joyce8/EMBER2024-capa huggingface dataset:
Function at 0x416ea0
Capabilities:
Hijack thread execution
Resume thread
Suspend thread

Disassembly:
push r12
push rbx
sub rsp, 0x28
mov r12, rcx
mov rcx, qword [0x00427398]
mov ebx, edx
test rcx, rcx
je 0x416f58
call sym.pthread_mutex_lock
mov rcx, r12
call sym.__pthread_get_pointer
mov rcx, qword [0x00427398]
test rax, rax
je 0x416f30
cmp qword [rax + 0x1d8], r12
jne 0x416f30
test byte [rax + 0x40], 0xc
jne 0x416f30
mov edx, dword [rax + 0xbc]
test edx, edx
jne 0x416f30
mov rax, qword [rax + 0x28]
sub rax, 1
cmp rax, 0xfffffffffffffffd
ja 0x416f30
test rcx, rcx
je 0x416fb0
call sym.pthread_mutex_unlock
test ebx, ebx
je 0x416f50
lea edx, [rbx - 2]
cmp edx, 0x15
ja 0x416fa8
mov rcx, r12
add rsp, 0x28
pop rbx
pop r12
jmp sym.pthread_cancel
test rcx, rcx
je 0x416f80
call sym.pthread_mutex_unlock
mov eax, 3
add rsp, 0x28
pop rbx
pop r12
ret
xor eax, eax
jmp 0x416f3f
lea rcx, str.mtx_pthr_locked_shmem
lea r8, [sym.__shmem_winpthreads_init_mtx_pthr_locked_shmem]
mov edx, 8
call sym.__shmem_winpthreads_grab
mov qword [0x00427398], rax
mov rcx, rax
jmp 0x416ebc
lea rcx, str.mtx_pthr_locked_shmem
lea r8, [sym.__shmem_winpthreads_init_mtx_pthr_locked_shmem]
mov edx, 8
call sym.__shmem_winpthreads_grab
mov qword [0x00427398], rax
mov rcx, rax
jmp 0x416f35
mov eax, 0x16
jmp 0x416f3f
lea rcx, str.mtx_pthr_locked_shmem
lea r8, [sym.__shmem_winpthreads_init_mtx_pthr_locked_shmem]
mov edx, 8
call sym.__shmem_winpthreads_grab
mov qword [0x00427398], rax
mov rcx, rax
jmp 0x416f05
Function at 0x417250
Capabilities:
Create thread
Resume thread

