joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14003868c
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
push rbp
lea rbp, [rsp - 0x740]
sub rsp, 0x840
mov rax, qword [0x1401f05f0]
xor rax, rsp
mov qword [rbp + 0x730], rax
and dword [rsp + 0x20], 0
mov eax, dword [0x1401ef3c8]
or ebx, 0xffffffff
mov dword [rsp + 0x20], eax
mov ecx, eax
cmp eax, ebx
jne 0x140038729
lea rcx, [rsp + 0x20]
call fcn.140038bb0
test al, al
jne 0x1400386dd
call fcn.14001123c
mov ecx, dword [rsp + 0x20]
cmp ecx, ebx
jne 0x140038709
lea rcx, [rsp + 0x20]
call fcn.140038bb0
test al, al
je 0x1400386f9
cmp dword [rsp + 0x20], ebx
jne 0x1400386fe
call fcn.14001123c
mov ecx, ebx
call fcn.14002c584
mov ecx, dword [rsp + 0x20]
or eax, 0xffffffff
lock cmpxchg dword [0x1401ef3c8], ecx
mov ecx, dword [rsp + 0x20]
je 0x140038729
call fcn.14002c584
mov ecx, dword [0x1401ef3c8]
mov dword [rsp + 0x20], ecx
call sub.KERNEL32.dll_TlsGetValue
test rax, rax
je 0x140038738
call fcn.14001123c
mov ebx, 0x800
lea rcx, [rsp + 0x30]
xor edx, edx
mov r8d, ebx
call fcn.140099550
mov ecx, dword [rsp + 0x20]
lea rdx, [rsp + 0x30]
call fcn.140038bdc
mov ecx, ebx
call fcn.1400979a4
lea rdx, [rsp + 0x30]
mov rbx, rax
mov rcx, rax
mov eax, reloc.WS2_32.dll_recv
lea r8d, [rax + 0x70]
movups xmm0, xmmword [rdx]
movups xmmword [rcx], xmm0
movups xmm1, xmmword [rdx + 0x10]
movups xmmword [rcx + 0x10], xmm1
movups xmm0, xmmword [rdx + 0x20]
movups xmmword [rcx + 0x20], xmm0
movups xmm1, xmmword [rdx + 0x30]
movups xmmword [rcx + 0x30], xmm1
movups xmm0, xmmword [rdx + 0x40]
movups xmmword [rcx + 0x40], xmm0
movups xmm1, xmmword [rdx + 0x50]
movups xmmword [rcx + 0x50], xmm1
movups xmm0, xmmword [rdx + 0x60]
movups xmmword [rcx + 0x60], xmm0
movups xmm1, xmmword [rdx + 0x70]
add rcx, r8
add rdx, r8
movups xmmword [rcx - 0x10], xmm1
dec rax
jne 0x140038775
mov ecx, dword [rsp + 0x20]
mov rdx, rbx
call fcn.140038bdc
mov rax, rbx
mov rcx, qword [rbp + 0x730]
xor rcx, rsp
call fcn.1400991d0
mov rbx, qword [rsp + 0x850]
add rsp, 0x840
pop rbp
ret

Function at 0x1400387f0
Capabilities:
Get thread local storage value

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
mov ecx, dword [0x1401ef3c8]
call sub.KERNEL32.dll_TlsGetValue
mov rdx, rax
test rax, rax
jne 0x140038814
call fcn.14003868c
mov rdx, rax
movsxd rax, dword [rbx + 4]
mov rax, qword [rdx + rax*8]
add rsp, 0x20
pop rbx
ret

Function at 0x140038824
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x20
and dword [rsp + 0x30], 0
mov rbx, rcx
mov ecx, dword [0x1401ef3c8]
mov rdi, rdx
cmp ecx, 0xffffffff
je 0x14003884e
call sub.KERNEL32.dll_TlsGetValue
test rax, rax
jne 0x140038853
call fcn.14003868c
mov ecx, 1
lock xadd dword [0x1401f39e0], ecx
inc ecx
mov dword [rbx + 4], ecx
cmp ecx, 0x100
jl 0x140038872
call fcn.14001123c
movsxd rcx, dword [rbx + 4]
lea rdx, [0x1401f39f0]
mov al, 1
mov qword [rdx + rcx*8], rdi
mov byte [rbx], 1
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x140038894
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x28
mov ecx, dword [0x1401ef3c8]
cmp ecx, 0xffffffff
je 0x1400388b5
call sub.KERNEL32.dll_TlsGetValue
test rax, rax
je 0x1400388b5
mov rcx, rax
call fcn.1400388bc
add rsp, 0x28
ret

Function at 0x1400389d8
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
mov ecx, dword [0x1401ef3c8]
mov rbx, rdx
call sub.KERNEL32.dll_TlsGetValue
mov r8, rax
test rax, rax
jne 0x140038a03
call fcn.14003868c
mov r8, rax
movsxd rax, dword [rdi + 4]
mov qword [r8 + rax*8], rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x140038bb0
Capabilities:
Allocate thread local storage

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
cmp eax, 0xffffffff
je 0x140038bca
mov dword [rbx], eax
mov al, 1
jmp 0x140038bcc
xor al, al
add rsp, 0x20
pop rbx
ret

Function at 0x140038bdc
Capabilities:
Set thread local storage value

Disassembly:
and dword [rsp + 0x18], 0
jmp qword [sym.imp.KERNEL32.dll_TlsSetValue]

Function at 0x140038be8
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x20
mov rax, qword [rcx + 8]
mov rsi, rdx
mov rbx, rcx
movsxd rdx, dword [rax + 0x3c]
add rdx, rax
mov rax, qword [rcx]
mov edx, dword [rdx + 0x88]
call qword [rax + reloc.WS2_32.dll_htonl]
xor ebp, ebp
mov rdi, rax
test rax, rax
jne 0x140038c27
xor eax, eax
jmp 0x140038c5b
lea r8, [rsp + 0x30]
mov rdx, rsi
mov rcx, rbx
mov word [rsp + 0x30], bp
call fcn.140038d94
test al, al
je 0x140038c23
mov rax, qword [rbx]
mov edx, dword [rdi + 0x1c]
mov rcx, rbx
call qword [rax + reloc.WS2_32.dll_htonl]
mov ecx, dword [rdi + 0x10]
movzx edx, word [rsp + 0x30]
sub rdx, rcx
lea rax, [rax + rdx*4]
mov rbx, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret
Function at 0x140038d94
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
mov r15, r8
mov r14, rdx
mov rdi, rcx
test r8, r8
je 0x140038ea8
mov rax, qword [rcx + 8]
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
mov rax, qword [rdi]
mov edx, dword [rcx + 0x88]
mov rcx, rdi
call qword [rax + reloc.WS2_32.dll_htonl]
mov rsi, rax
test rax, rax
je 0x140038ea8
cmp r14, 0xffff
ja 0x140038dfa
mov word [r15], r14w
jmp 0x140038ea4
mov rax, qword [rdi]
mov edx, dword [rsi + 0x20]
mov rcx, rdi
call qword [rax + reloc.WS2_32.dll_htonl]
mov ecx, dword [rsi + 0x18]
lea rbp, [rcx*4]
mov r13, rax
mov rbx, rax
add rbp, rax
cmp rax, rbp
je 0x140038ea8
mov rax, rbp
mov rcx, rdi
sub rax, rbx
sar rax, 2
cqo
sub rax, rdx
sar rax, 1
lea r12, [rbx + rax*4]
mov rax, qword [rdi]
mov edx, dword [r12]
call qword [rax + reloc.WS2_32.dll_htonl]
mov dl, byte [r14]
mov rcx, r14
jmp 0x140038e5a
cmp dl, byte [rax]
jne 0x140038e5e
inc rcx
inc rax
mov dl, byte [rcx]
test dl, dl
jne 0x140038e4e
movzx eax, byte [rax]
movzx ecx, byte [rcx]
sub ecx, eax
je 0x140038e7d
test ecx, ecx
jle 0x140038e73
lea rbx, [r12 + 4]
jmp 0x140038e76
mov rbp, r12
cmp rbx, rbp
jne 0x140038e23
jmp 0x140038e80
mov rbx, r12
test ecx, ecx
jne 0x140038ea8
mov r8, qword [rdi]
mov edx, dword [rsi + 0x24]
mov rcx, rdi
call qword [rreloc.WS2_32.dll_htonl + 8]
sub rbx, r13
sar rbx, 2
movzx ecx, word [rax + rbx*2]
add cx, word [rsi + 0x10]
mov word [r15], cx
mov al, 1
jmp 0x140038eaa
xor al, al
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
ret

Function at 0x140038f04
Capabilities:
Parse pe header

Disassembly:
mov rdx, qword [rcx + 8]
mov eax, 0x5a4d
cmp word [rdx], ax
je 0x140038f15
xor al, al
ret
movsxd rax, dword [rdx + 0x3c]
add rax, rdx
cmp dword [rax], 0x4550
jne 0x140038f12
mov ecx, 0xf0
cmp word [rax + 0x14], cx
jne 0x140038f12
mov ecx, 0x20b
cmp word [rax + 0x18], cx
sete al
ret

Function at 0x140039010
Capabilities:
Accept command line arguments
Create process on windows

Disassembly:
sub rsp, 0xe8
mov rcx, r9
call fcn.14003b270
test al, al
jne 0x1400390af
call fcn.140038f80
mov rcx, rax
mov rdx, qword [rax]
call qword [rdx + 0x28]
test al, al
je 0x1400390af
xor edx, edx
lea rcx, [rsp + 0x78]
mov dword [rsp + 0x70], WSAGetLastError
lea r8d, [rdx + 0x60]
call fcn.140099550
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
xor r9d, r9d
mov rdx, rax
lea rax, [rsp + 0x50]
xor r8d, r8d
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x70]
xor ecx, ecx
mov qword [rsp + 0x40], rax
and qword [rsp + 0x38], 0
and qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x400
and dword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x1400390af
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
add rsp, 0xe8
ret
Function at 0x140039b3c
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x20
mov rdx, rcx
mov rcx, qword [0x1401f4228]
test rcx, rcx
je 0x140039b7a
call fcn.1400bc9bc
mov rbx, qword [0x1401f4238]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov edx, 1
test rbx, rbx
jne 0x140039b78
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
jmp 0x140039b7a
call rbx
xor eax, eax
add rsp, 0x20
pop rbx
ret

Function at 0x140039bbc
Capabilities:
Create thread

Disassembly:
sub rsp, 0x48
xor eax, eax
lea r9, [0x1400390bc]
xor r8d, r8d
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], eax
xor edx, edx
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_CreateRemoteThread]
add rsp, 0x48
ret

Function at 0x140039be8
Capabilities:
Create thread

Disassembly:
sub rsp, 0x48
xor eax, eax
lea r9, [0x140039164]
xor r8d, r8d
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], eax
xor edx, edx
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_CreateRemoteThread]
add rsp, 0x48
ret

Function at 0x14003e4d8
Capabilities:
Identify system language via api

Disassembly:
push rbx
sub rsp, 0x20
and dword [rsp + 0x30], 0
mov rax, qword [rcx]
mov rcx, qword [rax + 8]
mov rbx, qword [rcx + 8]
test rbx, rbx
jne 0x14003e4f8
call fcn.14001123c
lea rcx, [rsp + 0x30]
call fcn.14009edf4
call qword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
call qword [sym.imp.KERNEL32.dll_GetUserDefaultLCID]
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + reloc.WS2_32.dll_htonl]
add rsp, 0x20
pop rbx
ret
Function at 0x140040b08
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r14
push r15
lea rbp, [rsp - 0x108]
sub rsp, 0x208
mov rax, qword [0x1401f05f0]
xor rax, rsp
mov qword [rbp + 0xf0], rax
mov rsi, qword [rbp + 0x160]
mov r15, r9
mov r14, r8
mov rbx, rdx
mov rdi, rcx
cmp rdx, 0x40
jbe 0x140040b87
lea rcx, [rsp + 0x20]
call fcn.140040fd0
lea rcx, [rsp + 0x20]
mov r8, rbx
mov rdx, rdi
call fcn.140040f4c
lea rdx, [rbp + 0x50]
lea rcx, [rsp + 0x20]
mov r9d, 0x20
xor r8d, r8d
call fcn.140041684
mov r8d, 0x20
lea rcx, [rbp + 0x70]
jmp 0x140040bac
mov r8, rdx
mov rdx, rcx
lea rcx, [rbp + 0x50]
call fcn.140098bd0
cmp rbx, 0x40
jae 0x140040bb3
lea rcx, [rbp + 0x50]
mov r8d, 0x40
sub r8, rbx
add rcx, rbx
xor edx, edx
call fcn.140099550
xor ebx, ebx
mov ecx, ebx
mov al, byte [rbp + rcx + 0x50]
inc rcx
xor al, 0x36
mov byte [rbp + rcx + 0x8f], al
cmp rcx, 0x40
jl 0x140040bb7
lea rcx, [rsp + 0x20]
call fcn.140040fd0
lea rdx, [rbp + 0x90]
lea rcx, [rsp + 0x20]
mov r8d, 0x40
call fcn.14004189c
lea rcx, [rsp + 0x20]
mov r8, r15
mov rdx, r14
call fcn.140040f4c
lea rdx, [rbp + 0xd0]
lea rcx, [rsp + 0x20]
mov r9d, 0x20
xor r8d, r8d
call fcn.140041684
mov al, byte [rbp + rbx + 0x50]
inc rbx
xor al, 0x5c
mov byte [rbp + rbx + 0x8f], al
cmp rbx, 0x40
jl 0x140040c18
lea rcx, [rsp + 0x20]
call fcn.140040fd0
lea rdx, [rbp + 0x90]
lea rcx, [rsp + 0x20]
mov r8d, 0x40
call fcn.14004189c
lea rdx, [rbp + 0xd0]
lea rcx, [rsp + 0x20]
mov r8d, 0x20
call fcn.14004189c
mov r9d, dword [rbp + 0x168]
lea rcx, [rsp + 0x20]
xor r8d, r8d
mov rdx, rsi
call fcn.140041684
mov rcx, qword [rbp + 0xf0]
xor rcx, rsp
call fcn.1400991d0
add rsp, 0x208
pop r15
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret
Function at 0x140040e08
Capabilities:
Hash data using sha1 via wincrypt
Hash data via wincrypt
Initialize hashing via wincrypt

Disassembly:
mov r11, rsp
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rsi
push rdi
sub rsp, 0x60
and dword [rsp + 0x70], 0
mov eax, dword [rcx]
mov rcx, qword [rcx + 8]
mov rdi, r9
mov rsi, r8
mov rbx, rdx
cmp eax, 1
jne 0x140040e65
mov rax, qword [rcx + 0x18]
cmp qword [rcx + 0x10], rax
je 0x140040f35
mov qword [r11 - 0x40], r9
mov r9, qword [rbx + 8]
mov rdx, rax
sub rdx, qword [rcx + 0x10]
mov rcx, qword [rcx + 0x10]
mov qword [r11 - 0x48], r8
mov r8, qword [rbx]
call fcn.140040b08
mov al, 1
jmp 0x140040f37
cmp qword [rcx], 0
je 0x140040f35
cmp qword [rcx + 8], 0
je 0x140040f35
test eax, eax
jne 0x140040f35
and qword [rsp + 0x30], 0
mov r8, qword [rcx + 8]
mov rcx, qword [rcx]
lea rax, [rsp + 0x30]
xor r9d, r9d
mov edx, 0x8009
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
je 0x140040f1f
xor edx, edx
lea rcx, [rsp + 0x38]
lea r8d, [rdx + 0x28]
call fcn.140099550
mov rcx, qword [rsp + 0x30]
xor r9d, r9d
lea r8, [rsp + 0x38]
lea edx, [r9 + 5]
mov dword [rsp + 0x38], 0x8004
call qword [sym.imp.ADVAPI32.dll_CryptSetHashParam]
test eax, eax
je 0x140040f1f
mov r8d, dword [rbx + 8]
mov rdx, qword [rbx]
mov rcx, qword [rsp + 0x30]
xor r9d, r9d
call qword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
je 0x140040f1f
mov rcx, qword [rsp + 0x30]
and dword [rsp + 0x20], 0
lea r9, [rsp + 0x70]
mov r8, rsi
mov edx, 2
mov dword [rsp + 0x70], edi
call qword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
test eax, eax
setne bl
jmp 0x140040f21
xor bl, bl
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x140040f31
call qword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
mov al, bl
jmp 0x140040f37
xor al, al
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret

Function at 0x140040fd0
Capabilities:
Hash data using sha256

Disassembly:
push rbx
sub rsp, 0x20
xor edx, edx
mov r8d, pe_nt_image_headers64
mov rbx, rcx
call fcn.140099550
movups xmm0, xmmword [0x1400c9170]
movups xmmword [rbx + 0x100], xmm0
movups xmm1, xmmword [0x1400c9180]
movups xmmword [rbx + 0x110], xmm1
add rsp, 0x20
pop rbx
ret
Function at 0x140042b08
Capabilities:
Connect pipe

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x20
and dword [rsp + 0x30], 0
cmp byte [rcx + 0x1068], 0
mov rdi, rcx
je 0x140042b2a
mov byte [rcx + 0x1068], 0
mov rcx, qword [rcx + 0x10a0]
lea rax, [rcx + 1]
test rax, 0xfffffffffffffffe
je 0x140042b7f
lea rdx, [rdi + 0x1040]
call qword [sym.imp.KERNEL32.dll_ConnectNamedPipe]
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
test ebx, ebx
jne 0x140042b7f
cmp eax, 0xe8
je 0x140042b7f
cmp eax, 0x217
je 0x140042b74
cmp eax, 0x3e5
jne 0x140042b7f
mov byte [rdi + 0x1068], 1
jmp 0x140042b7b
mov byte [rdi + 0x10d8], 0
mov al, 1
jmp 0x140042b81
xor al, al
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x140042b8c
Capabilities:
Check if file exists
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x140
xor ebx, ebx
mov rdi, rcx
mov dword [rsp + 0x150], ebx
cmp byte [rcx + 0x1098], bl
je 0x140042c3e
mov byte [rcx + 0x1098], bl
test rdx, rdx
je 0x140042d23
test r8d, r8d
je 0x140042d23
cmp qword [rcx + 0x10d0], rbx
jne 0x140042bdc
call fcn.14001123c
mov r8, qword [rdi + 0x10b0]
mov rdx, qword [rdi + 0x10c8]
test r8, r8
jne 0x140042bf4
mov r8, rbx
jmp 0x140042bf7
mov r8, qword [r8]
mov rcx, qword [r8 + 0x10]
mov rax, rdx
and edx, 1
shr rax, 1
dec rcx
and rcx, rax
mov rax, qword [r8 + 8]
mov rax, qword [rax + rcx*8]
mov rcx, qword [rax + rdx*8]
dec qword [rdi + 0x10d0]
jne 0x140042c28
mov qword [rdi + 0x10c8], rbx
jmp 0x140042c2f
inc qword [rdi + 0x10c8]
test rcx, rcx
je 0x140042c3e
mov rax, qword [rcx]
mov edx, 1
call qword [rax]
cmp qword [rdi + 0x10d0], rbx
je 0x140042d89
mov r10, qword [rdi + 0x10a0]
lea rax, [r10 + 1]
test rax, 0xfffffffffffffffe
je 0x140042d7e
mov rax, qword [rdi + 0x10b0]
mov r9, qword [rdi + 0x10c8]
mov rcx, rbx
test rax, rax
je 0x140042c7b
mov rcx, qword [rax]
mov rdx, qword [rcx + 0x10]
mov rax, r9
and r9d, 1
shr rax, 1
dec rdx
and rdx, rax
mov rax, qword [rcx + 8]
mov rcx, r10
mov rax, qword [rax + rdx*8]
mov r9, qword [rax + r9*8]
lea rax, [rdi + 0x1070]
mov rdx, qword [r9 + 8]
mov qword [rsp + 0x20], rax
mov r8d, dword [rdx]
add r8, qword [r9 + 0x10]
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x140042d82
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
cmp eax, 0x3e5
je 0x140042d82
call fcn.140011848
cmp eax, 2
jg 0x140042d1d
mov ebx, 0x80
lea rdx, str.c:core_no_admin_srcipcipc_channel_win.cc
lea rcx, [rsp + 0x30]
lea r9d, [rbx - 0x7e]
mov r8d, 0x19e
call fcn.1400112c8
lea rdx, str.pipe_error:
lea rcx, [rax + 8]
call fcn.140001c14
mov edx, esi
mov rcx, rax
call fcn.140008edc
test bl, bl
jns 0x140042d7e
jmp 0x140042d74
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
call fcn.140011848
cmp eax, 2
jg 0x140042d6f
mov ebx, 8
lea rdx, str.c:core_no_admin_srcipcipc_channel_win.cc
lea rcx, [rsp + 0x30]
lea r9d, [rbx - 6]
mov r8d, 0x17c
call fcn.1400112c8
lea rdx, str.pipe_error:
lea rcx, [rax + 8]
call fcn.140001c14
mov edx, edi
mov rcx, rax
call fcn.140008edc
test bl, 8
je 0x140042d7e
lea rcx, [rsp + 0x30]
call fcn.140011354
xor al, al
jmp 0x140042d8b
mov byte [rdi + 0x1098], 1
mov al, 1
lea r11, [rsp + 0x140]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x140045130
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rax, qword [0x1401f42d8]
lea rdi, [0x1401f42d8]
test rax, 0xfffffffffffffffe
jne 0x140045188
mov rcx, rdi
call fcn.1400231dc
test al, al
je 0x140045188
and dword [0x1401f42e0], 0
lea rcx, [0x1401f42e0]
call fcn.14002c55c
lea r9, [0x1400457c0]
lea rdx, [0x1401f42e0]
mov r8, rdi
mov rcx, rdi
call fcn.1400231c0
mov rax, qword [0x1401f42d8]
mov ecx, dword [rax]
call sub.KERNEL32.dll_TlsGetValue
mov rbx, rax
test rax, rax
jne 0x140045214
mov ecx, 0x80
call fcn.140098304
test rax, rax
je 0x1400451ba
mov rcx, rax
call fcn.140044c1c
mov rbx, rax
jmp 0x1400451bc
xor ebx, ebx
mov rax, qword [0x1401f42d8]
test rax, 0xfffffffffffffffe
jne 0x140045203
mov rcx, rdi
call fcn.1400231dc
test al, al
je 0x140045203
and dword [0x1401f42e0], 0
lea rcx, [0x1401f42e0]
call fcn.14002c55c
lea r9, [0x1400457c0]
lea rdx, [0x1401f42e0]
mov r8, rdi
mov rcx, rdi
call fcn.1400231c0
mov rax, qword [0x1401f42d8]
mov rdx, rbx
mov ecx, dword [rax]
call fcn.14002c590
inc dword [rbx + 0x74]
mov rax, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x14004c150
Capabilities:
Compare security identifiers

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0xa0
mov rax, qword [0x1401f05f0]
xor rax, rsp
mov qword [rsp + 0x90], rax
and dword [rsp + 0x30], 0
cmp byte [rcx + 0x54], 0
mov r14, rdx
mov rbp, rcx
jne 0x14004c196
mov eax, 0x3f0
jmp 0x14004c2f5
mov rcx, qword [rcx + 0x48]
and dword [rsp + 0x30], 0
xor r9d, r9d
lea edi, [r9 + 2]
lea rax, [rsp + 0x30]
xor r8d, r8d
mov edx, edi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
mov eax, dword [rsp + 0x30]
test eax, eax
jne 0x14004c1ce
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x14004c2f5
mov rcx, rax
call fcn.1400979a4
mov r9d, dword [rsp + 0x30]
mov rcx, qword [rbp + 0x48]
mov rbx, rax
lea rax, [rsp + 0x30]
mov edx, edi
mov r8, rbx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
jne 0x14004c205
mov rcx, rbx
call fcn.14009941c
jmp 0x14004c1c3
xor edi, edi
cmp dword [rbx], edi
jbe 0x14004c2eb
movabs rax, 0x7878787878787879
mov esi, edi
add rsi, rsi
test byte [rbx + rsi*8 + 0x10], 0x20
jne 0x14004c2d7
test dword [rbx + rsi*8 + 0x10], 0xc0000000
jne 0x14004c2d7
xor r15b, r15b
test r14, r14
je 0x14004c2b5
mov r8, qword [r14]
mov rcx, qword [r14 + 8]
xor r12d, r12d
sub rcx, r8
imul rcx
sar rdx, 5
mov rax, rdx
shr rax, 0x3f
add rdx, rax
je 0x14004c2b5
xor r9d, r9d
imul rcx, r9, 0x44
add rcx, r8
call fcn.14004c14c
mov rdx, qword [rbx + rsi*8 + 8]
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_EqualSid]
test eax, eax
jne 0x14004c2b2
mov r8, qword [r14]
mov rcx, qword [r14 + 8]
inc r12d
sub rcx, r8
movabs rax, 0x7878787878787879
mov r9d, r12d
imul rcx
sar rdx, 5
mov rax, rdx
shr rax, 0x3f
add rdx, rax
cmp r9, rdx
jb 0x14004c262
jmp 0x14004c2b5
mov r15b, 1
test r15b, r15b
jne 0x14004c2d7
mov rdx, qword [rbx + rsi*8 + 8]
lea rcx, [rsp + 0x40]
call fcn.14004c0f4
lea rcx, [rbp + 0x30]
lea rdx, [rsp + 0x40]
call fcn.14004cf00
inc edi
movabs rax, 0x7878787878787879
cmp edi, dword [rbx]
jb 0x14004c219
mov rcx, rbx
call fcn.14009941c
xor eax, eax
mov rcx, qword [rsp + 0x90]
xor rcx, rsp
call fcn.1400991d0
lea r11, [rsp + 0xa0]
mov rbx, qword [r11 + 0x40]
mov rbp, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
Function at 0x14004c720
Capabilities:
Get token privileges

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x30
and dword [rsp + 0x60], 0
cmp byte [rcx + 0x54], 0
mov rsi, rdx
mov rbp, rcx
jne 0x14004c74b
mov eax, 0x3f0
jmp 0x14004c86e
mov rcx, qword [rcx + 0x48]
and dword [rsp + 0x60], 0
xor r9d, r9d
lea edi, [r9 + 3]
lea rax, [rsp + 0x60]
xor r8d, r8d
mov edx, edi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
mov eax, dword [rsp + 0x60]
test eax, eax
jne 0x14004c783
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x14004c86e
mov rcx, rax
call fcn.1400979a4
mov r9d, dword [rsp + 0x60]
mov rcx, qword [rbp + 0x48]
mov rbx, rax
lea rax, [rsp + 0x60]
mov edx, edi
mov r8, rbx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
jne 0x14004c7ba
mov rcx, rbx
call fcn.14009941c
jmp 0x14004c778
xor edi, edi
cmp dword [rbx], edi
jbe 0x14004c864
test rsi, rsi
je 0x14004c840
mov rdx, qword [rsi]
mov rax, qword [rsi + 8]
xor r14d, r14d
sub rax, rdx
sar rax, 5
test rax, rax
je 0x14004c840
xor ecx, ecx
lea r15, [rdi + rdi*2]
and dword [rsp + 0x70], 0
shl rcx, 5
xor eax, eax
add rcx, rdx
mov dword [rsp + 0x74], eax
cmp qword [rcx + 0x18], 8
jb 0x14004c801
mov rcx, qword [rcx]
mov rdx, rcx
lea r8, [rsp + 0x70]
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
mov eax, dword [rsp + 0x74]
cmp dword [rbx + r15*4 + 8], eax
jne 0x14004c827
mov eax, dword [rsp + 0x70]
cmp dword [rbx + r15*4 + 4], eax
je 0x14004c85a
mov rdx, qword [rsi]
mov rax, qword [rsi + 8]
inc r14d
sub rax, rdx
mov ecx, r14d
sar rax, 5
cmp rcx, rax
jb 0x14004c7e5
mov eax, edi
lea rcx, [rdi*2 + 1]
add rcx, rax
lea rdx, [rbx + rcx*4]
lea rcx, [rbp + 0x18]
call fcn.14004ce84
inc edi
cmp edi, dword [rbx]
jb 0x14004c7c4
mov rcx, rbx
call fcn.14009941c
xor eax, eax
mov rbx, qword [rsp + 0x68]
add rsp, 0x30
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret