joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400207c0
Capabilities:
Print debug messages

Disassembly:
push r12
mov r12, rcx
push rdi
push rsi
push rbx
sub rsp, 0x58
mov rax, qword [0x14002d650]
mov qword [rsp + 0x40], 0
mov ebx, dword [rsp + 0xa0]
mov rax, qword [rax]
mov esi, dword [rsp + 0xa8]
mov qword [rsp + 0x48], 0
mov edi, dword [rsp + 0xb0]
cmp dword [rax + 0xde], 0
je 0x14002087b
mov rcx, qword [rax + 0x7f8]
test rcx, rcx
je 0x14002087b
mov r10w, word [rax + 0x81a]
test r10w, r10w
je 0x14002087b
mov qword [rsp + 0x40], rcx
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x98], r9
mov qword [rsp + 0x90], r8
mov qword [rsp + 0x88], rdx
mov word [rsp + 0x48], r10w
call sym.SysSetConfig
mov dword [rsp + 0x30], edi
mov rcx, r12
mov r9, qword [rsp + 0x98]
mov dword [rsp + 0x28], esi
mov r8, qword [rsp + 0x90]
mov dword [rsp + 0x20], ebx
mov rdx, qword [rsp + 0x88]
call sym.SysInvoke
jmp 0x140020890
mov dword [rsp + 0x30], edi
mov rcx, r12
mov dword [rsp + 0x28], esi
mov dword [rsp + 0x20], ebx
call qword [rax + 0x248]
mov dword [rsp + 0x20], eax
mov r8d, 0xbc
lea r9, [0x14002a9d5]
lea rdx, str.SysNtDuplicateObject
lea rcx, str._DEBUG::_s::_d___s__..._____08x_n
mov r12d, eax
call sym.DbgPrint
add rsp, 0x58
mov eax, r12d
pop rbx
pop rsi
pop rdi
pop r12
ret

Function at 0x1400208d0
Capabilities:
Print debug messages

Disassembly:
push r12
movzx r9d, r9b
mov r12, rcx
push rsi
push rbx
sub rsp, 0x50
mov rax, qword [0x14002d650]
mov qword [rsp + 0x40], 0
mov ebx, dword [rsp + 0x90]
mov rax, qword [rax]
mov rsi, qword [rsp + 0x98]
mov qword [rsp + 0x48], 0
cmp dword [rax + 0xde], 0
je 0x140020977
mov rcx, qword [rax + 0x7f8]
test rcx, rcx
je 0x140020977
mov r10w, word [rax + 0x80e]
test r10w, r10w
je 0x140020977
mov qword [rsp + 0x40], rcx
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x80], r8
mov dword [rsp + 0x78], edx
mov dword [rsp + 0x3c], r9d
mov word [rsp + 0x48], r10w
call sym.SysSetConfig
mov dword [rsp + 0x20], ebx
mov edx, dword [rsp + 0x78]
mov rcx, r12
mov qword [rsp + 0x28], rsi
mov r9d, dword [rsp + 0x3c]
mov r8, qword [rsp + 0x80]
call sym.SysInvoke
jmp 0x140020989
mov qword [rsp + 0x28], rsi
mov rcx, r12
mov dword [rsp + 0x20], ebx
call qword [rax + 0x218]
mov dword [rsp + 0x20], eax
mov r8d, 0x54
lea r9, [0x14002a975]
lea rdx, str.SysNtDuplicateToken
lea rcx, str._DEBUG::_s::_d___s__..._____08x_n
mov r12d, eax
call sym.DbgPrint
add rsp, 0x50
mov eax, r12d
pop rbx
pop rsi
pop r12
ret
Function at 0x1400209c0
Capabilities:
Print debug messages

Disassembly:
push r12
mov r12, rcx
sub rsp, 0x40
mov rax, qword [0x14002d650]
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x38], 0
mov rax, qword [rax]
cmp dword [rax + 0xde], 0
je 0x140020a45
mov rcx, qword [rax + 0x7f8]
test rcx, rcx
je 0x140020a45
mov r10w, word [rax + 0x82c]
test r10w, r10w
je 0x140020a45
mov qword [rsp + 0x30], rcx
lea rcx, [rsp + 0x30]
mov dword [rsp + 0x68], r9d
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x58], rdx
mov word [rsp + 0x38], r10w
call sym.SysSetConfig
mov r9d, dword [rsp + 0x68]
mov r8, qword [rsp + 0x60]
mov rcx, r12
mov rdx, qword [rsp + 0x58]
call sym.SysInvoke
jmp 0x140020a4e
mov rcx, r12
call qword [rax + 0x298]
mov dword [rsp + 0x20], eax
mov r8d, 0x12b
lea r9, [0x14002aa83]
lea rdx, str.SysNtFreeVirtualMemory
lea rcx, str._DEBUG::_s::_d___s__..._____08x_n
mov r12d, eax
call sym.DbgPrint
add rsp, 0x40
mov eax, r12d
pop r12
ret

Function at 0x140020a80
Capabilities:
Print debug messages

Disassembly:
push r12
mov r12, rcx
sub rsp, 0x40
mov rax, qword [0x14002d650]
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x38], 0
mov rax, qword [rax]
cmp dword [rax + 0xde], 0
je 0x140020af1
mov rcx, qword [rax + 0x7f8]
test rcx, rcx
je 0x140020af1
mov r8w, word [rax + 0x81c]
test r8w, r8w
je 0x140020af1
mov qword [rsp + 0x30], rcx
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x58], rdx
mov word [rsp + 0x38], r8w
call sym.SysSetConfig
mov rdx, qword [rsp + 0x58]
mov rcx, r12
call sym.SysInvoke
jmp 0x140020afa
mov rcx, r12
call qword [rax + 0x250]
mov dword [rsp + 0x20], eax
mov r8d, 0xc8
lea r9, [0x14002a9e7]
lea rdx, str.SysNtGetContextThread
lea rcx, str._DEBUG::_s::_d___s__..._____08x_n
mov r12d, eax
call sym.DbgPrint
add rsp, 0x40
mov eax, r12d
pop r12
ret

Function at 0x140020b30
Capabilities:
Print debug messages

Disassembly:
push r12
mov r12, rcx
push rsi
push rbx
sub rsp, 0x40
mov rax, qword [0x14002d650]
mov qword [rsp + 0x30], 0
mov ebx, dword [rsp + 0x80]
mov rax, qword [rax]
mov rsi, qword [rsp + 0x88]
mov qword [rsp + 0x38], 0
cmp dword [rax + 0xde], 0
je 0x140020bcf
mov rcx, qword [rax + 0x7f8]
test rcx, rcx
je 0x140020bcf
mov r10w, word [rax + 0x848]
test r10w, r10w
je 0x140020bcf
mov qword [rsp + 0x30], rcx
lea rcx, [rsp + 0x30]
mov dword [rsp + 0x78], r9d
mov dword [rsp + 0x70], r8d
mov qword [rsp + 0x68], rdx
mov word [rsp + 0x38], r10w
call sym.SysSetConfig
mov qword [rsp + 0x28], rsi
mov r9d, dword [rsp + 0x78]
mov rcx, r12
mov r8d, dword [rsp + 0x70]
mov rdx, qword [rsp + 0x68]
mov dword [rsp + 0x20], ebx
call sym.SysInvoke
jmp 0x140020be1
mov qword [rsp + 0x28], rsi
mov rcx, r12
mov dword [rsp + 0x20], ebx
call qword [rax + 0x1e8]
mov dword [rsp + 0x20], eax
mov r8d, 0x1f1
lea r9, [0x14002abad]
lea rdx, str.SysNtGetNextThread
lea rcx, str._DEBUG::_s::_d___s__..._____08x_n
mov r12d, eax
call sym.DbgPrint
add rsp, 0x40
mov eax, r12d
pop rbx
pop rsi
pop r12
ret
Function at 0x140020c20
Capabilities:
Print debug messages

Disassembly:
push r12
mov r12, rcx
sub rsp, 0x40
mov rax, qword [0x14002d650]
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x38], 0
mov rax, qword [rax]
cmp dword [rax + 0xde], 0
je 0x140020ca3
mov rcx, qword [rax + 0x7f8]
test rcx, rcx
je 0x140020ca3
mov r10w, word [rax + 0x80a]
test r10w, r10w
je 0x140020ca3
mov qword [rsp + 0x30], rcx
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x68], r9
mov qword [rsp + 0x60], r8
mov dword [rsp + 0x58], edx
mov word [rsp + 0x38], r10w
call sym.SysSetConfig
mov r9, qword [rsp + 0x68]
mov r8, qword [rsp + 0x60]
mov rcx, r12
mov edx, dword [rsp + 0x58]
call sym.SysInvoke
jmp 0x140020cac
mov rcx, r12
call qword [rax + 0x208]
mov dword [rsp + 0x20], eax
mov r8d, 0x1d
lea r9, [0x14002a92f]
lea rdx, str.SysNtOpenProcess
lea rcx, str._DEBUG::_s::_d___s__..._____08x_n
mov r12d, eax
call sym.DbgPrint
add rsp, 0x40
mov eax, r12d
pop r12
ret

Function at 0x140020ce0
Capabilities:
Print debug messages

Disassembly:
push r12
mov r12, rcx
sub rsp, 0x40
mov rax, qword [0x14002d650]
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x38], 0
mov rax, qword [rax]
cmp dword [rax + 0xde], 0
je 0x140020d59
mov rcx, qword [rax + 0x7f8]
test rcx, rcx
je 0x140020d59
mov r9w, word [rax + 0x80c]
test r9w, r9w
je 0x140020d59
mov qword [rsp + 0x30], rcx
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x60], r8
mov dword [rsp + 0x58], edx
mov word [rsp + 0x38], r9w
call sym.SysSetConfig
mov r8, qword [rsp + 0x60]
mov edx, dword [rsp + 0x58]
mov rcx, r12
call sym.SysInvoke
jmp 0x140020d62
mov rcx, r12
call qword [rax + 0x210]
mov dword [rsp + 0x20], eax
mov r8d, 0x44
lea r9, [0x14002a962]
lea rdx, str.SysNtOpenProcessToken
lea rcx, str._DEBUG::_s::_d___s__..._____08x_n
mov r12d, eax
call sym.DbgPrint
add rsp, 0x40
mov eax, r12d
pop r12
ret

Function at 0x140020da0
Capabilities:
Print debug messages

Disassembly:
push r12
mov r12, rcx
sub rsp, 0x40
mov rax, qword [0x14002d650]
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x38], 0
mov rax, qword [rax]
cmp dword [rax + 0xde], 0
je 0x140020e23
mov rcx, qword [rax + 0x7f8]
test rcx, rcx
je 0x140020e23
mov r10w, word [rax + 0x804]
test r10w, r10w
je 0x140020e23
mov qword [rsp + 0x30], rcx
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x68], r9
mov qword [rsp + 0x60], r8
mov dword [rsp + 0x58], edx
mov word [rsp + 0x38], r10w
call sym.SysSetConfig
mov r9, qword [rsp + 0x68]
mov r8, qword [rsp + 0x60]
mov rcx, r12
mov edx, dword [rsp + 0x58]
call sym.SysInvoke
jmp 0x140020e2c
mov rcx, r12
call qword [rax + 0x1f0]
mov dword [rsp + 0x20], eax
mov r8d, 0xf
lea r9, [0x14002a900]
lea rdx, str.SysNtOpenThread
lea rcx, str._DEBUG::_s::_d___s__..._____08x_n
mov r12d, eax
call sym.DbgPrint
add rsp, 0x40
mov eax, r12d
pop r12
ret
Function at 0x140020e60
Capabilities:
Print debug messages

Disassembly:
push r12
movzx r8d, r8b
mov r12, rcx
sub rsp, 0x50
mov rax, qword [0x14002d650]
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x48], 0
mov rax, qword [rax]
cmp dword [rax + 0xde], 0
je 0x140020ee7
mov rcx, qword [rax + 0x7f8]
test rcx, rcx
je 0x140020ee7
mov r10w, word [rax + 0x806]
test r10w, r10w
je 0x140020ee7
mov qword [rsp + 0x40], rcx
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x78], r9
mov dword [rsp + 0x68], edx
mov dword [rsp + 0x3c], r8d
mov word [rsp + 0x48], r10w
call sym.SysSetConfig
mov r9, qword [rsp + 0x78]
mov r8d, dword [rsp + 0x3c]
mov rcx, r12
mov edx, dword [rsp + 0x68]
call sym.SysInvoke
jmp 0x140020ef0
mov rcx, r12
call qword [rax + 0x1f8]
mov dword [rsp + 0x20], eax
mov r8d, 0x37
lea r9, [0x14002a950]
lea rdx, str.SysNtOpenThreadToken
lea rcx, str._DEBUG::_s::_d___s__..._____08x_n
mov r12d, eax
call sym.DbgPrint
add rsp, 0x50
mov eax, r12d
pop r12
ret

Function at 0x140020f30
Capabilities:
Print debug messages

Disassembly:
push r12
mov r12, rcx
push rbx
sub rsp, 0x48
mov rax, qword [0x14002d650]
mov qword [rsp + 0x30], 0
mov rbx, qword [rsp + 0x80]
mov qword [rsp + 0x38], 0
mov rax, qword [rax]
cmp dword [rax + 0xde], 0
je 0x140020fc3
mov rcx, qword [rax + 0x7f8]
test rcx, rcx
je 0x140020fc3
mov r10w, word [rax + 0x830]
test r10w, r10w
je 0x140020fc3
mov qword [rsp + 0x30], rcx
lea rcx, [rsp + 0x30]
mov dword [rsp + 0x78], r9d
mov qword [rsp + 0x70], r8
mov qword [rsp + 0x68], rdx
mov word [rsp + 0x38], r10w
call sym.SysSetConfig
mov qword [rsp + 0x20], rbx
mov r9d, dword [rsp + 0x78]
mov rcx, r12
mov r8, qword [rsp + 0x70]
mov rdx, qword [rsp + 0x68]
call sym.SysInvoke
jmp 0x140020fd1
mov qword [rsp + 0x20], rbx
mov rcx, r12
call qword [rax + 0x2a8]
mov dword [rsp + 0x20], eax
mov r8d, 0x146
lea r9, [0x14002aaac]
lea rdx, str.SysNtProtectVirtualMemory
lea rcx, str._DEBUG::_s::_d___s__..._____08x_n
mov r12d, eax
call sym.DbgPrint
add rsp, 0x48
mov eax, r12d
pop rbx
pop r12
ret

Function at 0x140021010
Capabilities:
Print debug messages

Disassembly:
push r12
mov r12, rcx
push rbx
sub rsp, 0x48
mov rax, qword [0x14002d650]
mov qword [rsp + 0x30], 0
mov rbx, qword [rsp + 0x80]
mov qword [rsp + 0x38], 0
mov rax, qword [rax]
cmp dword [rax + 0xde], 0
je 0x1400210a1
mov rcx, qword [rax + 0x7f8]
test rcx, rcx
je 0x1400210a1
mov r10w, word [rax + 0x820]
test r10w, r10w
je 0x1400210a1
mov qword [rsp + 0x30], rcx
lea rcx, [rsp + 0x30]
mov dword [rsp + 0x78], r9d
mov qword [rsp + 0x70], r8
mov dword [rsp + 0x68], edx
mov word [rsp + 0x38], r10w
call sym.SysSetConfig
mov qword [rsp + 0x20], rbx
mov edx, dword [rsp + 0x68]
mov rcx, r12
mov r9d, dword [rsp + 0x78]
mov r8, qword [rsp + 0x70]
call sym.SysInvoke
jmp 0x1400210af
mov qword [rsp + 0x20], rbx
mov rcx, r12
call qword [rax + 0x260]
mov dword [rsp + 0x20], eax
mov r8d, 0xe3
lea r9, [0x14002aa0d]
lea rdx, str.SysNtQueryInformationProcess
lea rcx, str._DEBUG::_s::_d___s__..._____08x_n
mov r12d, eax
call sym.DbgPrint
add rsp, 0x48
mov eax, r12d
pop rbx
pop r12
ret
Function at 0x1400210f0
Capabilities:
Print debug messages

Disassembly:
push r12
mov r12, rcx
push rbx
sub rsp, 0x48
mov rax, qword [0x14002d650]
mov qword [rsp + 0x30], 0
mov rbx, qword [rsp + 0x80]
mov qword [rsp + 0x38], 0
mov rax, qword [rax]
cmp dword [rax + 0xde], 0
je 0x140021181
mov rcx, qword [rax + 0x7f8]
test rcx, rcx
je 0x140021181
mov r10w, word [rax + 0x83c]
test r10w, r10w
je 0x140021181
mov qword [rsp + 0x30], rcx
lea rcx, [rsp + 0x30]
mov dword [rsp + 0x78], r9d
mov qword [rsp + 0x70], r8
mov dword [rsp + 0x68], edx
mov word [rsp + 0x38], r10w
call sym.SysSetConfig
mov qword [rsp + 0x20], rbx
mov edx, dword [rsp + 0x68]
mov rcx, r12
mov r9d, dword [rsp + 0x78]
mov r8, qword [rsp + 0x70]
call sym.SysInvoke
jmp 0x14002118f
mov qword [rsp + 0x20], rbx
mov rcx, r12
call qword [rax + 0x2e0]
mov dword [rsp + 0x20], eax
mov r8d, 0x1a9
lea r9, [0x14002ab49]
lea rdx, str.SysNtQueryInformationThread
lea rcx, str._DEBUG::_s::_d___s__..._____08x_n
mov r12d, eax
call sym.DbgPrint
add rsp, 0x48
mov eax, r12d
pop rbx
pop r12
ret

Function at 0x1400211d0
Capabilities:
Print debug messages

Disassembly:
push r12
mov r12, rcx
push rbx
sub rsp, 0x48
mov rax, qword [0x14002d650]
mov qword [rsp + 0x30], 0
mov rbx, qword [rsp + 0x80]
mov qword [rsp + 0x38], 0
mov rax, qword [rax]
cmp dword [rax + 0xde], 0
je 0x140021261
mov rcx, qword [rax + 0x7f8]
test rcx, rcx
je 0x140021261
mov r10w, word [rax + 0x83a]
test r10w, r10w
je 0x140021261
mov qword [rsp + 0x30], rcx
lea rcx, [rsp + 0x30]
mov dword [rsp + 0x78], r9d
mov qword [rsp + 0x70], r8
mov dword [rsp + 0x68], edx
mov word [rsp + 0x38], r10w
call sym.SysSetConfig
mov qword [rsp + 0x20], rbx
mov edx, dword [rsp + 0x68]
mov rcx, r12
mov r9d, dword [rsp + 0x78]
mov r8, qword [rsp + 0x70]
call sym.SysInvoke
jmp 0x14002126f
mov qword [rsp + 0x20], rbx
mov rcx, r12
call qword [rax + 0x2d8]
mov dword [rsp + 0x20], eax
mov r8d, 0x19a
lea r9, [0x14002ab31]
lea rdx, str.SysNtQueryInformationToken
lea rcx, str._DEBUG::_s::_d___s__..._____08x_n
mov r12d, eax
call sym.DbgPrint
add rsp, 0x48
mov eax, r12d
pop rbx
pop r12
ret

Function at 0x1400212b0
Capabilities:
Print debug messages

Disassembly:
push r12
mov r12, rcx
push rbx
sub rsp, 0x48
mov rax, qword [0x14002d650]
mov qword [rsp + 0x30], 0
mov rbx, qword [rsp + 0x80]
mov qword [rsp + 0x38], 0
mov rax, qword [rax]
cmp dword [rax + 0xde], 0
je 0x140021341
mov rcx, qword [rax + 0x7f8]
test rcx, rcx
je 0x140021341
mov r10w, word [rax + 0x83e]
test r10w, r10w
je 0x140021341
mov qword [rsp + 0x30], rcx
lea rcx, [rsp + 0x30]
mov dword [rsp + 0x78], r9d
mov qword [rsp + 0x70], r8
mov dword [rsp + 0x68], edx
mov word [rsp + 0x38], r10w
call sym.SysSetConfig
mov qword [rsp + 0x20], rbx
mov edx, dword [rsp + 0x68]
mov rcx, r12
mov r9d, dword [rsp + 0x78]
mov r8, qword [rsp + 0x70]
call sym.SysInvoke
jmp 0x14002134f
mov qword [rsp + 0x20], rbx
mov rcx, r12
call qword [rax + 0x2e8]
mov dword [rsp + 0x20], eax
mov r8d, 0x1b8
lea r9, [0x14002ab62]
lea rdx, str.SysNtQueryObject
lea rcx, str._DEBUG::_s::_d___s__..._____08x_n
mov r12d, eax
call sym.DbgPrint
add rsp, 0x48
mov eax, r12d
pop rbx
pop r12
ret
Function at 0x140021390
Capabilities:
Print debug messages

Disassembly:
push r12
mov r12d, ecx
sub rsp, 0x40
mov rax, qword [0x14002d650]
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x38], 0
mov rax, qword [rax]
cmp dword [rax + 0xde], 0
je 0x140021415
mov rcx, qword [rax + 0x7f8]
test rcx, rcx
je 0x140021415
mov r10w, word [rax + 0x822]
test r10w, r10w
je 0x140021415
mov qword [rsp + 0x30], rcx
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x68], r9
mov dword [rsp + 0x60], r8d
mov qword [rsp + 0x58], rdx
mov word [rsp + 0x38], r10w
call sym.SysSetConfig
mov r9, qword [rsp + 0x68]
mov r8d, dword [rsp + 0x60]
mov ecx, r12d
mov rdx, qword [rsp + 0x58]
call sym.SysInvoke
jmp 0x14002141e
mov ecx, r12d
call qword [rax + 0x268]
mov dword [rsp + 0x20], eax
mov r8d, 0xf1
lea r9, [0x14002aa27]
lea rdx, str.SysNtQuerySystemInformation
lea rcx, str._DEBUG::_s::_d___s__..._____08x_n
mov r12d, eax
call sym.DbgPrint
add rsp, 0x40
mov eax, r12d
pop r12
ret

Function at 0x140021450
Capabilities:
Print debug messages

Disassembly:
push r12
mov r12, rcx
push rsi
push rbx
sub rsp, 0x40
mov rax, qword [0x14002d650]
mov rbx, qword [rsp + 0x80]
mov rsi, qword [rsp + 0x88]
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x38], 0
mov rax, qword [rax]
cmp dword [rax + 0xde], 0
je 0x1400214f1
mov rcx, qword [rax + 0x7f8]
test rcx, rcx
je 0x1400214f1
mov r10w, word [rax + 0x838]
test r10w, r10w
je 0x1400214f1
mov qword [rsp + 0x30], rcx
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x78], r9
mov dword [rsp + 0x70], r8d
mov qword [rsp + 0x68], rdx
mov word [rsp + 0x38], r10w
call sym.SysSetConfig
mov qword [rsp + 0x28], rsi
mov r9, qword [rsp + 0x78]
mov rcx, r12
mov r8d, dword [rsp + 0x70]
mov rdx, qword [rsp + 0x68]
mov qword [rsp + 0x20], rbx
call sym.SysInvoke
jmp 0x140021504
mov qword [rsp + 0x28], rsi
mov rcx, r12
mov qword [rsp + 0x20], rbx
call qword [rax + 0x2d0]
mov dword [rsp + 0x20], eax
mov r8d, 0x18b
lea r9, [0x14002ab1c]
lea rdx, str.SysNtQueryVirtualMemory
lea rcx, str._DEBUG::_s::_d___s__..._____08x_n
mov r12d, eax
call sym.DbgPrint
add rsp, 0x40
mov eax, r12d
pop rbx
pop rsi
pop r12
ret

Function at 0x140021540
Capabilities:
Print debug messages

Disassembly:
push r12
mov r12, rcx
push rbx
sub rsp, 0x48
mov rax, qword [0x14002d650]
mov qword [rsp + 0x30], 0
mov rbx, qword [rsp + 0x80]
mov qword [rsp + 0x38], 0
mov rax, qword [rax]
cmp dword [rax + 0xde], 0
je 0x1400215d3
mov rcx, qword [rax + 0x7f8]
test rcx, rcx
je 0x1400215d3
mov r10w, word [rax + 0x810]
test r10w, r10w
je 0x1400215d3
mov qword [rsp + 0x30], rcx
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x78], r9
mov qword [rsp + 0x70], r8
mov qword [rsp + 0x68], rdx
mov word [rsp + 0x38], r10w
call sym.SysSetConfig
mov qword [rsp + 0x20], rbx
mov r9, qword [rsp + 0x78]
mov rcx, r12
mov r8, qword [rsp + 0x70]
mov rdx, qword [rsp + 0x68]
call sym.SysInvoke
jmp 0x1400215e1
mov qword [rsp + 0x20], rbx
mov rcx, r12
call qword [rax + 0x220]
mov dword [rsp + 0x20], eax
mov r8d, 0x63
lea r9, [0x14002a986]
lea rdx, str.SysNtQueueApcThread
lea rcx, str._DEBUG::_s::_d___s__..._____08x_n
mov r12d, eax
call sym.DbgPrint
add rsp, 0x48
mov eax, r12d
pop rbx
pop r12
ret
Function at 0x140021620
Capabilities:
Print debug messages

Disassembly:
push r12
mov r12, rcx
push rbx
sub rsp, 0x48
mov rax, qword [0x14002d650]
mov qword [rsp + 0x30], 0
mov rbx, qword [rsp + 0x80]
mov qword [rsp + 0x38], 0
mov rax, qword [rax]
cmp dword [rax + 0xde], 0
je 0x1400216b3
mov rcx, qword [rax + 0x7f8]
test rcx, rcx
je 0x1400216b3
mov r10w, word [rax + 0x82a]
test r10w, r10w
je 0x1400216b3
mov qword [rsp + 0x30], rcx
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x78], r9
mov qword [rsp + 0x70], r8
mov qword [rsp + 0x68], rdx
mov word [rsp + 0x38], r10w
call sym.SysSetConfig
mov qword [rsp + 0x20], rbx
mov r9, qword [rsp + 0x78]
mov rcx, r12
mov r8, qword [rsp + 0x70]
mov rdx, qword [rsp + 0x68]
call sym.SysInvoke
jmp 0x1400216c1
mov qword [rsp + 0x20], rbx
mov rcx, r12
call qword [rax + 0x290]
mov dword [rsp + 0x20], eax
mov r8d, 0x155
lea r9, [0x14002aac3]
lea rdx, str.SysNtReadVirtualMemory
lea rcx, str._DEBUG::_s::_d___s__..._____08x_n
mov r12d, eax
call sym.DbgPrint
add rsp, 0x48
mov eax, r12d
pop rbx
pop r12
ret

Function at 0x140021700
Capabilities:
Print debug messages

Disassembly:
push r12
mov r12, rcx
sub rsp, 0x40
mov rax, qword [0x14002d650]
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x38], 0
mov rax, qword [rax]
cmp dword [rax + 0xde], 0
je 0x140021771
mov rcx, qword [rax + 0x7f8]
test rcx, rcx
je 0x140021771
mov r8w, word [rax + 0x814]
test r8w, r8w
je 0x140021771
mov qword [rsp + 0x30], rcx
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x58], rdx
mov word [rsp + 0x38], r8w
call sym.SysSetConfig
mov rdx, qword [rsp + 0x58]
mov rcx, r12
call sym.SysInvoke
jmp 0x14002177a
mov rcx, r12
call qword [rax + 0x230]
mov dword [rsp + 0x20], eax
mov r8d, 0x7b
lea r9, [0x14002a9a7]
lea rdx, str.SysNtResumeThread
lea rcx, str._DEBUG::_s::_d___s__..._____08x_n
mov r12d, eax
call sym.DbgPrint
add rsp, 0x40
mov eax, r12d
pop r12
ret

Function at 0x1400217b0
Capabilities:
Print debug messages

Disassembly:
push r12
mov r12, rcx
sub rsp, 0x40
mov rax, qword [0x14002d650]
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x38], 0
mov rax, qword [rax]
cmp dword [rax + 0xde], 0
je 0x140021821
mov rcx, qword [rax + 0x7f8]
test rcx, rcx
je 0x140021821
mov r8w, word [rax + 0x81e]
test r8w, r8w
je 0x140021821
mov qword [rsp + 0x30], rcx
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x58], rdx
mov word [rsp + 0x38], r8w
call sym.SysSetConfig
mov rdx, qword [rsp + 0x58]
mov rcx, r12
call sym.SysInvoke
jmp 0x14002182a
mov rcx, r12
call qword [rax + 0x258]
mov dword [rsp + 0x20], eax
mov r8d, 0xd4
lea r9, [0x14002a9fa]
lea rdx, str.SysNtSetContextThread
lea rcx, str._DEBUG::_s::_d___s__..._____08x_n
mov r12d, eax
call sym.DbgPrint
add rsp, 0x40
mov eax, r12d
pop r12
ret
Function at 0x140021860
Capabilities:
Print debug messages

Disassembly:
push r12
mov r12, rcx
sub rsp, 0x40
mov rax, qword [0x14002d650]
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x38], 0
mov rax, qword [rax]
cmp dword [rax + 0xde], 0
je 0x1400218e3
mov rcx, qword [rax + 0x7f8]
test rcx, rcx
je 0x1400218e3
mov r10w, word [rax + 0x844]
test r10w, r10w
je 0x1400218e3
mov qword [rsp + 0x30], rcx
lea rcx, [rsp + 0x30]
mov dword [rsp + 0x68], r9d
mov qword [rsp + 0x60], r8
mov dword [rsp + 0x58], edx
mov word [rsp + 0x38], r10w
call sym.SysSetConfig
mov r9d, dword [rsp + 0x68]
mov r8, qword [rsp + 0x60]
mov rcx, r12
mov edx, dword [rsp + 0x58]
call sym.SysInvoke
jmp 0x1400218ec
mov rcx, r12
call qword [rax + 0x1d8]
mov dword [rsp + 0x20], eax
mov r8d, 0x1d1
lea r9, [0x14002ab78]
lea rdx, str.SysNtSetInformationThread
lea rcx, str._DEBUG::_s::_d___s__..._____08x_n
mov r12d, eax
call sym.DbgPrint
add rsp, 0x40
mov eax, r12d
pop r12
ret

Function at 0x140021920
Capabilities:
Print debug messages

Disassembly:
push r12
mov r12, rcx
push rsi
push rbx
sub rsp, 0x40
mov rax, qword [0x14002d650]
mov qword [rsp + 0x30], 0
mov rbx, qword [rsp + 0x80]
mov rax, qword [rax]
mov esi, dword [rsp + 0x88]
mov qword [rsp + 0x38], 0
cmp dword [rax + 0xde], 0
je 0x1400219bd
mov rcx, qword [rax + 0x7f8]
test rcx, rcx
je 0x1400219bd
mov r10w, word [rax + 0x846]
test r10w, r10w
je 0x1400219bd
mov qword [rsp + 0x30], rcx
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x78], r9
mov qword [rsp + 0x70], r8
mov dword [rsp + 0x68], edx
mov word [rsp + 0x38], r10w
call sym.SysSetConfig
mov dword [rsp + 0x28], esi
mov edx, dword [rsp + 0x68]
mov rcx, r12
mov r9, qword [rsp + 0x78]
mov r8, qword [rsp + 0x70]
mov qword [rsp + 0x20], rbx
call sym.SysInvoke
jmp 0x1400219cf
mov dword [rsp + 0x28], esi
mov rcx, r12
mov qword [rsp + 0x20], rbx
call qword [rax + 0x1e0]
mov dword [rsp + 0x20], eax
mov r8d, 0x1e1
lea r9, [0x14002ab8f]
lea rdx, str.SysNtSetInformationVirtualMemory
lea rcx, str._DEBUG::_s::_d___s__..._____08x_n
mov r12d, eax
call sym.DbgPrint
add rsp, 0x40
mov eax, r12d
pop rbx
pop rsi
pop r12
ret

Function at 0x140021a10
Capabilities:
Print debug messages

Disassembly:
push r12
movzx r8d, r8b
mov r12, rcx
sub rsp, 0x50
mov rax, qword [0x14002d650]
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x48], 0
mov rax, qword [rax]
cmp dword [rax + 0xde], 0
je 0x140021a99
mov rcx, qword [rax + 0x7f8]
test rcx, rcx
je 0x140021a99
mov r10w, word [rax + 0x836]
test r10w, r10w
je 0x140021a99
mov qword [rsp + 0x40], rcx
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x78], r9
mov qword [rsp + 0x68], rdx
mov dword [rsp + 0x3c], r8d
mov word [rsp + 0x48], r10w
call sym.SysSetConfig
mov r9, qword [rsp + 0x78]
mov r8d, dword [rsp + 0x3c]
mov rcx, r12
mov rdx, qword [rsp + 0x68]
call sym.SysInvoke
jmp 0x140021aa2
mov rcx, r12
call qword [rax + 0x2c8]
mov dword [rsp + 0x20], eax
mov r8d, 0x17b
lea r9, [0x14002aafd]
lea rdx, str.SysNtSignalAndWaitForSingleObject
lea rcx, str._DEBUG::_s::_d___s__..._____08x_n
mov r12d, eax
call sym.DbgPrint
add rsp, 0x50
mov eax, r12d
pop r12
ret