joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41ba30
Capabilities:
Check mutex on windows

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0x28
lea rbp, [rsp + 0x80]
mov r15, rcx
movsxd r12, edx
mov r13, r8
call sym.strlen
mov r14, rax
lea ebx, [rax + 0xf]
lea eax, [rax + 0x51]
cdqe
add rax, 0xf
and rax, 0xfffffffffffffff0
call fcn.0040b6d0
sub rsp, rax
movsxd rdi, r14d
movabs rax, 0x656d68732d636367
lea rsi, [rsp + 0x20]
lea rcx, [rsp + 0x2f]
mov r8, rdi
mov rdx, r15
mov qword [rsp + 0x20], rax
mov eax, 0x326d
mov dword [rsp + 0x28], 0x64742d6d
mov word [rsp + 0x2c], ax
lea r15d, [r14 + 0x50]
mov byte [rsp + 0x2e], 0x2d
movsxd rbx, ebx
call sym.memcpy
lea rax, [rsi + rdi + 0x10]
movabs rdx, 0x6161616161616161
xor ecx, ecx
mov r8, rsi
mov qword [rax], rdx
mov qword [rax + 8], rdx
mov qword [rax + 0x10], rdx
mov qword [rax + 0x18], rdx
mov qword [rax + 0x20], rdx
mov qword [rax + 0x28], rdx
mov qword [rax + 0x30], rdx
mov qword [rax + 0x38], rdx
movsxd rax, r15d
xor edx, edx
mov byte [rsp + rax + 0x20], 0
mov byte [rsp + rbx + 0x20], 0
call qword [sym.imp.KERNEL32.dll_CreateMutexA]
mov byte [rsp + rbx + 0x20], 0x2d
mov rdi, rax
mov edx, 0xffffffff
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x41bb19
int3
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FindAtomA]
test ax, ax
jne 0x41bbb2
mov rcx, r12
add r14d, 0x10
call sym.malloc
mov r10d, 0x40
mov rbx, rax
bt rbx, r10
jae 0x41bb54
mov r11d, r15d
sub r11d, r10d
movsxd r11, r11d
mov byte [rsi + r11], 0x41
sub r10d, 1
jne 0x41bb40
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_AddAtomA]
test ax, ax
je 0x41bbaf
mov rdx, rsi
movzx ecx, ax
mov r9d, r14d
mov r8d, r15d
call sym.get_ptr_from_atom_1
cmp rax, rbx
mov rsi, rax
je 0x41bbc9
mov rcx, rbx
call sym.free
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, rsi
lea rsp, [rbp - 0x58]
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
int3
lea r9d, [r14 + 0x10]
mov rdx, rsi
movzx ecx, ax
mov r8d, r15d
call sym.get_ptr_from_atom_1
mov rsi, rax
jmp 0x41bb89
xor edx, edx
mov r8, r12
mov rcx, rbx
call sym.memset
test r13, r13
je 0x41bb89
mov rcx, rbx
call r13
jmp 0x41bb89

Function at 0x41bc10
Capabilities:
Check mutex on windows

Disassembly:
lea r8, [sym.__shmem_winpthreads_init_spin_locked_shmem]
lea rcx, str.spin_locked_shmem
mov edx, 0x10
jmp sym.__shmem_winpthreads_grab

Function at 0x41c740
Capabilities:
Check mutex on windows

Disassembly:
lea r8, [sym.__shmem_winpthreads_init_rwl_global_shmem]
lea rcx, str.rwl_global_shmem
mov edx, 0x10
jmp sym.__shmem_winpthreads_grab

Function at 0x41c810
Capabilities:
Check mutex on windows

Disassembly:
lea r8, [sym.__shmem_winpthreads_init_cond_locked_shmem_rwlock]
lea rcx, str.cond_locked_shmem_rwlock
mov edx, 0x10
jmp sym.__shmem_winpthreads_grab

Function at 0x41d560
Capabilities:
Check mutex on windows

Disassembly:
lea r8, [sym.__shmem_init_init]
lea rcx, str.init
mov edx, 8
jmp dbg.__shmem_grab

Function at 0x41d580
Capabilities:
Check mutex on windows

Disassembly:
lea rcx, str.eh_globals
xor r8d, r8d
mov edx, 0x10
jmp dbg.__shmem_grab
Function at 0x41dc30
Capabilities:
Check mutex on windows

Disassembly:
lea r8, [sym.__shmem_init___terminate_handler_sh]
lea rcx, str.__terminate_handler_sh
mov edx, 8
jmp dbg.__shmem_grab

Function at 0x41dc50
Capabilities:
Check mutex on windows

Disassembly:
lea r8, [sym.__shmem_init___unexpected_handler_sh]
lea rcx, str.__unexpected_handler_sh
mov edx, 8
jmp dbg.__shmem_grab

Function at 0x41ed30
Capabilities:
Read file on windows

Disassembly:
push rsi
push rbx
sub rsp, 0x28
mov r9, qword [rcx + 0x40]
mov rsi, rdx
mov rbx, rcx
mov edx, 1
mov rcx, rsi
call sym.fread
test rax, rax
jle 0x41ed61
movzx edx, byte [rsi + rax - 1]
mov dword [rbx + 0x48], edx
add rsp, 0x28
pop rbx
pop rsi
ret
mov dword [rbx + 0x48], 0xffffffff
add rsp, 0x28
pop rbx
pop rsi
ret

Function at 0x41f450
Capabilities:
Write file on windows

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x30
cmp byte [0x0047dd30], 0
jne 0x41f518
mov byte [0x0047dd30], 1
call sym.__cxa_current_exception_type
test rax, rax
je 0x41f5ab
mov rax, qword [rax + 8]
xor esi, esi
lea r9, [rsp + 0x2c]
cmp byte [rax], 0x2a
mov dword [rsp + 0x2c], 0xffffffff
sete sil
xor r8d, r8d
xor edx, edx
add rsi, rax
mov rcx, rsi
call sym.__cxa_demangle
mov rbx, qword [sym.imp.msvcrt.dll___iob_func]
mov rdi, rax
call rbx
lea rcx, str.terminate_called_after_throwing_an_instance_of_
lea r9, [rax + 0x60]
mov r8d, 0x30
mov edx, 1
call sym.fwrite
cmp dword [rsp + 0x2c], 0
je 0x41f508
call rbx
lea rdx, [rax + 0x60]
mov rcx, rsi
call sym.fputs
call rbx
lea rcx, [0x0047f281]
lea r9, [rax + 0x60]
mov r8d, 2
mov edx, 1
call sym.fwrite
cmp dword [rsp + 0x2c], 0
je 0x41f53e
call sym.__cxa_rethrow
call rbx
lea rdx, [rax + 0x60]
mov rcx, rdi
call sym.fputs
jmp 0x41f4df
call qword [sym.imp.msvcrt.dll___iob_func]
lea rcx, str.terminate_called_recursively_n
lea r9, [rax + 0x60]
mov r8d, 0x1d
mov edx, 1
call sym.fwrite
call sym.abort
mov rcx, rdi
call sym.free
jmp 0x41f503
call sym.abort
nop dword [rax + rax]
call qword [sym.imp.msvcrt.dll___iob_func]
lea rcx, str.terminate_called_without_an_active_exception_n
lea r9, [rax + 0x60]
mov r8d, 0x2d
mov edx, 1
call sym.fwrite
jmp 0x41f5a6

Function at 0x449e40
Capabilities:
Read file on windows

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
mov r12, qword [sym.imp.msvcrt.dll__errno]
mov rbp, rcx
mov rdi, rdx
mov esi, r8d
mov rcx, rbp
call method.std::__basic_file_char_.fd__
mov r8d, esi
mov rdx, rdi
mov ecx, eax
call sym.read
movsxd rbx, eax
cmp rbx, 0xffffffffffffffff
je 0x449e90
mov rax, rbx
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
call r12
cmp dword [rax], 4
je 0x449e5a
mov rax, rbx
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
Function at 0x14001d900
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x250
mov rax, qword [0x1400d73a8]
xor rax, rsp
mov qword [rsp + 0x240], rax
mov qword [rsp + 0x268], rbp
mov rbp, rcx
lea rcx, [rsp + 0x21]
xor edx, edx
mov r8d, 0x103
mov byte [rsp + 0x20], 0
call fcn.140086940
lea rdx, [rsp + 0x20]
lea rcx, str._SystemRoot_SysWoW64
mov r8d, 0x104
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [rsp + 0x20]
lea rbx, [rbp + 0x38]
lea rdx, [rsp + 0x20]
repne scasb al, byte [rdi]
not rcx
lea r8, [rcx - 1]
mov rcx, rbx
call fcn.140003e20
mov r11, qword [rbx + 0x18]
cmp r11, 0x10
jb 0x14001d992
mov rsi, qword [rbx]
jmp 0x14001d995
mov rsi, rbx
cmp r11, 0x10
jb 0x14001d9a0
mov rcx, qword [rbx]
jmp 0x14001d9a3
mov rcx, rbx
mov rax, qword [rbx + 0x10]
lea rdi, [rcx + rax]
cmp r11, 0x10
jb 0x14001d9b4
mov rbx, qword [rbx]
cmp rbx, rdi
je 0x14001d9d4
sub rsi, rbx
nop dword [rax]
movsx ecx, byte [rbx]
call fcn.140088604
inc rbx
mov byte [rsi + rbx - 1], al
cmp rbx, rdi
jne 0x14001d9c0
lea rcx, [rsp + 0x131]
xor edx, edx
mov r8d, 0x103
mov byte [rsp + 0x130], 0
call fcn.140086940
lea rdx, [rsp + 0x130]
lea rcx, str._SystemRoot__system32
mov r8d, 0x104
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [rsp + 0x130]
lea rbx, [rbp + 0x60]
lea rdx, [rsp + 0x130]
repne scasb al, byte [rdi]
not rcx
lea r8, [rcx - 1]
mov rcx, rbx
call fcn.140003e20
mov r11, qword [rbx + 0x18]
mov rbp, qword [rsp + 0x268]
cmp r11, 0x10
jb 0x14001da4e
mov rsi, qword [rbx]
jmp 0x14001da51
mov rsi, rbx
cmp r11, 0x10
jb 0x14001da5c
mov rcx, qword [rbx]
jmp 0x14001da5f
mov rcx, rbx
mov rax, qword [rbx + 0x10]
lea rdi, [rcx + rax]
cmp r11, 0x10
jb 0x14001da70
mov rbx, qword [rbx]
cmp rbx, rdi
je 0x14001da8c
sub rsi, rbx
movsx ecx, byte [rbx]
call fcn.140088604
inc rbx
mov byte [rsi + rbx - 1], al
cmp rbx, rdi
jne 0x14001da78
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.140086bc0
lea r11, [rsp + 0x250]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x140020eb0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x80
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0xd0], rbx
mov r12, rdx
mov r13, rcx
mov edi, dword [rdx + 0x58]
mov rcx, qword [rcx]
call fcn.14003b0a0
cmp byte [r13 + 0x1c], 0
jne 0x140020f14
lea rdx, str.Scanning_threads.
lea rcx, [0x1400d66c0]
call fcn.1400042e0
mov rbx, rax
mov dl, 0xa
mov rcx, rax
call fcn.140004d20
mov rcx, rbx
call fcn.14003e8c0
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov r15d, eax
mov dword [rsp + 0xc0], eax
xor eax, eax
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], rax
lea rdx, [rsp + 0x28]
mov ecx, edi
call fcn.14003b530
test al, al
jne 0x140020f89
lea rdx, [rsp + 0x28]
mov ecx, edi
call fcn.14003b690
test al, al
jne 0x140020f89
cmp byte [r13 + 0x1c], al
jne 0x140020f84
lea rdx, str.____Failed_enumerating_threads.
lea rcx, [0x1400d66c0]
call fcn.1400042e0
mov rbx, rax
mov dl, 0xa
mov rcx, rax
call fcn.140004d20
mov rcx, rbx
call fcn.14003e8c0
nop
jmp 0x1400210ea
mov rcx, qword [r13]
call fcn.140028f10
mov rbx, qword [rsp + 0x28]
cmp rbx, qword [rsp + 0x30]
je 0x1400210c2
lea r14, [r12 + 0x70]
lea r15, vtable.pesieve::ThreadScanner.0
nop
mov rdx, qword [r12 + 0x50]
movzx ecx, byte [r13 + 9]
mov rax, qword [r13]
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x48], r15
mov byte [rsp + 0x58], cl
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x68], r14
mov qword [rsp + 0x70], rdx
lea rcx, [rsp + 0x48]
call fcn.14002a560
mov rsi, rax
mov qword [rsp + 0xc8], rax
test rax, rax
je 0x1400210ab
mov rax, qword [r12 + 0x38]
lea rcx, [rsp + 0xc8]
cmp rcx, rax
jae 0x14002105a
mov rcx, qword [r12 + 0x30]
lea rdx, [rsp + 0xc8]
cmp rcx, rdx
ja 0x14002105a
lea rbp, [rsp + 0xc8]
sub rbp, rcx
sar rbp, 3
cmp rax, qword [r12 + 0x40]
jne 0x140021042
mov edx, 1
lea rcx, [r12 + 0x30]
call fcn.1400461a0
mov rax, qword [r12 + 0x30]
mov rcx, qword [r12 + 0x38]
test rcx, rcx
je 0x14002107d
mov rax, qword [rax + rbp*8]
mov qword [rcx], rax
jmp 0x14002107d
cmp rax, qword [r12 + 0x40]
jne 0x140021070
mov edx, 1
lea rcx, [r12 + 0x30]
call fcn.1400461a0
mov rax, qword [r12 + 0x38]
test rax, rax
je 0x14002107d
mov qword [rax], rsi
add qword [r12 + 0x38], 8
cmp dword [rsi + 0x48], 0xffffffff
jne 0x14002108e
inc qword [r12 + 0x68]
mov rdx, rsi
mov rcx, r12
call fcn.140026f90
cmp dword [rsi + 0x48], 0xffffffff
je 0x1400210ab
mov rdx, rsi
mov rcx, r14
call fcn.140028790
nop
add rbx, 0x20
cmp rbx, qword [rsp + 0x30]
jne 0x140020fb0
mov r15d, dword [rsp + 0xc0]
mov rcx, qword [r13]
call fcn.140028f30
cmp byte [r13 + 0x1c], 0
jne 0x1400210ea
call qword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, r15d
mov edx, eax
lea rcx, str.Threads
call fcn.140020870
nop
mov rcx, qword [rsp + 0x28]
test rcx, rcx
je 0x1400210f9
call fcn.140085df8
xor eax, eax
mov rbx, qword [rsp + 0xd0]
add rsp, 0x80
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400248d0
Capabilities:
Get file size
Read file via mapping

Disassembly:
push rsi
sub rsp, 0x50
mov rsi, rcx
call fcn.140024820
test al, al
jne 0x1400248e8
add rsp, 0x50
pop rsi
ret
mov qword [rsp + 0x60], rbx
lea rcx, [rsp + 0x68]
mov qword [rsp + 0x70], rbp
xor ebp, ebp
mov qword [rsp + 0x68], rbp
call fcn.14003b1d0
cmp qword [rsi + 0x60], 0x10
lea rcx, [rsi + 0x48]
jb 0x140024911
mov rcx, qword [rcx]
xor r9d, r9d
mov qword [rsp + 0x30], rbp
mov edx, 0x80000000
lea r8d, [r9 + 1]
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rcx, qword [rsp + 0x68]
mov rbx, rax
call fcn.14003b220
cmp rbx, 0xffffffffffffffff
jne 0x14002495d
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x70]
xor al, al
add rsp, 0x50
pop rsi
ret
xor r9d, r9d
xor edx, edx
mov rcx, rbx
lea r8d, [r9 + 2]
mov qword [rsp + 0x28], rbp
mov qword [rsp + 0x48], rdi
mov dword [rsp + 0x20], ebp
call qword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov rdi, rax
test rax, rax
je 0x1400249ae
xor r9d, r9d
xor r8d, r8d
mov rcx, rax
lea edx, [r9 + 4]
mov qword [rsp + 0x20], rbp
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov rbp, rax
test rax, rax
jne 0x1400249bb
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
jmp 0x140024a24
mov rcx, rsi
mov qword [rsp + 0x40], r12
xor r12b, r12b
call fcn.140013340
test al, al
je 0x140024a00
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov r8, qword [rsi + 0xc0]
mov rcx, qword [rsi + 0xa0]
mov r11d, eax
mov rdx, rbp
cmp r8, r11
cmova r8, r11
call fcn.140086e50
test eax, eax
sete r12b
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
movzx eax, r12b
mov r12, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x70]
add rsp, 0x50
pop rsi
ret
Function at 0x140030980
Capabilities:
Parse pe header

Disassembly:
push rbp
push rsi
push r13
sub rsp, 0x70
mov rax, qword [rcx + 0x80]
mov rsi, rcx
mov rbp, qword [rax + 0x10]
mov r13, qword [rax + 0x18]
test rbp, rbp
jne 0x1400309ab
xor eax, eax
add rsp, 0x70
pop r13
pop rsi
pop rbp
ret
mov qword [rsp + 0x90], rbx
mov rbx, qword [rcx + 0x58]
cmp rbx, 0xffffffffffffffff
je 0x140030b8d
mov rax, qword [rcx + 0x50]
cmp rax, 0xffffffffffffffff
je 0x140030b8d
cmp rbx, rax
jb 0x140030b8d
sub rbx, rax
cmp rbx, 0xffffffffffffffff
je 0x140030b8d
cmp rbx, 0x44
jae 0x140030b8d
mov rcx, qword [rcx + 0x60]
cmp rcx, 0xffffffffffffffff
je 0x140030b8d
mov rax, qword [rsi + 0x68]
mov qword [rsp + 0x98], rdi
mov qword [rsp + 0x68], r14
lea rax, [rax + rax*4 + 5]
mov r14d, 0x44
xor r8d, r8d
lea rdi, [rcx + rax*8]
sub r14, rbx
lea rcx, [rdi + rbp]
mov rdx, r14
call fcn.14005cf10
test al, al
jne 0x140030a3a
xor eax, eax
jmp 0x140030b23
mov rax, qword [rsi + 0x50]
mov qword [rsp + 0xa0], r12
cmp rax, 0xffffffffffffffff
je 0x140030a5c
cmp rdi, 0xffffffffffffffff
je 0x140030a5c
cmp rdi, rax
jb 0x140030a5c
sub rdi, rax
jmp 0x140030a60
or rdi, 0xffffffffffffffff
lea r12, [r14 + rbp]
mov r9, rdi
mov rdx, r13
add r12, rax
mov rcx, rbp
mov r8, r12
call fcn.140056950
test al, al
jne 0x140030a83
xor eax, eax
jmp 0x140030b1b
xor eax, eax
cmp rbx, 4
jb 0x140030b1b
mov dword [rsp + 0x5a], eax
mov word [rsp + 0x5e], ax
mov qword [rsp + 0x60], r15
mov r15, qword [rsi + 0x50]
mov qword [rsp + 0x22], rax
mov qword [rsp + 0x2a], rax
mov qword [rsp + 0x32], rax
mov qword [rsp + 0x3a], rax
mov qword [rsp + 0x42], rax
mov qword [rsp + 0x4a], rax
mov qword [rsp + 0x52], rax
mov eax, 0x5a4d
add r15, rbp
lea ebx, [rbx + r14 - 4]
mov r9d, 0x40
mov rdx, r13
mov rcx, rbp
mov r8, r15
mov word [rsp + 0x20], ax
mov dword [rsp + 0x5c], ebx
call fcn.140056950
test al, al
je 0x140030b14
movsxd rbx, ebx
mov r9d, 4
mov rdx, r13
add rbx, rbp
mov rcx, rbp
add rbx, qword [rsi + 0x50]
mov r8, rbx
call fcn.140056950
test al, al
jne 0x140030b41
xor eax, eax
mov r15, qword [rsp + 0x60]
mov r12, qword [rsp + 0xa0]
mov rdi, qword [rsp + 0x98]
mov r14, qword [rsp + 0x68]
mov rbx, qword [rsp + 0x90]
add rsp, 0x70
pop r13
pop rsi
pop rbp
ret
mov rdx, qword [rsi + 0x50]
mov r8, rdi
mov rcx, r12
add rdx, rbp
call fcn.140085e10
mov rax, r14
movaps xmm0, xmmword [rsp + 0x20]
movaps xmm1, xmmword [rsp + 0x30]
movups xmmword [r15], xmm0
movups xmmword [r15 + 0x10], xmm1
movaps xmm0, xmmword [rsp + 0x40]
movaps xmm1, xmmword [rsp + 0x50]
movups xmmword [r15 + 0x20], xmm0
movups xmmword [r15 + 0x30], xmm1
mov dword [rbx], 0x4550
add qword [rsi + 0x58], r14
add qword [rsi + 0x60], r14
jmp 0x140030b16
xor eax, eax
mov rbx, qword [rsp + 0x90]
add rsp, 0x70
pop r13
pop rsi
pop rbp
ret
Function at 0x140030fa0
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 0x18], rbx
push rsi
sub rsp, 0x20
mov rax, qword [rcx + 0x80]
mov rbx, qword [rax + 0x10]
mov rsi, qword [rax + 0x18]
test rbx, rbx
jne 0x140030fcb
xor al, al
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop rsi
ret
mov rax, qword [rcx + 0x58]
cmp rax, 0xffffffffffffffff
je 0x140030fbe
mov qword [rsp + 0x30], rbp
lea rbp, [rcx + 0x40]
mov qword [rsp + 0x38], rdi
mov rcx, qword [rbp + 0x10]
cmp rcx, 0xffffffffffffffff
je 0x140030ff7
cmp rax, rcx
jb 0x140030ff7
sub rax, rcx
jmp 0x140030ffb
or rax, 0xffffffffffffffff
lea rdi, [rax + rbx - 4]
mov r9d, 4
mov rdx, rsi
mov r8, rdi
mov rcx, rbx
call fcn.140056950
test al, al
je 0x140031075
mov eax, 0x8664
mov dword [rdi], 0x4550
cmp word [rdi + 4], ax
sete cl
cmp word [rdi + 0x14], 0
jne 0x140031045
mov eax, 0xe0
mov edx, 0xf0
test cl, cl
cmovne ax, dx
mov word [rdi + 0x14], ax
mov eax, 0x5a4d
lea r8, [rdi + 0x18]
mov r9, rbp
mov word [rbx], ax
mov eax, edi
mov rdx, rsi
sub eax, ebx
test cl, cl
mov rcx, rbx
mov dword [rbx + 0x3c], eax
je 0x14003106c
call fcn.140030e40
jmp 0x140031071
call fcn.140030ef0
test al, al
jne 0x140031079
xor al, al
jmp 0x14003108a
mov rdx, rsi
mov rcx, rbx
call fcn.1400557e0
test rax, rax
setne al
mov rbp, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop rsi
ret
Function at 0x14003b530
Capabilities:
Enumerate processes via ntquerysysteminformation
Get system information on windows

Disassembly:
mov qword [rsp + 0x10], rbp
push rsi
push rdi
push r12
sub rsp, 0x40
xor edi, edi
mov r12, rdx
mov ebp, ecx
mov esi, edi
mov dword [rsp + 0x70], edi
nop word [rax + rax]
lea r9, [rsp + 0x70]
mov r8d, esi
mov rdx, rdi
mov ecx, 5
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
cmp eax, 0xc0000004
jne 0x14003b59b
mov rcx, rdi
call fcn.140086144
mov esi, dword [rsp + 0x70]
mov edx, 1
mov ecx, esi
call fcn.1400889dc
mov rdi, rax
test rax, rax
jne 0x14003b550
mov rbp, qword [rsp + 0x68]
add rsp, 0x40
pop r12
pop rdi
pop rsi
ret
test eax, eax
je 0x14003b5b7
mov rcx, rdi
call fcn.140086144
xor al, al
mov rbp, qword [rsp + 0x68]
add rsp, 0x40
pop r12
pop rdi
pop rsi
ret
mov qword [rsp + 0x60], rbx
mov rbx, rdi
test rdi, rdi
je 0x14003b5f6
cmp qword [rbx + 0x50], rbp
je 0x14003b613
mov eax, dword [rbx]
test eax, eax
je 0x14003b5f6
cmp eax, 0x150
jb 0x14003b5f6
add rbx, rax
mov edx, esi
mov r9d, 0x150
mov r8, rbx
mov rcx, rdi
call fcn.140056950
test al, al
je 0x14003b5f6
test rbx, rbx
jne 0x14003b5c4
mov rcx, rdi
call fcn.140086144
xor al, al
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
add rsp, 0x40
pop r12
pop rdi
pop rsi
ret
mov esi, dword [rbx + 4]
test rsi, rsi
je 0x14003b678
add rbx, 0x130
mov ebp, 0xffffffff
nop word [rax + rax]
mov rax, qword [rbx]
mov ecx, ebp
lea rdx, [rsp + 0x20]
cmp rax, rbp
mov byte [rsp + 0x24], 1
cmovb ecx, eax
mov rax, qword [rbx - 0x10]
mov qword [rsp + 0x28], rax
mov eax, dword [rbx + 0x14]
mov dword [rsp + 0x20], ecx
mov dword [rsp + 0x30], eax
mov eax, dword [rbx + 0x18]
mov rcx, r12
mov dword [rsp + 0x34], eax
mov eax, dword [rbx - 0x18]
mov dword [rsp + 0x38], eax
call fcn.14003b490
add rbx, 0x50
dec rsi
jne 0x14003b630
mov rcx, rdi
call fcn.140086144
mov al, 1
jmp 0x14003b600
Function at 0x14003b690
Capabilities:
Enumerate threads

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push r12
mov rbp, rsp
sub rsp, 0x70
mov rax, qword [0x1400d73a8]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov rbx, rdx
xor edx, edx
mov r12d, ecx
lea ecx, [rdx + 4]
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov rsi, rax
cmp rax, 0xffffffffffffffff
jne 0x14003b6d4
call qword [sym.imp.KERNEL32.dll_GetLastError]
xor al, al
jmp 0x14003b81a
xor eax, eax
lea rdx, [rbp - 0x30]
mov rcx, rsi
mov qword [rbp - 0x2c], rax
mov qword [rbp - 0x24], rax
mov qword [rbp - 0x1c], rax
mov dword [rbp - 0x30], 0x1c
call sub.KERNEL32.dll_Thread32First
test eax, eax
jne 0x14003b709
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
jmp 0x14003b81a
mov qword [rsp + 0xa0], r13
xor r13d, r13d
mov qword [rsp + 0x90], rdi
nop dword [rax]
cmp dword [rbp - 0x24], r12d
jne 0x14003b7eb
mov rax, qword [rbx + 8]
mov edi, dword [rbp - 0x28]
lea rcx, [rbp - 0x50]
mov qword [rbp - 0x48], r13
mov qword [rbp - 0x40], r13
mov dword [rbp - 0x38], r13d
mov dword [rbp - 0x50], edi
mov byte [rbp - 0x4c], r13b
cmp rcx, rax
jae 0x14003b7b0
mov rcx, qword [rbx]
lea rdx, [rbp - 0x50]
cmp rcx, rdx
ja 0x14003b7b0
lea rdi, [rbp - 0x50]
sub rdi, rcx
cmp rax, qword [rbx + 0x10]
jne 0x14003b773
mov edx, 1
mov rcx, rbx
call fcn.14003b410
mov rcx, qword [rbx + 8]
and rdi, 0xffffffffffffffe0
add rdi, qword [rbx]
test rcx, rcx
je 0x14003b7e6
mov qword [rcx + 8], r13
mov qword [rcx + 0x10], r13
mov dword [rcx + 0x18], r13d
mov eax, dword [rdi]
mov dword [rcx], eax
movzx eax, byte [rdi + 4]
mov byte [rcx + 4], al
mov rax, qword [rdi + 8]
mov qword [rcx + 8], rax
mov rax, qword [rdi + 0x10]
mov qword [rcx + 0x10], rax
mov rax, qword [rdi + 0x18]
jmp 0x14003b7e2
cmp rax, qword [rbx + 0x10]
jne 0x14003b7c3
mov edx, 1
mov rcx, rbx
call fcn.14003b410
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x14003b7e6
mov rax, qword [rbp - 0x40]
mov qword [rcx + 8], r13
mov dword [rcx], edi
mov qword [rcx + 0x10], rax
mov rax, qword [rbp - 0x38]
mov byte [rcx + 4], r13b
mov qword [rcx + 0x18], rax
add qword [rbx + 8], 0x20
lea rdx, [rbp - 0x30]
mov rcx, rsi
call sub.KERNEL32.dll_Thread32Next
test eax, eax
jne 0x14003b720
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r13, qword [rsp + 0xa0]
mov rdi, qword [rsp + 0x90]
mov al, 1
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.140086bc0
mov rbx, qword [rsp + 0xa8]
add rsp, 0x70
pop r12
pop rsi
pop rbp
ret
Function at 0x14003bbf0
Capabilities:
Acquire debug privileges

Disassembly:
push rbx
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
xor r8d, r8d
lea r9, [rsp + 0x30]
lea edx, [r8 + 0x28]
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenThreadToken]
test eax, eax
jne 0x14003bc80
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3f0
jne 0x14003bc80
mov ecx, 2
call qword [sym.imp.ADVAPI32.dll_ImpersonateSelf]
test eax, eax
je 0x14003bc78
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
xor r8d, r8d
lea r9, [rsp + 0x30]
lea edx, [r8 + 0x28]
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenThreadToken]
test eax, eax
jne 0x14003bc80
lea rdx, str.Error:_cannot_open_the_token
lea rcx, [0x1400d6650]
call fcn.1400042e0
mov dl, 0xa
mov rcx, rax
mov rbx, rax
call fcn.140004d20
mov rcx, rbx
call fcn.14003e8c0
xor al, al
add rsp, 0x20
pop rbx
ret
mov rcx, qword [rsp + 0x30]
mov qword [rsp + 0x38], rdi
mov edi, 1
lea rdx, str.SeDebugPrivilege
mov r8d, edi
xor bl, bl
call fcn.14003b840
mov rcx, qword [rsp + 0x30]
movzx ebx, bl
test eax, eax
cmovne ebx, edi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rdi, qword [rsp + 0x38]
movzx eax, bl
add rsp, 0x20
pop rbx
ret

Function at 0x14003c2e0
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x150
mov rax, qword [0x1400d73a8]
xor rax, rsp
mov qword [rsp + 0x140], rax
mov rbx, rcx
lea rcx, [rsp + 0x30]
xor edi, edi
mov edx, 0x104
mov dword [rsp + 0x20], edi
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
mov byte [rsp + 0x32], dil
mov qword [rbx + 0x10], rdi
or rcx, 0xffffffffffffffff
mov qword [rbx + 0x18], 0xf
mov byte [rbx], dil
xor eax, eax
lea rdi, [rsp + 0x30]
lea rdx, [rsp + 0x30]
repne scasb al, byte [rdi]
not rcx
lea r8, [rcx - 1]
mov rcx, rbx
call fcn.140003e20
mov rax, rbx
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.140086bc0
mov rbx, qword [rsp + 0x168]
add rsp, 0x150
pop rdi
ret