Disassembly:
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x40
mov rdi, rcx
mov rsi, rdx
mov rbx, r8
mov rbp, r9
call sym.pop_pthread_mem
mov r12, rax
test rax, rax
je 0x41748b
test rdi, rdi
je 0x41728a
mov rax, qword [rax + 0x1d8]
mov qword [rdi], rax
mov r13, qword [sym.imp.KERNEL32.dll_Sleep]
mov qword [r12 + 8], rbp
mov dword [r12 + 0x44], 1
mov rbp, qword [sym.imp.KERNEL32.dll_CreateEventA]
mov dword [r12 + 0xbc], 0
mov r14, r13
mov qword [r12 + 0x28], 0xffffffffffffffff
mov qword [r12 + 0x10], rbx
xor ebx, ebx
xor r9d, r9d
xor r8d, r8d
mov edx, 1
xor ecx, ecx
call rbp
mov qword [r12 + 0x30], rax
test rax, rax
jne 0x417300
test ebx, ebx
je 0x4172f8
mov ecx, 0x14
call r14
cmp ebx, 4
je 0x417300
add ebx, 1
jmp 0x4172c5
xor ecx, ecx
call r13
jmp 0x4172ef
mov qword [r12 + 0x38], 0xffffffffffffffff
lea r14, [r12 + 0x68]
mov rcx, r14
call sym.replace_spin_keys.constprop.0
cmp qword [r12 + 0x30], 0
mov dword [r12], 0xbab1f00d
mov dword [r12 + 0xc0], 0
mov dword [r12 + 0xb8], 0
je 0x41746c
xor edx, edx
test rsi, rsi
je 0x417366
mov eax, dword [rsi]
mov edx, dword [rsi + 0x10]
mov dword [r12 + 0x44], eax
test al, 8
jne 0x4174a0
mov eax, dword [rsi + 0x18]
mov dword [r12 + 0xc0], eax
lea r8, [sym.pthread_create_wrapper]
mov r9, r12
xor ecx, ecx
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 4
call qword [sym.imp.msvcrt.dll__beginthreadex]
mov r13, rax
lea rax, [rax - 1]
cmp rax, 0xfffffffffffffffd
ja 0x417438
mov eax, dword [r12 + 0xc0]
mov edx, 0xfffffff1
cmp eax, 0xfffffff2
jge 0x417410
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov rcx, qword [r12 + 0x30]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
test byte [r12 + 0x44], 4
jne 0x4173f0
mov qword [r12 + 0x28], r13
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_ResumeThread]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_Sleep]
xor eax, eax
add rsp, 0x40
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
mov qword [r12 + 0x28], 0
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x4173d6
mov edx, 0xfffffffe
cmp eax, 0xffffffff
jl 0x4173ac
mov edx, 0xf
cmp eax, 0xe
jg 0x4173ac
cmp eax, 2
mov edx, 2
cmovle edx, eax
jmp 0x4173ac
mov rcx, qword [r12 + 0x30]
test rcx, rcx
je 0x417448
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [r12 + 0x38]
call sym.pthread_mutex_destroy
mov rcx, r14
call sym.replace_spin_keys.constprop.0
mov qword [r12 + 0x30], 0
mov qword [r12 + 0x28], 0
test rdi, rdi
je 0x417478
mov qword [rdi], 0
cmp qword [r12 + 0x1d0], 0
jne 0x41748b
mov rcx, r12
call sym.push_pthread_mem.part.0
mov eax, 0xb
add rsp, 0x40
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
mov dword [rsp + 0x3c], edx
call sym.__pthread_self_lite
mov edx, dword [rsp + 0x3c]
mov eax, dword [rax + 0xc0]
mov dword [r12 + 0xc0], eax
jmp 0x417366

Function at 0x417ad0
Capabilities:
Check mutex on windows

Disassembly:
xor r8d, r8d
mov edx, 4
lea rcx, str.dummy_concurrency_level_shmem
jmp sym.__shmem_winpthreads_grab
Function at 0x417df0
Capabilities:
Check mutex on windows

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0x38
lea rbp, [rsp + 0x80]
mov rsi, r8
mov r12, rcx
movsxd rbx, edx
call sym.strlen
mov r8, rax
lea eax, [rax + 0xf]
mov dword [rbp - 0x54], eax
lea eax, [r8 + 0x51]
lea edi, [r8 + 0x10]
cdqe
lea r15d, [r8 + 0x50]
add rax, 0xf
and rax, 0xfffffffffffffff0
call fcn.0040d730
movabs rcx, 0x656d68732d636367
sub rsp, rax
movsxd r13, r8d
mov rdx, r12
mov eax, 0x326d
mov r8, r13
mov qword [rsp + 0x20], rcx
lea r14, [rsp + 0x20]
lea rcx, [rsp + 0x2f]
mov dword [rsp + 0x28], 0x64742d6d
mov word [rsp + 0x2c], ax
mov byte [rsp + 0x2e], 0x2d
call sym.memcpy
lea rax, [r14 + r13 + 0x10]
movsxd r12, dword [rbp - 0x54]
mov r8, r14
movabs rdx, 0x6161616161616161
movabs rcx, 0x6161616161616161
mov qword [rax], rdx
mov qword [rax + 8], rcx
mov qword [rax + 0x10], rdx
mov qword [rax + 0x18], rcx
mov qword [rax + 0x20], rdx
mov qword [rax + 0x28], rcx
mov qword [rax + 0x30], rdx
xor edx, edx
mov qword [rax + 0x38], rcx
movsxd rax, r15d
xor ecx, ecx
mov byte [rsp + rax + 0x20], 0
mov byte [rsp + r12 + 0x20], 0
call qword [sym.imp.KERNEL32.dll_CreateMutexA]
mov byte [rsp + r12 + 0x20], 0x2d
mov edx, 0xffffffff
mov r13, rax
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x417eee
int3
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_FindAtomA]
test ax, ax
je 0x417f40
mov rdx, r14
movzx ecx, ax
mov r9d, edi
mov r8d, r15d
call sym.get_ptr_from_atom_1
mov r14, rax
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, r14
lea rsp, [rbp - 0x48]
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
mov rcx, rbx
call sym.malloc
mov r12, rax
mov eax, 0x40
bt r12, rax
jae 0x417f63
mov edx, r15d
sub edx, eax
movsxd rdx, edx
mov byte [r14 + rdx], 0x41
sub eax, 1
jne 0x417f50
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_AddAtomA]
test ax, ax
jne 0x417f77
int3
mov rdx, r14
movzx ecx, ax
mov r9d, edi
mov r8d, r15d
call sym.get_ptr_from_atom_1
mov r14, rax
cmp r12, rax
je 0x417f9d
mov rcx, r12
call sym.free
jmp 0x417f10
xor edx, edx
mov r8, rbx
mov rcx, rax
call sym.memset
test rsi, rsi
je 0x417f10
mov rcx, r14
call rsi
jmp 0x417f10

Function at 0x4186c0
Capabilities:
Check mutex on windows

Disassembly:
lea r8, [sym.__shmem_winpthreads_init_rwl_global_shmem]
mov edx, 8
lea rcx, str.rwl_global_shmem
jmp sym.__shmem_winpthreads_grab

Function at 0x418790
Capabilities:
Check mutex on windows

Disassembly:
lea r8, [sym.__shmem_winpthreads_init_cond_locked_shmem_rwlock]
mov edx, 8
lea rcx, str.cond_locked_shmem_rwlock
jmp sym.__shmem_winpthreads_grab

Function at 0x419540
Capabilities:
Check mutex on windows

Disassembly:
lea r8, [sym.__shmem_winpthreads_init_cond_locked_shmem_cond]
mov edx, 8
lea rcx, str.cond_locked_shmem_cond
jmp sym.__shmem_winpthreads_grab

Function at 0x41acb0
Capabilities:
Check mutex on windows

Disassembly:
lea r8, [sym.__shmem_init_init]
mov edx, 8
lea rcx, str.init
jmp dbg.__shmem_grab
Function at 0x41acd0
Capabilities:
Check mutex on windows

Disassembly:
xor r8d, r8d
mov edx, 0x10
lea rcx, str.eh_globals
jmp dbg.__shmem_grab

Function at 0x41b380
Capabilities:
Check mutex on windows

Disassembly:
lea r8, [sym.__shmem_init___terminate_handler_sh]
mov edx, 8
lea rcx, str.__terminate_handler_sh
jmp dbg.__shmem_grab

Function at 0x41b3a0
Capabilities:
Check mutex on windows

Disassembly:
lea r8, [sym.__shmem_init___unexpected_handler_sh]
mov edx, 8
lea rcx, str.__unexpected_handler_sh
jmp dbg.__shmem_grab

Function at 0x41bc40
Capabilities:
Write file on windows

Disassembly:
push r13
push r12
push rbx
sub rsp, 0x30
cmp byte [0x0041d140], 0
jne 0x41bd4a
mov byte [0x0041d140], 1
call sym.__cxa_current_exception_type
test rax, rax
je 0x41bd20
mov r12, qword [rax + 8]
xor eax, eax
lea r9, [rsp + 0x2c]
cmp byte [r12], 0x2a
mov dword [rsp + 0x2c], 0xffffffff
sete al
xor r8d, r8d
xor edx, edx
add r12, rax
mov rcx, r12
call sym.__cxa_demangle
mov ecx, 2
mov rbx, qword [dbg.__acrt_iob_func]
mov r13, rax
call rbx
mov edx, 1
lea rcx, str.terminate_called_after_throwing_an_instance_of_
mov r8d, 0x30
mov r9, rax
call sym.fwrite
mov edx, dword [rsp + 0x2c]
mov ecx, 2
test edx, edx
je 0x41bd11
call rbx
mov rcx, r12
mov rdx, rax
call sym.fputs
mov ecx, 2
call rbx
mov r8d, 2
mov edx, 1
lea rcx, [0x0041e211]
mov r9, rax
call sym.fwrite
mov eax, dword [rsp + 0x2c]
test eax, eax
jne 0x41bd0c
mov rcx, r13
call sym.free
call sym.__cxa_rethrow
call rbx
mov rcx, r13
mov rdx, rax
call sym.fputs
jmp 0x41bcdb
mov ecx, 2
call qword [dbg.__acrt_iob_func]
mov r8d, 0x2d
mov edx, 1
lea rcx, str.terminate_called_without_an_active_exception_n
mov r9, rax
call sym.fwrite
call sym.abort
mov ecx, 2
call qword [dbg.__acrt_iob_func]
mov r8d, 0x1d
mov edx, 1
lea rcx, str.terminate_called_recursively_n
mov r9, rax
call sym.fwrite
call sym.abort
sub rdx, 1
mov rcx, rax
jne 0x41bddf
call sym.__cxa_begin_catch
mov rcx, rax
mov rax, qword [rax]
call qword [rax + 0x10]
mov ecx, 2
mov r12, rax
call rbx
mov r9, rax
mov r8d, 0xb
mov edx, 1
lea rcx, str.__what__:
call sym.fwrite
mov ecx, 2
call rbx
mov rdx, rax
mov rcx, r12
call sym.fputs
mov ecx, 2
call rbx
mov rdx, rax
mov ecx, 0xa
call sym.fputc
call sym.__cxa_end_catch
jmp 0x41bd45
call sym.__cxa_begin_catch
call sym.__cxa_end_catch
jmp 0x41bd45
Function at 0x14007cb26
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 8], rcx
push r15
xor rax, rax
push rax
push rax
push rax
sub rsp, 0x28
call fcn.1400f3810
mov qword [rsp + 0x28], 0
jmp 0x14007cb47
mov rax, qword [rsp + 0x50]
cmp rax, qword [rsp + 0x28]
jl 0x14007cc43
push 0
pop rcx
call fcn.1400da5ec
and rax, rax
je 0x14007cc38
mov qword [rsp + 0x30], 0xffffffffffffffff
call fcn.14008672d
mov qword [rsp + 0x30], rax
mov r15, qword [rsp + 0x30]
and r15, r15
jle 0x14007cc01
call fcn.1400df0bc
mov rax, rax
push rax
mov r15, qword [0x1412479d0]
cmp r15, qword [rsp]
jne 0x14007cbbe
sub rsp, 8
push qword [rsp + 0x40]
pop rcx
sub rsp, 0x20
call fcn.14007aabd
add rsp, 0x28
mov r15, rax
and r15, r15
jne 0x14007cbbc
jmp 0x14007cbfe
xor r15, r15
cmp r15, qword [rsp]
jne 0x14007cbe7
sub rsp, 8
push qword [rsp + 0x40]
pop rcx
sub rsp, 0x20
call fcn.1400650a2
add rsp, 0x28
mov r15, rax
and r15, r15
jne 0x14007cbe5
jmp 0x14007cbfe
sub rsp, 8
push 3
pop rcx
sub rsp, 0x20
call fcn.1400da190
add rsp, 0x28
pop rax
jmp 0x14007cc0c
push 5
pop rcx
call fcn.1400da190
push 0x1b
pop rcx
call sub.USER32.dll_GetKeyState
mov r15, rax
cmp r15, 1
jle 0x14007cc2d
mov qword [0x141247938], 1
jmp 0x14007cc38
mov qword [0x141247938], 0
inc qword [rsp + 0x28]
jno 0x14007cb47
xor rax, rax
add rsp, 0x40
pop r15
ret
Function at 0x14008685b
Capabilities:
Delete registry key

Disassembly:
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
push r15
mov rax, 7
sub rsp, 8
mov qword [rsp], 0
dec rax
jne 0x14008686e
sub rsp, 0x28
call fcn.1400f3810
mov rdx, qword [rsp + 0x70]
lea rcx, [rsp + 0x28]
sub rsp, 0x10
call fcn.1400f3380
add rsp, 0x10
mov rdx, qword [rsp + 0x78]
lea rcx, [rsp + 0x30]
sub rsp, 0x10
call fcn.1400f3380
add rsp, 0x10
push qword [rsp + 0x28]
pop rcx
call fcn.140086aa7
push qword [rsp + 0x30]
movabs rcx, 0x1401ac678
pop rdx
call fcn.1400f3610
or rax, rax
je 0x14008699f
cmp dword [0x141247bf0], 0
je 0x14008697d
movabs rax, 0x1401abcd4
push rax
push 0xffffffffffffffff
pop rcx
pop rdx
call fcn.1400cd4cc
mov qword [rsp + 0x38], rax
cmp qword [rsp + 0x38], 0
je 0x14008697b
movabs rax, 0x1401bb7c0
push rax
push qword [rsp + 0x40]
pop rcx
pop rdx
call fcn.1400cd554
mov qword [rsp + 0x40], rax
sub rsp, 8
push 0
movsxd r15, dword [0x141247bf4]
or r15, 0xf003f
mov rax, r15
push rax
mov rax, qword [0x141247b70]
mov rax, rax
push rax
push qword [0x141247b80]
push qword [rsp + 0x68]
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call fcn.1400cdf2c
add rsp, 0x30
mov qword [rsp + 0x48], rax
push qword [rsp + 0x38]
pop rcx
call fcn.1400cd3b8
jmp 0x14008699a
mov rax, qword [0x141247b70]
mov rax, rax
push rax
push qword [0x141247b80]
pop rcx
pop rdx
call sub.ADVAPI32.dll_RegDeleteKeyW
mov qword [rsp + 0x48], rax
jmp 0x140086a64
lea rax, [rsp + 0x58]
mov rax, rax
push rax
push qword [0x141247b80]
push qword [rsp + 0x40]
pop rcx
pop rdx
pop r8
call sub.ADVAPI32.dll_RegConnectRegistryW
movsxd rax, eax
mov qword [rsp + 0x50], rax
cmp dword [0x141247bf0], 0
je 0x140086a49
movabs rax, 0x1401abcd4
push rax
push 0xffffffffffffffff
pop rcx
pop rdx
call fcn.1400cd4cc
mov qword [rsp + 0x38], rax
cmp qword [rsp + 0x38], 0
je 0x140086a47
push 0
movsxd r15, dword [0x141247bf4]
or r15, 0xf003f
mov rax, r15
push rax
mov rax, qword [0x141247b70]
mov rax, rax
push rax
push qword [rsp + 0x70]
movabs rax, 0x1401bb7c0
push rax
push qword [rsp + 0x60]
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call fcn.1400ceb40
add rsp, 0x30
mov qword [rsp + 0x48], rax
push qword [rsp + 0x38]
pop rcx
call fcn.1400cd3b8
jmp 0x140086a64
mov rax, qword [0x141247b70]
mov rax, rax
push rax
push qword [rsp + 0x60]
pop rcx
pop rdx
call sub.ADVAPI32.dll_RegDeleteKeyW
mov qword [rsp + 0x48], rax
mov r15, qword [rsp + 0x48]
and r15, r15
jne 0x140086a77
mov rax, 1
jmp 0x140086a7a
xor rax, rax
push rax
mov rcx, qword [rsp + 0x38]
sub rsp, 0x28
call fcn.1400f3880
add rsp, 0x28
mov rcx, qword [rsp + 0x30]
sub rsp, 0x28
call fcn.1400f3880
add rsp, 0x28
pop rax
add rsp, 0x60
pop r15
ret
Function at 0x140086e2c
Capabilities:
Get graphical window text

Disassembly:
push r15
xor rax, rax
push rax
sub rsp, 0x28
call fcn.1400f3810
mov rcx, qword [rsp + 0x60]
call fcn.1400882e0
mov r15, qword [0x141247bf8]
and r15, r15
jne 0x140086e76
push 0
push 0
pop rcx
pop rdx
call sub.USER32.dll_FindWindowW
mov qword [0x141247c00], rax
mov qword [0x141247bf8], 1
jmp 0x140086e8f
push 2
push qword [0x141247c00]
pop rcx
pop rdx
call sub.USER32.dll_GetWindow
mov qword [0x141247c00], rax
mov r15, qword [0x141247c00]
and r15, r15
je 0x140086f65
push 0xfffffffffffffff0
push qword [0x141247c00]
pop rcx
pop rdx
call sub.USER32.dll_GetWindowLongPtrW
mov r15, rax
and r15, 0x10000000
cmp r15, 0x10000000
jne 0x140086f63
push 0xffffffffffffffec
push qword [0x141247c00]
pop rcx
pop rdx
call sub.USER32.dll_GetWindowLongPtrW
mov r15, rax
and r15, 0x80
cmp r15, 0x80
je 0x140086f63
push rcx
sub rsp, 0x28
call fcn.1400f34e0
add rsp, 0x28
pop rcx
push rax
sub rsp, 8
push rcx
sub rsp, 0x28
call fcn.1400f34e0
add rsp, 0x28
pop rcx
push rax
push 0x100
pop rcx
pop rdx
sub rsp, 0x20
call fcn.1400f0430
add rsp, 0x28
lea rcx, [rsp + 0x30]
pop rdx
call fcn.1400f3530
push 0x100
push qword [rsp + 0x30]
push qword [0x141247c00]
pop rcx
pop rdx
pop r8
call sub.USER32.dll_GetWindowTextW
push qword [rsp + 0x28]
movabs rcx, 0x1401ab0c4
pop rdx
call fcn.1400f3610
or rax, rax
jne 0x140086f63
jmp 0x140086f80
jmp 0x140086f70
mov qword [0x141247bf8], 0
mov r15, qword [0x141247c00]
and r15, r15
jne 0x140086e45
mov rcx, qword [rsp + 0x28]
push rcx
sub rsp, 0x28
call fcn.1400f34e0
add rsp, 0x28
pop rcx
push rax
sub rsp, 0x28
call fcn.1400f3670
add rsp, 0x28
pop rax
push rax
call fcn.1400f36e0
pop rdx
add rax, rdx
jmp 0x140086fb9
push rax
mov rcx, qword [rsp + 0x30]
sub rsp, 0x28
call fcn.1400f3880
add rsp, 0x28
pop rax
add rsp, 0x30
pop r15
ret
Function at 0x140086fd4
Capabilities:
Create process on windows

Disassembly:
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
push rbp
push r15
mov rax, 0x14
sub rsp, 8
mov qword [rsp], 0
dec rax
jne 0x140086fe8
sub rsp, 0x28
call fcn.1400f3810
mov rdx, qword [rsp + 0xe0]
lea rcx, [rsp + 0x28]
sub rsp, 0x10
call fcn.1400f3380
add rsp, 0x10
lea rax, [rsp + 0x30]
lea rax, [rsp + 0x98]
lea rbp, [rsp + 0x30]
mov dword [rbp], 0x68
mov dword [rbp + 0x3c], 1
mov r15, qword [rsp + 0xe8]
and r15, 2
and r15, r15
je 0x14008705a
lea rbp, [rsp + 0x30]
mov word [rbp + 0x40], 0
jmp 0x140087065
lea rbp, [rsp + 0x30]
mov word [rbp + 0x40], 1
lea rax, [rsp + 0x98]
mov rax, rax
push rax
lea rax, [rsp + 0x38]
mov rax, rax
push rax
push 0
push 0
push 0
push 0
push 0
push 0
push qword [rsp + 0x68]
push 0
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call sub.KERNEL32.dll_CreateProcessW
add rsp, 0x50
mov qword [rsp + 0xb0], rax
cmp qword [rsp + 0xb0], 0
je 0x140087134
mov r15, qword [rsp + 0xe8]
and r15, 1
and r15, r15
je 0x140087126
lea rbp, [rsp + 0x98]
push qword [rbp + 8]
pop rax
mov qword [rsp + 0xb8], rax
push 1
pop rcx
call fcn.1400da190
lea rax, [rsp + 0xc0]
mov rax, rax
push rax
push qword [rsp + 0xc0]
pop rcx
pop rdx
call sub.KERNEL32.dll_GetExitCodeThread
movsxd r15, dword [rsp + 0xc0]
cmp r15, 0x103
je 0x140087124
jmp 0x140087126
jmp 0x1400870ec
lea rbp, [rsp + 0x98]
mov rax, qword [rbp]
jmp 0x140087137
xor rax, rax
push rax
mov rcx, qword [rsp + 0x30]
sub rsp, 0x28
call fcn.1400f3880
add rsp, 0x28
pop rax
add rsp, 0xc8
pop r15
pop rbp
ret

Function at 0x140087182
Capabilities:
Acquire debug privileges

Disassembly:
push rbp
push r15
mov rax, 8
sub rsp, 8
mov qword [rsp], 0
dec rax
jne 0x14008718c
sub rsp, 0x28
call fcn.1400f3810
mov byte [rsp + 0x28], 0
lea rax, [rsp + 0x30]
mov rax, rax
push rax
push 0x28
sub rsp, 0x20
call sub.KERNEL32.dll_GetCurrentProcess
add rsp, 0x20
mov rax, rax
push rax
pop rcx
pop rdx
pop r8
call sub.ADVAPI32.dll_OpenProcessToken
and rax, rax
je 0x14008729f
lea rax, [rsp + 0x38]
lea rax, [rsp + 0x38]
mov rax, rax
push rax
movabs rax, 0x1401b362c
push rax
push 0
pop rcx
pop rdx
pop r8
call sub.ADVAPI32.dll_LookupPrivilegeValueW
and rax, rax
je 0x140087295
lea rax, [rsp + 0x40]
lea rbp, [rsp + 0x40]
mov dword [rbp], 1
lea rbp, [rsp + 0x38]
movsxd rax, dword [rbp]
push rax
lea rbp, [rsp + 0x48]
push rbp
pop rbp
pop rax
mov dword [rbp + 4], eax
lea rbp, [rsp + 0x38]
movsxd rax, dword [rbp + 4]
push rax
lea rbp, [rsp + 0x48]
push rbp
pop rbp
pop rax
mov dword [rbp + 8], eax
push rbp
pop rbp
mov dword [rbp + 0xc], 2
lea rax, [rsp + 0x60]
mov rax, rax
push rax
lea rax, [rsp + 0x58]
mov rax, rax
push rax
push 0x10
lea rax, [rsp + 0x58]
mov rax, rax
push rax
push 0
push qword [rsp + 0x58]
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call sub.ADVAPI32.dll_AdjustTokenPrivileges
add rsp, 0x30
mov rax, rax
push rax
pop rax
mov byte [rsp + 0x28], al
push qword [rsp + 0x30]
pop rcx
call sub.KERNEL32.dll_CloseHandle
movsx rax, byte [rsp + 0x28]
movsx rax, al
jmp 0x1400872ae
add rsp, 0x68
pop r15
pop rbp
ret
Function at 0x1400882e0
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x48
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x30], rcx
call sub.KERNEL32.dll_GetLastError
mov qword [rsp + 0x38], rax
mov rcx, qword [0x141242ac8]
call sub.KERNEL32.dll_TlsGetValue
mov rcx, qword [rsp + 0x30]
mov qword [rax + 0x10], rcx
mov rcx, qword [rsp + 0x38]
call sub.KERNEL32.dll_SetLastError
mov rax, qword [rsp + 0x28]
add rsp, 0x48
ret

Function at 0x1400898f4
Capabilities:
Create thread

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rbp
mov qword [r11 + 0x20], rsi
push rdi
sub rsp, 0x30
lea rax, [r11 + 0x18]
mov r9, rdx
mov r8, rcx
mov qword [r11 - 0x10], rax
xor edi, edi
mov edx, 0x1000
xor ecx, ecx
mov dword [rsp + 0x20], edi
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rbp, rax
test rax, rax
je 0x1400899ba
lea rcx, [0x1412c2740]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x141247db8]
jmp 0x14008997e
lea rsi, [rbx + 0x10]
xor edx, edx
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x14008997b
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbx, qword [rbx]
lea rcx, [0x141247db8]
mov rdx, rsi
call fcn.1400f3264
jmp 0x14008997e
mov rbx, qword [rbx]
test rbx, rbx
jne 0x14008994b
mov rdx, qword [0x1412428c8]
lea rcx, [0x141247db8]
mov rdi, rdx
inc rdx
mov qword [0x1412428c8], rdx
lea edx, [rbx + 0x20]
call fcn.1400f32ac
lea rcx, [0x1412c2740]
mov qword [rax], rbp
mov qword [rax + 8], rdi
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x58]
mov rax, rdi
add rsp, 0x30
pop rdi
ret

Function at 0x1400899d4
Capabilities:
Terminate thread

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
call fcn.140089770
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateThread]
lea rcx, [0x1412c2740]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x141247db8]
jmp 0x140089a10
cmp qword [rbx + 0x18], rdi
je 0x140089a17
mov rbx, qword [rbx]
test rbx, rbx
jne 0x140089a07
jmp 0x140089a31
mov rcx, qword [rbx + 0x10]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, [rbx + 0x10]
lea rcx, [0x141247db8]
call fcn.1400f3264
lea rcx, [0x1412c2740]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
Function at 0x140089e00
Capabilities:
Enumerate gui resources

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x40
test ecx, ecx
je 0x140089e77
movsxd rdx, ecx
lea rcx, [0x140089d5c]
call qword [sym.imp.USER32.dll_EnumWindows]
mov rbx, qword [0x141247dc8]
test rbx, rbx
je 0x140089eea
mov rdi, qword [rbx]
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [rbx + 0x10], eax
jne 0x140089e6d
cmp byte [rbx + 0x20], 0
je 0x140089e6d
mov rcx, qword [rbx + 0x18]
xor r9d, r9d
mov dword [rsp + 0x30], 3
and dword [rsp + 0x28], 0
and dword [rsp + 0x20], 0
lea rdx, [r9 - 2]
xor r8d, r8d
call qword [sym.imp.USER32.dll_SetWindowPos]
mov rbx, rdi
test rdi, rdi
jne 0x140089e33
jmp 0x140089eea
mov rbx, qword [0x141247dc8]
test rbx, rbx
je 0x140089eea
mov rdi, qword [rbx]
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [rbx + 0x10], eax
jne 0x140089ee2
cmp byte [rbx + 0x21], 0
je 0x140089ea6
mov rcx, qword [rbx + 0x18]
mov edx, 1
call qword [sym.imp.USER32.dll_EnableWindow]
cmp byte [rbx + 0x20], 0
je 0x140089ed2
mov rcx, qword [rbx + 0x18]
mov dword [rsp + 0x30], 3
and dword [rsp + 0x28], 0
and dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
or rdx, 0xffffffffffffffff
call qword [sym.imp.USER32.dll_SetWindowPos]
lea rdx, [rbx + 0x10]
lea rcx, [0x141247dc8]
call fcn.1400f3264
mov rbx, rdi
test rdi, rdi
jne 0x140089e83
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret

Function at 0x14008a5b0
Capabilities:
Get thread local storage value

Disassembly:
push rbx
sub rsp, 0x20
mov ebx, edx
mov rdx, rcx
mov rcx, qword [0x1412c27c0]
call fcn.1400f287c
test rax, rax
je 0x14008a5ed
cmp dword [rax + 0x28], 0
je 0x14008a5ed
mov rcx, qword [rax + 0x18]
mov r9d, ebx
mov r8d, dword [rcx + 4]
mov edx, dword [rcx]
mov rcx, qword [rax + 0x10]
add rsp, 0x20
pop rbx
jmp fcn.14008a1d0
mov ecx, ebx
add rsp, 0x20
pop rbx
jmp fcn.1400f3da0
Function at 0x1400a7868
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov ebx, edx
xor r8d, r8d
xor edx, edx
mov rsi, rcx
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
xor ebp, ebp
mov edi, eax
test eax, eax
je 0x1400a7896
dec edi
mov edx, ebx
mov ecx, edi
call fcn.1400f3940
lea r8d, [rdi + 1]
mov rcx, rsi
mov rdx, rax
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov rsi, qword [rsp + 0x40]
movsxd rcx, edi
mov word [rbx + rcx*2], bp
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret