joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140167ce0
Capabilities:
Parse pe header

Disassembly:
push rdi
sub rsp, 0x40
xor edi, edi
test byte [0x1402bbdf0], 1
jne 0x140167e60
lock bts qword [0x1402bbdf0], 0x1f
nop
jae 0x140167d25
test byte [0x1402bbdf0], 1
jne 0x140167e60
xor edx, edx
lea rcx, [0x1402bbdf0]
call sym.SystemInformer.exe_PhfWaitForEvent
nop dword [rax]
jmp 0x140167e60
mov qword [rsp + 0x50], rbx
lea rdx, [rsp + 0x30]
lea rbx, [0x1402379c0]
mov qword [rsp + 0x30], 0x12
mov qword [rsp + 0x38], rbx
call fcn.140174480
mov rcx, rax
test rax, rax
jne 0x140167db2
xor edx, edx
mov r8d, 0x800
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
test rax, rax
jne 0x140167db2
xor edx, edx
mov r8d, 0x200
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
test rax, rax
jne 0x140167db2
cmp dword [0x1402b5e88], 0x3e
jae 0x140167e4f
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
test rax, rax
je 0x140167e4f
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x140167e4f
mov edx, dword [rcx + 0x3c]
lea eax, [rdx - 1]
cmp eax, 0x7ffffffd
ja 0x140167e4f
cmp dword [rdx + rcx], 0x4550
jne 0x140167e4f
add rdx, 0x88
add rdx, rcx
mov eax, dword [rdx]
test eax, eax
je 0x140167e4f
cmp dword [rdx + 4], edi
je 0x140167e4f
lea r8, [rcx + rax]
mov word [rsp + 0x20], di
lea r9, str.NtSetInformationVirtualMemory
call fcn.140174840
mov r9, rax
test rax, rax
je 0x140167e4f
mov r8, qword [0x7ffe0320]
mov ecx, dword [0x7ffe0004]
mov eax, r8d
shr r8, 0x20
imul rax, rcx
imul r8, rcx
shr rax, 0x18
shl r8, 8
add rax, r8
mov qword [0x1402c3300], rax
xor rax, r9
mov qword [0x1402c3370], rax
lea rcx, [0x1402bbdf0]
call sym.SystemInformer.exe_PhfSetEvent
mov rbx, qword [rsp + 0x50]
mov rax, qword [0x1402c3370]
test rax, rax
je 0x140167e81
mov rcx, qword [0x1402c3300]
test rcx, rcx
je 0x140167e81
xor rax, rcx
add rsp, 0x40
pop rdi
ret
mov rax, rdi
add rsp, 0x40
pop rdi
ret
Function at 0x140167ea0
Capabilities:
Parse pe header

Disassembly:
push rdi
sub rsp, 0x40
xor edi, edi
test byte [0x1402bbd70], 1
jne 0x140168020
lock bts qword [0x1402bbd70], 0x1f
nop
jae 0x140167ee5
test byte [0x1402bbd70], 1
jne 0x140168020
xor edx, edx
lea rcx, [0x1402bbd70]
call sym.SystemInformer.exe_PhfWaitForEvent
nop dword [rax]
jmp 0x140168020
mov qword [rsp + 0x50], rbx
lea rdx, [rsp + 0x30]
lea rbx, [0x1402379c0]
mov qword [rsp + 0x30], 0x12
mov qword [rsp + 0x38], rbx
call fcn.140174480
mov rcx, rax
test rax, rax
jne 0x140167f72
xor edx, edx
mov r8d, 0x800
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
test rax, rax
jne 0x140167f72
xor edx, edx
mov r8d, 0x200
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
test rax, rax
jne 0x140167f72
cmp dword [0x1402b5e88], 0x3e
jae 0x14016800f
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
test rax, rax
je 0x14016800f
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x14016800f
mov edx, dword [rcx + 0x3c]
lea eax, [rdx - 1]
cmp eax, 0x7ffffffd
ja 0x14016800f
cmp dword [rdx + rcx], 0x4550
jne 0x14016800f
add rdx, 0x88
add rdx, rcx
mov eax, dword [rdx]
test eax, eax
je 0x14016800f
cmp dword [rdx + 4], edi
je 0x14016800f
lea r8, [rcx + rax]
mov word [rsp + 0x20], di
lea r9, str.NtCreateProcessStateChange
call fcn.140174840
mov r9, rax
test rax, rax
je 0x14016800f
mov r8, qword [0x7ffe0320]
mov ecx, dword [0x7ffe0004]
mov eax, r8d
shr r8, 0x20
imul rax, rcx
imul r8, rcx
shr rax, 0x18
shl r8, 8
add rax, r8
mov qword [0x1402c3328], rax
xor rax, r9
mov qword [0x1402c32b8], rax
lea rcx, [0x1402bbd70]
call sym.SystemInformer.exe_PhfSetEvent
mov rbx, qword [rsp + 0x50]
mov rax, qword [0x1402c32b8]
test rax, rax
je 0x140168041
mov rcx, qword [0x1402c3328]
test rcx, rcx
je 0x140168041
xor rax, rcx
add rsp, 0x40
pop rdi
ret
mov rax, rdi
add rsp, 0x40
pop rdi
ret
Function at 0x140168060
Capabilities:
Parse pe header

Disassembly:
push rdi
sub rsp, 0x40
xor edi, edi
test byte [0x1402bbdd0], 1
jne 0x1401681e0
lock bts qword [0x1402bbdd0], 0x1f
nop
jae 0x1401680a5
test byte [0x1402bbdd0], 1
jne 0x1401681e0
xor edx, edx
lea rcx, [0x1402bbdd0]
call sym.SystemInformer.exe_PhfWaitForEvent
nop dword [rax]
jmp 0x1401681e0
mov qword [rsp + 0x50], rbx
lea rdx, [rsp + 0x30]
lea rbx, [0x1402379c0]
mov qword [rsp + 0x30], 0x12
mov qword [rsp + 0x38], rbx
call fcn.140174480
mov rcx, rax
test rax, rax
jne 0x140168132
xor edx, edx
mov r8d, 0x800
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
test rax, rax
jne 0x140168132
xor edx, edx
mov r8d, 0x200
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
test rax, rax
jne 0x140168132
cmp dword [0x1402b5e88], 0x3e
jae 0x1401681cf
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
test rax, rax
je 0x1401681cf
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x1401681cf
mov edx, dword [rcx + 0x3c]
lea eax, [rdx - 1]
cmp eax, 0x7ffffffd
ja 0x1401681cf
cmp dword [rdx + rcx], 0x4550
jne 0x1401681cf
add rdx, 0x88
add rdx, rcx
mov eax, dword [rdx]
test eax, eax
je 0x1401681cf
cmp dword [rdx + 4], edi
je 0x1401681cf
lea r8, [rcx + rax]
mov word [rsp + 0x20], di
lea r9, str.NtChangeProcessState
call fcn.140174840
mov r9, rax
test rax, rax
je 0x1401681cf
mov r8, qword [0x7ffe0320]
mov ecx, dword [0x7ffe0004]
mov eax, r8d
shr r8, 0x20
imul rax, rcx
imul r8, rcx
shr rax, 0x18
shl r8, 8
add rax, r8
mov qword [0x1402c3388], rax
xor rax, r9
mov qword [0x1402c3290], rax
lea rcx, [0x1402bbdd0]
call sym.SystemInformer.exe_PhfSetEvent
mov rbx, qword [rsp + 0x50]
mov rax, qword [0x1402c3290]
test rax, rax
je 0x140168201
mov rcx, qword [0x1402c3388]
test rcx, rcx
je 0x140168201
xor rax, rcx
add rsp, 0x40
pop rdi
ret
mov rax, rdi
add rsp, 0x40
