joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400c9300
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x50
mov rbp, rcx
mov rdi, r8
lea rcx, [0x140196250]
mov rsi, rdx
call qword [sym.imp.ntdll.dll_RtlInterlockedPopEntrySList]
mov rbx, rax
test rax, rax
je 0x1400c933b
lock dec dword [0x140196260]
jmp 0x1400c935b
mov r8, qword [0x140196268]
mov edx, 4
mov rcx, qword [0x140196670]
add r8, 0x10
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov rbx, rax
lea rcx, [rbx + 0x10]
xor edx, edx
lea rax, [rsp + 0x68]
mov qword [rcx], rsi
mov qword [rsp + 0x48], rdx
xor r9d, r9d
mov qword [rsp + 0x40], rax
xor r8d, r8d
mov qword [rsp + 0x38], rcx
lea rax, [0x1400c9280]
mov qword [rsp + 0x30], rax
mov qword [rcx + 8], rdi
or rcx, 0xffffffffffffffff
mov qword [rsp + 0x28], rbp
mov qword [rsp + 0x20], rdx
call qword [sym.imp.ntdll.dll_RtlCreateUserThread]
test eax, eax
js 0x1400c93ad
mov rax, qword [rsp + 0x68]
jmp 0x1400c93e8
mov eax, dword [0x140196264]
cmp dword [0x140196260], eax
jae 0x1400c93d4
mov rdx, rbx
lea rcx, [0x140196250]
call qword [sym.imp.ntdll.dll_RtlInterlockedPushEntrySList]
lock inc dword [0x140196260]
jmp 0x1400c93e6
mov rcx, qword [0x140196670]
mov r8, rbx
xor edx, edx
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
xor eax, eax
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x50
pop rdi
ret

Function at 0x1400c9400
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x50
mov rsi, rcx
mov rdi, rdx
lea rcx, [0x140196250]
call qword [sym.imp.ntdll.dll_RtlInterlockedPopEntrySList]
mov rbx, rax
test rax, rax
je 0x1400c9433
lock dec dword [0x140196260]
jmp 0x1400c9453
mov r8, qword [0x140196268]
mov edx, 4
mov rcx, qword [0x140196670]
add r8, 0x10
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov rbx, rax
xor edx, edx
mov qword [rbx + 0x10], rsi
mov qword [rsp + 0x48], rdx
lea rcx, [rbx + 0x10]
lea rax, [rsp + 0x60]
mov qword [rcx + 8], rdi
mov qword [rsp + 0x40], rax
xor r9d, r9d
mov qword [rsp + 0x38], rcx
lea rax, [0x1400c9280]
mov qword [rsp + 0x30], rax
xor r8d, r8d
mov qword [rsp + 0x28], rdx
or rcx, 0xffffffffffffffff
mov qword [rsp + 0x20], rdx
call qword [sym.imp.ntdll.dll_RtlCreateUserThread]
mov edi, eax
test eax, eax
js 0x1400c94be
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ntdll.dll_NtClose]
mov eax, edi
mov rbx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
ret
mov eax, dword [0x140196264]
cmp dword [0x140196260], eax
jae 0x1400c94f5
mov rdx, rbx
lea rcx, [0x140196250]
call qword [sym.imp.ntdll.dll_RtlInterlockedPushEntrySList]
lock inc dword [0x140196260]
mov eax, edi
mov rbx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
ret
mov rcx, qword [0x140196670]
mov r8, rbx
xor edx, edx
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
mov rbx, qword [rsp + 0x68]
mov eax, edi
mov rsi, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
ret
Function at 0x1400c96c0
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 8], rcx
push rbx
sub rsp, 0x30
mov rbx, rdx
mov dword [rsp + 0x28], 4
lea rdx, [rsp + 0x50]
mov qword [rsp + 0x50], 0
lea r9, [rsp + 0x40]
mov dword [rsp + 0x20], 0x1000
xor r8d, r8d
or rcx, 0xffffffffffffffff
call qword [sym.imp.ntdll.dll_NtAllocateVirtualMemory]
test eax, eax
js 0x1400c9719
test rbx, rbx
je 0x1400c970e
mov rax, qword [rsp + 0x40]
mov qword [rbx], rax
mov rax, qword [rsp + 0x50]
add rsp, 0x30
pop rbx
ret
xor eax, eax
add rsp, 0x30
pop rbx
ret

Function at 0x1400ce200
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
xor eax, eax
mov r8, rcx
test rdx, rdx
je 0x1400ce226
nop word [rax + rax]
movzx ecx, byte [r8]
lea r8, [r8 + 1]
xor eax, ecx
imul eax, eax, 0x1000193
sub rdx, 1
jne 0x1400ce210
ret

Function at 0x1400ce230
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push rbx
sub rsp, 0x20
mov r8, qword [rcx]
xor ebx, ebx
test r8, r8
jne 0x1400ce248
xor eax, eax
add rsp, 0x20
pop rbx
ret
mov qword [rsp + 0x30], rsi
mov rsi, r8
shr rsi, 1
mov qword [rsp + 0x38], rdi
mov rdi, qword [rcx + 8]
test dl, dl
jne 0x1400ce290
movzx eax, byte [rdi]
lea rdi, [rdi + 1]
xor ebx, eax
imul ebx, ebx, 0x1000193
sub r8, 1
jne 0x1400ce260
mov rsi, qword [rsp + 0x30]
mov eax, ebx
mov rdi, qword [rsp + 0x38]
add rsp, 0x20
pop rbx
ret
movzx ecx, word [rdi]
lea rdi, [rdi + 2]
call qword [sym.imp.ntdll.dll_RtlUpcaseUnicodeChar]
movzx eax, ax
xor eax, ebx
imul ebx, eax, 0x1000193
sub rsi, 1
jne 0x1400ce290
mov rsi, qword [rsp + 0x30]
mov eax, ebx
mov rdi, qword [rsp + 0x38]
add rsp, 0x20
pop rbx
ret
Function at 0x1400cfc00
Capabilities:
Get file attributes

Disassembly:
push rbx
sub rsp, 0x40
test byte [rcx + 8], 0xc
mov rbx, rcx
jne 0x1400cfc54
mov rcx, qword [rcx]
lea r8, [rsp + 0x50]
mov r9d, 8
mov dword [rsp + 0x20], 0xe
lea rdx, [rsp + 0x30]
call qword [sym.imp.ntdll.dll_NtQueryInformationFile]
test eax, eax
jns 0x1400cfc3d
mov ecx, eax
call qword [sym.imp.ntdll.dll_RtlRaiseStatus]
int3
mov rax, qword [rsp + 0x50]
cmp qword [rbx + 0x10], rax
je 0x1400cfc54
mov ecx, 0xc00000e5
call qword [sym.imp.ntdll.dll_RtlRaiseStatus]
int3
add rsp, 0x40
pop rbx
ret

Function at 0x1400cfc60
Capabilities:
Read file on windows

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rsi
push rdi
sub rsp, 0x60
test byte [rcx + 8], 8
lea rax, [rcx + 0x10]
mov rsi, rcx
mov rdi, r9
mov ecx, 0
cmove rax, rcx
mov qword [r11 - 0x28], rcx
mov qword [r11 - 0x30], rax
xor r9d, r9d
mov rcx, qword [rsi]
lea rax, [r11 - 0x18]
mov dword [r11 - 0x38], r8d
xor r8d, r8d
mov qword [r11 - 0x40], rdx
xor edx, edx
mov qword [r11 - 0x48], rax
call qword [sym.imp.ntdll.dll_NtReadFile]
cmp eax, 0x103
jne 0x1400cfccd
mov rcx, qword [rsi]
xor r8d, r8d
xor edx, edx
call qword [sym.imp.ntdll.dll_NtWaitForSingleObject]
test eax, eax
js 0x1400cfce1
mov eax, dword [rsp + 0x50]
test eax, eax
js 0x1400cfce1
mov rcx, qword [rsp + 0x58]
add qword [rsi + 0x10], rcx
test rdi, rdi
je 0x1400cfce1
mov dword [rdi], ecx
mov rbx, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x60
pop rdi
ret
Function at 0x1400cff80
Capabilities:
Write file on windows

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
push rdi
sub rsp, 0x60
test byte [rcx + 8], 8
lea rax, [rcx + 0x10]
mov rbx, rcx
mov ecx, 0
cmove rax, rcx
mov qword [r11 - 0x28], rcx
mov qword [r11 - 0x30], rax
xor r9d, r9d
mov dword [r11 - 0x38], r8d
lea rax, [r11 - 0x18]
mov rcx, qword [rbx]
xor r8d, r8d
mov qword [r11 - 0x40], rdx
xor edx, edx
mov qword [r11 - 0x48], rax
call qword [sym.imp.ntdll.dll_NtWriteFile]
mov ecx, eax
cmp eax, 0x103
jne 0x1400cffe8
mov rcx, qword [rbx]
xor r8d, r8d
xor edx, edx
call qword [sym.imp.ntdll.dll_NtWaitForSingleObject]
test eax, eax
js 0x1400cfffe
mov ecx, dword [rsp + 0x50]
test ecx, ecx
js 0x1400cfffc
mov rax, qword [rsp + 0x58]
add qword [rbx + 0x10], rax
or dword [rbx + 8], 0x80000000
mov eax, ecx
mov rbx, qword [rsp + 0x70]
add rsp, 0x60
pop rdi
ret

Function at 0x1400d0010
Capabilities:
Write file on windows

Disassembly:
push rbx
push rbp
push rsi
push rdi
sub rsp, 0x38
xor ebx, ebx
mov esi, r8d
test byte [rcx + 8], 2
mov rbp, rdx
mov rdi, rcx
je 0x1400d0037
add rsp, 0x38
pop rdi
pop rsi
pop rbp
pop rbx
jmp fcn.1400cff80
cmp dword [rcx + 0x2c], ebx
jne 0x1400d004b
call fcn.1400d0160
mov ebx, eax
test eax, eax
js 0x1400d014c
mov r8d, dword [rdi + 0x2c]
mov qword [rsp + 0x68], r14
mov qword [rsp + 0x30], r15
test r8d, r8d
je 0x1400d00ba
mov r14d, dword [rdi + 0x20]
sub r14d, r8d
je 0x1400d009d
mov ecx, r8d
cmp r14d, esi
mov rdx, rbp
cmova r14d, esi
add rcx, qword [rdi + 0x18]
mov r8d, r14d
mov r15d, r14d
call fcn.14010e700
mov r8d, dword [rdi + 0x2c]
add r8d, r14d
mov dword [rdi + 0x2c], r8d
cmp r14d, esi
je 0x1400d0140
add rbp, r15
sub esi, r14d
mov rdx, qword [rdi + 0x18]
mov rcx, rdi
call fcn.1400cff80
mov ebx, eax
test eax, eax
js 0x1400d0142
mov dword [rdi + 0x2c], 0
mov eax, dword [rdi + 0x20]
cmp esi, eax
jb 0x1400d00d7
mov r8d, esi
mov rdx, rbp
mov rcx, rdi
call fcn.1400cff80
mov ebx, eax
test eax, eax
jns 0x1400d0140
jmp 0x1400d0142
test esi, esi
je 0x1400d0140
mov rcx, qword [rdi + 0x18]
test rcx, rcx
jne 0x1400d0132
mov qword [rsp + 0x60], rcx
lea r9, [rsp + 0x78]
or rcx, 0xffffffffffffffff
mov dword [rsp + 0x28], 4
xor r8d, r8d
mov qword [rsp + 0x78], rax
lea rdx, [rsp + 0x60]
mov dword [rsp + 0x20], 0x1000
call qword [sym.imp.ntdll.dll_NtAllocateVirtualMemory]
xor ecx, ecx
test eax, eax
mov eax, 0xc0000017
cmovns rcx, qword [rsp + 0x60]
xor ebx, ebx
test rcx, rcx
mov qword [rdi + 0x18], rcx
cmove ebx, eax
je 0x1400d0140
mov r8d, esi
mov rdx, rbp
call fcn.14010e700
mov dword [rdi + 0x2c], esi
mov eax, ebx
mov r14, qword [rsp + 0x68]
mov r15, qword [rsp + 0x30]
add rsp, 0x38
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x1400d0160
Capabilities:
Set file attributes

Disassembly:
push rbx
sub rsp, 0x40
mov rbx, rcx
xor ecx, ecx
mov r9d, dword [rbx + 0x28]
mov r8d, dword [rbx + 0x24]
cmp r9d, r8d
je 0x1400d01c2
sub r8d, r9d
xor edx, edx
movsxd r8, r8d
add r8, qword [rbx + 0x10]
test byte [rbx + 8], 8
mov qword [rbx + 0x10], r8
jne 0x1400d01b4
mov qword [rsp + 0x50], r8
lea r9d, [rcx + 8]
mov rcx, qword [rbx]
lea r8, [rsp + 0x50]
lea rdx, [rsp + 0x30]
mov dword [rsp + 0x20], 0xe
call qword [sym.imp.ntdll.dll_NtSetInformationFile]
mov edx, eax
mov ecx, edx
test edx, edx
jns 0x1400d01c2
mov eax, edx
add rsp, 0x40
pop rbx
ret
mov qword [rbx + 0x24], 0
mov eax, ecx
add rsp, 0x40
pop rbx
ret

Function at 0x1400d0280
Capabilities:
Get file attributes
Set file attributes

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x60
mov rbx, rcx
mov rdi, rdx
xor ecx, ecx
test r8d, r8d
je 0x1400d02f6
sub r8d, 1
je 0x1400d02ed
cmp r8d, 1
jne 0x1400d02fd
lea r9d, [rcx + 0x18]
mov dword [rsp + 0x20], 5
mov rcx, qword [rbx]
lea r8, [rsp + 0x40]
lea rdx, [rsp + 0x30]
call qword [sym.imp.ntdll.dll_NtQueryInformationFile]
mov edx, eax
mov ecx, eax
test eax, eax
js 0x1400d02d3
mov rax, qword [rsp + 0x48]
mov qword [rbx + 0x10], rax
test edx, edx
jns 0x1400d02e4
mov eax, edx
mov rbx, qword [rsp + 0x70]
add rsp, 0x60
pop rdi
ret
mov rax, qword [rdi]
add qword [rbx + 0x10], rax
jmp 0x1400d02fd
mov rax, qword [rdx]
add qword [rbx + 0x10], rax
jmp 0x1400d02fd
mov rax, qword [rdx]
mov qword [rbx + 0x10], rax
test byte [rbx + 8], 8
jne 0x1400d0339
mov rax, qword [rbx + 0x10]
lea r8, [rsp + 0x88]
mov rcx, qword [rbx]
lea rdx, [rsp + 0x30]
mov r9d, 8
mov qword [rsp + 0x88], rax
mov dword [rsp + 0x20], 0xe
call qword [sym.imp.ntdll.dll_NtSetInformationFile]
mov ecx, eax
test eax, eax
js 0x1400d033b
mov eax, ecx
mov rbx, qword [rsp + 0x70]
add rsp, 0x60
pop rdi
ret
Function at 0x1400d3ee0
Capabilities:
Terminate process

Disassembly:
mov r11, rsp
mov qword [r11 + 0x10], rsi
push rdi
sub rsp, 0x90
cmp byte [0x1401937ba], 0
mov edi, edx
mov rsi, rcx
je 0x1400d3faa
mov qword [r11 - 0x48], rcx
lea rax, [0x1400dd110]
xor ecx, ecx
mov qword [r11 - 0x28], rax
mov dword [rsp + 0x48], ecx
lea rax, [r11 - 0x48]
mov qword [r11 - 0x58], rcx
lea r8, [0x1400dcf20]
mov qword [r11 - 0x20], rax
xor r9d, r9d
lea rax, [r11 + 0x18]
mov dword [rsp + 0x38], 4
mov qword [r11 - 0x68], rax
lea rax, [r11 - 0x38]
mov dword [rsp + 0x58], edx
xor edx, edx
mov dword [rsp + 0x5c], ecx
mov rcx, qword [0x140193948]
mov dword [rsp + 0x28], 0x9999200b
mov qword [r11 - 0x78], rax
mov qword [r11 + 8], rbx
mov dword [r11 + 0x18], 2
mov dword [r11 - 0x18], 0xc0000001
call qword [sym.imp.ntdll.dll_NtDeviceIoControlFile]
mov ebx, eax
call qword [sym.imp.ntdll.dll_NtTestAlert]
mov eax, dword [rsp + 0x80]
test ebx, ebx
cmovs eax, ebx
mov rbx, qword [rsp + 0xa0]
cmp eax, 0xc00000db
jne 0x1400d3fa3
mov ecx, edi
call qword [sym.imp.ntdll.dll_RtlExitUserProcess]
int3
cmp eax, 0xc00000bb
jne 0x1400d3fb5
mov edx, edi
mov rcx, rsi
call qword [sym.imp.ntdll.dll_NtTerminateProcess]
mov rsi, qword [rsp + 0xa8]
add rsp, 0x90
pop rdi
ret
Function at 0x1400d59d0
Capabilities:
Get file attributes

Disassembly:
push rbx
sub rsp, 0x60
mov rbx, rdx
mov dword [rsp + 0x20], 5
lea rdx, [rsp + 0x30]
mov r9d, 0x18
lea r8, [rsp + 0x40]
call qword [sym.imp.ntdll.dll_NtQueryInformationFile]
mov ecx, eax
test eax, eax
js 0x1400d5a07
mov rax, qword [rsp + 0x48]
mov qword [rbx], rax
mov eax, ecx
add rsp, 0x60
pop rbx
ret

Function at 0x1400d5a10
Capabilities:
Set file attributes

Disassembly:
sub rsp, 0x48
mov rax, qword [rdx]
lea r8, [rsp + 0x58]
lea rdx, [rsp + 0x30]
mov qword [rsp + 0x58], rax
mov r9d, 8
mov dword [rsp + 0x20], 0x14
call qword [sym.imp.ntdll.dll_NtSetInformationFile]
add rsp, 0x48
ret
Function at 0x1400d75c0
Capabilities:
Get system information on windows
Make suspicious ntquerysysteminformation call

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
mov dword [rsp + 0x38], 0x800
mov rcx, qword [0x140196670]
mov edx, 4
mov r8d, 0x800
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov r8d, dword [rsp + 0x38]
lea r9, [rsp + 0x38]
mov rdx, rax
mov ecx, 0xb
mov rbx, rax
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
cmp eax, 0xc0000004
jne 0x1400d7653
mov rcx, qword [0x140196670]
mov r8, rbx
xor edx, edx
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
mov r8d, dword [rsp + 0x38]
mov edx, 4
mov rcx, qword [0x140196670]
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov r8d, dword [rsp + 0x38]
lea r9, [rsp + 0x38]
mov rdx, rax
mov ecx, 0xb
mov rbx, rax
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
test eax, eax
js 0x1400d765a
mov qword [rdi], rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x1400d76e0
Capabilities:
Get system information on windows

Disassembly:
mov edx, 5
jmp sym.ProcessHacker.exe_PhEnumProcessesEx

Function at 0x1400d76f0
Capabilities:
Get system information on windows

Disassembly:
push rsi
push r14
push r15
sub rsp, 0x20
mov r8d, edx
mov esi, edx
mov r15, rcx
sub r8d, 5
je 0x1400d7741
sub r8d, 0x34
je 0x1400d7732
cmp r8d, 0x5b
je 0x1400d7723
mov eax, 0xc0000003
add rsp, 0x20
pop r15
pop r14
pop rsi
ret
mov eax, dword [0x14018de58]
lea r14, [0x14018de58]
jmp 0x1400d774e
mov eax, dword [0x14018de54]
lea r14, [0x14018de54]
jmp 0x1400d774e
mov eax, dword [0x14018de50]
lea r14, [0x14018de50]
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x50], rdi
mov dword [rsp + 0x48], eax
mov r8d, eax
mov rcx, qword [0x140196670]
mov edx, 4
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov r8d, dword [rsp + 0x48]
lea r9, [rsp + 0x48]
mov rdx, rax
mov ecx, esi
mov rdi, rax
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
mov ebx, eax
cmp eax, 0xc0000023
je 0x1400d7799
cmp eax, 0xc0000004
jne 0x1400d77b2
mov rcx, qword [0x140196670]
mov r8, rdi
xor edx, edx
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
mov r8d, dword [rsp + 0x48]
jmp 0x1400d775f
test ebx, ebx
jns 0x1400d77ca
mov rcx, qword [0x140196670]
mov r8, rdi
xor edx, edx
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
jmp 0x1400d77db
mov eax, dword [rsp + 0x48]
cmp eax, 0x100000
ja 0x1400d77d8
mov dword [r14], eax
mov qword [r15], rdi
mov rdi, qword [rsp + 0x50]
mov eax, ebx
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop r15
pop r14
pop rsi
ret
Function at 0x1400d7800
Capabilities:
Get system information on windows
Make suspicious ntquerysysteminformation call

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
mov eax, dword [0x14018dce8]
mov ebx, edx
mov rsi, rcx
mov dword [rsp + 0x48], eax
mov rcx, qword [0x140196670]
mov r8d, eax
mov edx, 4
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov dword [rsp + 0x20], ebx
mov ecx, dword [rsp + 0x48]
lea r9, [rsp + 0x48]
mov r8d, 0x10
mov dword [rsp + 0x24], ecx
lea rdx, [rsp + 0x20]
mov qword [rsp + 0x28], rax
mov rdi, rax
lea ecx, [r8 + 0x25]
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
mov ebx, eax
cmp eax, 0xc0000023
je 0x1400d7871
cmp eax, 0xc0000004
jne 0x1400d789c
mov rcx, qword [0x140196670]
mov r8, rdi
xor edx, edx
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
mov r8d, dword [rsp + 0x48]
mov edx, 4
mov rcx, qword [0x140196670]
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
jmp 0x1400d7837
test ebx, ebx
jns 0x1400d78c4
mov rcx, qword [0x140196670]
mov r8, rdi
xor edx, edx
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
mov eax, ebx
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
mov ecx, dword [0x14018dce8]
cmp dword [rsp + 0x48], 0x100000
mov rbx, qword [rsp + 0x40]
cmovbe ecx, dword [rsp + 0x48]
mov qword [rsi], rdi
mov rsi, qword [rsp + 0x50]
mov dword [0x14018dce8], ecx
add rsp, 0x30
pop rdi
ret

Function at 0x1400d7a50
Capabilities:
Get system information on windows
Make suspicious ntquerysysteminformation call

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push r14
sub rsp, 0x20
mov ebx, dword [0x14018dcbc]
mov r14, rcx
mov rcx, qword [0x140196670]
mov r8d, ebx
mov edx, 4
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
xor r9d, r9d
mov r8d, ebx
mov rdx, rax
mov rdi, rax
lea ecx, [r9 + 0x10]
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
mov esi, eax
cmp eax, 0xc0000004
jne 0x1400d7af2
mov rcx, qword [0x140196670]
mov r8, rdi
xor edx, edx
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
add ebx, ebx
cmp ebx, 0x10000000
ja 0x1400d7b0a
mov rcx, qword [0x140196670]
mov edx, 4
mov r8d, ebx
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
xor r9d, r9d
mov r8d, ebx
mov rdx, rax
mov rdi, rax
lea ecx, [r9 + 0x10]
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
mov esi, eax
cmp eax, 0xc0000004
je 0x1400d7aa2
test esi, esi
jns 0x1400d7b11
mov rcx, qword [0x140196670]
mov r8, rdi
xor edx, edx
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
jmp 0x1400d7b29
mov eax, 0xc000009a
jmp 0x1400d7b2b
mov eax, dword [0x14018dcbc]
cmp ebx, 0x100000
mov qword [r14], rdi
cmovbe eax, ebx
mov dword [0x14018dcbc], eax
mov eax, esi
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x40]
add rsp, 0x20
pop r14
ret
Function at 0x1400d7b50
Capabilities:
Get system information on windows
Make suspicious ntquerysysteminformation call

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push r14
sub rsp, 0x20
mov ebx, dword [0x14018de5c]
mov r14, rcx
mov rcx, qword [0x140196670]
mov r8d, ebx
mov edx, 4
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
xor r9d, r9d
mov r8d, ebx
mov rdx, rax
mov rdi, rax
lea ecx, [r9 + 0x40]
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
mov esi, eax
cmp eax, 0xc0000004
jne 0x1400d7bf2
mov rcx, qword [0x140196670]
mov r8, rdi
xor edx, edx
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
add ebx, ebx
cmp ebx, 0x10000000
ja 0x1400d7c0a
mov rcx, qword [0x140196670]
mov edx, 4
mov r8d, ebx
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
xor r9d, r9d
mov r8d, ebx
mov rdx, rax
mov rdi, rax
lea ecx, [r9 + 0x40]
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
mov esi, eax
cmp eax, 0xc0000004
je 0x1400d7ba2
test esi, esi
jns 0x1400d7c11
mov rcx, qword [0x140196670]
mov r8, rdi
xor edx, edx
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
jmp 0x1400d7c29
mov eax, 0xc000009a
jmp 0x1400d7c2b
mov eax, dword [0x14018de5c]
cmp ebx, 0x200000
mov qword [r14], rdi
cmovbe eax, ebx
mov dword [0x14018de5c], eax
mov eax, esi
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x40]
add rsp, 0x20
pop r14
ret

Function at 0x1400d7c50
Capabilities:
Get system information on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push r14
sub rsp, 0x20
mov r14, rcx
mov ebx, 0x200
mov rcx, qword [0x140196670]
mov r8d, ebx
mov edx, 4
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
xor r9d, r9d
mov r8d, ebx
mov rdx, rax
mov rdi, rax
lea ecx, [r9 + 0x12]
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
mov esi, eax
cmp eax, 0xc0000004
jne 0x1400d7cf3
mov rcx, qword [0x140196670]
mov r8, rdi
xor edx, edx
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
lea eax, [rbx + rbx]
mov ebx, eax
cmp eax, 0x10000000
ja 0x1400d7d0b
mov rcx, qword [0x140196670]
mov r8d, ebx
mov edx, 4
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
xor r9d, r9d
mov r8d, ebx
mov rdx, rax
mov rdi, rax
lea ecx, [r9 + 0x12]
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
mov esi, eax
cmp eax, 0xc0000004
je 0x1400d7ca1
test esi, esi
jns 0x1400d7d12
mov rcx, qword [0x140196670]
mov r8, rdi
xor edx, edx
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
jmp 0x1400d7d15
mov eax, 0xc000009a
jmp 0x1400d7d17
mov qword [r14], rdi
mov eax, esi
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x40]
add rsp, 0x20
pop r14
ret
Function at 0x1400d7d30
Capabilities:
Get system information on windows
Make suspicious ntquerysysteminformation call

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rdi
push r12
push r15
sub rsp, 0x40
mov r15, rdx
mov rbx, rcx
mov rcx, qword [0x140196670]
mov edx, 4
mov r8d, 0x100
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
xor r12d, r12d
mov qword [rsp + 0x20], rbx
xor r9d, r9d
mov dword [rsp + 0x28], 0x1000000
lea rdx, [rsp + 0x20]
mov qword [rsp + 0x30], rax
mov rbp, rax
lea r8d, [r12 + 0x18]
lea ecx, [r12 + 0x58]
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
mov edi, eax
cmp eax, 0xc0000004
jne 0x1400d7de6
mov rcx, qword [0x140196670]
mov r8, rbp
xor edx, edx
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
movzx r8d, word [rsp + 0x2a]
lea edx, [r12 + 4]
mov rcx, qword [0x140196670]
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
xor r9d, r9d
lea r8d, [r12 + 0x18]
lea rdx, [rsp + 0x20]
mov qword [rsp + 0x30], rax
lea ecx, [r12 + 0x58]
mov rbp, rax
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
mov edi, eax
test edi, edi
js 0x1400d7e54
movzx eax, word [rsp + 0x28]
test ax, ax
jne 0x1400d7dfe
call sym.ProcessHacker.exe_PhReferenceEmptyString
mov rbx, rax
jmp 0x1400d7e51
mov rdx, qword [0x140196800]
mov qword [rsp + 0x60], rsi
movzx esi, ax
mov qword [rsp + 0x68], r14
mov r14, qword [rsp + 0x30]
lea rcx, [rsi + 0x12]
call sym.ProcessHacker.exe_PhCreateObject
mov rbx, rax
mov qword [rax], rsi
add rax, 0x10
mov qword [rbx + 8], rax
mov word [rax + rsi], r12w
test r14, r14
je 0x1400d7e47
mov rcx, qword [rbx + 8]
mov r8d, esi
mov rdx, r14
call fcn.14010e700
mov rsi, qword [rsp + 0x60]
mov r14, qword [rsp + 0x68]
mov qword [r15], rbx
mov rcx, qword [0x140196670]
mov r8, rbp
xor edx, edx
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
mov rbx, qword [rsp + 0x70]
mov eax, edi
mov rbp, qword [rsp + 0x78]
add rsp, 0x40
pop r15
pop r12
pop rdi
ret