joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14001bf90
Capabilities:
Get thread local storage value
Hijack thread execution

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x4f8
mov rsi, rcx
test rcx, rcx
je 0x14001c080
lea rdi, [0x1400bb178]
mov rcx, rdi
call sym.pthread_mutex_lock
mov rcx, rsi
call sym.__pthread_get_pointer
mov rcx, rdi
mov rbx, rax
call sym.pthread_mutex_unlock
test rbx, rbx
je 0x14001c080
mov rcx, qword [rbx + 0x28]
lea rax, [rcx - 1]
cmp rax, 0xfffffffffffffffd
ja 0x14001c080
lea rdi, [rsp + 0x20]
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_GetHandleInformation]
test eax, eax
je 0x14001c080
lea rbp, [rbx + 0x38]
mov rcx, rbp
call sym.pthread_mutex_lock
call sym._pthread_once_raw.constprop.0.isra.0
mov ecx, dword [0x1400bb188]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x14001c190
movzx edx, byte [rbx + 0x40]
cmp rsi, qword [rax + 0x1d8]
je 0x14001c098
mov eax, dword [rbx + 0x44]
not eax
test al, 3
je 0x14001c0f0
test dl, 3
jne 0x14001c070
and edx, 0xfffffffc
or edx, 1
mov byte [rbx + 0x40], dl
lock add dword [0x1400ecd48], 1
mov rcx, qword [rbx + 0x30]
test rcx, rcx
je 0x14001c05f
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov rcx, rbp
call sym.pthread_mutex_unlock
xor eax, eax
jmp 0x14001c085
mov rcx, rbp
call sym.pthread_mutex_unlock
test byte [rbx + 0x40], 0xc
je 0x14001c067
nop
mov eax, 3
add rsp, 0x4f8
pop rbx
pop rsi
pop rdi
pop rbp
ret
test dl, 3
jne 0x14001c070
and edx, 0xfffffffc
or edx, 1
mov byte [rbx + 0x40], dl
lock add dword [0x1400ecd48], 1
mov rcx, qword [rbx + 0x30]
test rcx, rcx
je 0x14001c0bd
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov eax, dword [rbx + 0x44]
mov edx, eax
not edx
and edx, 3
jne 0x14001c05f
and eax, 0xfffffffe
mov rcx, rbp
mov dword [rbx + 0x44], eax
movzx eax, byte [rbx + 0x40]
and eax, 0xfffffff3
or eax, 4
mov byte [rbx + 0x40], al
call sym.pthread_mutex_unlock
call sym._pthread_invoke_cancel
nop dword [rax]
test dl, 0xc
jne 0x14001c070
and edx, 0xf
jne 0x14001c080
mov rcx, qword [rbx + 0x28]
mov dword [rsp + 0x50], 0x100001
call qword [sym.imp.KERNEL32.dll_SuspendThread]
xor edx, edx
mov rcx, qword [rbx + 0x28]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x14001c05f
mov rcx, qword [rbx + 0x28]
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_GetThreadContext]
lea rax, [sym._pthread_invoke_cancel]
mov rcx, qword [rbx + 0x28]
mov rdx, rdi
mov qword [rsp + 0x118], rax
call qword [sym.imp.KERNEL32.dll_SetThreadContext]
movzx eax, byte [rbx + 0x40]
and dword [rbx + 0x44], 0xfffffffe
and eax, 0xfffffff0
or eax, 5
mov byte [rbx + 0x40], al
lock add dword [0x1400ecd48], 1
mov rcx, qword [rbx + 0x30]
test rcx, rcx
je 0x14001c178
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov rcx, rbp
call sym.pthread_mutex_unlock
mov rcx, qword [rbx + 0x28]
call qword [sym.imp.KERNEL32.dll_ResumeThread]
jmp 0x14001c05f
call sym.__pthread_self_lite.part.0
test rax, rax
jne 0x14001c020
movzx edx, byte [rbx + 0x40]
jmp 0x14001c02d
Function at 0x14001c1b0
Capabilities:
Get thread local storage value
Hijack thread execution
Resume thread
Suspend thread

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x20
lea rdi, [0x1400bb178]
mov rbx, rcx
mov rcx, rdi
mov esi, edx
call sym.pthread_mutex_lock
mov rcx, rbx
call sym.__pthread_get_pointer
test rax, rax
je 0x14001c228
cmp qword [rax + 0x1d8], rbx
jne 0x14001c228
test byte [rax + 0x40], 0xc
jne 0x14001c228
mov edx, dword [rax + 0xbc]
test edx, edx
jne 0x14001c228
mov rax, qword [rax + 0x28]
sub rax, 1
cmp rax, 0xfffffffffffffffd
ja 0x14001c228
mov rcx, rdi
call sym.pthread_mutex_unlock
test esi, esi
je 0x14001c240
lea edx, [rsi - 2]
cmp edx, 0x15
ja 0x14001c248
mov rcx, rbx
add rsp, 0x20
pop rbx
pop rsi
pop rdi
jmp sym.pthread_cancel
mov rcx, rdi
call sym.pthread_mutex_unlock
mov eax, 3
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret
xor eax, eax
jmp 0x14001c235
mov eax, 0x16
jmp 0x14001c235

Function at 0x14001c3e0
Capabilities:
Get thread local storage value

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
mov esi, ecx
mov rdi, rdx
call sym._pthread_once_raw.constprop.0.isra.0
mov ecx, dword [0x1400bb188]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, rax
test rax, rax
je 0x14001c450
cmp esi, 1
ja 0x14001c45d
lea rbp, [rbx + 0x38]
mov rcx, rbp
call sym.pthread_mutex_lock
test rdi, rdi
je 0x14001c424
mov eax, dword [rbx + 0x44]
and eax, 1
mov dword [rdi], eax
mov eax, dword [rbx + 0x44]
mov rcx, qword [rbx + 0x1d8]
and eax, 0xfffffffe
or eax, esi
mov dword [rbx + 0x44], eax
call sym.test_cancel_locked
mov rcx, rbp
call sym.pthread_mutex_unlock
xor eax, eax
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
ret
call sym.__pthread_self_lite.part.0
mov rbx, rax
test rax, rax
jne 0x14001c406
mov eax, 0x16
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
ret

Function at 0x14001c470
Capabilities:
Get thread local storage value

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
mov esi, ecx
mov rdi, rdx
call sym._pthread_once_raw.constprop.0.isra.0
mov ecx, dword [0x1400bb188]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, rax
test rax, rax
je 0x14001c4e8
mov ebp, esi
and ebp, 0xfffffffd
jne 0x14001c4f5
lea r12, [rbx + 0x38]
mov rcx, r12
call sym.pthread_mutex_lock
test rdi, rdi
je 0x14001c4b8
mov eax, dword [rbx + 0x44]
and eax, 2
mov dword [rdi], eax
mov eax, dword [rbx + 0x44]
mov rcx, qword [rbx + 0x1d8]
and eax, 0xfffffffd
or eax, esi
mov dword [rbx + 0x44], eax
call sym.test_cancel_locked
mov rcx, r12
call sym.pthread_mutex_unlock
mov eax, ebp
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
call sym.__pthread_self_lite.part.0
mov rbx, rax
test rax, rax
jne 0x14001c498
mov ebp, 0x16
mov eax, ebp
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
Function at 0x14001c7a0
Capabilities:
Get thread local storage value

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x38
mov rsi, rcx
mov rbp, rdx
test rcx, rcx
je 0x14001c8c0
lea rdi, [0x1400bb178]
mov rcx, rdi
call sym.pthread_mutex_lock
mov rcx, rsi
call sym.__pthread_get_pointer
mov rcx, rdi
mov rbx, rax
call sym.pthread_mutex_unlock
test rbx, rbx
je 0x14001c8c0
mov rcx, qword [rbx + 0x28]
test rcx, rcx
je 0x14001c8c0
lea rdx, [rsp + 0x2c]
call qword [sym.imp.KERNEL32.dll_GetHandleInformation]
test eax, eax
je 0x14001c8c0
test byte [rbx + 0x44], 4
jne 0x14001c8d0
call sym._pthread_once_raw.constprop.0.isra.0
mov ecx, dword [0x1400bb188]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x14001c8f0
cmp rsi, qword [rax + 0x1d8]
je 0x14001c920
mov eax, dword [rbx + 0xbc]
mov rcx, qword [rbx + 0x28]
test eax, eax
je 0x14001c84b
lea rax, [rcx - 1]
cmp rax, 0xfffffffffffffffd
ja 0x14001c85a
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rbx + 0x28]
mov rsi, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rsi
mov rcx, qword [rbx + 0x30]
test rcx, rcx
je 0x14001c86e
call rsi
mov qword [rbx + 0x30], 0
test rbp, rbp
je 0x14001c908
mov rax, qword [rbx + 8]
lea rcx, [rbx + 0x38]
mov qword [rbp], rax
call sym.pthread_mutex_destroy
lea rcx, [rbx + 0x68]
call sym.pthread_spin_destroy
cmp eax, 1
je 0x14001c927
cmp qword [rbx + 0x1d0], 0
mov qword [rbx + 0x68], 0xffffffffffffffff
je 0x14001c8e0
xor eax, eax
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
ret
mov eax, 3
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
ret
mov eax, 0x16
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
ret
mov rcx, rbx
call sym.push_pthread_mem.part.0
xor eax, eax
jmp 0x14001c8b6
call sym.__pthread_self_lite.part.0
test rax, rax
jne 0x14001c826
jmp 0x14001c833
lea rcx, [rbx + 0x38]
call sym.pthread_mutex_destroy
lea rcx, [rbx + 0x68]
jmp 0x14001c894
mov eax, 0x24
jmp 0x14001c8c5
call sym.replace_spin_keys.part.0
nop
nop dword [rax]
Function at 0x14001c930
Capabilities:
Get thread local storage value

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x38
lea rbp, [0x1400bb178]
mov rsi, rcx
mov rcx, rbp
mov rdi, rdx
call sym.pthread_mutex_lock
mov rcx, rsi
call sym.__pthread_get_pointer
mov rbx, rax
test rax, rax
je 0x14001ca50
mov rcx, qword [rax + 0x28]
test rcx, rcx
je 0x14001ca50
lea rdx, [rsp + 0x2c]
call qword [sym.imp.KERNEL32.dll_GetHandleInformation]
test eax, eax
je 0x14001ca50
test byte [rbx + 0x44], 4
jne 0x14001ca70
call sym._pthread_once_raw.constprop.0.isra.0
mov ecx, dword [0x1400bb188]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x14001cab0
mov rdx, qword [rax + 0x1d8]
cmp rsi, rdx
je 0x14001caf0
mov edx, dword [rbx + 0xbc]
mov rcx, qword [rbx + 0x28]
test edx, edx
jne 0x14001c9d7
xor edx, edx
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x14001ca90
mov rcx, qword [rbx + 0x28]
mov rsi, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rsi
mov rcx, qword [rbx + 0x30]
test rcx, rcx
je 0x14001c9eb
call rsi
mov qword [rbx + 0x30], 0
test rdi, rdi
je 0x14001cac8
mov rax, qword [rbx + 8]
lea rcx, [rbx + 0x38]
mov qword [rdi], rax
call sym.pthread_mutex_destroy
lea rcx, [rbx + 0x68]
call sym.pthread_spin_destroy
cmp eax, 1
je 0x14001cb02
cmp qword [rbx + 0x1d0], 0
mov qword [rbx + 0x68], 0xffffffffffffffff
je 0x14001cae0
mov rcx, rbp
call sym.pthread_mutex_unlock
xor eax, eax
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
ret
mov rcx, rbp
call sym.pthread_mutex_unlock
mov eax, 3
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
ret
mov rcx, rbp
call sym.pthread_mutex_unlock
mov eax, 0x16
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
ret
mov eax, dword [rbx + 0xbc]
test eax, eax
jne 0x14001c9d3
mov rcx, rbp
call sym.pthread_mutex_unlock
mov eax, 0x10
jmp 0x14001ca3e
call sym.__pthread_self_lite.part.0
xor edx, edx
test rax, rax
jne 0x14001c9a5
jmp 0x14001c9ac
lea rcx, [rbx + 0x38]
call sym.pthread_mutex_destroy
lea rcx, [rbx + 0x68]
jmp 0x14001ca10
mov rcx, rbx
call sym.push_pthread_mem.part.0
jmp 0x14001ca34
mov rcx, rbp
call sym.pthread_mutex_unlock
mov eax, 0x24
jmp 0x14001ca3e
call sym.replace_spin_keys.part.0
nop
nop dword [rax + rax]

Function at 0x14001fb80
Capabilities:
Read file on windows

Disassembly:
push rsi
push rbx
sub rsp, 0x28
mov r9, qword [rcx + 0x40]
mov rsi, rdx
mov rbx, rcx
mov edx, 1
mov rcx, rsi
call sym.fread
mov edx, 0xffffffff
test rax, rax
jle 0x14001fbac
movzx edx, byte [rsi + rax - 1]
mov dword [rbx + 0x48], edx
add rsp, 0x28
pop rbx
pop rsi
ret
Function at 0x1400207d0
Capabilities:
Write file on windows

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x30
cmp byte [0x1400bdef0], 0
jne 0x1400208d3
mov byte [0x1400bdef0], 1
call sym.__cxa_current_exception_type
test rax, rax
je 0x1400208a8
mov rbx, qword [rax + 8]
xor eax, eax
lea r9, [rsp + 0x2c]
cmp byte [rbx], 0x2a
mov dword [rsp + 0x2c], 0xffffffff
sete al
xor r8d, r8d
xor edx, edx
add rbx, rax
mov rcx, rbx
call sym.__cxa_demangle
mov ecx, 2
mov rsi, qword [sym.__acrt_iob_func]
mov rdi, rax
call rsi
mov edx, 1
lea rcx, str.terminate_called_after_throwing_an_instance_of_
mov r8d, 0x30
mov r9, rax
call sym.fwrite
mov edx, dword [rsp + 0x2c]
mov ecx, 2
test edx, edx
je 0x140020899
call rsi
mov rcx, rbx
mov rdx, rax
call sym.fputs
mov ecx, 2
call rsi
mov r8d, 2
mov edx, 1
lea rcx, [0x1400be441]
mov r9, rax
call sym.fwrite
mov eax, dword [rsp + 0x2c]
test eax, eax
jne 0x1400b8587
jmp 0x1400b857f
call rsi
mov rcx, rdi
mov rdx, rax
call sym.fputs
jmp 0x140020867
mov ecx, 2
call qword [sym.__acrt_iob_func]
mov r8d, 0x2d
mov edx, 1
lea rcx, str.terminate_called_without_an_active_exception_n
mov r9, rax
call sym.fwrite
nop
jmp 0x1400b857a
mov ecx, 2
call qword [sym.__acrt_iob_func]
mov r8d, 0x1d
mov edx, 1
lea rcx, str.terminate_called_recursively_n
mov r9, rax
call sym.fwrite
call sym.abort
nop
nop
nop

Function at 0x14007f400
Capabilities:
Read file on windows

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
mov r12, qword [sym.imp.msvcrt.dll__errno]
mov rdi, rcx
mov rsi, rdx
mov ebx, r8d
mov rcx, qword [rdi]
call sym.fileno
mov ecx, eax
mov r8d, ebx
mov rdx, rsi
call sym.read
movsxd rbp, eax
cmp eax, 0xffffffff
je 0x14007f448
mov rax, rbp
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
call r12
cmp dword [rax], 4
je 0x14007f41a
mov rax, rbp
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret

Function at 0x140091d70
Capabilities:
Read file on windows

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x38
mov rax, qword [rcx + 8]
mov rdi, rcx
test rax, rax
je 0x140091d98
mov rcx, qword [rcx]
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
jmp rax
mov rbp, qword [sym.imp.msvcrt.dll__errno]
mov ebx, 4
lea rsi, [rsp + 0x2c]
nop dword [rax]
mov ecx, dword [rdi + 0x10]
mov r8d, ebx
mov rdx, rsi
call sym.read
test eax, eax
jle 0x140091de0
cdqe
add rsi, rax
sub rbx, rax
jne 0x140091db0
mov eax, dword [rsp + 0x2c]
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
ret
cmp eax, 0xffffffff
jne 0x140091dec
call rbp
cmp dword [rax], 4
je 0x140091db0
lea rcx, str.random_device_could_not_be_read
call method.std.__throw_runtime_error_char_const_
nop
nop
nop
nop
nop
nop
nop
nop
Function at 0x1400b8510
Capabilities:
Write file on windows

Disassembly:
nop
mov rcx, rax
mov rax, rdx
sub rax, 1
jne 0x1400b858c
call sym.__cxa_begin_catch
mov rcx, rax
mov rax, qword [rax]
call qword [rax + 0x10]
mov ecx, 2
mov rbx, rax
call rsi
mov r9, rax
mov r8d, 0xb
mov edx, 1
lea rcx, str.__what__:
call sym.fwrite
mov ecx, 2
call rsi
mov rdx, rax
mov rcx, rbx
call sym.fputs
mov ecx, 2
call rsi
mov rdx, rax
mov ecx, 0xa
call sym.fputc
call sym.__cxa_end_catch
call sym.abort
mov rcx, rdi
call sym.free
call sym.__cxa_rethrow
call sym.__cxa_begin_catch
call sym.__cxa_end_catch
jmp 0x1400b857a

Function at 0x1400b9d00
Capabilities:
Query environment variable

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x68
xor edx, edx
lea rcx, [0x1400bb7a0]
movabs rdi, 0x2e78786362696c67
movabs r12, 0x6c6f6f705f68652e
call sym.pthread_mutex_init
pxor xmm0, xmm0
lea rcx, str.GLIBCXX_TUNABLES
mov qword [0x1400bb7b8], 0
movups xmmword [0x1400bb7a8], xmm0
call sym.getenv
mov dword [rsp + 0x40], 0
mov rbx, rax
lea rax, str.obj_size
mov qword [rsp + 0x30], 8
mov qword [rsp + 0x38], rax
lea rax, str.obj_count
mov qword [rsp + 0x48], 9
mov qword [rsp + 0x50], rax
mov dword [rsp + 0x58], 0x100
test rbx, rbx
jne 0x1400b9db5
jmp 0x1400b9e5f
mov rcx, rbx
mov edx, 0x3a
call sym.strchr
mov rbx, rax
test rax, rax
je 0x1400b9e10
xor eax, eax
cmp byte [rbx], 0x3a
sete al
add rbx, rax
cmp qword [rbx], rdi
jne 0x1400b9da0
cmp qword [rbx + 7], r12
jne 0x1400b9da0
cmp byte [rbx + 0xf], 0x2e
jne 0x1400b9da0
add rbx, 0x10
lea rbp, [rsp + 0x30]
lea r13, [rsp + 0x60]
mov rsi, qword [rbp]
mov rcx, qword [rbp + 8]
test rsi, rsi
je 0x1400b9dfb
mov r8, rsi
mov rdx, rbx
call sym.memcmp
test eax, eax
jne 0x1400b9e05
cmp byte [rbx + rsi], 0x3d
je 0x1400b9e95
add rbp, 0x18
cmp rbp, r13
jne 0x1400b9ddf
jmp 0x1400b9da0
mov eax, dword [rsp + 0x58]
mov edx, 0x1000
mov ecx, 6
cmp eax, edx
cmovle edx, eax
mov eax, dword [rsp + 0x40]
test eax, eax
cmove eax, ecx
movsxd rbx, eax
movsxd rax, edx
add rbx, 0x26
imul rbx, rax
shl rbx, 3
mov qword [0x1400bb7b8], rbx
jne 0x1400b9e6f
lea rcx, [sym.__tcf_0_4]
add rsp, 0x68
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
jmp sym.atexit
mov qword [0x1400bb7b8], 0x16000
mov ebx, 0x16000
mov rcx, rbx
call sym.malloc
mov qword [0x1400bb7b0], rax
test rax, rax
je 0x1400b9ecc
xor edx, edx
mov qword [0x1400bb7a8], rax
mov qword [rax], rbx
mov qword [rax + 8], rdx
jmp 0x1400b9e47
lea rdx, [rsp + 0x28]
lea rcx, [rbx + rsi + 1]
xor r8d, r8d
call sym.strtoul
mov rbx, qword [rsp + 0x28]
movzx edx, byte [rbx]
cmp dl, 0x3a
je 0x1400b9ebc
test dl, dl
jne 0x1400b9da0
test eax, eax
js 0x1400b9da0
mov dword [rbp + 0x10], eax
jmp 0x1400b9da0
xor ecx, ecx
mov qword [0x1400bb7b8], rcx
jmp 0x1400b9e47
Function at 0x140001c40
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140001c8a
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140001c8a
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140001c8a
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140001c8a
cmp dword [rcx + 0x84], 0xe
jbe 0x140001c8a
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140001c8c
xor al, al
add rsp, 0x28
ret
Function at 0x14000b470
Capabilities:
Create process on windows

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x1c0
mov rax, qword [0x14005b080]
xor rax, rsp
mov qword [rsp + 0x1b0], rax
mov r8d, 0x104
lea rdx, [rsp + 0xa0]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
xorps xmm0, xmm0
mov dword [rsp + 0x30], 0x70
xor eax, eax
mov qword [rsp + 0x94], rax
mov dword [rsp + 0x9c], eax
lea rax, str.runas
movups xmmword [rsp + 0x44], xmm0
movups xmmword [rsp + 0x34], xmm0
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0xa0]
movups xmmword [rsp + 0x54], xmm0
mov qword [rsp + 0x48], rax
movups xmmword [rsp + 0x64], xmm0
mov dword [rsp + 0x60], 1
movups xmmword [rsp + 0x74], xmm0
movups xmmword [rsp + 0x84], xmm0
call fcn.14000b0a0
movsx ebx, al
call fcn.14000b090
movsx ecx, al
imul ebx, ecx
call fcn.14000b0d0
movsx edi, al
xor edx, edx
movsx eax, byte [reloc.OLEAUT32.dll_VariantCopy]
lea ecx, [rbx + rdi]
lea ecx, [rcx + rbx*8]
add eax, ecx
movsx ecx, byte [0x14005bcd0]
div ecx
movsx ecx, byte [0x14005bcd3]
cmp eax, ecx
je 0x14000b67d
lea rcx, [rsp + 0x30]
call qword [sym.imp.SHELL32.dll_ShellExecuteExA]
xor ecx, ecx
xorps xmm2, xmm2
test eax, eax
movsx eax, byte [0x14005bcd2]
sete cl
xor edx, edx
movd xmm1, eax
movsx eax, byte [0x14005bcd4]
cvtsi2sd xmm2, rcx
movd xmm0, eax
lea eax, [rbx + rbx*4]
lea r10d, [rdi + rax*2]
cvtdq2pd xmm1, xmm1
cvtdq2pd xmm0, xmm0
addsd xmm0, xmm0
subsd xmm1, xmm0
mulsd xmm1, xmm2
movsd qword [rsp + 0x20], xmm1
movsx eax, byte [reloc.OLEAUT32.dll_VariantCopy]
movsx ecx, byte [0x14005bcd0]
add eax, r10d
div ecx
movsx ecx, byte [0x14005bcd3]
cmp eax, ecx
je 0x14000b5f8
call fcn.14000b0b0
movsx edx, al
movsx eax, byte [0x14005e1b0]
imul edx, eax
lea r8d, [rdx + rdx*4]
call fcn.14000b0e0
movsx ecx, al
sub r8d, ecx
call fcn.14000b0c0
movsx ecx, al
add r8d, ecx
movsx ecx, byte [0x14005bcd4]
add ecx, r8d
je 0x14000b5f8
mov r9d, 0xa
jmp 0x14000b657
movsx eax, byte [reloc.OLEAUT32.dll_VariantCopy]
xor edx, edx
movsx ecx, byte [0x14005bcd0]
add eax, edi
lea eax, [rax + rbx*2]
div ecx
movsx ecx, byte [0x14005bcd3]
cmp eax, ecx
je 0x14000b652
movsx eax, byte [reloc.OLEAUT32.dll_VariantCopy]
lea edx, [rbx + rbx*2]
movsx ecx, byte [0x14005bcd0]
add eax, edi
xorps xmm0, xmm0
lea eax, [rax + rdx*2]
xor edx, edx
div ecx
movsx ecx, byte [0x14005bcd3]
sub eax, ecx
cvtsi2sd xmm0, rax
mulsd xmm0, qword [rsp + 0x20]
cvttsd2si r9d, xmm0
jmp 0x14000b657
mov r9d, dword [rsp + 0x20]
movsx eax, byte [reloc.OLEAUT32.dll_VariantCopy]
xor edx, edx
movsx ecx, byte [0x14005bcd0]
add eax, r10d
div ecx
movsx edx, byte [0x14005bcd3]
sub eax, edx
imul eax, r9d
test eax, eax
jne 0x14000b69e
mov rcx, qword [rsp + 0x1b0]
xor rcx, rsp
call fcn.140025340
mov rbx, qword [rsp + 0x1d0]
add rsp, 0x1c0
pop rdi
ret
lea rdx, str.Failed_to_restart_as_admin_
lea rcx, [0x14005c4f0]
call fcn.140021a20
mov rcx, rax
call fcn.14001f4c0
mov ecx, 1
call fcn.14002c098
int3
Function at 0x14001e690
Capabilities:
Read file on windows

Disassembly:
push rbx
push rsi
push r14
sub rsp, 0x30
mov r14, r8
mov rsi, rdx
mov rbx, rcx
test r8, r8
jg 0x14001e6b2
xor eax, eax
add rsp, 0x30
pop r14
pop rsi
pop rbx
ret
cmp qword [rcx + 0x68], 0
mov qword [rsp + 0x28], rbp
mov qword [rsp + 0x20], rdi
je 0x14001e72c
mov rdi, r14
mov rcx, rbx
call fcn.140020b50
test rax, rax
jle 0x14001e704
mov rdx, qword [rbx + 0x38]
cmp rdi, rax
mov rbp, rdi
mov rcx, rsi
cmovge rbp, rax
mov r8, rbp
mov rdx, qword [rdx]
call fcn.140046080
mov rax, qword [rbx + 0x50]
sub rdi, rbp
sub dword [rax], ebp
mov rcx, qword [rbx + 0x38]
movsxd rax, ebp
add qword [rcx], rax
jmp 0x14001e71c
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x38]
cmp eax, 0xffffffff
je 0x14001e724
mov byte [rsi], al
dec rdi
mov ebp, 1
add rsi, rbp
test rdi, rdi
jg 0x14001e6c6
sub r14, rdi
jmp 0x14001e80f
mov rax, qword [rcx + 0x38]
mov rbp, r14
mov rdx, qword [rax]
test rdx, rdx
je 0x14001e743
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x14001e745
xor ecx, ecx
movsxd rax, ecx
test ecx, ecx
je 0x14001e777
cmp rax, r14
mov rdi, r14
mov rcx, rsi
cmovb rdi, rax
mov r8, rdi
call fcn.140046080
mov rax, qword [rbx + 0x50]
add rsi, rdi
sub rbp, rdi
sub dword [rax], edi
mov rcx, qword [rbx + 0x38]
movsxd rax, edi
add qword [rcx], rax
cmp qword [rbx + 0x80], 0
je 0x14001e80c
mov r8, qword [rbx + 0x18]
lea rax, [rbx + 0x70]
cmp qword [r8], rax
jne 0x14001e7b2
mov rcx, qword [rbx + 0x88]
mov rdx, qword [rbx + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
cmp rbp, 0xfff
jbe 0x14001e7ed
nop dword [rax + rax]
mov r9, qword [rbx + 0x80]
mov edx, 1
mov r8d, 0xfff
mov rcx, rsi
call fcn.14003006c
add rsi, rax
sub rbp, rax
cmp rax, 0xfff
jne 0x14001e80c
cmp rbp, rax
ja 0x14001e7c0
test rbp, rbp
je 0x14001e80c
mov r9, qword [rbx + 0x80]
mov r8, rbp
mov edx, 1
mov rcx, rsi
call fcn.14003006c
sub rbp, rax
sub r14, rbp
mov rbp, qword [rsp + 0x28]
mov rax, r14
mov rdi, qword [rsp + 0x20]
add rsp, 0x30
pop r14
pop rsi
pop rbx
ret

Function at 0x1400260f0
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14002613a
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14002613a
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14002613a
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14002613a
cmp dword [rcx + 0x84], 0xe
jbe 0x14002613a
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14002613c
xor al, al
add rsp, 0x28
ret
Function at 0x14002c098
Capabilities:
Parse pe header

Disassembly:
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rbp - 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov ebx, ecx
test r8d, r8d
jne 0x14002bf03
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14002bf03
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14002bf03
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14002bf03
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14002bf03
cmp dword [rcx + 0x84], 0xe
jbe 0x14002bf03
cmp dword [rcx + 0xf8], 0
je 0x14002bf03
mov ecx, ebx
call fcn.14002bfb4
mov byte [rbp + 0x28], 0
lea rax, [rbp + 0x18]
mov qword [rbp - 0x18], rax
lea rax, [rbp + 0x20]
mov qword [rbp - 0x10], rax
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov eax, 2
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
lea r9, [rbp - 0x2c]
lea r8, [rbp - 0x18]
lea rdx, [rbp - 0x28]
lea rcx, [rbp - 0x30]
call fcn.14002bd90
nop
cmp dword [rbp + 0x20], 0
je 0x14002bf51
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.14002bf5c
int3
xor r8d, r8d
xor edx, edx
jmp 0x14002be94

Function at 0x14002c9f8
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x30
xor edi, edi
mov esi, edx
mov rbp, rcx
test r8, r8
jne 0x14002ca2f
call fcn.1400316a8
mov dword [rax], 0x16
call fcn.1400307c0
xor eax, eax
jmp 0x14002cabd
mov rdx, r9
mov rcx, r8
call fcn.14002c994
mov rbx, rax
test rax, rax
je 0x14002caba
lea rax, [rsp + 0x50]
mov rdx, rsi
mov qword [rsp + 0x28], rax
lea r8, [0x14002c8c0]
mov eax, dword [rsp + 0x60]
mov r9, rbx
mov rcx, rbp
mov dword [rsp + 0x20], eax
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rdx, rax
test rax, rax
jne 0x14002caa7
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.14003161c
mov rcx, qword [rbx + 0x10]
test rcx, rcx
je 0x14002ca8e
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbx + 0x18]
test rcx, rcx
je 0x14002ca9d
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rcx, rbx
call fcn.140036ecc
jmp 0x14002caba
mov rcx, qword [rsp + 0x68]
test rcx, rcx
je 0x14002cab7
mov eax, dword [rsp + 0x50]
mov dword [rcx], eax
mov rdi, rdx
mov rax, rdi
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret