joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140170f80
Capabilities:
Parse pe header

Disassembly:
push rdi
sub rsp, 0x40
xor edi, edi
test byte [0x1402c61f0], 1
jne 0x1401710fc
lock bts qword [0x1402c61f0], 0x1f
setb al
test al, al
je 0x140170fca
test byte [0x1402c61f0], 1
jne 0x1401710fc
xor edx, edx
lea rcx, [0x1402c61f0]
call sym.SystemInformer.exe_PhfWaitForEvent
jmp 0x1401710fc
mov qword [rsp + 0x50], rbx
lea rdx, [rsp + 0x30]
lea rbx, [0x14023ec90]
mov qword [rsp + 0x30], 0x12
mov qword [rsp + 0x38], rbx
call fcn.14017e120
mov rcx, rax
test rax, rax
jne 0x140171055
xor edx, edx
mov r8d, 0x800
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
test rax, rax
jne 0x140171055
xor edx, edx
mov r8d, 0x200
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
test rax, rax
jne 0x140171055
cmp dword [0x1402bff40], 0x3e
jae 0x1401710eb
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
test rax, rax
je 0x1401710eb
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x1401710eb
mov edx, dword [rcx + 0x3c]
lea eax, [rdx - 1]
cmp eax, 0x7ffffffd
ja 0x1401710eb
cmp dword [rdx + rcx], 0x4550
jne 0x1401710eb
add rdx, 0x88
add rdx, rcx
mov eax, dword [rdx]
test eax, eax
je 0x1401710eb
cmp dword [rdx + 4], edi
je 0x1401710eb
lea r8, [rcx + rax]
mov word [rsp + 0x20], di
lea r9, str.NtQueryInformationTransaction
call fcn.14017e4c0
mov r9, rax
test rax, rax
je 0x1401710eb
mov r8, qword [0x7ffe0320]
mov ecx, dword [0x7ffe0004]
mov eax, r8d
shr r8, 0x20
imul rax, rcx
imul r8, rcx
shr rax, 0x18
shl r8, 8
add rax, r8
mov qword [0x1402ce098], rax
xor rax, r9
mov qword [0x1402ce000], rax
lea rcx, [0x1402c61f0]
call sym.SystemInformer.exe_PhfSetEvent
mov rbx, qword [rsp + 0x50]
mov rax, qword [0x1402ce000]
test rax, rax
je 0x14017111d
mov rcx, qword [0x1402ce098]
test rcx, rcx
je 0x14017111d
xor rax, rcx
add rsp, 0x40
pop rdi
ret
mov rax, rdi
add rsp, 0x40
pop rdi
ret
Function at 0x140171140
Capabilities:
Parse pe header

Disassembly:
push rdi
sub rsp, 0x40
xor edi, edi
test byte [0x1402c6260], 1
jne 0x1401712bc
lock bts qword [0x1402c6260], 0x1f
setb al
test al, al
je 0x14017118a
test byte [0x1402c6260], 1
jne 0x1401712bc
xor edx, edx
lea rcx, [0x1402c6260]
call sym.SystemInformer.exe_PhfWaitForEvent
jmp 0x1401712bc
mov qword [rsp + 0x50], rbx
lea rdx, [rsp + 0x30]
lea rbx, [0x14023ec90]
mov qword [rsp + 0x30], 0x12
mov qword [rsp + 0x38], rbx
call fcn.14017e120
mov rcx, rax
test rax, rax
jne 0x140171215
xor edx, edx
mov r8d, 0x800
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
test rax, rax
jne 0x140171215
xor edx, edx
mov r8d, 0x200
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
test rax, rax
jne 0x140171215
cmp dword [0x1402bff40], 0x3e
jae 0x1401712ab
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
test rax, rax
