword [rsp + 0x30], 3
and dword [rsp + 0x28], 0
and dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
or rdx, 0xffffffffffffffff
call qword [sym.imp.USER32.dll_SetWindowPos]
lea rdx, [rbx + 0x10]
lea rcx, [0x140b37120]
call fcn.1400e800c
mov rbx, rdi
test rdi, rdi
jne 0x14007edd7
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret

Function at 0x14007f500
Capabilities:
Get thread local storage value

Disassembly:
push rbx
sub rsp, 0x20
mov ebx, edx
mov rdx, rcx
mov rcx, qword [0x140bb1aa0]
call fcn.1400e761c
test rax, rax
je 0x14007f53d
cmp dword [rax + 0x28], 0
je 0x14007f53d
mov rcx, qword [rax + 0x18]
mov r9d, ebx
mov r8d, dword [rcx + 4]
mov edx, dword [rcx]
mov rcx, qword [rax + 0x10]
add rsp, 0x20
pop rbx
jmp fcn.14007f120
mov ecx, ebx
add rsp, 0x20
pop rbx
jmp fcn.1400e8b50