pop rdi
ret
Function at 0x140168220
Capabilities:
Parse pe header

Disassembly:
push rdi
sub rsp, 0x40
xor edi, edi
test byte [0x1402bbd80], 1
jne 0x1401683a0
lock bts qword [0x1402bbd80], 0x1f
nop
jae 0x140168265
test byte [0x1402bbd80], 1
jne 0x1401683a0
xor edx, edx
lea rcx, [0x1402bbd80]
call sym.SystemInformer.exe_PhfWaitForEvent
nop dword [rax]
jmp 0x1401683a0
mov qword [rsp + 0x50], rbx
lea rdx, [rsp + 0x30]
lea rbx, [0x1402379c0]
mov qword [rsp + 0x30], 0x12
mov qword [rsp + 0x38], rbx
call fcn.140174480
mov rcx, rax
test rax, rax
jne 0x1401682f2
xor edx, edx
mov r8d, 0x800
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
test rax, rax
jne 0x1401682f2
xor edx, edx
mov r8d, 0x200
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
test rax, rax
jne 0x1401682f2
cmp dword [0x1402b5e88], 0x3e
jae 0x14016838f
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
test rax, rax
je 0x14016838f
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x14016838f
mov edx, dword [rcx + 0x3c]
lea eax, [rdx - 1]
cmp eax, 0x7ffffffd
ja 0x14016838f
cmp dword [rdx + rcx], 0x4550
jne 0x14016838f
add rdx, 0x88
add rdx, rcx
mov eax, dword [rdx]
test eax, eax
je 0x14016838f
cmp dword [rdx + 4], edi
je 0x14016838f
lea r8, [rcx + rax]
mov word [rsp + 0x20], di
lea r9, str.RtlDefaultNpAcl
call fcn.140174840
mov r9, rax
test rax, rax
je 0x14016838f
mov r8, qword [0x7ffe0320]
mov ecx, dword [0x7ffe0004]
mov eax, r8d
shr r8, 0x20
imul rax, rcx
imul r8, rcx
shr rax, 0x18
shl r8, 8
add rax, r8
mov qword [0x1402c33e8], rax
xor rax, r9
mov qword [0x1402c3308], rax
lea rcx, [0x1402bbd80]
call sym.SystemInformer.exe_PhfSetEvent
mov rbx, qword [rsp + 0x50]
mov rax, qword [0x1402c3308]
test rax, rax
je 0x1401683c1
mov rcx, qword [0x1402c33e8]
test rcx, rcx
je 0x1401683c1
xor rax, rcx
add rsp, 0x40
pop rdi
ret
mov rax, rdi
add rsp, 0x40
pop rdi
ret
Function at 0x1401683e0
Capabilities:
Parse pe header

Disassembly:
push rdi
sub rsp, 0x40
xor edi, edi
test byte [0x1402bbd00], 1
jne 0x140168560
lock bts qword [0x1402bbd00], 0x1f
nop
jae 0x140168425
test byte [0x1402bbd00], 1
jne 0x140168560
xor edx, edx
lea rcx, [0x1402bbd00]
call sym.SystemInformer.exe_PhfWaitForEvent
nop dword [rax]
jmp 0x140168560
mov qword [rsp + 0x50], rbx
lea rdx, [rsp + 0x30]
lea rbx, [0x1402379c0]
mov qword [rsp + 0x30], 0x12
mov qword [rsp + 0x38], rbx
call fcn.140174480
mov rcx, rax
test rax, rax
jne 0x1401684b2
xor edx, edx
mov r8d, 0x800
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
test rax, rax
jne 0x1401684b2
xor edx, edx
mov r8d, 0x200
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
test rax, rax
jne 0x1401684b2
cmp dword [0x1402b5e88], 0x3e
jae 0x14016854f
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
test rax, rax
je 0x14016854f
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x14016854f
mov edx, dword [rcx + 0x3c]
lea eax, [rdx - 1]
cmp eax, 0x7ffffffd
ja 0x14016854f
cmp dword [rdx + rcx], 0x4550
jne 0x14016854f
add rdx, 0x88
add rdx, rcx
mov eax, dword [rdx]
test eax, eax
je 0x14016854f
cmp dword [rdx + 4], edi
je 0x14016854f
lea r8, [rcx + rax]
mov word [rsp + 0x20], di
lea r9, str.RtlGetTokenNamedObjectPath
call fcn.140174840
mov r9, rax
test rax, rax
je 0x14016854f
mov r8, qword [0x7ffe0320]
mov ecx, dword [0x7ffe0004]
mov eax, r8d
shr r8, 0x20
imul rax, rcx
imul r8, rcx
shr rax, 0x18
shl r8, 8
add rax, r8
mov qword [0x1402c33b0], rax
xor rax, r9
mov qword [0x1402c3310], rax
lea rcx, [0x1402bbd00]
call sym.SystemInformer.exe_PhfSetEvent
mov rbx, qword [rsp + 0x50]
mov rax, qword [0x1402c3310]
test rax, rax
je 0x140168581
mov rcx, qword [0x1402c33b0]
test rcx, rcx
je 0x140168581
xor rax, rcx
add rsp, 0x40
pop rdi
ret
mov rax, rdi
add rsp, 0x40
pop rdi
ret
Function at 0x1401685a0
Capabilities:
Parse pe header

Disassembly:
push rdi
sub rsp, 0x40
xor edi, edi
test byte [0x1402bbd30], 1
jne 0x140168720
lock bts qword [0x1402bbd30], 0x1f
nop
jae 0x1401685e5
test byte [0x1402bbd30], 1
jne 0x140168720
xor edx, edx
lea rcx, [0x1402bbd30]
call sym.SystemInformer.exe_PhfWaitForEvent
nop dword [rax]
jmp 0x140168720
mov qword [rsp + 0x50], rbx
lea rdx, [rsp + 0x30]
lea rbx, [0x1402379c0]
mov qword [rsp + 0x30], 0x12
mov qword [rsp + 0x38], rbx
call fcn.140174480
mov rcx, rax
test rax, rax
jne 0x140168672
xor edx, edx
mov r8d, 0x800
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
test rax, rax
jne 0x140168672
xor edx, edx
mov r8d, 0x200
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
test rax, rax
jne 0x140168672
cmp dword [0x1402b5e88], 0x3e
jae 0x14016870f
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
test rax, rax
je 0x14016870f
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x14016870f
mov edx, dword [rcx + 0x3c]
lea eax, [rdx - 1]
cmp eax, 0x7ffffffd
ja 0x14016870f
cmp dword [rdx + rcx], 0x4550
jne 0x14016870f
add rdx, 0x88
add rdx, rcx
mov eax, dword [rdx]
test eax, eax
je 0x14016870f
cmp dword [rdx + 4], edi
je 0x14016870f
lea r8, [rcx + rax]
mov word [rsp + 0x20], di
lea r9, str.RtlGetAppContainerNamedObjectPath
call fcn.140174840
mov r9, rax
test rax, rax
je 0x14016870f
mov r8, qword [0x7ffe0320]
mov ecx, dword [0x7ffe0004]
mov eax, r8d
shr r8, 0x20
imul rax, rcx
imul r8, rcx
shr rax, 0x18
shl r8, 8
add rax, r8
mov qword [0x1402c3340], rax
xor rax, r9
mov qword [0x1402c32f8], rax
lea rcx, [0x1402bbd30]
call sym.SystemInformer.exe_PhfSetEvent
mov rbx, qword [rsp + 0x50]
mov rax, qword [0x1402c32f8]
test rax, rax
je 0x140168741
mov rcx, qword [0x1402c3340]
test rcx, rcx
je 0x140168741
xor rax, rcx
add rsp, 0x40
pop rdi
ret
mov rax, rdi
add rsp, 0x40
pop rdi
ret
Function at 0x140168760
Capabilities:
Parse pe header

Disassembly:
push rdi
sub rsp, 0x40
xor edi, edi
test byte [0x1402bbd50], 1
jne 0x1401688e0
lock bts qword [0x1402bbd50], 0x1f
nop
jae 0x1401687a5
test byte [0x1402bbd50], 1
jne 0x1401688e0
xor edx, edx
lea rcx, [0x1402bbd50]
call sym.SystemInformer.exe_PhfWaitForEvent
nop dword [rax]
jmp 0x1401688e0
mov qword [rsp + 0x50], rbx
lea rdx, [rsp + 0x30]
lea rbx, [0x1402379c0]
mov qword [rsp + 0x30], 0x12
mov qword [rsp + 0x38], rbx
call fcn.140174480
mov rcx, rax
test rax, rax
jne 0x140168832
xor edx, edx
mov r8d, 0x800
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
test rax, rax
jne 0x140168832
xor edx, edx
mov r8d, 0x200
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
test rax, rax
jne 0x140168832
cmp dword [0x1402b5e88], 0x3e
jae 0x1401688cf
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
test rax, rax
je 0x1401688cf
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x1401688cf
mov edx, dword [rcx + 0x3c]
lea eax, [rdx - 1]
cmp eax, 0x7ffffffd
ja 0x1401688cf
cmp dword [rdx + rcx], 0x4550
jne 0x1401688cf
add rdx, 0x88
add rdx, rcx
mov eax, dword [rdx]
test eax, eax
je 0x1401688cf
cmp dword [rdx + 4], edi
je 0x1401688cf
lea r8, [rcx + rax]
mov word [rsp + 0x20], di
lea r9, str.RtlGetAppContainerSidType
call fcn.140174840
mov r9, rax
test rax, rax
je 0x1401688cf
mov r8, qword [0x7ffe0320]
mov ecx, dword [0x7ffe0004]
mov eax, r8d
shr r8, 0x20
imul rax, rcx
imul r8, rcx
shr rax, 0x18
shl r8, 8
add rax, r8
mov qword [0x1402c32d0], rax
xor rax, r9
mov qword [0x1402c33f0], rax
lea rcx, [0x1402bbd50]
call sym.SystemInformer.exe_PhfSetEvent
mov rbx, qword [rsp + 0x50]
mov rax, qword [0x1402c33f0]
test rax, rax
je 0x140168901
mov rcx, qword [0x1402c32d0]
test rcx, rcx
je 0x140168901
xor rax, rcx
add rsp, 0x40
pop rdi
ret
mov rax, rdi
add rsp, 0x40
pop rdi
ret
Function at 0x140168920
Capabilities:
Parse pe header

Disassembly:
push rdi
sub rsp, 0x40
xor edi, edi
test byte [0x1402bbd60], 1
jne 0x140168aa0
lock bts qword [0x1402bbd60], 0x1f
nop
jae 0x140168965
test byte [0x1402bbd60], 1
jne 0x140168aa0
xor edx, edx
lea rcx, [0x1402bbd60]
call sym.SystemInformer.exe_PhfWaitForEvent
nop dword [rax]
jmp 0x140168aa0
mov qword [rsp + 0x50], rbx
lea rdx, [rsp + 0x30]
lea rbx, [0x1402379c0]
mov qword [rsp + 0x30], 0x12
mov qword [rsp + 0x38], rbx
call fcn.140174480
mov rcx, rax
test rax, rax
jne 0x1401689f2
xor edx, edx
mov r8d, 0x800
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
test rax, rax
jne 0x1401689f2
xor edx, edx
mov r8d, 0x200
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
test rax, rax
jne 0x1401689f2
cmp dword [0x1402b5e88], 0x3e
jae 0x140168a8f
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
test rax, rax
je 0x140168a8f
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x140168a8f
mov edx, dword [rcx + 0x3c]
lea eax, [rdx - 1]
cmp eax, 0x7ffffffd
ja 0x140168a8f
cmp dword [rdx + rcx], 0x4550
jne 0x140168a8f
add rdx, 0x88
add rdx, rcx
mov eax, dword [rdx]
test eax, eax
je 0x140168a8f
cmp dword [rdx + 4], edi
je 0x140168a8f
lea r8, [rcx + rax]
mov word [rsp + 0x20], di
lea r9, str.RtlGetAppContainerParent
call fcn.140174840
mov r9, rax
test rax, rax
je 0x140168a8f
mov r8, qword [0x7ffe0320]
mov ecx, dword [0x7ffe0004]
mov eax, r8d
shr r8, 0x20
imul rax, rcx
imul r8, rcx
shr rax, 0x18
shl r8, 8
add rax, r8
mov qword [0x1402c3380], rax
xor rax, r9
mov qword [0x1402c33c8], rax
lea rcx, [0x1402bbd60]
call sym.SystemInformer.exe_PhfSetEvent
mov rbx, qword [rsp + 0x50]
mov rax, qword [0x1402c33c8]
test rax, rax
je 0x140168ac1
mov rcx, qword [0x1402c3380]
test rcx, rcx
je 0x140168ac1
xor rax, rcx
add rsp, 0x40
pop rdi
ret
mov rax, rdi
add rsp, 0x40
pop rdi
ret
Function at 0x140168ae0
Capabilities:
Parse pe header

Disassembly:
push rdi
sub rsp, 0x40
xor edi, edi
test byte [0x1402bbd90], 1
jne 0x140168c60
lock bts qword [0x1402bbd90], 0x1f
nop
jae 0x140168b25
test byte [0x1402bbd90], 1
jne 0x140168c60
xor edx, edx
lea rcx, [0x1402bbd90]
call sym.SystemInformer.exe_PhfWaitForEvent
nop dword [rax]
jmp 0x140168c60
mov qword [rsp + 0x50], rbx
lea rdx, [rsp + 0x30]
lea rbx, [0x1402379c0]
mov qword [rsp + 0x30], 0x12
mov qword [rsp + 0x38], rbx
call fcn.140174480
mov rcx, rax
test rax, rax
jne 0x140168bb2
xor edx, edx
mov r8d, 0x800
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
test rax, rax
jne 0x140168bb2
xor edx, edx
mov r8d, 0x200
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
test rax, rax
jne 0x140168bb2
cmp dword [0x1402b5e88], 0x3e
jae 0x140168c4f
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
test rax, rax
je 0x140168c4f
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x140168c4f
mov edx, dword [rcx + 0x3c]
lea eax, [rdx - 1]
cmp eax, 0x7ffffffd
ja 0x140168c4f
cmp dword [rdx + rcx], 0x4550
jne 0x140168c4f
add rdx, 0x88
add rdx, rcx
mov eax, dword [rdx]
test eax, eax
je 0x140168c4f
cmp dword [rdx + 4], edi
je 0x140168c4f
lea r8, [rcx + rax]
mov word [rsp + 0x20], di
lea r9, str.RtlDeriveCapabilitySidsFromName
call fcn.140174840
mov r9, rax
test rax, rax
je 0x140168c4f
mov r8, qword [0x7ffe0320]
mov ecx, dword [0x7ffe0004]
mov eax, r8d
shr r8, 0x20
imul rax, rcx
imul r8, rcx
shr rax, 0x18
shl r8, 8
add rax, r8
mov qword [0x1402c33e0], rax
xor rax, r9
mov qword [0x1402c33a8], rax
lea rcx, [0x1402bbd90]
call sym.SystemInformer.exe_PhfSetEvent
mov rbx, qword [rsp + 0x50]
mov rax, qword [0x1402c33a8]
test rax, rax
je 0x140168c81
mov rcx, qword [0x1402c33e0]
test rcx, rcx
je 0x140168c81
xor rax, rcx
add rsp, 0x40
pop rdi
ret
mov rax, rdi
add rsp, 0x40
pop rdi
ret
Function at 0x140168ca0
Capabilities:
Parse pe header

Disassembly:
push rdi
sub rsp, 0x40
xor edi, edi
test byte [0x1402bbd10], 1
jne 0x140168e20
lock bts qword [0x1402bbd10], 0x1f
nop
jae 0x140168ce5
test byte [0x1402bbd10], 1
jne 0x140168e20
xor edx, edx
lea rcx, [0x1402bbd10]
call sym.SystemInformer.exe_PhfWaitForEvent
nop dword [rax]
jmp 0x140168e20
mov qword [rsp + 0x50], rbx
lea rdx, [rsp + 0x30]
lea rbx, str.advapi32.dll
mov qword [rsp + 0x30], 0x18
mov qword [rsp + 0x38], rbx
call fcn.140174480
mov rcx, rax
test rax, rax
jne 0x140168d72
xor edx, edx
mov r8d, 0x800
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
test rax, rax
jne 0x140168d72
xor edx, edx
mov r8d, 0x200
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
test rax, rax
jne 0x140168d72
cmp dword [0x1402b5e88], 0x3e
jae 0x140168e0f
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
test rax, rax
je 0x140168e0f
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x140168e0f
mov edx, dword [rcx + 0x3c]
lea eax, [rdx - 1]
cmp eax, 0x7ffffffd
ja 0x140168e0f
cmp dword [rdx + rcx], 0x4550
jne 0x140168e0f
add rdx, 0x88
add rdx, rcx
mov eax, dword [rdx]
test eax, eax
je 0x140168e0f
cmp dword [rdx + 4], edi
je 0x140168e0f
lea r8, [rcx + rax]
mov word [rsp + 0x20], di
lea r9, str.ConvertSecurityDescriptorToStringSecurityDescriptorW
call fcn.140174840
mov r9, rax
test rax, rax
je 0x140168e0f
mov r8, qword [0x7ffe0320]
mov ecx, dword [0x7ffe0004]
mov eax, r8d
shr r8, 0x20
imul rax, rcx
imul r8, rcx
shr rax, 0x18
shl r8, 8
add rax, r8
mov qword [0x1402c3320], rax
xor rax, r9
mov qword [0x1402c32b0], rax
lea rcx, [0x1402bbd10]
call sym.SystemInformer.exe_PhfSetEvent
mov rbx, qword [rsp + 0x50]
mov rax, qword [0x1402c32b0]
test rax, rax
je 0x140168e41
mov rcx, qword [0x1402c3320]
test rcx, rcx
je 0x140168e41
xor rax, rcx
add rsp, 0x40
pop rdi
ret
mov rax, rdi
add rsp, 0x40
pop rdi
ret
Function at 0x140168e60
Capabilities:
Parse pe header

Disassembly:
push rdi
sub rsp, 0x40
xor edi, edi
test byte [0x1402bbe20], 1
jne 0x140168fe0
lock bts qword [0x1402bbe20], 0x1f
nop
jae 0x140168ea5
test byte [0x1402bbe20], 1
jne 0x140168fe0
xor edx, edx
lea rcx, [0x1402bbe20]
call sym.SystemInformer.exe_PhfWaitForEvent
nop dword [rax]
jmp 0x140168fe0
mov qword [rsp + 0x50], rbx
lea rdx, [rsp + 0x30]
lea rbx, str.advapi32.dll
mov qword [rsp + 0x30], 0x18
mov qword [rsp + 0x38], rbx
call fcn.140174480
mov rcx, rax
test rax, rax
jne 0x140168f32
xor edx, edx
mov r8d, 0x800
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
test rax, rax
jne 0x140168f32
xor edx, edx
mov r8d, 0x200
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
test rax, rax
jne 0x140168f32
cmp dword [0x1402b5e88], 0x3e
jae 0x140168fcf
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
test rax, rax
je 0x140168fcf
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x140168fcf
mov edx, dword [rcx + 0x3c]
lea eax, [rdx - 1]
cmp eax, 0x7ffffffd
ja 0x140168fcf
cmp dword [rdx + rcx], 0x4550
jne 0x140168fcf
add rdx, 0x88
add rdx, rcx
mov eax, dword [rdx]
test eax, eax
je 0x140168fcf
cmp dword [rdx + 4], edi
je 0x140168fcf
lea r8, [rcx + rax]
mov word [rsp + 0x20], di
lea r9, str.ConvertStringSecurityDescriptorToSecurityDescriptorW
call fcn.140174840
mov r9, rax
test rax, rax
je 0x140168fcf
mov r8, qword [0x7ffe0320]
mov ecx, dword [0x7ffe0004]
mov eax, r8d
shr r8, 0x20
imul rax, rcx
imul r8, rcx
shr rax, 0x18
shl r8, 8
add rax, r8
mov qword [0x1402c3378], rax
xor rax, r9
mov qword [0x1402c3338], rax
lea rcx, [0x1402bbe20]
call sym.SystemInformer.exe_PhfSetEvent
mov rbx, qword [rsp + 0x50]
mov rax, qword [0x1402c3338]
test rax, rax
je 0x140169001
mov rcx, qword [0x1402c3378]
test rcx, rcx
je 0x140169001
xor rax, rcx
add rsp, 0x40
pop rdi
ret
mov rax, rdi
add rsp, 0x40
pop rdi
ret
Function at 0x140169020
Capabilities:
Parse pe header

Disassembly:
push rdi
sub rsp, 0x40
xor edi, edi
test byte [0x1402bbda0], 1
jne 0x1401691a0
lock bts qword [0x1402bbda0], 0x1f
nop
jae 0x140169065
test byte [0x1402bbda0], 1
jne 0x1401691a0
xor edx, edx
lea rcx, [0x1402bbda0]
call sym.SystemInformer.exe_PhfWaitForEvent
nop dword [rax]
jmp 0x1401691a0
mov qword [rsp + 0x50], rbx
lea rdx, [rsp + 0x30]
lea rbx, str.shlwapi.dll
mov qword [rsp + 0x30], 0x16
mov qword [rsp + 0x38], rbx
call fcn.140174480
mov rcx, rax
test rax, rax
jne 0x1401690f2
xor edx, edx
mov r8d, 0x800
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
test rax, rax
jne 0x1401690f2
xor edx, edx
mov r8d, 0x200
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
test rax, rax
jne 0x1401690f2
cmp dword [0x1402b5e88], 0x3e
jae 0x14016918f
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
test rax, rax
je 0x14016918f
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x14016918f
mov edx, dword [rcx + 0x3c]
lea eax, [rdx - 1]
cmp eax, 0x7ffffffd
ja 0x14016918f
cmp dword [rdx + rcx], 0x4550
jne 0x14016918f
add rdx, 0x88
add rdx, rcx
mov eax, dword [rdx]
test eax, eax
je 0x14016918f
cmp dword [rdx + 4], edi
je 0x14016918f
lea r8, [rcx + rax]
mov word [rsp + 0x20], di
lea r9, str.SHAutoComplete
call fcn.140174840
mov r9, rax
test rax, rax
je 0x14016918f
mov r8, qword [0x7ffe0320]
mov ecx, dword [0x7ffe0004]
mov eax, r8d
shr r8, 0x20
imul rax, rcx
imul r8, rcx
shr rax, 0x18
shl r8, 8
add rax, r8
mov qword [0x1402c32e0], rax
xor rax, r9
mov qword [0x1402c3368], rax
lea rcx, [0x1402bbda0]
call sym.SystemInformer.exe_PhfSetEvent
mov rbx, qword [rsp + 0x50]
mov rax, qword [0x1402c3368]
test rax, rax
je 0x1401691c1
mov rcx, qword [0x1402c32e0]
test rcx, rcx
je 0x1401691c1
xor rax, rcx
add rsp, 0x40
pop rdi
ret
mov rax, rdi
add rsp, 0x40
pop rdi
ret