je 0x1401712ab
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x1401712ab
mov edx, dword [rcx + 0x3c]
lea eax, [rdx - 1]
cmp eax, 0x7ffffffd
ja 0x1401712ab
cmp dword [rdx + rcx], 0x4550
jne 0x1401712ab
add rdx, 0x88
add rdx, rcx
mov eax, dword [rdx]
test eax, eax
je 0x1401712ab
cmp dword [rdx + 4], edi
je 0x1401712ab
lea r8, [rcx + rax]
mov word [rsp + 0x20], di
lea r9, str.NtQueryInformationTransactionManager
call fcn.14017e4c0
mov r9, rax
test rax, rax
je 0x1401712ab
mov r8, qword [0x7ffe0320]
mov ecx, dword [0x7ffe0004]
mov eax, r8d
shr r8, 0x20
imul rax, rcx
imul r8, rcx
shr rax, 0x18
shl r8, 8
add rax, r8
mov qword [0x1402cdfc8], rax
xor rax, r9
mov qword [0x1402ce108], rax
lea rcx, [0x1402c6260]
call sym.SystemInformer.exe_PhfSetEvent
mov rbx, qword [rsp + 0x50]
mov rax, qword [0x1402ce108]
test rax, rax
je 0x1401712dd
mov rcx, qword [0x1402cdfc8]
test rcx, rcx
je 0x1401712dd
xor rax, rcx
add rsp, 0x40
pop rdi
ret
mov rax, rdi
add rsp, 0x40
pop rdi
ret
Function at 0x140171300
Capabilities:
Parse pe header

Disassembly:
push rdi
sub rsp, 0x40
xor edi, edi
test byte [0x1402c6200], 1
jne 0x14017147c
lock bts qword [0x1402c6200], 0x1f
setb al
test al, al
je 0x14017134a
test byte [0x1402c6200], 1
jne 0x14017147c
xor edx, edx
lea rcx, [0x1402c6200]
call sym.SystemInformer.exe_PhfWaitForEvent
jmp 0x14017147c
mov qword [rsp + 0x50], rbx
lea rdx, [rsp + 0x30]
lea rbx, [0x14023ec90]
mov qword [rsp + 0x30], 0x12
mov qword [rsp + 0x38], rbx
call fcn.14017e120
mov rcx, rax
test rax, rax
jne 0x1401713d5
xor edx, edx
mov r8d, 0x800
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
test rax, rax
jne 0x1401713d5
xor edx, edx
mov r8d, 0x200
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
test rax, rax
jne 0x1401713d5
cmp dword [0x1402bff40], 0x3e
jae 0x14017146b
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
test rax, rax
je 0x14017146b
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x14017146b
mov edx, dword [rcx + 0x3c]
lea eax, [rdx - 1]
cmp eax, 0x7ffffffd
ja 0x14017146b
cmp dword [rdx + rcx], 0x4550
jne 0x14017146b
add rdx, 0x88
add rdx, rcx
mov eax, dword [rdx]
test eax, eax
je 0x14017146b
cmp dword [rdx + 4], edi
je 0x14017146b
lea r8, [rcx + rax]
mov word [rsp + 0x20], di
lea r9, str.NtSetInformationVirtualMemory
call fcn.14017e4c0
mov r9, rax
test rax, rax
je 0x14017146b
mov r8, qword [0x7ffe0320]
mov ecx, dword [0x7ffe0004]
mov eax, r8d
shr r8, 0x20
imul rax, rcx
imul r8, rcx
shr rax, 0x18
shl r8, 8
add rax, r8
mov qword [0x1402ce040], rax
xor rax, r9
mov qword [0x1402ce0a8], rax
lea rcx, [0x1402c6200]
call sym.SystemInformer.exe_PhfSetEvent
mov rbx, qword [rsp + 0x50]
mov rax, qword [0x1402ce0a8]
test rax, rax
je 0x14017149d
mov rcx, qword [0x1402ce040]
test rcx, rcx
je 0x14017149d
xor rax, rcx
add rsp, 0x40
pop rdi
ret
mov rax, rdi
add rsp, 0x40
pop rdi
ret
Function at 0x1401714c0
Capabilities:
Parse pe header

Disassembly:
push rdi
sub rsp, 0x40
xor edi, edi
test byte [0x1402c6180], 1
jne 0x14017163c
lock bts qword [0x1402c6180], 0x1f
setb al
test al, al
je 0x14017150a
test byte [0x1402c6180], 1
jne 0x14017163c
xor edx, edx
lea rcx, [0x1402c6180]
call sym.SystemInformer.exe_PhfWaitForEvent
jmp 0x14017163c
mov qword [rsp + 0x50], rbx
lea rdx, [rsp + 0x30]
lea rbx, [0x14023ec90]
mov qword [rsp + 0x30], 0x12
mov qword [rsp + 0x38], rbx
call fcn.14017e120
mov rcx, rax
test rax, rax
jne 0x140171595
xor edx, edx
mov r8d, 0x800
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
test rax, rax
jne 0x140171595
xor edx, edx
mov r8d, 0x200
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
test rax, rax
jne 0x140171595
cmp dword [0x1402bff40], 0x3e
jae 0x14017162b
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
test rax, rax
je 0x14017162b
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x14017162b
mov edx, dword [rcx + 0x3c]
lea eax, [rdx - 1]
cmp eax, 0x7ffffffd
ja 0x14017162b
cmp dword [rdx + rcx], 0x4550
jne 0x14017162b
add rdx, 0x88
add rdx, rcx
mov eax, dword [rdx]
test eax, eax
je 0x14017162b
cmp dword [rdx + 4], edi
je 0x14017162b
lea r8, [rcx + rax]
mov word [rsp + 0x20], di
lea r9, str.NtCreateProcessStateChange
call fcn.14017e4c0
mov r9, rax
test rax, rax
je 0x14017162b
mov r8, qword [0x7ffe0320]
mov ecx, dword [0x7ffe0004]
mov eax, r8d
shr r8, 0x20
imul rax, rcx
imul r8, rcx
shr rax, 0x18
shl r8, 8
add rax, r8
mov qword [0x1402ce068], rax
xor rax, r9
mov qword [0x1402cdff8], rax
lea rcx, [0x1402c6180]
call sym.SystemInformer.exe_PhfSetEvent
mov rbx, qword [rsp + 0x50]
mov rax, qword [0x1402cdff8]
test rax, rax
je 0x14017165d
mov rcx, qword [0x1402ce068]
test rcx, rcx
je 0x14017165d
xor rax, rcx
add rsp, 0x40
pop rdi
ret
mov rax, rdi
add rsp, 0x40
pop rdi
ret
Function at 0x140171680
Capabilities:
Parse pe header

Disassembly:
push rdi
sub rsp, 0x40
xor edi, edi
test byte [0x1402c61e0], 1
jne 0x1401717fc
lock bts qword [0x1402c61e0], 0x1f
setb al
test al, al
je 0x1401716ca
test byte [0x1402c61e0], 1
jne 0x1401717fc
xor edx, edx
lea rcx, [0x1402c61e0]
call sym.SystemInformer.exe_PhfWaitForEvent
jmp 0x1401717fc
mov qword [rsp + 0x50], rbx
lea rdx, [rsp + 0x30]
lea rbx, [0x14023ec90]
mov qword [rsp + 0x30], 0x12
mov qword [rsp + 0x38], rbx
call fcn.14017e120
mov rcx, rax
test rax, rax
jne 0x140171755
xor edx, edx
mov r8d, 0x800
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
test rax, rax
jne 0x140171755
xor edx, edx
mov r8d, 0x200
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
test rax, rax
jne 0x140171755
cmp dword [0x1402bff40], 0x3e
jae 0x1401717eb
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
test rax, rax
je 0x1401717eb
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x1401717eb
mov edx, dword [rcx + 0x3c]
lea eax, [rdx - 1]
cmp eax, 0x7ffffffd
ja 0x1401717eb
cmp dword [rdx + rcx], 0x4550
jne 0x1401717eb
add rdx, 0x88
add rdx, rcx
mov eax, dword [rdx]
test eax, eax
je 0x1401717eb
cmp dword [rdx + 4], edi
je 0x1401717eb
lea r8, [rcx + rax]
mov word [rsp + 0x20], di
lea r9, str.NtChangeProcessState
call fcn.14017e4c0
mov r9, rax
test rax, rax
je 0x1401717eb
mov r8, qword [0x7ffe0320]
mov ecx, dword [0x7ffe0004]
mov eax, r8d
shr r8, 0x20
imul rax, rcx
imul r8, rcx
shr rax, 0x18
shl r8, 8
add rax, r8
mov qword [0x1402ce0c0], rax
xor rax, r9
mov qword [0x1402cdfd0], rax
lea rcx, [0x1402c61e0]
call sym.SystemInformer.exe_PhfSetEvent
mov rbx, qword [rsp + 0x50]
mov rax, qword [0x1402cdfd0]
test rax, rax
je 0x14017181d
mov rcx, qword [0x1402ce0c0]
test rcx, rcx
je 0x14017181d
xor rax, rcx
add rsp, 0x40
pop rdi
ret
mov rax, rdi
add rsp, 0x40
pop rdi
ret
Function at 0x140171840
Capabilities:
Parse pe header

Disassembly:
push rdi
sub rsp, 0x40
xor edi, edi
test byte [0x1402c6190], 1
jne 0x1401719bc
lock bts qword [0x1402c6190], 0x1f
setb al
test al, al
je 0x14017188a
test byte [0x1402c6190], 1
jne 0x1401719bc
xor edx, edx
lea rcx, [0x1402c6190]
call sym.SystemInformer.exe_PhfWaitForEvent
jmp 0x1401719bc
mov qword [rsp + 0x50], rbx
lea rdx, [rsp + 0x30]
lea rbx, [0x14023ec90]
mov qword [rsp + 0x30], 0x12
mov qword [rsp + 0x38], rbx
call fcn.14017e120
mov rcx, rax
test rax, rax
jne 0x140171915
xor edx, edx
mov r8d, 0x800
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
test rax, rax
jne 0x140171915
xor edx, edx
mov r8d, 0x200
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
test rax, rax
jne 0x140171915
cmp dword [0x1402bff40], 0x3e
jae 0x1401719ab
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
test rax, rax
je 0x1401719ab
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x1401719ab
mov edx, dword [rcx + 0x3c]
lea eax, [rdx - 1]
cmp eax, 0x7ffffffd
ja 0x1401719ab
cmp dword [rdx + rcx], 0x4550
jne 0x1401719ab
add rdx, 0x88
add rdx, rcx
mov eax, dword [rdx]
test eax, eax
je 0x1401719ab
cmp dword [rdx + 4], edi
je 0x1401719ab
lea r8, [rcx + rax]
mov word [rsp + 0x20], di
lea r9, str.RtlDefaultNpAcl
call fcn.14017e4c0
mov r9, rax
test rax, rax
je 0x1401719ab
mov r8, qword [0x7ffe0320]
mov ecx, dword [0x7ffe0004]
mov eax, r8d
shr r8, 0x20
imul rax, rcx
imul r8, rcx
shr rax, 0x18
shl r8, 8
add rax, r8
mov qword [0x1402ce118], rax
xor rax, r9
mov qword [0x1402ce048], rax
lea rcx, [0x1402c6190]
call sym.SystemInformer.exe_PhfSetEvent
mov rbx, qword [rsp + 0x50]
mov rax, qword [0x1402ce048]
test rax, rax
je 0x1401719dd
mov rcx, qword [0x1402ce118]
test rcx, rcx
je 0x1401719dd
xor rax, rcx
add rsp, 0x40
pop rdi
ret
mov rax, rdi
add rsp, 0x40
pop rdi
ret
Function at 0x140171a00
Capabilities:
Parse pe header

Disassembly:
push rdi
sub rsp, 0x40
xor edi, edi
test byte [0x1402c6110], 1
jne 0x140171b7c
lock bts qword [0x1402c6110], 0x1f
setb al
test al, al
je 0x140171a4a
test byte [0x1402c6110], 1
jne 0x140171b7c
xor edx, edx
lea rcx, [0x1402c6110]
call sym.SystemInformer.exe_PhfWaitForEvent
jmp 0x140171b7c
mov qword [rsp + 0x50], rbx
lea rdx, [rsp + 0x30]
lea rbx, [0x14023ec90]
mov qword [rsp + 0x30], 0x12
mov qword [rsp + 0x38], rbx
call fcn.14017e120
mov rcx, rax
test rax, rax
jne 0x140171ad5
xor edx, edx
mov r8d, 0x800
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
test rax, rax
jne 0x140171ad5
xor edx, edx
mov r8d, 0x200
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
test rax, rax
jne 0x140171ad5
cmp dword [0x1402bff40], 0x3e
jae 0x140171b6b
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
test rax, rax
je 0x140171b6b
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x140171b6b
mov edx, dword [rcx + 0x3c]
lea eax, [rdx - 1]
cmp eax, 0x7ffffffd
ja 0x140171b6b
cmp dword [rdx + rcx], 0x4550
jne 0x140171b6b
add rdx, 0x88
add rdx, rcx
mov eax, dword [rdx]
test eax, eax
je 0x140171b6b
cmp dword [rdx + 4], edi
je 0x140171b6b
lea r8, [rcx + rax]
mov word [rsp + 0x20], di
lea r9, str.RtlGetTokenNamedObjectPath
call fcn.14017e4c0
mov r9, rax
test rax, rax
je 0x140171b6b
mov r8, qword [0x7ffe0320]
mov ecx, dword [0x7ffe0004]
mov eax, r8d
shr r8, 0x20
imul rax, rcx
imul r8, rcx
shr rax, 0x18
shl r8, 8
add rax, r8
mov qword [0x1402ce0e8], rax
xor rax, r9
mov qword [0x1402ce050], rax
lea rcx, [0x1402c6110]
call sym.SystemInformer.exe_PhfSetEvent
mov rbx, qword [rsp + 0x50]
mov rax, qword [0x1402ce050]
test rax, rax
je 0x140171b9d
mov rcx, qword [0x1402ce0e8]
test rcx, rcx
je 0x140171b9d
xor rax, rcx
add rsp, 0x40
pop rdi
ret
mov rax, rdi
add rsp, 0x40
pop rdi
ret
Function at 0x140171bc0
Capabilities:
Parse pe header

Disassembly:
push rdi
sub rsp, 0x40
xor edi, edi
test byte [0x1402c6140], 1
jne 0x140171d3c
lock bts qword [0x1402c6140], 0x1f
setb al
test al, al
je 0x140171c0a
test byte [0x1402c6140], 1
jne 0x140171d3c
xor edx, edx
lea rcx, [0x1402c6140]
call sym.SystemInformer.exe_PhfWaitForEvent
jmp 0x140171d3c
mov qword [rsp + 0x50], rbx
lea rdx, [rsp + 0x30]
lea rbx, [0x14023ec90]
mov qword [rsp + 0x30], 0x12
mov qword [rsp + 0x38], rbx
call fcn.14017e120
mov rcx, rax
test rax, rax
jne 0x140171c95
xor edx, edx
mov r8d, 0x800
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
test rax, rax
jne 0x140171c95
xor edx, edx
mov r8d, 0x200
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
test rax, rax
jne 0x140171c95
cmp dword [0x1402bff40], 0x3e
jae 0x140171d2b
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
test rax, rax
je 0x140171d2b
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x140171d2b
mov edx, dword [rcx + 0x3c]
lea eax, [rdx - 1]
cmp eax, 0x7ffffffd
ja 0x140171d2b
cmp dword [rdx + rcx], 0x4550
jne 0x140171d2b
add rdx, 0x88
add rdx, rcx
mov eax, dword [rdx]
test eax, eax
je 0x140171d2b
cmp dword [rdx + 4], edi
je 0x140171d2b
lea r8, [rcx + rax]
mov word [rsp + 0x20], di
lea r9, str.RtlGetAppContainerNamedObjectPath
call fcn.14017e4c0
mov r9, rax
test rax, rax
je 0x140171d2b
mov r8, qword [0x7ffe0320]
mov ecx, dword [0x7ffe0004]
mov eax, r8d
shr r8, 0x20
imul rax, rcx
imul r8, rcx
shr rax, 0x18
shl r8, 8
add rax, r8
mov qword [0x1402ce080], rax
xor rax, r9
mov qword [0x1402ce038], rax
lea rcx, [0x1402c6140]
call sym.SystemInformer.exe_PhfSetEvent
mov rbx, qword [rsp + 0x50]
mov rax, qword [0x1402ce038]
test rax, rax
je 0x140171d5d
mov rcx, qword [0x1402ce080]
test rcx, rcx
je 0x140171d5d
xor rax, rcx
add rsp, 0x40
pop rdi
ret
mov rax, rdi
add rsp, 0x40
pop rdi
ret
Function at 0x140171d80
Capabilities:
Parse pe header

Disassembly:
push rdi
sub rsp, 0x40
xor edi, edi
test byte [0x1402c6160], 1
jne 0x140171efc
lock bts qword [0x1402c6160], 0x1f
setb al
test al, al
je 0x140171dca
test byte [0x1402c6160], 1
jne 0x140171efc
xor edx, edx
lea rcx, [0x1402c6160]
call sym.SystemInformer.exe_PhfWaitForEvent
jmp 0x140171efc
mov qword [rsp + 0x50], rbx
lea rdx, [rsp + 0x30]
lea rbx, [0x14023ec90]
mov qword [rsp + 0x30], 0x12
mov qword [rsp + 0x38], rbx
call fcn.14017e120
mov rcx, rax
test rax, rax
jne 0x140171e55
xor edx, edx
mov r8d, 0x800
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
test rax, rax
jne 0x140171e55
xor edx, edx
mov r8d, 0x200
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
test rax, rax
jne 0x140171e55
cmp dword [0x1402bff40], 0x3e
jae 0x140171eeb
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
test rax, rax
je 0x140171eeb
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x140171eeb
mov edx, dword [rcx + 0x3c]
lea eax, [rdx - 1]
cmp eax, 0x7ffffffd
ja 0x140171eeb
cmp dword [rdx + rcx], 0x4550
jne 0x140171eeb
add rdx, 0x88
add rdx, rcx
mov eax, dword [rdx]
test eax, eax
je 0x140171eeb
cmp dword [rdx + 4], edi
je 0x140171eeb
lea r8, [rcx + rax]
mov word [rsp + 0x20], di
lea r9, str.RtlGetAppContainerSidType
call fcn.14017e4c0
mov r9, rax
test rax, rax
je 0x140171eeb
mov r8, qword [0x7ffe0320]
mov ecx, dword [0x7ffe0004]
mov eax, r8d
shr r8, 0x20
imul rax, rcx
imul r8, rcx
shr rax, 0x18
shl r8, 8
add rax, r8
mov qword [0x1402ce010], rax
xor rax, r9
mov qword [0x1402ce120], rax
lea rcx, [0x1402c6160]
call sym.SystemInformer.exe_PhfSetEvent
mov rbx, qword [rsp + 0x50]
mov rax, qword [0x1402ce120]
test rax, rax
je 0x140171f1d
mov rcx, qword [0x1402ce010]
test rcx, rcx
je 0x140171f1d
xor rax, rcx
add rsp, 0x40
pop rdi
ret
mov rax, rdi
add rsp, 0x40
pop rdi
ret
Function at 0x140171f40
Capabilities:
Parse pe header

Disassembly:
push rdi
sub rsp, 0x40
xor edi, edi
test byte [0x1402c6170], 1
jne 0x1401720bc
lock bts qword [0x1402c6170], 0x1f
setb al
test al, al
je 0x140171f8a
test byte [0x1402c6170], 1
jne 0x1401720bc
xor edx, edx
lea rcx, [0x1402c6170]
call sym.SystemInformer.exe_PhfWaitForEvent
jmp 0x1401720bc
mov qword [rsp + 0x50], rbx
lea rdx, [rsp + 0x30]
lea rbx, [0x14023ec90]
mov qword [rsp + 0x30], 0x12
mov qword [rsp + 0x38], rbx
call fcn.14017e120
mov rcx, rax
test rax, rax
jne 0x140172015
xor edx, edx
mov r8d, 0x800
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
test rax, rax
jne 0x140172015
xor edx, edx
mov r8d, 0x200
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
test rax, rax
jne 0x140172015
cmp dword [0x1402bff40], 0x3e
jae 0x1401720ab
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
test rax, rax
je 0x1401720ab
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x1401720ab
mov edx, dword [rcx + 0x3c]
lea eax, [rdx - 1]
cmp eax, 0x7ffffffd
ja 0x1401720ab
cmp dword [rdx + rcx], 0x4550
jne 0x1401720ab
add rdx, 0x88
add rdx, rcx
mov eax, dword [rdx]
test eax, eax
je 0x1401720ab
cmp dword [rdx + 4], edi
je 0x1401720ab
lea r8, [rcx + rax]
mov word [rsp + 0x20], di
lea r9, str.RtlGetAppContainerParent
call fcn.14017e4c0
mov r9, rax
test rax, rax
je 0x1401720ab
mov r8, qword [0x7ffe0320]
mov ecx, dword [0x7ffe0004]
mov eax, r8d
shr r8, 0x20
imul rax, rcx
imul r8, rcx
shr rax, 0x18
shl r8, 8
add rax, r8
mov qword [0x1402ce0b8], rax
xor rax, r9
mov qword [0x1402ce100], rax
lea rcx, [0x1402c6170]
call sym.SystemInformer.exe_PhfSetEvent
mov rbx, qword [rsp + 0x50]
mov rax, qword [0x1402ce100]
test rax, rax
je 0x1401720dd
mov rcx, qword [0x1402ce0b8]
test rcx, rcx
je 0x1401720dd
xor rax, rcx
add rsp, 0x40
pop rdi
ret
mov rax, rdi
add rsp, 0x40
pop rdi
ret
Function at 0x140172100
Capabilities:
Parse pe header

Disassembly:
push rdi
sub rsp, 0x40
xor edi, edi
test byte [0x1402c61a0], 1
jne 0x14017227c
lock bts qword [0x1402c61a0], 0x1f
setb al
test al, al
je 0x14017214a
test byte [0x1402c61a0], 1
jne 0x14017227c
xor edx, edx
lea rcx, [0x1402c61a0]
call sym.SystemInformer.exe_PhfWaitForEvent
jmp 0x14017227c
mov qword [rsp + 0x50], rbx
lea rdx, [rsp + 0x30]
lea rbx, [0x14023ec90]
mov qword [rsp + 0x30], 0x12
mov qword [rsp + 0x38], rbx
call fcn.14017e120
mov rcx, rax
test rax, rax
jne 0x1401721d5
xor edx, edx
mov r8d, 0x800
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
test rax, rax
jne 0x1401721d5
xor edx, edx
mov r8d, 0x200
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
test rax, rax
jne 0x1401721d5
cmp dword [0x1402bff40], 0x3e
jae 0x14017226b
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
test rax, rax
je 0x14017226b
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x14017226b
mov edx, dword [rcx + 0x3c]
lea eax, [rdx - 1]
cmp eax, 0x7ffffffd
ja 0x14017226b
cmp dword [rdx + rcx], 0x4550
jne 0x14017226b
add rdx, 0x88
add rdx, rcx
mov eax, dword [rdx]
test eax, eax
je 0x14017226b
cmp dword [rdx + 4], edi
je 0x14017226b
lea r8, [rcx + rax]
mov word [rsp + 0x20], di
lea r9, str.RtlDeriveCapabilitySidsFromName
call fcn.14017e4c0
mov r9, rax
test rax, rax
je 0x14017226b
mov r8, qword [0x7ffe0320]
mov ecx, dword [0x7ffe0004]
mov eax, r8d
shr r8, 0x20
imul rax, rcx
imul r8, rcx
shr rax, 0x18
shl r8, 8
add rax, r8
mov qword [0x1402ce110], rax
xor rax, r9
mov qword [0x1402ce0e0], rax
lea rcx, [0x1402c61a0]
call sym.SystemInformer.exe_PhfSetEvent
mov rbx, qword [rsp + 0x50]
mov rax, qword [0x1402ce0e0]
test rax, rax
je 0x14017229d
mov rcx, qword [0x1402ce110]
test rcx, rcx
je 0x14017229d
xor rax, rcx
add rsp, 0x40
pop rdi
ret
mov rax, rdi
add rsp, 0x40
pop rdi
ret
Function at 0x1401722c0
Capabilities:
Parse pe header

Disassembly:
push rdi
sub rsp, 0x40
xor edi, edi
test byte [0x1402c6120], 1
jne 0x14017243c
lock bts qword [0x1402c6120], 0x1f
setb al
test al, al
je 0x14017230a
test byte [0x1402c6120], 1
jne 0x14017243c
xor edx, edx
lea rcx, [0x1402c6120]
call sym.SystemInformer.exe_PhfWaitForEvent
jmp 0x14017243c
mov qword [rsp + 0x50], rbx
lea rdx, [rsp + 0x30]
lea rbx, str.advapi32.dll
mov qword [rsp + 0x30], 0x18
mov qword [rsp + 0x38], rbx
call fcn.14017e120
mov rcx, rax
test rax, rax
jne 0x140172395
xor edx, edx
mov r8d, 0x800
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
test rax, rax
jne 0x140172395
xor edx, edx
mov r8d, 0x200
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
test rax, rax
jne 0x140172395
cmp dword [0x1402bff40], 0x3e
jae 0x14017242b
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
test rax, rax
je 0x14017242b
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x14017242b
mov edx, dword [rcx + 0x3c]
lea eax, [rdx - 1]
cmp eax, 0x7ffffffd
ja 0x14017242b
cmp dword [rdx + rcx], 0x4550
jne 0x14017242b
add rdx, 0x88
add rdx, rcx
mov eax, dword [rdx]
test eax, eax
je 0x14017242b
cmp dword [rdx + 4], edi
je 0x14017242b
lea r8, [rcx + rax]
mov word [rsp + 0x20], di
lea r9, str.ConvertSecurityDescriptorToStringSecurityDescriptorW
call fcn.14017e4c0
mov r9, rax
test rax, rax
je 0x14017242b
mov r8, qword [0x7ffe0320]
mov ecx, dword [0x7ffe0004]
mov eax, r8d
shr r8, 0x20
imul rax, rcx
imul r8, rcx
shr rax, 0x18
shl r8, 8
add rax, r8
mov qword [0x1402ce060], rax
xor rax, r9
mov qword [0x1402cdff0], rax
lea rcx, [0x1402c6120]
call sym.SystemInformer.exe_PhfSetEvent
mov rbx, qword [rsp + 0x50]
mov rax, qword [0x1402cdff0]
test rax, rax
je 0x14017245d
mov rcx, qword [0x1402ce060]
test rcx, rcx
je 0x14017245d
xor rax, rcx
add rsp, 0x40
pop rdi
ret
mov rax, rdi
add rsp, 0x40
pop rdi
ret