joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400af090
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
mov rbp, rcx
mov rdi, r8
lea rcx, [0x14015db00]
mov rsi, rdx
call qword [sym.imp.ntdll.dll_RtlInterlockedPopEntrySList]
test rax, rax
je 0x1400af0c8
lock dec dword [0x14015db10]
jmp 0x1400af0e5
mov r8, qword [0x14015db18]
mov edx, 4
mov rcx, qword [sym.ProcessJacker.exe_PhHeapHandle]
add r8, 0x10
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
lea rbx, [rax + 0x10]
xor eax, eax
lea r8, [0x1400af010]
mov qword [rbx], rsi
mov qword [rsp + 0x28], rax
mov r9, rbx
mov rdx, rbp
mov dword [rsp + 0x20], eax
xor ecx, ecx
mov qword [rbx + 8], rdi
call qword [sym.imp.KERNEL32.dll_CreateThread]
test rax, rax
jne 0x1400af151
mov eax, dword [0x14015db14]
lea r8, [rbx - 0x10]
cmp dword [0x14015db10], eax
jae 0x1400af140
mov rdx, r8
lea rcx, [0x14015db00]
call qword [sym.imp.ntdll.dll_RtlInterlockedPushEntrySList]
lock inc dword [0x14015db10]
jmp 0x1400af14f
mov rcx, qword [sym.ProcessJacker.exe_PhHeapHandle]
xor edx, edx
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
xor eax, eax
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret

Function at 0x1400af2d0
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 8], rcx
push rbx
sub rsp, 0x30
mov rbx, rdx
mov dword [rsp + 0x28], 4
lea rdx, [rsp + 0x50]
mov qword [rsp + 0x50], 0
lea r9, [rsp + 0x40]
mov dword [rsp + 0x20], 0x1000
xor r8d, r8d
or rcx, 0xffffffffffffffff
call qword [sym.imp.ntdll.dll_NtAllocateVirtualMemory]
test eax, eax
js 0x1400af329
test rbx, rbx
je 0x1400af31e
mov rax, qword [rsp + 0x40]
mov qword [rbx], rax
mov rax, qword [rsp + 0x50]
add rsp, 0x30
pop rbx
ret
xor eax, eax
add rsp, 0x30
pop rbx
ret

Function at 0x1400b3ae0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
xor eax, eax
mov r8, rcx
test rdx, rdx
je 0x1400b3b06
nop word [rax + rax]
movzx ecx, byte [r8]
lea r8, [r8 + 1]
xor eax, ecx
imul eax, eax, 0x1000193
sub rdx, 1
jne 0x1400b3af0
ret

Function at 0x1400b3b10
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push rbx
sub rsp, 0x20
mov r8, qword [rcx]
xor ebx, ebx
test r8, r8
jne 0x1400b3b28
xor eax, eax
add rsp, 0x20
pop rbx
ret
mov qword [rsp + 0x30], rsi
mov rsi, r8
shr rsi, 1
mov qword [rsp + 0x38], rdi
mov rdi, qword [rcx + 8]
test dl, dl
jne 0x1400b3b70
movzx eax, byte [rdi]
lea rdi, [rdi + 1]
xor ebx, eax
imul ebx, ebx, 0x1000193
sub r8, 1
jne 0x1400b3b40
mov rsi, qword [rsp + 0x30]
mov eax, ebx
mov rdi, qword [rsp + 0x38]
add rsp, 0x20
pop rbx
ret
movzx ecx, word [rdi]
lea rdi, [rdi + 2]
call qword [sym.imp.ntdll.dll_RtlUpcaseUnicodeChar]
movzx eax, ax
xor eax, ebx
imul ebx, eax, 0x1000193
sub rsi, 1
jne 0x1400b3b70
mov rsi, qword [rsp + 0x30]
mov eax, ebx
mov rdi, qword [rsp + 0x38]
add rsp, 0x20
pop rbx
ret
Function at 0x1400b4eb0
Capabilities:
Get file attributes

Disassembly:
push rbx
sub rsp, 0x40
test byte [rcx + 8], 0xc
mov rbx, rcx
jne 0x1400b4f04
mov rcx, qword [rcx]
lea r8, [rsp + 0x50]
mov r9d, 8
mov dword [rsp + 0x20], 0xe
lea rdx, [rsp + 0x30]
call qword [sym.imp.ntdll.dll_NtQueryInformationFile]
test eax, eax
jns 0x1400b4eed
mov ecx, eax
call qword [sym.imp.ntdll.dll_RtlRaiseStatus]
int3
mov rax, qword [rsp + 0x50]
cmp qword [rbx + 0x10], rax
je 0x1400b4f04
mov ecx, 0xc00000e5
call qword [sym.imp.ntdll.dll_RtlRaiseStatus]
int3
add rsp, 0x40
pop rbx
ret

Function at 0x1400b4f10
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x30
mov eax, dword [rcx + 0x20]
lea r9, [rsp + 0x48]
mov rbx, rcx
mov dword [rsp + 0x28], 4
xor edi, edi
mov qword [rsp + 0x48], rax
or rcx, 0xffffffffffffffff
mov qword [rsp + 0x40], rdi
xor r8d, r8d
mov dword [rsp + 0x20], 0x1000
lea rdx, [rsp + 0x40]
call qword [sym.imp.ntdll.dll_NtAllocateVirtualMemory]
test eax, eax
mov edx, edi
mov eax, 0xc0000017
cmovns rdx, qword [rsp + 0x40]
test rdx, rdx
mov qword [rbx + 0x18], rdx
mov rbx, qword [rsp + 0x50]
cmovne eax, edi
add rsp, 0x30
pop rdi
ret
Function at 0x1400b4f80
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x60
xor eax, eax
mov rdi, r9
test byte [rcx + 8], 8
mov rbx, rcx
je 0x1400b4f9c
lea rax, [rcx + 0x10]
mov rcx, qword [rcx]
xor r9d, r9d
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x50]
mov dword [rsp + 0x30], r8d
xor r8d, r8d
mov qword [rsp + 0x28], rdx
xor edx, edx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntdll.dll_NtReadFile]
cmp eax, 0x103
jne 0x1400b4fec
mov rcx, qword [rbx]
xor r8d, r8d
xor edx, edx
call qword [sym.imp.ntdll.dll_NtWaitForSingleObject]
test eax, eax
js 0x1400b5000
mov eax, dword [rsp + 0x50]
test eax, eax
js 0x1400b5000
mov rcx, qword [rsp + 0x58]
add qword [rbx + 0x10], rcx
test rdi, rdi
je 0x1400b5000
mov dword [rdi], ecx
mov rbx, qword [rsp + 0x70]
add rsp, 0x60
pop rdi
ret
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push r13
push r14
push r15
sub rsp, 0x20
xor r13d, r13d
mov r14, r9
test byte [rcx + 8], 2
mov ebp, r8d
mov r15, rdx
mov rbx, rcx
mov esi, r13d
je 0x1400b504f
mov rbx, qword [rsp + 0x68]
add rsp, 0x20
pop r15
pop r14
pop r13
pop rsi
pop rbp
jmp 0x1400b4f80
mov qword [rsp + 0x58], rdi
mov edi, dword [rcx + 0x28]
sub edi, dword [rcx + 0x24]
jne 0x1400b50e7
mov r8d, dword [rcx + 0x2c]
test r8d, r8d
je 0x1400b507e
mov rdx, qword [rcx + 0x18]
call fcn.1400b5160
test eax, eax
js 0x1400b5149
mov dword [rbx + 0x2c], r13d
cmp ebp, dword [rbx + 0x20]
jb 0x1400b509d
mov r9, r14
mov qword [rbx + 0x24], r13
mov r8d, ebp
mov rdx, r15
mov rcx, rbx
call 0x1400b4f80
jmp 0x1400b5149
cmp qword [rbx + 0x18], rsi
jne 0x1400b50b3
mov rcx, rbx
call fcn.1400b4f10
test eax, eax
js 0x1400b5149
mov r8d, dword [rbx + 0x20]
lea r9, [rsp + 0x50]
mov rdx, qword [rbx + 0x18]
mov rcx, rbx
call 0x1400b4f80
mov esi, eax
test eax, eax
js 0x1400b5149
mov edi, dword [rsp + 0x50]
test edi, edi
jne 0x1400b50e0
test r14, r14
je 0x1400b5149
mov dword [r14], r13d
jmp 0x1400b5149
mov dword [rbx + 0x24], r13d
mov dword [rbx + 0x28], edi
mov edx, dword [rbx + 0x24]
cmp edi, ebp
mov rcx, r15
mov qword [rsp + 0x60], r12
cmova edi, ebp
add rdx, qword [rbx + 0x18]
mov r8d, edi
call fcn.1400e3970
add dword [rbx + 0x24], edi
cmp edi, ebp
jae 0x1400b5136
mov eax, dword [rbx + 0x20]
cmp dword [rbx + 0x28], eax
jne 0x1400b5136
sub ebp, edi
lea rdx, [rdi + r15]
mov r8d, ebp
lea r9, [rsp + 0x50]
mov rcx, rbx
call 0x1400b4f80
mov esi, eax
test eax, eax
js 0x1400b5142
add edi, dword [rsp + 0x50]
mov qword [rbx + 0x24], r13
test esi, esi
js 0x1400b5142
test r14, r14
je 0x1400b5142
mov dword [r14], edi
mov r12, qword [rsp + 0x60]
mov eax, esi
mov rdi, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x68]
add rsp, 0x20
pop r15
pop r14
pop r13
pop rsi
pop rbp
ret
Function at 0x1400b5010
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x60
xor eax, eax
mov rdi, r9
test byte [rcx + 8], 8
mov rbx, rcx
je 0x1400b4f9c
lea rax, [rcx + 0x10]
mov rcx, qword [rcx]
xor r9d, r9d
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x50]
mov dword [rsp + 0x30], r8d
xor r8d, r8d
mov qword [rsp + 0x28], rdx
xor edx, edx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntdll.dll_NtReadFile]
cmp eax, 0x103
jne 0x1400b4fec
mov rcx, qword [rbx]
xor r8d, r8d
xor edx, edx
call qword [sym.imp.ntdll.dll_NtWaitForSingleObject]
test eax, eax
js 0x1400b5000
mov eax, dword [rsp + 0x50]
test eax, eax
js 0x1400b5000
mov rcx, qword [rsp + 0x58]
add qword [rbx + 0x10], rcx
test rdi, rdi
je 0x1400b5000
mov dword [rdi], ecx
mov rbx, qword [rsp + 0x70]
add rsp, 0x60
pop rdi
ret
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push r13
push r14
push r15
sub rsp, 0x20
xor r13d, r13d
mov r14, r9
test byte [rcx + 8], 2
mov ebp, r8d
mov r15, rdx
mov rbx, rcx
mov esi, r13d
je 0x1400b504f
mov rbx, qword [rsp + 0x68]
add rsp, 0x20
pop r15
pop r14
pop r13
pop rsi
pop rbp
jmp 0x1400b4f80
mov qword [rsp + 0x58], rdi
mov edi, dword [rcx + 0x28]
sub edi, dword [rcx + 0x24]
jne 0x1400b50e7
mov r8d, dword [rcx + 0x2c]
test r8d, r8d
je 0x1400b507e
mov rdx, qword [rcx + 0x18]
call fcn.1400b5160
test eax, eax
js 0x1400b5149
mov dword [rbx + 0x2c], r13d
cmp ebp, dword [rbx + 0x20]
jb 0x1400b509d
mov r9, r14
mov qword [rbx + 0x24], r13
mov r8d, ebp
mov rdx, r15
mov rcx, rbx
call 0x1400b4f80
jmp 0x1400b5149
cmp qword [rbx + 0x18], rsi
jne 0x1400b50b3
mov rcx, rbx
call fcn.1400b4f10
test eax, eax
js 0x1400b5149
mov r8d, dword [rbx + 0x20]
lea r9, [rsp + 0x50]
mov rdx, qword [rbx + 0x18]
mov rcx, rbx
call 0x1400b4f80
mov esi, eax
test eax, eax
js 0x1400b5149
mov edi, dword [rsp + 0x50]
test edi, edi
jne 0x1400b50e0
test r14, r14
je 0x1400b5149
mov dword [r14], r13d
jmp 0x1400b5149
mov dword [rbx + 0x24], r13d
mov dword [rbx + 0x28], edi
mov edx, dword [rbx + 0x24]
cmp edi, ebp
mov rcx, r15
mov qword [rsp + 0x60], r12
cmova edi, ebp
add rdx, qword [rbx + 0x18]
mov r8d, edi
call fcn.1400e3970
add dword [rbx + 0x24], edi
cmp edi, ebp
jae 0x1400b5136
mov eax, dword [rbx + 0x20]
cmp dword [rbx + 0x28], eax
jne 0x1400b5136
sub ebp, edi
lea rdx, [rdi + r15]
mov r8d, ebp
lea r9, [rsp + 0x50]
mov rcx, rbx
call 0x1400b4f80
mov esi, eax
test eax, eax
js 0x1400b5142
add edi, dword [rsp + 0x50]
mov qword [rbx + 0x24], r13
test esi, esi
js 0x1400b5142
test r14, r14
je 0x1400b5142
mov dword [r14], edi
mov r12, qword [rsp + 0x60]
mov eax, esi
mov rdi, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x68]
add rsp, 0x20
pop r15
pop r14
pop r13
pop rsi
pop rbp
ret
Function at 0x1400b5160
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x60
xor eax, eax
mov rbx, rcx
test byte [rcx + 8], 8
je 0x1400b5175
lea rax, [rcx + 0x10]
mov rcx, qword [rcx]
xor r9d, r9d
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x50]
mov dword [rsp + 0x30], r8d
xor r8d, r8d
mov qword [rsp + 0x28], rdx
xor edx, edx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntdll.dll_NtWriteFile]
mov ecx, eax
cmp eax, 0x103
jne 0x1400b51c7
mov rcx, qword [rbx]
xor r8d, r8d
xor edx, edx
call qword [sym.imp.ntdll.dll_NtWaitForSingleObject]
test eax, eax
js 0x1400b51dd
mov ecx, dword [rsp + 0x50]
test ecx, ecx
js 0x1400b51db
mov rax, qword [rsp + 0x58]
add qword [rbx + 0x10], rax
or dword [rbx + 8], 0x80000000
mov eax, ecx
add rsp, 0x60
pop rbx
ret

Function at 0x1400b51f0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
sub rsp, 0x20
xor edi, edi
mov esi, r8d
test byte [rcx + 8], 2
mov rbp, rdx
mov rbx, rcx
je 0x1400b521e
mov rbx, qword [rsp + 0x50]
add rsp, 0x20
pop rdi
pop rsi
pop rbp
jmp fcn.1400b5160
cmp dword [rcx + 0x2c], edi
jne 0x1400b5232
call fcn.1400b5300
mov edi, eax
test eax, eax
js 0x1400b52e5
mov eax, dword [rbx + 0x2c]
mov qword [rsp + 0x40], r14
mov qword [rsp + 0x48], r15
test eax, eax
je 0x1400b5293
mov r14d, dword [rbx + 0x20]
sub r14d, eax
je 0x1400b5276
mov ecx, eax
cmp r14d, esi
mov rdx, rbp
cmova r14d, esi
add rcx, qword [rbx + 0x18]
mov r8d, r14d
mov r15d, r14d
call fcn.1400e3970
add dword [rbx + 0x2c], r14d
cmp r14d, esi
je 0x1400b52d9
add rbp, r15
sub esi, r14d
mov r8d, dword [rbx + 0x2c]
mov rcx, rbx
mov rdx, qword [rbx + 0x18]
call fcn.1400b5160
mov edi, eax
test eax, eax
js 0x1400b52db
mov dword [rbx + 0x2c], 0
cmp esi, dword [rbx + 0x20]
jb 0x1400b52ae
mov r8d, esi
mov rdx, rbp
mov rcx, rbx
call fcn.1400b5160
mov edi, eax
test eax, eax
jns 0x1400b52d9
jmp 0x1400b52db
test esi, esi
je 0x1400b52d9
cmp qword [rbx + 0x18], 0
jne 0x1400b52c7
mov rcx, rbx
call fcn.1400b4f10
mov edi, eax
test eax, eax
js 0x1400b52db
mov rcx, qword [rbx + 0x18]
mov rdx, rbp
mov r8d, esi
call fcn.1400e3970
mov dword [rbx + 0x2c], esi
mov eax, edi
mov r14, qword [rsp + 0x40]
mov r15, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x50]
add rsp, 0x20
pop rdi
pop rsi
pop rbp
ret

Function at 0x1400b5300
Capabilities:
Set file attributes

Disassembly:
push rbx
sub rsp, 0x40
mov r9d, dword [rcx + 0x28]
xor edx, edx
mov r8d, dword [rcx + 0x24]
mov rbx, rcx
cmp r9d, r8d
je 0x1400b5362
sub r8d, r9d
xor ecx, ecx
movsxd rax, r8d
add qword [rbx + 0x10], rax
test byte [rbx + 8], 8
mov rax, qword [rbx + 0x10]
jne 0x1400b5354
mov rcx, qword [rbx]
lea r9d, [rdx + 8]
lea rdx, [rsp + 0x30]
mov qword [rsp + 0x50], rax
lea r8, [rsp + 0x50]
mov dword [rsp + 0x20], 0xe
call qword [sym.imp.ntdll.dll_NtSetInformationFile]
mov ecx, eax
mov edx, ecx
test ecx, ecx
jns 0x1400b5362
mov eax, ecx
add rsp, 0x40
pop rbx
ret
mov qword [rbx + 0x24], 0
mov eax, edx
add rsp, 0x40
pop rbx
ret
Function at 0x1400b5420
Capabilities:
Get file attributes
Set file attributes

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x60
mov rbx, rcx
mov rdi, rdx
xor ecx, ecx
test r8d, r8d
je 0x1400b5496
sub r8d, 1
je 0x1400b548d
cmp r8d, 1
jne 0x1400b549d
lea r9d, [rcx + 0x18]
mov dword [rsp + 0x20], 5
mov rcx, qword [rbx]
lea r8, [rsp + 0x40]
lea rdx, [rsp + 0x30]
call qword [sym.imp.ntdll.dll_NtQueryInformationFile]
mov edx, eax
mov ecx, eax
test eax, eax
js 0x1400b5473
mov rax, qword [rsp + 0x48]
mov qword [rbx + 0x10], rax
test edx, edx
jns 0x1400b5484
mov eax, edx
mov rbx, qword [rsp + 0x70]
add rsp, 0x60
pop rdi
ret
mov rax, qword [rdi]
add qword [rbx + 0x10], rax
jmp 0x1400b549d
mov rax, qword [rdx]
add qword [rbx + 0x10], rax
jmp 0x1400b549d
mov rax, qword [rdx]
mov qword [rbx + 0x10], rax
test byte [rbx + 8], 8
jne 0x1400b54d9
mov rax, qword [rbx + 0x10]
lea r8, [rsp + 0x88]
mov rcx, qword [rbx]
lea rdx, [rsp + 0x30]
mov r9d, 8
mov qword [rsp + 0x88], rax
mov dword [rsp + 0x20], 0xe
call qword [sym.imp.ntdll.dll_NtSetInformationFile]
mov ecx, eax
test eax, eax
js 0x1400b54db
mov eax, ecx
mov rbx, qword [rsp + 0x70]
add rsp, 0x60
pop rdi
ret
Function at 0x1400b7510
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x10], rbp
push rsi
push rdi
push r14
sub rsp, 0xa0
cmp qword [r8 + 8], 0
mov rsi, r9
mov rdi, r8
mov rbp, rdx
mov r14, rcx
jne 0x1400b753d
mov eax, 0xc000000d
jmp 0x1400b7686
mov rcx, qword [0x1401559f8]
mov rax, qword [str.SoftwareMicrosoftWindows_NTCurrentVersionKnownFunctionTableDlls]
mov qword [rsp + 0xc0], rbx
mov word [rsp + 0x50], cx
mov word [rsp + 0x52], cx
mov qword [rsp + 0x58], rax
cmp rcx, 0xfffe
jbe 0x1400b7575
mov eax, 0xc0000106
jmp 0x1400b767e
xor r8d, r8d
lea rax, [rsp + 0x40]
lea r9, [rsp + 0x70]
mov qword [rsp + 0x20], rax
lea rdx, [rsp + 0x50]
lea rcx, [r8 - 3]
call fcn.1400beed0
mov ebx, eax
test eax, eax
js 0x1400b75c4
lea r8, [rsp + 0x70]
mov edx, 0x20019
lea rcx, [rsp + 0x30]
call qword [sym.imp.ntdll.dll_NtOpenKey]
mov rcx, qword [rsp + 0x40]
mov ebx, eax
test rcx, rcx
je 0x1400b75c2
call qword [sym.imp.ntdll.dll_NtClose]
mov eax, ebx
test ebx, ebx
js 0x1400b767e
mov rcx, qword [rsp + 0x30]
lea rax, [rsp + 0xd0]
xor r9d, r9d
mov qword [rsp + 0x28], rax
mov rdx, rdi
mov dword [rsp + 0x20], 0
lea r8d, [r9 + 2]
call qword [sym.imp.ntdll.dll_NtQueryValueKey]
mov rcx, qword [rsp + 0x30]
mov ebx, eax
call qword [sym.imp.ntdll.dll_NtClose]
cmp ebx, 0xc0000034
jne 0x1400b7612
mov eax, 0xc0000361
jmp 0x1400b767e
lea r9, [rsp + 0x38]
mov r8, rdi
xor edx, edx
xor ecx, ecx
call qword [sym.imp.ntdll.dll_LdrLoadDll]
test eax, eax
js 0x1400b767e
mov rcx, qword [rsp + 0x38]
lea rax, str.OutOfProcessFunctionTableCallback
lea r9, [rsp + 0x48]
mov qword [rsp + 0x68], rax
xor r8d, r8d
mov dword [rsp + 0x60], 0x220021
lea rdx, [rsp + 0x60]
call qword [sym.imp.ntdll.dll_LdrGetProcedureAddress]
mov ebx, eax
test eax, eax
js 0x1400b7671
mov r8, qword [rsp + 0xe0]
mov r9, rsi
mov rdx, rbp
mov rcx, r14
call qword [rsp + 0x48]
mov ebx, eax
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ntdll.dll_LdrUnloadDll]
mov eax, ebx
mov rbx, qword [rsp + 0xc0]
mov rbp, qword [rsp + 0xc8]
add rsp, 0xa0
pop r14
pop rdi
pop rsi
ret
Function at 0x1400b8980
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
cmp byte [0x14015e000], 0
mov ebx, edx
mov rdi, rcx
je 0x1400b89a4
call fcn.1400c0500
cmp eax, 0xc00000bb
jne 0x1400b89af
mov edx, ebx
mov rcx, rdi
call qword [sym.imp.ntdll.dll_NtTerminateProcess]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x1400b9200
Capabilities:
Allocate or change rwx memory

Disassembly:
push rbx
push rsi
push r12
push r14
sub rsp, 0xb8
xor ebx, ebx
mov r14, r9
mov qword [rsp + 0x20], rbx
mov r12, r8
mov rsi, rcx
test dl, 1
jne 0x1400b9296
lea r9d, [rbx + 0x30]
xor edx, edx
lea r8, [rsp + 0x78]
call qword [sym.imp.ntdll.dll_NtQueryInformationProcess]
test eax, eax
js 0x1400b93f8
mov rdx, qword [rsp + 0x80]
lea r9d, [rbx + 8]
add rdx, 0x20
mov qword [rsp + 0x20], rbx
lea r8, [rsp + 0x30]
mov rcx, rsi
call qword [sym.imp.ntdll.dll_NtReadVirtualMemory]
test eax, eax
js 0x1400b93f8
mov rdx, qword [rsp + 0x30]
lea r9d, [rbx + 8]
sub rdx, 0xffffffffffffff80
mov qword [rsp + 0x20], rbx
lea r8, [rsp + 0x38]
mov rcx, rsi
call qword [sym.imp.ntdll.dll_NtReadVirtualMemory]
test eax, eax
js 0x1400b93f8
mov rdx, qword [rsp + 0x38]
jmp 0x1400b9315
mov r9d, 8
lea r8, [rsp + 0x40]
lea edx, [r9 + 0x12]
call qword [sym.imp.ntdll.dll_NtQueryInformationProcess]
test eax, eax
js 0x1400b93f8
mov rdx, qword [rsp + 0x40]
lea r8, [rsp + 0xe8]
add rdx, 0x10
mov qword [rsp + 0x20], rbx
mov r9d, 4
mov rcx, rsi
call qword [sym.imp.ntdll.dll_NtReadVirtualMemory]
test eax, eax
js 0x1400b93f8
mov edx, dword [rsp + 0xe8]
lea r8, [rsp + 0x30]
add rdx, 0x48
mov qword [rsp + 0x20], rbx
mov r9d, 4
mov rcx, rsi
call qword [sym.imp.ntdll.dll_NtReadVirtualMemory]
test eax, eax
js 0x1400b93f8
mov edx, dword [rsp + 0x30]
mov qword [rsp + 0x38], rdx
mov qword [rsp + 0x28], rbx
lea r9, [rsp + 0x48]
xor r8d, r8d
mov qword [rsp + 0x20], 0x30
mov rcx, rsi
call qword [sym.imp.ntdll.dll_NtQueryVirtualMemory]
test eax, eax
js 0x1400b93f8
mov qword [rsp + 0xe0], rbp
lea r9, [rsp + 0x40]
mov ebp, dword [rsp + 0x60]
lea rdx, [rsp + 0x30]
sub ebp, dword [rsp + 0x38]
xor r8d, r8d
add ebp, dword [rsp + 0x48]
or rcx, 0xffffffffffffffff
mov qword [rsp + 0xf0], rdi
mov qword [rsp + 0xb0], r15
mov r15d, ebp
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x40], r15
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x20], 0x1000
call qword [sym.imp.ntdll.dll_NtAllocateVirtualMemory]
test eax, eax
js 0x1400b93db
mov rdi, qword [rsp + 0x30]
test rdi, rdi
je 0x1400b93db
mov rdx, qword [rsp + 0x38]
mov r9d, r15d
mov r8, rdi
mov qword [rsp + 0x20], rbx
mov rcx, rsi
call qword [sym.imp.ntdll.dll_NtReadVirtualMemory]
mov ebx, eax
test eax, eax
jns 0x1400b93cd
mov rcx, rdi
call sym.ProcessJacker.exe_PhFreePage
mov eax, ebx
jmp 0x1400b93e0
mov qword [r12], rdi
test r14, r14
je 0x1400b93e0
mov dword [r14], ebp
jmp 0x1400b93e0
mov eax, 0xc0000017
mov rdi, qword [rsp + 0xf0]
mov rbp, qword [rsp + 0xe0]
mov r15, qword [rsp + 0xb0]
add rsp, 0xb8
pop r14
pop r12
pop rsi
pop rbx
ret
Function at 0x1400ba610
Capabilities:
Get file attributes

Disassembly:
push rbx
sub rsp, 0x60
mov rbx, rdx
mov dword [rsp + 0x20], 5
lea rdx, [rsp + 0x30]
mov r9d, 0x18
lea r8, [rsp + 0x40]
call qword [sym.imp.ntdll.dll_NtQueryInformationFile]
mov ecx, eax
test eax, eax
js 0x1400ba647
mov rax, qword [rsp + 0x48]
mov qword [rbx], rax
mov eax, ecx
add rsp, 0x60
pop rbx
ret

Function at 0x1400ba650
Capabilities:
Set file attributes

Disassembly:
sub rsp, 0x48
mov rax, qword [rdx]
lea r8, [rsp + 0x58]
lea rdx, [rsp + 0x30]
mov qword [rsp + 0x58], rax
mov r9d, 8
mov dword [rsp + 0x20], 0x14
call qword [sym.imp.ntdll.dll_NtSetInformationFile]
add rsp, 0x48
ret
Function at 0x1400bc350
Capabilities:
Get system information on windows
Make suspicious ntquerysysteminformation call

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
mov dword [rsp + 0x38], 0x800
mov rcx, qword [sym.ProcessJacker.exe_PhHeapHandle]
mov edx, 4
mov r8d, 0x800
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov r8d, dword [rsp + 0x38]
lea r9, [rsp + 0x38]
mov rdx, rax
mov ecx, 0xb
mov rbx, rax
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
cmp eax, 0xc0000004
jne 0x1400bc3e3
mov rcx, qword [sym.ProcessJacker.exe_PhHeapHandle]
mov r8, rbx
xor edx, edx
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
mov r8d, dword [rsp + 0x38]
mov edx, 4
mov rcx, qword [sym.ProcessJacker.exe_PhHeapHandle]
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov r8d, dword [rsp + 0x38]
lea r9, [rsp + 0x38]
mov rdx, rax
mov ecx, 0xb
mov rbx, rax
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
test eax, eax
js 0x1400bc3ea
mov qword [rdi], rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x1400bc400
Capabilities:
Get system information on windows
Make suspicious ntquerysysteminformation call

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x20
mov rcx, qword [sym.ProcessJacker.exe_PhHeapHandle]
xor edi, edi
mov r8d, 0x800
mov dword [rsp + 0x30], 0x800
lea edx, [rdi + 4]
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov r8d, dword [rsp + 0x30]
lea r9, [rsp + 0x30]
mov rdx, rax
lea ecx, [rdi + 0xb]
mov rbx, rax
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
cmp eax, 0xc0000004
jne 0x1400bc48a
mov rcx, qword [sym.ProcessJacker.exe_PhHeapHandle]
mov r8, rbx
xor edx, edx
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
mov r8d, dword [rsp + 0x30]
lea edx, [rdi + 4]
mov rcx, qword [sym.ProcessJacker.exe_PhHeapHandle]
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov r8d, dword [rsp + 0x30]
lea r9, [rsp + 0x30]
mov rdx, rax
lea ecx, [rdi + 0xb]
mov rbx, rax
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
test eax, eax
jns 0x1400bc49b
xor eax, eax
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
cmp dword [rbx], 1
jb 0x1400bc4c1
lea rcx, [rbx + 0x30]
or rdx, 0xffffffffffffffff
nop dword [rax + rax]
inc rdx
cmp byte [rcx + rdx], dil
jne 0x1400bc4b0
call sym.ProcessJacker.exe_PhConvertMultiByteToUtf16Ex
mov rdi, rax
mov rcx, qword [sym.ProcessJacker.exe_PhHeapHandle]
mov r8, rbx
xor edx, edx
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
mov rbx, qword [rsp + 0x38]
mov rax, rdi
add rsp, 0x20
pop rdi
ret

Function at 0x1400bc4f0
Capabilities:
Get system information on windows

Disassembly:
mov edx, 5
jmp sym.ProcessJacker.exe_PhEnumProcessesEx