joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14000e080
Capabilities:
Get thread local storage value

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x20
test rcx, rcx
je 0x14000e0f0
call sym._pthread_time_in_ms_from_timespec
mov rsi, rax
mov eax, 0xfffffffe
cmp rax, rsi
jb 0x14000e128
call sym._pthread_once_raw.constprop.0.isra.0
mov ecx, dword [0x1400123e8]
mov edi, esi
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
mov rbx, rax
je 0x14000e180
test esi, esi
je 0x14000e106
call sym.pthread_testcancel
mov rcx, qword [rbx + 0x30]
test rcx, rcx
je 0x14000e160
mov edx, edi
call sym._pthread_wait_for_single_object
call sym.pthread_testcancel
xor eax, eax
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret
call sym._pthread_once_raw.constprop.0.isra.0
mov ecx, dword [0x1400123e8]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x14000e170
call sym.pthread_testcancel
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_Sleep]
call sym.pthread_testcancel
xor eax, eax
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret
call sym._pthread_once_raw.constprop.0.isra.0
mov ecx, dword [0x1400123e8]
mov edi, 0xffffffff
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
mov rbx, rax
jne 0x14000e0c5
call sym.__pthread_self_lite.part.0
mov rbx, rax
jmp 0x14000e0c5
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x14000e0de
call sym.__pthread_self_lite.part.0
jmp 0x14000e106
call sym.__pthread_self_lite.part.0
mov rbx, rax
jmp 0x14000e0c1

Function at 0x14000e190
Capabilities:
Get thread local storage value

Disassembly:
push rsi
push rbx
sub rsp, 0x28
mov esi, ecx
call sym._pthread_once_raw.constprop.0.isra.0
mov ecx, dword [0x1400123e8]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
mov rbx, rax
je 0x14000e200
test esi, esi
je 0x14000e1e0
call sym.pthread_testcancel
mov rcx, qword [rbx + 0x30]
test rcx, rcx
je 0x14000e210
mov edx, esi
call sym._pthread_wait_for_single_object
call sym.pthread_testcancel
xor eax, eax
add rsp, 0x28
pop rbx
pop rsi
ret
call sym.pthread_testcancel
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_Sleep]
call sym.pthread_testcancel
xor eax, eax
add rsp, 0x28
pop rbx
pop rsi
ret
call sym.__pthread_self_lite.part.0
mov rbx, rax
jmp 0x14000e1b1
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x14000e1ca
Function at 0x14000e220
Capabilities:
Get thread local storage value
Hijack thread execution

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x4f8
test rcx, rcx
mov rsi, rcx
je 0x14000e310
lea rdi, [0x1400123d8]
mov rcx, rdi
call sym.pthread_mutex_lock
mov rcx, rsi
call sym.__pthread_get_pointer
mov rcx, rdi
mov rbx, rax
call sym.pthread_mutex_unlock
test rbx, rbx
je 0x14000e310
mov rcx, qword [rbx + 0x28]
lea rax, [rcx - 1]
cmp rax, 0xfffffffffffffffd
ja 0x14000e310
lea rdi, [rsp + 0x20]
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_GetHandleInformation]
test eax, eax
je 0x14000e310
lea rbp, [rbx + 0x38]
mov rcx, rbp
call sym.pthread_mutex_lock
call sym._pthread_once_raw.constprop.0.isra.0
mov ecx, dword [0x1400123e8]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x14000e420
cmp rsi, qword [rax + 0x1d8]
movzx edx, byte [rbx + 0x40]
je 0x14000e328
mov eax, dword [rbx + 0x44]
and eax, 3
cmp eax, 3
je 0x14000e380
test dl, 3
jne 0x14000e300
and edx, 0xfffffffc
or edx, 1
mov byte [rbx + 0x40], dl
lock add dword [0x140019cf8], 1
mov rcx, qword [rbx + 0x30]
test rcx, rcx
je 0x14000e2f1
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov rcx, rbp
call sym.pthread_mutex_unlock
xor eax, eax
jmp 0x14000e315
mov rcx, rbp
call sym.pthread_mutex_unlock
test byte [rbx + 0x40], 0xc
je 0x14000e2f9
nop
mov eax, 3
add rsp, 0x4f8
pop rbx
pop rsi
pop rdi
pop rbp
ret
test dl, 3
jne 0x14000e300
and edx, 0xfffffffc
or edx, 1
mov byte [rbx + 0x40], dl
lock add dword [0x140019cf8], 1
mov rcx, qword [rbx + 0x30]
test rcx, rcx
je 0x14000e34d
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov eax, dword [rbx + 0x44]
mov edx, eax
and edx, 3
cmp edx, 3
jne 0x14000e2f1
and eax, 0xfffffffe
mov rcx, rbp
mov dword [rbx + 0x44], eax
movzx eax, byte [rbx + 0x40]
and eax, 0xfffffff3
or eax, 4
mov byte [rbx + 0x40], al
call sym.pthread_mutex_unlock
call sym._pthread_invoke_cancel
nop word [rax + rax]
test dl, 0xc
jne 0x14000e300
and edx, 0xf
jne 0x14000e310
mov rcx, qword [rbx + 0x28]
mov dword [rsp + 0x50], 0x100001
call qword [sym.imp.KERNEL32.dll_SuspendThread]
xor edx, edx
mov rcx, qword [rbx + 0x28]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x14000e2f1
mov rcx, qword [rbx + 0x28]
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_GetThreadContext]
lea rax, [sym._pthread_invoke_cancel]
mov rcx, qword [rbx + 0x28]
mov rdx, rdi
mov qword [rsp + 0x118], rax
call qword [sym.imp.KERNEL32.dll_SetThreadContext]
movzx eax, byte [rbx + 0x40]
and dword [rbx + 0x44], 0xfffffffe
and eax, 0xfffffff0
or eax, 5
mov byte [rbx + 0x40], al
lock add dword [0x140019cf8], 1
mov rcx, qword [rbx + 0x30]
test rcx, rcx
je 0x14000e408
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov rcx, rbp
call sym.pthread_mutex_unlock
mov rcx, qword [rbx + 0x28]
call qword [sym.imp.KERNEL32.dll_ResumeThread]
jmp 0x14000e2f1
call sym.__pthread_self_lite.part.0
test rax, rax
jne 0x14000e2b0
movzx edx, byte [rbx + 0x40]
jmp 0x14000e2bd
Function at 0x14000e440
Capabilities:
Get thread local storage value
Hijack thread execution
Resume thread
Suspend thread

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x20
lea rdi, [0x1400123d8]
mov rbx, rcx
mov rcx, rdi
mov esi, edx
call sym.pthread_mutex_lock
mov rcx, rbx
call sym.__pthread_get_pointer
test rax, rax
je 0x14000e4b8
cmp qword [rax + 0x1d8], rbx
jne 0x14000e4b8
test byte [rax + 0x40], 0xc
jne 0x14000e4b8
mov edx, dword [rax + 0xbc]
test edx, edx
jne 0x14000e4b8
mov rax, qword [rax + 0x28]
sub rax, 1
cmp rax, 0xfffffffffffffffd
ja 0x14000e4b8
mov rcx, rdi
call sym.pthread_mutex_unlock
test esi, esi
je 0x14000e4d0
lea edx, [rsi - 2]
cmp edx, 0x15
ja 0x14000e4d8
mov rcx, rbx
add rsp, 0x20
pop rbx
pop rsi
pop rdi
jmp sym.pthread_cancel
mov rcx, rdi
call sym.pthread_mutex_unlock
mov eax, 3
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret
xor eax, eax
jmp 0x14000e4c5
mov eax, 0x16
jmp 0x14000e4c5

Function at 0x14000e6a0
Capabilities:
Get thread local storage value

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
mov esi, ecx
mov rdi, rdx
call sym._pthread_once_raw.constprop.0.isra.0
mov ecx, dword [0x1400123e8]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
mov rbx, rax
je 0x14000e710
cmp esi, 1
ja 0x14000e71d
lea rbp, [rbx + 0x38]
mov rcx, rbp
call sym.pthread_mutex_lock
test rdi, rdi
je 0x14000e6e4
mov eax, dword [rbx + 0x44]
and eax, 1
mov dword [rdi], eax
mov eax, dword [rbx + 0x44]
mov rcx, qword [rbx + 0x1d8]
and eax, 0xfffffffe
or eax, esi
mov dword [rbx + 0x44], eax
call sym.test_cancel_locked
mov rcx, rbp
call sym.pthread_mutex_unlock
xor eax, eax
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
ret
call sym.__pthread_self_lite.part.0
test rax, rax
mov rbx, rax
jne 0x14000e6c6
mov eax, 0x16
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
ret

Function at 0x14000e730
Capabilities:
Get thread local storage value

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
mov esi, ecx
mov rdi, rdx
call sym._pthread_once_raw.constprop.0.isra.0
mov ecx, dword [0x1400123e8]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
mov rbx, rax
je 0x14000e7a8
mov ebp, esi
and ebp, 0xfffffffd
jne 0x14000e7b5
lea r12, [rbx + 0x38]
mov rcx, r12
call sym.pthread_mutex_lock
test rdi, rdi
je 0x14000e778
mov eax, dword [rbx + 0x44]
and eax, 2
mov dword [rdi], eax
mov eax, dword [rbx + 0x44]
mov rcx, qword [rbx + 0x1d8]
and eax, 0xfffffffd
or eax, esi
mov dword [rbx + 0x44], eax
call sym.test_cancel_locked
mov rcx, r12
call sym.pthread_mutex_unlock
mov eax, ebp
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
call sym.__pthread_self_lite.part.0
test rax, rax
mov rbx, rax
jne 0x14000e758
mov ebp, 0x16
mov eax, ebp
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
Function at 0x14000ea60
Capabilities:
Get thread local storage value

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x38
test rcx, rcx
mov rsi, rcx
mov rbp, rdx
je 0x14000eb80
lea rdi, [0x1400123d8]
mov rcx, rdi
call sym.pthread_mutex_lock
mov rcx, rsi
call sym.__pthread_get_pointer
mov rcx, rdi
mov rbx, rax
call sym.pthread_mutex_unlock
test rbx, rbx
je 0x14000eb80
mov rcx, qword [rbx + 0x28]
test rcx, rcx
je 0x14000eb80
lea rdx, [rsp + 0x2c]
call qword [sym.imp.KERNEL32.dll_GetHandleInformation]
test eax, eax
je 0x14000eb80
test byte [rbx + 0x44], 4
jne 0x14000eb90
call sym._pthread_once_raw.constprop.0.isra.0
mov ecx, dword [0x1400123e8]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x14000ebb0
cmp rsi, qword [rax + 0x1d8]
je 0x14000ebd8
mov eax, dword [rbx + 0xbc]
mov rcx, qword [rbx + 0x28]
test eax, eax
je 0x14000eb0b
lea rax, [rcx - 1]
cmp rax, 0xfffffffffffffffd
ja 0x14000eb1a
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rbx + 0x28]
mov rsi, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rsi
mov rcx, qword [rbx + 0x30]
test rcx, rcx
je 0x14000eb2e
call rsi
mov qword [rbx + 0x30], 0
lea rcx, [rbx + 0x38]
test rbp, rbp
je 0x14000ebc8
mov rax, qword [rbx + 8]
mov qword [rbp], rax
call sym.pthread_mutex_destroy
lea rcx, [rbx + 0x68]
call sym.pthread_spin_destroy
cmp eax, 1
je 0x14000ebdf
cmp qword [rbx + 0x1d0], 0
mov qword [rbx + 0x68], 0xffffffffffffffff
je 0x14000eba0
xor eax, eax
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
ret
mov eax, 3
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
ret
mov eax, 0x16
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
ret
mov rcx, rbx
call sym.push_pthread_mem.part.0
xor eax, eax
jmp 0x14000eb76
call sym.__pthread_self_lite.part.0
test rax, rax
jne 0x14000eae6
jmp 0x14000eaf3
call sym.pthread_mutex_destroy
jmp 0x14000eb50
mov eax, 0x24
jmp 0x14000eb85
call sym.replace_spin_keys.part.0
nop
nop word cs:[rax + rax]
Function at 0x14000ebf0
Capabilities:
Get thread local storage value

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x38
lea rbp, [0x1400123d8]
mov rsi, rcx
mov rcx, rbp
mov rdi, rdx
call sym.pthread_mutex_lock
mov rcx, rsi
call sym.__pthread_get_pointer
test rax, rax
mov rbx, rax
je 0x14000ed10
mov rcx, qword [rax + 0x28]
test rcx, rcx
je 0x14000ed10
lea rdx, [rsp + 0x2c]
call qword [sym.imp.KERNEL32.dll_GetHandleInformation]
test eax, eax
je 0x14000ed10
test byte [rbx + 0x44], 4
jne 0x14000ed30
call sym._pthread_once_raw.constprop.0.isra.0
mov ecx, dword [0x1400123e8]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x14000ed70
mov rdx, qword [rax + 0x1d8]
cmp rsi, rdx
je 0x14000eda8
mov edx, dword [rbx + 0xbc]
mov rcx, qword [rbx + 0x28]
test edx, edx
jne 0x14000ec97
xor edx, edx
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x14000ed50
mov rcx, qword [rbx + 0x28]
mov rsi, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rsi
mov rcx, qword [rbx + 0x30]
test rcx, rcx
je 0x14000ecab
call rsi
mov qword [rbx + 0x30], 0
lea rcx, [rbx + 0x38]
test rdi, rdi
je 0x14000ed88
mov rax, qword [rbx + 8]
mov qword [rdi], rax
call sym.pthread_mutex_destroy
lea rcx, [rbx + 0x68]
call sym.pthread_spin_destroy
cmp eax, 1
je 0x14000edba
cmp qword [rbx + 0x1d0], 0
mov qword [rbx + 0x68], 0xffffffffffffffff
je 0x14000ed98
mov rcx, rbp
call sym.pthread_mutex_unlock
xor eax, eax
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
ret
mov rcx, rbp
call sym.pthread_mutex_unlock
mov eax, 3
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
ret
mov rcx, rbp
call sym.pthread_mutex_unlock
mov eax, 0x16
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
ret
mov eax, dword [rbx + 0xbc]
test eax, eax
jne 0x14000ec93
mov rcx, rbp
call sym.pthread_mutex_unlock
mov eax, 0x10
jmp 0x14000ecfe
call sym.__pthread_self_lite.part.0
xor edx, edx
test rax, rax
jne 0x14000ec65
jmp 0x14000ec6c
call sym.pthread_mutex_destroy
jmp 0x14000eccc
mov rcx, rbx
call sym.push_pthread_mem.part.0
jmp 0x14000ecf4
mov rcx, rbp
call sym.pthread_mutex_unlock
mov eax, 0x24
jmp 0x14000ecfe
call sym.replace_spin_keys.part.0
nop
Function at 0x1400388e0
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0xa8
mov rax, qword [0x140057040]
xor rax, rsp
mov qword [rsp + 0x90], rax
lea rax, [rsp + 0x80]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, str.HARDWARERESOURCEMAPSystem_ResourcesPhysical_Memory
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea rax, [rsp + 0x78]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x88]
xor r8d, r8d
lea rdx, str..Translated
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov eax, dword [rsp + 0x78]
mov ecx, eax
call fcn.14004b860
mov qword [rsp + 0x58], rax
mov rax, qword [rsp + 0x58]
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x78]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x88]
xor r8d, r8d
lea rdx, str..Translated
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov rax, qword [rsp + 0x38]
mov eax, dword [rax + 0x10]
mov dword [rsp + 0x48], eax
mov rax, qword [rsp + 0x38]
add rax, 0x18
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x30], 0
jmp 0x1400389d7
mov eax, dword [rsp + 0x30]
inc eax
mov dword [rsp + 0x30], eax
mov eax, dword [rsp + 0x48]
cmp dword [rsp + 0x30], eax
jae 0x140038a13
mov rax, qword [rsp + 0x40]
add rax, 8
mov r9, rax
mov r8, qword [rsp + 0x40]
lea rdx, [rsp + 0x68]
lea rcx, [0x140057da0]
call fcn.14003cd30
mov rax, qword [rsp + 0x40]
add rax, 0x14
mov qword [rsp + 0x40], rax
jmp 0x1400389cd
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x50], rax
mov rcx, qword [rsp + 0x50]
call fcn.14004b4cc
cmp qword [rsp + 0x50], 0
jne 0x140038a3a
mov qword [rsp + 0x60], 0
jmp 0x140038a4d
mov qword [rsp + 0x38], 0x8123
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x60], rax
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, 1
mov rcx, qword [rsp + 0x90]
xor rcx, rsp
call fcn.14004b470
add rsp, 0xa8
ret
Function at 0x140038a80
Capabilities:
Get system information on windows
Make suspicious ntquerysysteminformation call

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x88
mov rax, qword [0x140057040]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x50], 0
lea r9, [rsp + 0x50]
mov r8d, dword [rsp + 0x50]
mov rdx, qword [rsp + 0x28]
mov ecx, 0xb
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
mov dword [rsp + 0x30], eax
cmp dword [rsp + 0x30], 0xc0000004
jne 0x140038b26
mov r8d, 0x8000
xor edx, edx
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov eax, dword [rsp + 0x50]
mov r9d, 4
mov r8d, 0x3000
mov edx, eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x50]
mov r8d, dword [rsp + 0x50]
mov rdx, qword [rsp + 0x28]
mov ecx, 0xb
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
mov dword [rsp + 0x30], eax
jmp 0x140038aca
cmp dword [rsp + 0x30], 0
jge 0x140038b47
mov r8d, 0x8000
xor edx, edx
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_VirtualFree]
xor eax, eax
jmp 0x140038c3d
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x20], 0
jmp 0x140038b65
mov eax, dword [rsp + 0x20]
inc eax
mov dword [rsp + 0x20], eax
mov rax, qword [rsp + 0x38]
mov eax, dword [rax]
cmp dword [rsp + 0x20], eax
jae 0x140038c28
mov eax, dword [rsp + 0x20]
imul rax, rax, 0x128
mov rcx, qword [rsp + 0x38]
lea rax, [rcx + rax + 8]
mov ecx, dword [rsp + 0x20]
imul rcx, rcx, 0x128
mov rdx, qword [rsp + 0x38]
movzx ecx, word [rdx + rcx + 0x2e]
lea rax, [rax + rcx + 0x28]
mov rdx, rax
lea rcx, [rsp + 0x58]
call fcn.14003b210
lea rcx, [rsp + 0x58]
call fcn.14003b050
mov rdx, qword [rsp + 0x90]
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__stricmp]
test eax, eax
jne 0x140038c19
mov eax, dword [rsp + 0x20]
imul rax, rax, 0x128
mov rcx, qword [rsp + 0x38]
mov rax, qword [rcx + rax + 0x18]
mov qword [rsp + 0x40], rax
mov r8d, 0x8000
xor edx, edx
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x48], rax
lea rcx, [rsp + 0x58]
call fcn.14003b1e0
mov rax, qword [rsp + 0x48]
jmp 0x140038c3d
lea rcx, [rsp + 0x58]
call fcn.14003b1e0
jmp 0x140038b5b
mov r8d, 0x8000
xor edx, edx
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_VirtualFree]
xor eax, eax
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.14004b470
add rsp, 0x88
ret
Function at 0x140039a70
Capabilities:
Load ntoskrnl

Disassembly:
mov qword [rsp + 8], rcx
push rsi
push rdi
sub rsp, 0xd8
mov rax, qword [0x140057040]
xor rax, rsp
mov qword [rsp + 0xc0], rax
lea rcx, [0x140057c08]
call fcn.14003aa50
test rax, rax
jne 0x140039ab6
movzx eax, word [0x140057d80]
test eax, eax
jne 0x140039ab6
cmp qword [0x140057d78], 0
je 0x140039abb
jmp 0x140039c9b
mov r8b, 1
mov rdx, qword [str.NtShutdownSystem]
lea rcx, [0x14004e8f8]
call fcn.140038c60
mov dword [0x140057d84], eax
xor edx, edx
mov eax, dword [0x140057d84]
mov ecx, 0x1000
div ecx
mov eax, edx
mov word [0x140057d80], ax
mov r8d, 1
xor edx, edx
lea rcx, [0x14004e908]
call qword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov qword [0x140057d78], rax
mov edx, 0x18
lea rcx, [rsp + 0x98]
call fcn.140037330
lea rcx, [rsp + 0x98]
call fcn.1400372e0
nop
lea rax, [0x140057da0]
mov qword [rsp + 0x38], rax
mov edx, 8
lea rcx, [rsp + 0x90]
call fcn.140037330
lea rdx, [rsp + 0x90]
mov rcx, qword [rsp + 0x38]
call fcn.14003ae30
lea rdx, [rsp + 0x88]
mov rcx, qword [rsp + 0x38]
call fcn.14003ae00
jmp 0x140039b7c
lea rcx, [rsp + 0x90]
call fcn.14003ad80
movzx edx, byte [rsp + 0x88]
lea rcx, [rsp + 0x90]
call fcn.14003adc0
movzx eax, al
test eax, eax
je 0x140039c31
lea rcx, [rsp + 0x90]
call fcn.14003ada0
lea rcx, [rsp + 0xb0]
mov rdi, rcx
mov rsi, rax
mov ecx, 0x10
rep movsb byte [rdi], byte [rsi]
mov rax, qword [rsp + 0xf0]
mov qword [rsp + 0x48], rax
lea rax, [0x140039cf0]
mov qword [rsp + 0x50], rax
lea rax, [rsp + 0xb8]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0xb0]
lea r8, [rsp + 0x48]
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x78]
call fcn.14003dd70
mov qword [rsp + 0x58], rax
mov rax, qword [rsp + 0x58]
mov qword [rsp + 0x60], rax
mov rdx, qword [rsp + 0x60]
lea rcx, [rsp + 0x98]
call fcn.140039cc0
nop
lea rcx, [rsp + 0x78]
call fcn.140038670
jmp 0x140039b6f
lea rax, [rsp + 0x98]
mov qword [rsp + 0x40], rax
mov rcx, qword [rsp + 0x40]
call fcn.1400381c0
mov qword [rsp + 0x30], rax
mov rcx, qword [rsp + 0x40]
call fcn.14003aa20
mov qword [rsp + 0x68], rax
jmp 0x140039c6c
mov rax, qword [rsp + 0x30]
add rax, 0x10
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x68]
cmp qword [rsp + 0x30], rax
je 0x140039c8e
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x70], rax
mov rcx, qword [rsp + 0x70]
call fcn.140038730
jmp 0x140039c5e
lea rcx, [rsp + 0x98]
call fcn.14003aa30
mov rax, qword [rsp + 0xf0]
mov rcx, qword [rsp + 0xc0]
xor rcx, rsp
call fcn.14004b470
add rsp, 0xd8
pop rdi
pop rsi
ret
Function at 0x140040330
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x58
mov rax, qword [0x140057040]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov edx, 8
lea rcx, [rsp + 0x40]
call fcn.140037330
mov rax, qword [rsp + 0x80]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x78]
mov r8, qword [rsp + 0x70]
mov rdx, qword [rsp + 0x68]
lea rcx, [rsp + 0x40]
call fcn.140041710
nop
lea rax, [0x1400417b0]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x60]
add rax, 8
mov qword [rsp + 0x30], rax
lea rcx, [rsp + 0x40]
call fcn.1400381c0
mov rcx, qword [rsp + 0x30]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], 0
mov r9, rax
mov r8, qword [rsp + 0x38]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov rcx, qword [rsp + 0x60]
mov qword [rcx], rax
mov rax, qword [rsp + 0x60]
cmp qword [rax], 0
je 0x1400403f4
lea rcx, [rsp + 0x40]
call fcn.140040b30
jmp 0x14004040c
mov rax, qword [rsp + 0x60]
mov dword [rax + 8], 0
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
lea rcx, [rsp + 0x40]
call fcn.140040b60
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.14004b470
add rsp, 0x58
ret
Function at 0x140042fd0
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0xa8
mov rax, qword [0x140057040]
xor rax, rsp
mov qword [rsp + 0x90], rax
lea rax, [rsp + 0x80]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, str.HARDWARERESOURCEMAPSystem_ResourcesPhysical_Memory
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea rax, [rsp + 0x78]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x88]
xor r8d, r8d
lea rdx, str..Translated
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov eax, dword [rsp + 0x78]
mov ecx, eax
call fcn.14004b860
mov qword [rsp + 0x58], rax
mov rax, qword [rsp + 0x58]
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x78]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x88]
xor r8d, r8d
lea rdx, str..Translated
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov rax, qword [rsp + 0x38]
mov eax, dword [rax + 0x10]
mov dword [rsp + 0x48], eax
mov rax, qword [rsp + 0x38]
add rax, 0x18
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x30], 0
jmp 0x1400430c7
mov eax, dword [rsp + 0x30]
inc eax
mov dword [rsp + 0x30], eax
mov eax, dword [rsp + 0x48]
cmp dword [rsp + 0x30], eax
jae 0x140043103
mov rax, qword [rsp + 0x40]
add rax, 8
mov r9, rax
mov r8, qword [rsp + 0x40]
lea rdx, [rsp + 0x68]
lea rcx, [0x140057db8]
call fcn.14003cd30
mov rax, qword [rsp + 0x40]
add rax, 0x14
mov qword [rsp + 0x40], rax
jmp 0x1400430bd
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x50], rax
mov rcx, qword [rsp + 0x50]
call fcn.14004b4cc
cmp qword [rsp + 0x50], 0
jne 0x14004312a
mov qword [rsp + 0x60], 0
jmp 0x14004313d
mov qword [rsp + 0x38], 0x8123
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x60], rax
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, 1
mov rcx, qword [rsp + 0x90]
xor rcx, rsp
call fcn.14004b470
add rsp, 0xa8
ret
Function at 0x140044470
Capabilities:
Delete registry key

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x58
mov rax, qword [0x140057040]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov eax, 4
mov eax, eax
mov rcx, qword gs:[0x58]
mov rcx, qword [rcx]
mov eax, dword [rax + rcx]
cmp dword [0x140057eb8], eax
jle 0x1400444e7
lea rcx, [0x140057eb8]
call fcn.14004b5a8
cmp dword [0x140057eb8], 0xffffffff
jne 0x1400444e7
lea rdx, str.SystemCurrentControlSetServices_
lea rcx, [0x140057e98]
call fcn.14003b210
lea rcx, [0x14004d120]
call fcn.14004b848
nop
lea rcx, [0x140057eb8]
call fcn.14004b53c
lea rcx, [0x140057e98]
call fcn.14003b050
lea r8, [rsp + 0x38]
mov rdx, rax
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
mov dword [rsp + 0x24], eax
mov rcx, qword [rsp + 0x60]
call fcn.14003b050
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x30], rax
mov rdx, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
test eax, eax
jne 0x140044552
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
jne 0x140044552
mov dword [rsp + 0x20], 1
jmp 0x14004455a
mov dword [rsp + 0x20], 0
movzx eax, byte [rsp + 0x20]
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.14004b470
add rsp, 0x58
ret