joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140007d40
Capabilities:
Check if file exists
Delete file
Get file attributes
Move file
Terminate process

Disassembly:
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x70
movaps xmmword [rsp + 0x60], xmm6
mov rcx, qword [0x14002d0a0]
test rcx, rcx
je 0x140007d7b
mov edx, 0x1388
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x140007da0
mov rcx, qword [0x14002d0a0]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp byte [0x1400300e0], 0
jne 0x140007db8
movaps xmm6, xmmword [rsp + 0x60]
add rsp, 0x70
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
mov rcx, qword [0x14002d0a0]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
jmp 0x140007d6e
mov edx, 0x414
lea r12, [rsp + 0x20]
lea rsi, [0x14001d3e2]
mov qword [rsp + 0x20], 0
lea rdi, [0x140030100]
movq xmm0, rsi
mov rcx, r12
mov dword [rsp + 0x28], 3
movq xmm6, rdi
mov word [rsp + 0x40], dx
mov rbp, qword [sym.imp.SHELL32.dll_SHFileOperationW]
mov ebx, 0x14
punpcklqdq xmm6, xmm0
mov dword [rsp + 0x44], 0
mov qword [rsp + 0x48], 0
mov qword [rsp + 0x50], rsi
movaps xmmword [rsp + 0x30], xmm6
call rbp
mov r13, qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov r14, qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x140007e84
test al, 0x10
je 0x140007d84
mov ecx, 0x64
call r14
mov eax, 0x414
mov qword [rsp + 0x50], rsi
mov rcx, r12
mov qword [rsp + 0x20], 0
mov dword [rsp + 0x28], 3
mov word [rsp + 0x40], ax
mov dword [rsp + 0x44], 0
mov qword [rsp + 0x48], 0
movaps xmmword [rsp + 0x30], xmm6
call rbp
sub ebx, 1
je 0x140007d84
mov rcx, rdi
call r13
cmp eax, 0xffffffff
jne 0x140007e30
jmp 0x140007d84

Function at 0x14000e4f0
Capabilities:
Create directory

Disassembly:
push rdi
mov eax, 0x2020
push rsi
push rbx
call fcn.140015590
sub rsp, rax
mov eax, dword [0x140034100]
mov rsi, rcx
test eax, eax
je 0x14000e590
xor ebx, ebx
lea rdi, [0x140032100]
test eax, eax
jg 0x14000e52c
jmp 0x14000e540
add rbx, 1
cmp dword [0x140034100], ebx
jle 0x14000e540
mov rdx, qword [rdi + rbx*8]
mov rcx, rsi
call sub.msvcrt.dll_wcscmp
test eax, eax
jne 0x14000e520
jmp 0x14000e577
mov rcx, rsi
call sub.msvcrt.dll_wcslen
cmp rax, 2
jne 0x14000e555
cmp word [rsi + 2], 0x3a
je 0x14000e577
xor edx, edx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x14000e5e0
movsxd rbx, dword [0x140034100]
cmp ebx, 0x3ff
jle 0x14000e5f8
mov eax, 1
add rsp, 0x2020
pop rbx
pop rsi
pop rdi
ret
lea rdi, [rsp + 0x20]
lea rbx, str.HOME
mov r8d, 0x1000
mov rdx, rbx
mov rcx, rdi
call fcn.140007540
test al, al
je 0x14000e61a
movsxd rbx, dword [0x140034100]
mov rcx, rdi
lea rdi, [0x140032100]
call sub.msvcrt.dll__wcsdup
mov qword [rdi + rbx*8], rax
mov eax, dword [0x140034100]
add eax, 1
mov dword [0x140034100], eax
jmp 0x14000e511
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x14000e564
xor eax, eax
jmp 0x14000e57c
mov rcx, rsi
call sub.msvcrt.dll__wcsdup
add dword [0x140034100], 1
mov rdx, rax
lea rax, [0x140032100]
mov qword [rax + rbx*8], rdx
jmp 0x14000e577
mov rcx, rbx
call fcn.140007c80
nop
nop word cs:[rax + rax]
nop
Function at 0x413d60
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x58
movsxd rbp, dword [0x004ae0d4]
mov rbx, rcx
mov rsi, rdx
mov rdi, r8
test ebp, ebp
jle 0x413e7a
mov rax, qword [0x004ae0d8]
xor r9d, r9d
add rax, 8
mov r10, qword [rax]
cmp rbx, r10
jb 0x413dae
mov rdx, qword [rax + 8]
mov r11d, dword [rdx + 8]
add r10, r11
cmp rbx, r10
jb 0x413e60
add r9d, 1
add rax, 0x18
cmp r9d, ebp
jne 0x413d92
mov rcx, rbx
call fcn.00414ba0
test rax, rax
mov r12, rax
je 0x413eb2
lea rbp, [rbp + rbp*2]
shl rbp, 3
mov r13, rbp
add r13, qword [0x004ae0d8]
mov qword [r13 + 0x10], rax
mov dword [r13], 0
call fcn.00414cc0
mov edx, dword [r12 + 0xc]
mov r8d, 0x30
add rax, rdx
lea rdx, [rsp + 0x20]
mov qword [r13 + 8], rax
mov rax, qword [0x004ae0d8]
mov rcx, qword [rax + rbp + 8]
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x413e95
mov eax, dword [rsp + 0x44]
lea edx, [rax - 4]
and edx, 0xfffffffb
je 0x413e59
sub eax, 0x40
and eax, 0xffffffbf
je 0x413e59
mov r9, rbp
add r9, qword [0x004ae0d8]
mov r8d, 0x40
mov rdx, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x413e81
add dword [0x004ae0d4], 1
mov r8, rdi
mov rdx, rsi
mov rcx, rbx
add rsp, 0x58
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
jmp sub.msvcrt.dll_memcpy
xor ebp, ebp
jmp 0x413dbb
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.__VirtualProtect_failed_with_code_0x_x
mov edx, eax
call fcn.00413cf0
mov rax, qword [0x004ae0d8]
mov edx, dword [r12 + 8]
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov r8, qword [rax + rbp + 8]
call fcn.00413cf0
lea rcx, str.Address__p_has_no_image_section
mov rdx, rbx
call fcn.00413cf0
nop
nop word cs:[rax + rax]

Function at 0x414ab0
Capabilities:
Enumerate pe sections

Disassembly:
movsxd rax, dword [rcx + 0x3c]
add rcx, rax
movzx eax, word [rcx + 0x14]
lea rax, [rcx + rax + 0x18]
movzx ecx, word [rcx + 6]
test ecx, ecx
je 0x414af1
sub ecx, 1
lea rcx, [rcx + rcx*4]
lea r9, [rax + rcx*8 + 0x28]
mov r8d, dword [rax + 0xc]
cmp r8, rdx
mov rcx, r8
ja 0x414ae8
add ecx, dword [rax + 8]
cmp rdx, rcx
jb 0x414af3
add rax, 0x28
cmp rax, r9
jne 0x414ad4
xor eax, eax
repz ret

Function at 0x414ba0
Capabilities:
Enumerate pe sections

Disassembly:
push rsi
push rbx
sub rsp, 0x28
mov rbx, qword [0x00492aa0]
cmp word [rbx], 0x5a4d
je 0x414bc0
xor eax, eax
add rsp, 0x28
pop rbx
pop rsi
ret
mov rsi, rcx
mov rcx, rbx
call fcn.00414a70
test eax, eax
je 0x414bb4
sub rsi, rbx
mov rcx, rbx
mov rdx, rsi
add rsp, 0x28
pop rbx
pop rsi
jmp fcn.00414ab0
Function at 0x414e10
Capabilities:
Get thread local storage value

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
lea rcx, [0x004aea40]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x004aea20]
test rbx, rbx
je 0x414e64
mov rbp, qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, qword [sym.imp.KERNEL32.dll_GetLastError]
nop
mov ecx, dword [rbx]
call rbp
mov rsi, rax
call rdi
test eax, eax
jne 0x414e5b
test rsi, rsi
je 0x414e5b
mov rax, qword [rbx + 8]
mov rcx, rsi
call rax
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x414e40
mov rax, qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
lea rcx, [0x004aea40]
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
jmp rax

Function at 0x4155c0
Capabilities:
Check mutex on windows

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0x38
lea rbp, [rsp + 0x80]
mov rdi, rcx
movsxd r12, edx
mov r13, r8
call sub.msvcrt.dll_strlen
mov rsi, rax
lea ebx, [rax + 0xf]
lea eax, [rax + 0x52]
cdqe
add rax, 0xf
and rax, 0xfffffffffffffff0
call fcn.00415780
sub rsp, rax
movsxd r14, esi
movabs rax, 0x656d68732d636367
lea r15, [rsp + 0x20]
lea rcx, [rsp + 0x2f]
mov r8, r14
mov rdx, rdi
mov qword [rsp + 0x20], rax
mov eax, 0x326d
mov dword [rsp + 0x28], 0x64742d6d
mov word [rsp + 0x2c], ax
movsxd rbx, ebx
mov byte [rsp + 0x2e], 0x2d
call sub.msvcrt.dll_memcpy
lea rax, [r15 + r14 + 0x10]
lea r14d, [rsi + 0x50]
movabs rdx, 0x6161616161616161
xor ecx, ecx
mov r8, r15
mov qword [rax], rdx
mov qword [rax + 8], rdx
mov qword [rax + 0x10], rdx
mov qword [rax + 0x18], rdx
mov qword [rax + 0x20], rdx
mov qword [rax + 0x28], rdx
mov qword [rax + 0x30], rdx
mov qword [rax + 0x38], rdx
movsxd rax, r14d
xor edx, edx
mov byte [rsp + rax + 0x20], 0
mov byte [rsp + rbx + 0x20], 0
call qword [sym.imp.KERNEL32.dll_CreateMutexA]
mov byte [rsp + rbx + 0x20], 0x2d
mov rdi, rax
mov edx, 0xffffffff
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x4156a9
int3
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_FindAtomA]
test ax, ax
jne 0x415748
mov rcx, r12
call sub.msvcrt.dll_malloc
lea r9d, [rsi + 0x10]
mov rbx, rax
mov r10d, 0x40
bt rbx, r10
jae 0x4156e4
mov r11d, r14d
sub r11d, r10d
movsxd r11, r11d
mov byte [r15 + r11], 0x41
sub r10d, 1
jne 0x4156d0
mov dword [rbp - 0x54], r9d
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_AddAtomA]
test ax, ax
mov r9d, dword [rbp - 0x54]
je 0x415745
lea r8d, [rsi + 0x51]
movzx ecx, ax
mov rdx, r15
call fcn.00415540
cmp rax, rbx
mov rsi, rax
je 0x415760
mov rcx, rbx
call fcn.0041fb68
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, rsi
lea rsp, [rbp - 0x48]
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
int3
lea r9d, [rsi + 0x10]
lea r8d, [rsi + 0x51]
movzx ecx, ax
mov rdx, r15
call fcn.00415540
mov rsi, rax
jmp 0x41571f
xor edx, edx
mov r8, r12
mov rcx, rbx
call sub.msvcrt.dll_memset
test r13, r13
je 0x41571f
mov rcx, rbx
call r13
jmp 0x41571f
Function at 0x420980
Capabilities:
Allocate thread local storage

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, qword [0x004af588]
test rbx, rbx
je 0x4209b0
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [rbx], eax
mov rax, qword [0x004af588]
test rax, rax
je 0x4209d4
cmp dword [rax], 0xffffffff
je 0x4209f5
add rsp, 0x20
pop rbx
ret
lea r8, [0x0041fe10]
lea rcx, str._pthread_tls_shmem
mov edx, 4
call fcn.00425b60
mov rbx, rax
mov qword [0x004af588], rax
jmp 0x420991
lea r8, [0x0041fe10]
lea rcx, str._pthread_tls_shmem
mov edx, 4
call fcn.00425b60
mov qword [0x004af588], rax
jmp 0x4209a5
call sub.msvcrt.dll_abort
nop
nop dword [rax + rax]

Function at 0x420e90
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x48
mov rcx, qword [0x004af590]
test rcx, rcx
je 0x420fd0
call fcn.00420e00
mov rax, qword [0x004af588]
test rax, rax
je 0x420ff3
mov ecx, dword [rax]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x420ed3
add rsp, 0x48
pop rbx
pop rsi
pop rdi
pop rbp
ret
call fcn.004207d0
test rax, rax
mov rbx, rax
je 0x42103b
cmp qword [0x004b2050], 0
je 0x42103b
mov dword [rax + 0x44], 1
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
mov edx, 1
mov dword [rbx + 0x68], eax
call qword [sym.imp.KERNEL32.dll_CreateEventA]
mov rsi, qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov qword [rbx + 0x30], rax
mov qword [rbx + 0x38], 0xffffffffffffffff
mov qword [rbx + 0x60], 0xffffffffffffffff
mov dword [rbx + 0xb0], 0
mov qword [rbx + 0x28], 0
call rsi
mov rbp, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov rdi, rax
call rsi
mov dword [rsp + 0x30], 2
mov rcx, rax
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
lea r9, [rbx + 0x28]
mov r8, rbp
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_DuplicateHandle]
test eax, eax
je 0x421042
mov rcx, qword [rbx + 0x28]
call qword [sym.imp.KERNEL32.dll_GetThreadPriority]
mov dword [rbx + 0xb8], eax
movzx eax, byte [rbx + 0x40]
mov dword [rbx + 0xb4], 0
and eax, 0xffffffcf
or eax, 0x10
mov byte [rbx + 0x40], al
mov rax, qword [0x004af588]
test rax, rax
je 0x421017
mov rdx, rbx
mov ecx, dword [rax]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
je 0x421042
mov rax, rbx
jmp 0x420eca
lea rcx, str._pthread_tls_once_shmem
xor r8d, r8d
mov edx, 4
call fcn.00425b60
mov rcx, rax
mov qword [0x004af590], rax
jmp 0x420ea8
lea r8, [0x0041fe10]
lea rcx, str._pthread_tls_shmem
mov edx, 4
call fcn.00425b60
mov qword [0x004af588], rax
jmp 0x420ebd
lea r8, [0x0041fe10]
lea rcx, str._pthread_tls_shmem
mov edx, 4
call fcn.00425b60
mov qword [0x004af588], rax
jmp 0x420fb8
xor eax, eax
jmp 0x420eca
call sub.msvcrt.dll_abort
nop
nop dword [rax + rax]
lea rcx, str._pthread_key_dest_shmem
xor r8d, r8d
mov edx, 8
jmp fcn.00425b60
Function at 0x421050
Capabilities:
Check mutex on windows

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x48
mov rcx, qword [0x004af590]
test rcx, rcx
je 0x420fd0
call fcn.00420e00
mov rax, qword [0x004af588]
test rax, rax
je 0x420ff3
mov ecx, dword [rax]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x420ed3
add rsp, 0x48
pop rbx
pop rsi
pop rdi
pop rbp
ret
call fcn.004207d0
test rax, rax
mov rbx, rax
je 0x42103b
cmp qword [0x004b2050], 0
je 0x42103b
mov dword [rax + 0x44], 1
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
mov edx, 1
mov dword [rbx + 0x68], eax
call qword [sym.imp.KERNEL32.dll_CreateEventA]
mov rsi, qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov qword [rbx + 0x30], rax
mov qword [rbx + 0x38], 0xffffffffffffffff
mov qword [rbx + 0x60], 0xffffffffffffffff
mov dword [rbx + 0xb0], 0
mov qword [rbx + 0x28], 0
call rsi
mov rbp, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov rdi, rax
call rsi
mov dword [rsp + 0x30], 2
mov rcx, rax
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
lea r9, [rbx + 0x28]
mov r8, rbp
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_DuplicateHandle]
test eax, eax
je 0x421042
mov rcx, qword [rbx + 0x28]
call qword [sym.imp.KERNEL32.dll_GetThreadPriority]
mov dword [rbx + 0xb8], eax
movzx eax, byte [rbx + 0x40]
mov dword [rbx + 0xb4], 0
and eax, 0xffffffcf
or eax, 0x10
mov byte [rbx + 0x40], al
mov rax, qword [0x004af588]
test rax, rax
je 0x421017
mov rdx, rbx
mov ecx, dword [rax]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
je 0x421042
mov rax, rbx
jmp 0x420eca
lea rcx, str._pthread_tls_once_shmem
xor r8d, r8d
mov edx, 4
call fcn.00425b60
mov rcx, rax
mov qword [0x004af590], rax
jmp 0x420ea8
lea r8, [0x0041fe10]
lea rcx, str._pthread_tls_shmem
mov edx, 4
call fcn.00425b60
mov qword [0x004af588], rax
jmp 0x420ebd
lea r8, [0x0041fe10]
lea rcx, str._pthread_tls_shmem
mov edx, 4
call fcn.00425b60
mov qword [0x004af588], rax
jmp 0x420fb8
xor eax, eax
jmp 0x420eca
call sub.msvcrt.dll_abort
nop
nop dword [rax + rax]
lea rcx, str._pthread_key_dest_shmem
xor r8d, r8d
mov edx, 8
jmp fcn.00425b60
Function at 0x423e00
Capabilities:
Check mutex on windows

Disassembly:
push rsi
push rbx
sub rsp, 0x38
mov rbx, rcx
mov rcx, qword [0x004af5d8]
mov esi, edx
test rcx, rcx
je 0x423da0
call fcn.00425f20
cmp dword [rbx], 0xbab1f00d
jne 0x423dc7
mov eax, dword [rbx + 4]
test eax, eax
jle 0x423dc7
mov eax, dword [rbx + 4]
test eax, eax
jle 0x423d53
mov eax, dword [rbx + 4]
sub eax, 1
mov dword [rbx + 4], eax
mov rcx, qword [0x004af5d8]
test rcx, rcx
je 0x423d70
call fcn.00425fd0
mov eax, esi
add rsp, 0x38
pop rbx
pop rsi
ret
lea r8, [0x00423ae0]
lea rcx, str.mutex_global_shmem
mov edx, 8
call fcn.00425b60
mov rcx, rax
mov qword [0x004af5d8], rax
call fcn.00425fd0
mov eax, esi
add rsp, 0x38
pop rbx
pop rsi
ret
lea rcx, str.mutex_global_shmem
lea r8, [0x00423ae0]
mov edx, 8
call fcn.00425b60
mov rcx, rax
mov qword [0x004af5d8], rax
jmp 0x423d27
call qword [sym.imp.msvcrt.dll___iob_func]
lea r9, str.C:_crossdev_src_winpthreads_git20141130_src_mutex.c
lea rcx, [rax + 0x60]
lea r8, str._m___valid__LIFE_MUTEX____m___busy___0_
lea rdx, [0x00491f60]
mov dword [rsp + 0x20], 0x39
call sub.msvcrt.dll_fprintf
mov ecx, 1
call sub.msvcrt.dll_exit
nop
nop
lea r8, [0x00423ae0]
lea rcx, str.mutex_global_shmem
mov edx, 8
jmp fcn.00425b60
Function at 0x425b60
Capabilities:
Check mutex on windows

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0x28
lea rbp, [rsp + 0x80]
mov rdi, rcx
movsxd r12, edx
mov r13, r8
call sub.msvcrt.dll_strlen
mov r14, rax
lea ebx, [rax + 0xf]
lea eax, [rax + 0x51]
cdqe
add rax, 0xf
and rax, 0xfffffffffffffff0
call fcn.00415780
sub rsp, rax
movsxd r15, r14d
movabs rax, 0x656d68732d636367
lea rsi, [rsp + 0x20]
lea rcx, [rsp + 0x2f]
mov r8, r15
mov rdx, rdi
mov qword [rsp + 0x20], rax
mov eax, 0x326d
mov dword [rsp + 0x28], 0x64742d6d
mov word [rsp + 0x2c], ax
movsxd rbx, ebx
mov byte [rsp + 0x2e], 0x2d
call sub.msvcrt.dll_memcpy
lea rax, [rsi + r15 + 0x10]
lea r15d, [r14 + 0x50]
movabs rdx, 0x6161616161616161
xor ecx, ecx
mov r8, rsi
mov qword [rax], rdx
mov qword [rax + 8], rdx
mov qword [rax + 0x10], rdx
mov qword [rax + 0x18], rdx
mov qword [rax + 0x20], rdx
mov qword [rax + 0x28], rdx
mov qword [rax + 0x30], rdx
mov qword [rax + 0x38], rdx
movsxd rax, r15d
xor edx, edx
mov byte [rsp + rax + 0x20], 0
mov byte [rsp + rbx + 0x20], 0
call qword [sym.imp.KERNEL32.dll_CreateMutexA]
mov byte [rsp + rbx + 0x20], 0x2d
mov rdi, rax
mov edx, 0xffffffff
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x425c49
int3
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FindAtomA]
test ax, ax
jne 0x425ce2
mov rcx, r12
add r14d, 0x10
call sub.msvcrt.dll_malloc
mov r10d, 0x40
mov rbx, rax
bt rbx, r10
jae 0x425c84
mov r11d, r15d
sub r11d, r10d
movsxd r11, r11d
mov byte [rsi + r11], 0x41
sub r10d, 1
jne 0x425c70
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_AddAtomA]
test ax, ax
je 0x425cdf
mov rdx, rsi
movzx ecx, ax
mov r9d, r14d
mov r8d, r15d
call fcn.00425ae0
cmp rax, rbx
mov rsi, rax
je 0x425cf9
mov rcx, rbx
call fcn.0041fb68
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, rsi
lea rsp, [rbp - 0x58]
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
int3
lea r9d, [r14 + 0x10]
mov rdx, rsi
movzx ecx, ax
mov r8d, r15d
call fcn.00425ae0
mov rsi, rax
jmp 0x425cb9
xor edx, edx
mov r8, r12
mov rcx, rbx
call sub.msvcrt.dll_memset
test r13, r13
je 0x425cb9
mov rcx, rbx
call r13
jmp 0x425cb9

Function at 0x4278f0
Capabilities:
Check mutex on windows

Disassembly:
lea r8, [0x00477570]
lea rcx, str.__terminate_handler_sh
mov edx, 8
jmp fcn.004155c0

Function at 0x427910
Capabilities:
Check mutex on windows

Disassembly:
lea r8, [0x00477580]
lea rcx, str.__unexpected_handler_sh
mov edx, 8
jmp fcn.004155c0
Function at 0x4579d0
Capabilities:
Read file on windows

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
mov r12, qword [sym.imp.msvcrt.dll__errno]
mov rbp, rcx
mov rdi, rdx
mov esi, r8d
mov rcx, rbp
call fcn.004578b0
mov r8d, esi
mov rdx, rdi
mov ecx, eax
call sub.msvcrt.dll__read
movsxd rbx, eax
cmp rbx, 0xffffffffffffffff
je 0x457a20
mov rax, rbx
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
call r12
cmp dword [rax], 4
je 0x4579ea
mov rax, rbx
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
Function at 0x140001c40
Capabilities:
Lock the desktop

Disassembly:
push rdi
sub rsp, 0x30
mov rdi, rcx
call qword [sym.imp.USER32.dll_LockWorkStation]
test eax, eax
je 0x140001c5b
mov al, 1
add rsp, 0x30
pop rdi
ret
mov qword [rsp + 0x40], rbx
call qword [sym.imp.KERNEL32.DLL_GetLastError]
test eax, eax
jne 0x140001c73
xor ecx, ecx
call sym.ProcessHacker.exe_PhGetNtMessage
jmp 0x140001c7a
mov ecx, eax
call sym.ProcessHacker.exe_PhGetWin32Message
lea r9, str.Unable_to_lock_the_computer
mov rbx, rax
mov edx, 0x10
mov rcx, rdi
test rax, rax
jne 0x140001caa
lea r8, [0x1401339b8]
call sym.ProcessHacker.exe_PhShowMessage
mov rbx, qword [rsp + 0x40]
xor al, al
add rsp, 0x30
pop rdi
ret
mov rax, qword [rbx + 8]
lea r8, str._s:__s
mov qword [rsp + 0x20], rax
call sym.ProcessHacker.exe_PhShowMessage
lea rcx, [rbx - 0x10]
or eax, 0xffffffff
lock xadd dword [rcx + 8], eax
sub eax, 1
jne 0x140001cd5
call fcn.1400ae900
xor al, al
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret

Function at 0x140001cf0
Capabilities:
Shutdown system

Disassembly:
push rdi
sub rsp, 0x30
mov rdi, rcx
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_ExitWindowsEx]
test eax, eax
je 0x140001d0f
mov al, 1
add rsp, 0x30
pop rdi
ret
mov qword [rsp + 0x40], rbx
call qword [sym.imp.KERNEL32.DLL_GetLastError]
test eax, eax
jne 0x140001d27
xor ecx, ecx
call sym.ProcessHacker.exe_PhGetNtMessage
jmp 0x140001d2e
mov ecx, eax
call sym.ProcessHacker.exe_PhGetWin32Message
lea r9, str.Unable_to_log_off_the_computer
mov rbx, rax
mov edx, 0x10
mov rcx, rdi
test rax, rax
jne 0x140001d5e
lea r8, [0x1401339b8]
call sym.ProcessHacker.exe_PhShowMessage
mov rbx, qword [rsp + 0x40]
xor al, al
add rsp, 0x30
pop rdi
ret
mov rax, qword [rbx + 8]
lea r8, str._s:__s
mov qword [rsp + 0x20], rax
call sym.ProcessHacker.exe_PhShowMessage
lea rcx, [rbx - 0x10]
or eax, 0xffffffff
lock xadd dword [rcx + 8], eax
sub eax, 1
jne 0x140001d89
call fcn.1400ae900
xor al, al
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
Function at 0x140001e40
Capabilities:
Shutdown system

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov rdi, rcx
mov ebx, edx
lea rcx, str.EnableWarnings
call sym.ProcessHacker.exe_PhGetIntegerSetting
test eax, eax
je 0x140001e85
xor r9d, r9d
mov byte [rsp + 0x20], 0
lea r8, str.the_computer
mov rcx, rdi
lea rdx, str.restart
call sym.ProcessHacker.exe_PhShowConfirmMessage
test al, al
je 0x140001f18
or ebx, 2
xor edx, edx
mov ecx, ebx
call qword [sym.imp.USER32.dll_ExitWindowsEx]
test eax, eax
je 0x140001ea3
mov al, 1
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
call qword [sym.imp.KERNEL32.DLL_GetLastError]
test eax, eax
jne 0x140001eb6
xor ecx, ecx
call sym.ProcessHacker.exe_PhGetNtMessage
jmp 0x140001ebd
mov ecx, eax
call sym.ProcessHacker.exe_PhGetWin32Message
lea r9, str.Unable_to_restart_the_computer
mov rbx, rax
mov edx, 0x10
mov rcx, rdi
test rax, rax
jne 0x140001eed
lea r8, [0x1401339b8]
call sym.ProcessHacker.exe_PhShowMessage
xor al, al
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
mov rax, qword [rbx + 8]
lea r8, str._s:__s
mov qword [rsp + 0x20], rax
call sym.ProcessHacker.exe_PhShowMessage
lea rcx, [rbx - 0x10]
or eax, 0xffffffff
lock xadd dword [rcx + 8], eax
sub eax, 1
jne 0x140001f18
call fcn.1400ae900
xor al, al
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret

Function at 0x140001f30
Capabilities:
Shutdown system

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov rdi, rcx
mov ebx, edx
lea rcx, str.EnableWarnings
call sym.ProcessHacker.exe_PhGetIntegerSetting
test eax, eax
je 0x140001f75
xor r9d, r9d
mov byte [rsp + 0x20], 0
lea r8, str.the_computer
mov rcx, rdi
lea rdx, str.shut_down
call sym.ProcessHacker.exe_PhShowConfirmMessage
test al, al
je 0x140002019
mov ecx, ebx
xor edx, edx
or ecx, 8
call qword [sym.imp.USER32.dll_ExitWindowsEx]
test eax, eax
je 0x140001f93
mov al, 1
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
or ebx, 1
xor edx, edx
mov ecx, ebx
call qword [sym.imp.USER32.dll_ExitWindowsEx]
test eax, eax
jne 0x140001f86
call qword [sym.imp.KERNEL32.DLL_GetLastError]
test eax, eax
jne 0x140001fb7
xor ecx, ecx
call sym.ProcessHacker.exe_PhGetNtMessage
jmp 0x140001fbe
mov ecx, eax
call sym.ProcessHacker.exe_PhGetWin32Message
lea r9, str.Unable_to_shut_down_the_computer
mov rbx, rax
mov edx, 0x10
mov rcx, rdi
test rax, rax
jne 0x140001fee
lea r8, [0x1401339b8]
call sym.ProcessHacker.exe_PhShowMessage
xor al, al
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
mov rax, qword [rbx + 8]
lea r8, str._s:__s
mov qword [rsp + 0x20], rax
call sym.ProcessHacker.exe_PhShowMessage
lea rcx, [rbx - 0x10]
or eax, 0xffffffff
lock xadd dword [rcx + 8], eax
sub eax, 1
jne 0x140002019
call fcn.1400ae900
xor al, al
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret