joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140011820
Capabilities:
Get file system object information

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
sub rsp, 0x2f0
movzx esi, r8b
mov rdi, rdx
mov rbp, rcx
test rdx, rdx
je 0x1400118f5
movzx eax, byte [rdx]
xor al, 0xe
test al, 0x1f
jne 0x1400118f5
lea rdx, str..exe
mov rcx, rdi
call fcn.1400e9230
test eax, eax
jne 0x1400118f5
xor ebx, ebx
mov qword [rsp + 0x318], rbx
test rbp, rbp
je 0x1400118b4
test sil, sil
mov dword [rsp + 0x20], 1
lea r9, [rsp + 0x318]
mov rcx, rbp
cmovne r9, rbx
lea r8, [rsp + 0x318]
cmove r8, rbx
xor edx, edx
call qword [sym.imp.SHELL32.dll_ExtractIconExW]
mov rax, qword [rsp + 0x318]
test rax, rax
jne 0x14001199b
test sil, sil
lea rdx, [rsp + 0x318]
lea rcx, [rsp + 0x318]
cmove rdx, rbx
cmovne rcx, rbx
call sym.ProcessHacker.exe_PhGetStockApplicationIcon
mov rax, qword [rsp + 0x318]
test rax, rax
je 0x14001199b
mov rdx, rax
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_DuplicateIcon]
jmp 0x14001199b
xor ebx, ebx
mov qword [rsp + 0x310], r14
test sil, sil
mov qword [rsp + 0x318], rbx
mov r14d, ebx
sete r14b
test rbp, rbp
je 0x140011955
mov eax, r14d
lea r8, [rsp + 0x30]
bts eax, 8
mov r9d, 0x2b8
xor edx, edx
mov dword [rsp + 0x20], eax
mov rcx, rbp
call qword [sym.imp.SHELL32.dll_SHGetFileInfoW]
mov rbx, qword [rsp + 0x318]
test rax, rax
cmovne rbx, qword [rsp + 0x30]
mov qword [rsp + 0x318], rbx
test rbx, rbx
jne 0x140011990
test rdi, rdi
je 0x140011990
or r14d, 0x110
lea r8, [rsp + 0x30]
mov r9d, 0x2b8
mov dword [rsp + 0x20], r14d
mov edx, 0x80
mov rcx, rdi
call qword [sym.imp.SHELL32.dll_SHGetFileInfoW]
mov rbx, qword [rsp + 0x318]
test rax, rax
cmovne rbx, qword [rsp + 0x30]
mov r14, qword [rsp + 0x310]
mov rax, rbx
mov rbx, qword [rsp + 0x320]
add rsp, 0x2f0
pop rdi
pop rsi
pop rbp
ret

Function at 0x1400119b0
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rdi, rdx
mov rsi, rcx
mov rdx, qword [rdx]
mov ecx, 2
add rdx, 2
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov rcx, rax
mov rbp, rax
call qword [sym.imp.KERNEL32.dll_GlobalLock]
mov r8, qword [rdi]
mov rcx, rax
mov rdx, qword [rdi + 8]
mov rbx, rax
call fcn.1400e19b0
mov rcx, qword [rdi]
xor eax, eax
mov word [rbx + rcx], ax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov rcx, rsi
call qword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x140011a3e
call qword [sym.imp.USER32.dll_EmptyClipboard]
test eax, eax
je 0x140011a3e
mov rdx, rbp
mov ecx, 0xd
call qword [sym.imp.USER32.dll_SetClipboardData]
test rax, rax
je 0x140011a3e
call qword [sym.imp.USER32.dll_CloseClipboard]
jmp 0x140011a47
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_GlobalFree]
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x140011a60
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push r14
sub rsp, 0x30
mov rsi, r8
mov r14, rcx
mov rcx, rsi
mov r8d, 5
mov rdx, r9
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rbx, rax
test rax, rax
jne 0x140011aa1
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop r14
ret
mov rdx, rax
mov qword [rsp + 0x48], rdi
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov edi, eax
test eax, eax
je 0x140011ac9
mov rdx, rbx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
jne 0x140011ad0
xor eax, eax
jmp 0x140011b64
mov rcx, rax
mov qword [rsp + 0x40], rbp
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rbp, rax
test rax, rax
je 0x140011b5f
mov rcx, qword [sym.ProcessHacker.exe_PhHeapHandle]
mov r8, rdi
mov edx, 4
mov rbx, rdi
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov r8, rbx
mov rdx, rbp
mov rcx, rax
mov rdi, rax
call fcn.1400e19b0
mov eax, 0xffff
cmp word [rdi + 2], ax
jne 0x140011b23
mov dword [rdi + 0xc], 0x40000448
jmp 0x140011b29
mov dword [rdi], 0x40000448
mov rax, qword [rsp + 0x68]
mov r8, r14
mov r9, qword [rsp + 0x60]
mov rdx, rdi
mov rcx, rsi
mov qword [rsp + 0x20], rax
call qword [sym.imp.USER32.dll_CreateDialogIndirectParamW]
mov rcx, qword [sym.ProcessHacker.exe_PhHeapHandle]
mov r8, rdi
xor edx, edx
mov rbx, rax
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
mov rax, rbx
mov rbp, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop r14
ret
Function at 0x1400149d0
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
push rbx
push r14
sub rsp, 0x28
mov rbx, rdx
mov r14, rcx
call qword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x140014b3a
lea rcx, str.BinaryData
mov qword [rsp + 0x40], rbp
call qword [sym.imp.USER32.dll_RegisterClipboardFormatW]
mov ecx, eax
call qword [sym.imp.USER32.dll_GetClipboardData]
mov rbp, rax
test rax, rax
jne 0x140014a23
lea ecx, [rax + 1]
call qword [sym.imp.USER32.dll_GetClipboardData]
mov rbp, rax
test rax, rax
je 0x140014b2f
mov qword [rsp + 0x48], rsi
mov rcx, rbp
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x58], r12
mov qword [rsp + 0x20], r15
call qword [sym.imp.KERNEL32.dll_GlobalLock]
mov rcx, rbp
mov r12, rax
call qword [sym.imp.KERNEL32.dll_GlobalSize]
mov ecx, dword [rbx + 0x1c]
mov rsi, rax
mov edx, dword [rbx + 0x20]
mov r15d, dword [rbx + 0x14]
cmp ecx, edx
jle 0x140014a63
mov dword [rbx + 0x20], ecx
mov dword [rbx + 0x1c], edx
cmp byte [rbx + 0x30], 0
mov edi, dword [rbx + 0x1c]
je 0x140014acb
cmp edi, 0xffffffff
jne 0x140014a94
cmp dword [rbx + 0x18], 3
jne 0x140014a7e
lea eax, [r15 + 1]
mov dword [rbx + 0x14], eax
mov edi, dword [rbx + 0x14]
mov r9d, esi
mov r8d, edi
mov rdx, rbx
mov rcx, r14
call fcn.140014c40
jmp 0x140014aea
mov r9d, dword [rbx + 0x20]
mov r8d, edi
mov rdx, rbx
mov rcx, r14
call fcn.140014b50
mov r9d, esi
mov r8d, edi
mov rdx, rbx
mov rcx, r14
call fcn.140014c40
or r9d, 0xffffffff
mov rdx, rbx
or r8d, r9d
mov rcx, r14
call fcn.140014620
jmp 0x140014aea
cmp edi, 0xffffffff
jne 0x140014ae0
cmp dword [rbx + 0x18], 3
jne 0x140014add
lea eax, [r15 + 1]
mov dword [rbx + 0x14], eax
mov edi, dword [rbx + 0x14]
mov eax, dword [rbx + 8]
sub eax, edi
cmp esi, eax
cmova esi, eax
mov ecx, edi
mov rdx, r12
add rcx, qword [rbx]
mov r8d, esi
call fcn.1400e19b0
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov r9d, 0x105
mov dword [rbx + 0x14], r15d
xor r8d, r8d
xor edx, edx
mov rcx, r14
call qword [sym.imp.USER32.dll_RedrawWindow]
mov r15, qword [rsp + 0x20]
mov r12, qword [rsp + 0x58]
mov rdi, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x48]
call qword [sym.imp.USER32.dll_CloseClipboard]
mov rbp, qword [rsp + 0x40]
add rsp, 0x28
pop r14
pop rbx
ret

Function at 0x1400158a0
Capabilities:
Map section object

Disassembly:
mov r11, rsp
push rbx
sub rsp, 0x50
mov dword [rsp + 0x48], 2
lea rax, [r11 + 0x20]
mov rbx, rdx
mov qword [r11 + 0x20], 1
xor edx, edx
lea r8, [r11 + 0x18]
mov dword [rsp + 0x40], edx
xor r9d, r9d
mov dword [rsp + 0x38], 1
mov qword [r11 - 0x28], rax
mov qword [r11 - 0x30], rdx
mov qword [r11 - 0x38], rdx
mov qword [r11 + 0x18], rdx
or rdx, 0xffffffffffffffff
call qword [sym.imp.ntdll.dll_NtMapViewOfSection]
test eax, eax
js 0x140015916
mov rdx, qword [rsp + 0x70]
mov r8, rbx
or rcx, 0xffffffffffffffff
call sym.ProcessHacker.exe_PhGetProcessMappedFileName
mov rdx, qword [rsp + 0x70]
or rcx, 0xffffffffffffffff
mov ebx, eax
call qword [sym.imp.ntdll.dll_NtUnmapViewOfSection]
mov eax, ebx
add rsp, 0x50
pop rbx
ret
Function at 0x140017470
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x20], rbp
push rdi
push r14
push r15
sub rsp, 0x60
cmp qword [rcx + 0x20], 0
mov rbp, r9
mov r15, r8
mov rdi, rcx
jne 0x1400174b3
mov r9d, 1
mov byte [rsp + 0x20], 0
xor r8d, r8d
mov edx, 0x1f0003
add rcx, 0x20
call qword [sym.imp.ntdll.dll_NtCreateEvent]
test eax, eax
js 0x1400175eb
cmp qword [rdi + 0x28], 0
mov qword [rsp + 0x88], rsi
jne 0x1400174e7
mov r9d, 1
mov byte [rsp + 0x20], 0
xor r8d, r8d
lea rcx, [rdi + 0x28]
mov edx, 0x1f0003
call qword [sym.imp.ntdll.dll_NtCreateEvent]
test eax, eax
js 0x1400175e3
mov qword [rsp + 0x80], rbx
lea rbx, [rdi + 0x30]
mov qword [rsp + 0x90], r12
xor r12d, r12d
cmp qword [rbx], r12
jne 0x14001756a
mov rcx, qword [rdi + 0x20]
call qword [sym.imp.ntdll.dll_NtClearEvent]
mov rcx, qword [rdi + 0x28]
call qword [sym.imp.ntdll.dll_NtClearEvent]
lea rax, [rsp + 0x50]
xor r9d, r9d
mov qword [rsp + 0x48], rax
xor r8d, r8d
mov qword [rsp + 0x40], rbx
lea rax, [0x140017600]
mov qword [rsp + 0x38], rdi
xor edx, edx
mov qword [rsp + 0x30], rax
or rcx, 0xffffffffffffffff
mov qword [rsp + 0x28], 0x8000
mov qword [rsp + 0x20], r12
call qword [sym.imp.ntdll.dll_RtlCreateUserThread]
test eax, eax
js 0x1400175d3
mov rcx, qword [rdi + 0x28]
xor r8d, r8d
xor edx, edx
call qword [sym.imp.ntdll.dll_NtWaitForSingleObject]
mov rcx, qword [rdi + 0x20]
lea rax, [0x140017650]
xor edx, edx
mov qword [rdi + 0x10], rax
mov qword [rdi + 0x18], r15
call qword [sym.imp.ntdll.dll_NtSetEvent]
mov rcx, qword [rdi + 0x28]
mov r8, rbp
xor edx, edx
call qword [sym.imp.ntdll.dll_NtWaitForSingleObject]
mov esi, eax
mov qword [rdi + 0x10], r12
lock or dword [rsp], r12d
mov qword [rdi + 0x18], r12
test eax, eax
je 0x1400175d1
mov rcx, qword [rbx]
mov esi, 0xc0000001
mov edx, esi
call qword [sym.imp.ntdll.dll_NtTerminateThread]
mov rcx, qword [rbx]
xor r8d, r8d
xor edx, edx
call qword [sym.imp.ntdll.dll_NtWaitForSingleObject]
mov rcx, qword [rbx]
call qword [sym.imp.ntdll.dll_NtClose]
mov qword [rbx], r12
mov eax, esi
mov rbx, qword [rsp + 0x80]
mov r12, qword [rsp + 0x90]
mov rsi, qword [rsp + 0x88]
mov rbp, qword [rsp + 0x98]
add rsp, 0x60
pop r15
pop r14
pop rdi
ret

Function at 0x140018620
Capabilities:
Get file attributes

Disassembly:
push rbx
sub rsp, 0x40
test byte [rcx + 8], 0xc
mov rbx, rcx
jne 0x140018674
mov rcx, qword [rcx]
lea r8, [rsp + 0x50]
mov r9d, 8
mov dword [rsp + 0x20], 0xe
lea rdx, [rsp + 0x30]
call qword [sym.imp.ntdll.dll_NtQueryInformationFile]
test eax, eax
jns 0x14001865d
mov ecx, eax
call qword [sym.imp.ntdll.dll_RtlRaiseStatus]
int3
mov rax, qword [rsp + 0x50]
cmp qword [rbx + 0x10], rax
je 0x140018674
mov ecx, 0xc00000e5
call qword [sym.imp.ntdll.dll_RtlRaiseStatus]
int3
add rsp, 0x40
pop rbx
ret
Function at 0x140018680
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x30
mov eax, dword [rcx + 0x20]
lea r9, [rsp + 0x48]
mov rbx, rcx
mov dword [rsp + 0x28], 4
xor edi, edi
mov qword [rsp + 0x48], rax
or rcx, 0xffffffffffffffff
mov qword [rsp + 0x40], rdi
xor r8d, r8d
mov dword [rsp + 0x20], 0x1000
lea rdx, [rsp + 0x40]
call qword [sym.imp.ntdll.dll_NtAllocateVirtualMemory]
test eax, eax
mov edx, edi
mov eax, 0xc0000017
cmovns rdx, qword [rsp + 0x40]
test rdx, rdx
mov qword [rbx + 0x18], rdx
mov rbx, qword [rsp + 0x50]
cmovne eax, edi
add rsp, 0x30
pop rdi
ret
Function at 0x1400186f0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x60
xor eax, eax
mov rdi, r9
test byte [rcx + 8], 8
mov rbx, rcx
je 0x14001870c
lea rax, [rcx + 0x10]
mov rcx, qword [rcx]
xor r9d, r9d
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x50]
mov dword [rsp + 0x30], r8d
xor r8d, r8d
mov qword [rsp + 0x28], rdx
xor edx, edx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntdll.dll_NtReadFile]
cmp eax, 0x103
jne 0x14001875c
mov rcx, qword [rbx]
xor r8d, r8d
xor edx, edx
call qword [sym.imp.ntdll.dll_NtWaitForSingleObject]
test eax, eax
js 0x140018770
mov eax, dword [rsp + 0x50]
test eax, eax
js 0x140018770
mov rcx, qword [rsp + 0x58]
add qword [rbx + 0x10], rcx
test rdi, rdi
je 0x140018770
mov dword [rdi], ecx
mov rbx, qword [rsp + 0x70]
add rsp, 0x60
pop rdi
ret
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push r13
push r14
push r15
sub rsp, 0x20
xor r13d, r13d
mov r14, r9
test byte [rcx + 8], 2
mov ebp, r8d
mov r15, rdx
mov rbx, rcx
mov esi, r13d
je 0x1400187bf
mov rbx, qword [rsp + 0x68]
add rsp, 0x20
pop r15
pop r14
pop r13
pop rsi
pop rbp
jmp 0x1400186f0
mov qword [rsp + 0x58], rdi
mov edi, dword [rcx + 0x28]
sub edi, dword [rcx + 0x24]
jne 0x140018857
mov r8d, dword [rcx + 0x2c]
test r8d, r8d
je 0x1400187ee
mov rdx, qword [rcx + 0x18]
call fcn.1400188d0
test eax, eax
js 0x1400188b9
mov dword [rbx + 0x2c], r13d
cmp ebp, dword [rbx + 0x20]
jb 0x14001880d
mov r9, r14
mov qword [rbx + 0x24], r13
mov r8d, ebp
mov rdx, r15
mov rcx, rbx
call 0x1400186f0
jmp 0x1400188b9
cmp qword [rbx + 0x18], rsi
jne 0x140018823
mov rcx, rbx
call fcn.140018680
test eax, eax
js 0x1400188b9
mov r8d, dword [rbx + 0x20]
lea r9, [rsp + 0x50]
mov rdx, qword [rbx + 0x18]
mov rcx, rbx
call 0x1400186f0
mov esi, eax
test eax, eax
js 0x1400188b9
mov edi, dword [rsp + 0x50]
test edi, edi
jne 0x140018850
test r14, r14
je 0x1400188b9
mov dword [r14], r13d
jmp 0x1400188b9
mov dword [rbx + 0x24], r13d
mov dword [rbx + 0x28], edi
mov edx, dword [rbx + 0x24]
cmp edi, ebp
mov rcx, r15
mov qword [rsp + 0x60], r12
cmova edi, ebp
add rdx, qword [rbx + 0x18]
mov r8d, edi
call fcn.1400e19b0
add dword [rbx + 0x24], edi
cmp edi, ebp
jae 0x1400188a6
mov eax, dword [rbx + 0x20]
cmp dword [rbx + 0x28], eax
jne 0x1400188a6
sub ebp, edi
lea rdx, [rdi + r15]
mov r8d, ebp
lea r9, [rsp + 0x50]
mov rcx, rbx
call 0x1400186f0
mov esi, eax
test eax, eax
js 0x1400188b2
add edi, dword [rsp + 0x50]
mov qword [rbx + 0x24], r13
test esi, esi
js 0x1400188b2
test r14, r14
je 0x1400188b2
mov dword [r14], edi
mov r12, qword [rsp + 0x60]
mov eax, esi
mov rdi, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x68]
add rsp, 0x20
pop r15
pop r14
pop r13
pop rsi
pop rbp
ret
Function at 0x140018780
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x60
xor eax, eax
mov rdi, r9
test byte [rcx + 8], 8
mov rbx, rcx
je 0x14001870c
lea rax, [rcx + 0x10]
mov rcx, qword [rcx]
xor r9d, r9d
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x50]
mov dword [rsp + 0x30], r8d
xor r8d, r8d
mov qword [rsp + 0x28], rdx
xor edx, edx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntdll.dll_NtReadFile]
cmp eax, 0x103
jne 0x14001875c
mov rcx, qword [rbx]
xor r8d, r8d
xor edx, edx
call qword [sym.imp.ntdll.dll_NtWaitForSingleObject]
test eax, eax
js 0x140018770
mov eax, dword [rsp + 0x50]
test eax, eax
js 0x140018770
mov rcx, qword [rsp + 0x58]
add qword [rbx + 0x10], rcx
test rdi, rdi
je 0x140018770
mov dword [rdi], ecx
mov rbx, qword [rsp + 0x70]
add rsp, 0x60
pop rdi
ret
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push r13
push r14
push r15
sub rsp, 0x20
xor r13d, r13d
mov r14, r9
test byte [rcx + 8], 2
mov ebp, r8d
mov r15, rdx
mov rbx, rcx
mov esi, r13d
je 0x1400187bf
mov rbx, qword [rsp + 0x68]
add rsp, 0x20
pop r15
pop r14
pop r13
pop rsi
pop rbp
jmp 0x1400186f0
mov qword [rsp + 0x58], rdi
mov edi, dword [rcx + 0x28]
sub edi, dword [rcx + 0x24]
jne 0x140018857
mov r8d, dword [rcx + 0x2c]
test r8d, r8d
je 0x1400187ee
mov rdx, qword [rcx + 0x18]
call fcn.1400188d0
test eax, eax
js 0x1400188b9
mov dword [rbx + 0x2c], r13d
cmp ebp, dword [rbx + 0x20]
jb 0x14001880d
mov r9, r14
mov qword [rbx + 0x24], r13
mov r8d, ebp
mov rdx, r15
mov rcx, rbx
call 0x1400186f0
jmp 0x1400188b9
cmp qword [rbx + 0x18], rsi
jne 0x140018823
mov rcx, rbx
call fcn.140018680
test eax, eax
js 0x1400188b9
mov r8d, dword [rbx + 0x20]
lea r9, [rsp + 0x50]
mov rdx, qword [rbx + 0x18]
mov rcx, rbx
call 0x1400186f0
mov esi, eax
test eax, eax
js 0x1400188b9
mov edi, dword [rsp + 0x50]
test edi, edi
jne 0x140018850
test r14, r14
je 0x1400188b9
mov dword [r14], r13d
jmp 0x1400188b9
mov dword [rbx + 0x24], r13d
mov dword [rbx + 0x28], edi
mov edx, dword [rbx + 0x24]
cmp edi, ebp
mov rcx, r15
mov qword [rsp + 0x60], r12
cmova edi, ebp
add rdx, qword [rbx + 0x18]
mov r8d, edi
call fcn.1400e19b0
add dword [rbx + 0x24], edi
cmp edi, ebp
jae 0x1400188a6
mov eax, dword [rbx + 0x20]
cmp dword [rbx + 0x28], eax
jne 0x1400188a6
sub ebp, edi
lea rdx, [rdi + r15]
mov r8d, ebp
lea r9, [rsp + 0x50]
mov rcx, rbx
call 0x1400186f0
mov esi, eax
test eax, eax
js 0x1400188b2
add edi, dword [rsp + 0x50]
mov qword [rbx + 0x24], r13
test esi, esi
js 0x1400188b2
test r14, r14
je 0x1400188b2
mov dword [r14], edi
mov r12, qword [rsp + 0x60]
mov eax, esi
mov rdi, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x68]
add rsp, 0x20
pop r15
pop r14
pop r13
pop rsi
pop rbp
ret
Function at 0x1400188d0
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x60
xor eax, eax
mov rbx, rcx
test byte [rcx + 8], 8
je 0x1400188e5
lea rax, [rcx + 0x10]
mov rcx, qword [rcx]
xor r9d, r9d
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x50]
mov dword [rsp + 0x30], r8d
xor r8d, r8d
mov qword [rsp + 0x28], rdx
xor edx, edx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntdll.dll_NtWriteFile]
mov ecx, eax
cmp eax, 0x103
jne 0x140018937
mov rcx, qword [rbx]
xor r8d, r8d
xor edx, edx
call qword [sym.imp.ntdll.dll_NtWaitForSingleObject]
test eax, eax
js 0x14001894d
mov ecx, dword [rsp + 0x50]
test ecx, ecx
js 0x14001894b
mov rax, qword [rsp + 0x58]
add qword [rbx + 0x10], rax
or dword [rbx + 8], 0x80000000
mov eax, ecx
add rsp, 0x60
pop rbx
ret

Function at 0x140018960
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
sub rsp, 0x20
xor edi, edi
mov esi, r8d
test byte [rcx + 8], 2
mov rbp, rdx
mov rbx, rcx
je 0x14001898e
mov rbx, qword [rsp + 0x50]
add rsp, 0x20
pop rdi
pop rsi
pop rbp
jmp fcn.1400188d0
cmp dword [rcx + 0x2c], edi
jne 0x1400189a2
call fcn.140018a70
mov edi, eax
test eax, eax
js 0x140018a55
mov eax, dword [rbx + 0x2c]
mov qword [rsp + 0x40], r14
mov qword [rsp + 0x48], r15
test eax, eax
je 0x140018a03
mov r14d, dword [rbx + 0x20]
sub r14d, eax
je 0x1400189e6
mov ecx, eax
cmp r14d, esi
mov rdx, rbp
cmova r14d, esi
add rcx, qword [rbx + 0x18]
mov r8d, r14d
mov r15d, r14d
call fcn.1400e19b0
add dword [rbx + 0x2c], r14d
cmp r14d, esi
je 0x140018a49
add rbp, r15
sub esi, r14d
mov r8d, dword [rbx + 0x2c]
mov rcx, rbx
mov rdx, qword [rbx + 0x18]
call fcn.1400188d0
mov edi, eax
test eax, eax
js 0x140018a4b
mov dword [rbx + 0x2c], 0
cmp esi, dword [rbx + 0x20]
jb 0x140018a1e
mov r8d, esi
mov rdx, rbp
mov rcx, rbx
call fcn.1400188d0
mov edi, eax
test eax, eax
jns 0x140018a49
jmp 0x140018a4b
test esi, esi
je 0x140018a49
cmp qword [rbx + 0x18], 0
jne 0x140018a37
mov rcx, rbx
call fcn.140018680
mov edi, eax
test eax, eax
js 0x140018a4b
mov rcx, qword [rbx + 0x18]
mov rdx, rbp
mov r8d, esi
call fcn.1400e19b0
mov dword [rbx + 0x2c], esi
mov eax, edi
mov r14, qword [rsp + 0x40]
mov r15, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x50]
add rsp, 0x20
pop rdi
pop rsi
pop rbp
ret

Function at 0x140018a70
Capabilities:
Set file attributes

Disassembly:
push rbx
sub rsp, 0x40
mov r9d, dword [rcx + 0x28]
xor edx, edx
mov r8d, dword [rcx + 0x24]
mov rbx, rcx
cmp r9d, r8d
je 0x140018ad2
sub r8d, r9d
xor ecx, ecx
movsxd rax, r8d
add qword [rbx + 0x10], rax
test byte [rbx + 8], 8
mov rax, qword [rbx + 0x10]
jne 0x140018ac4
mov rcx, qword [rbx]
lea r9d, [rdx + 8]
lea rdx, [rsp + 0x30]
mov qword [rsp + 0x50], rax
lea r8, [rsp + 0x50]
mov dword [rsp + 0x20], 0xe
call qword [sym.imp.ntdll.dll_NtSetInformationFile]
mov ecx, eax
mov edx, ecx
test ecx, ecx
jns 0x140018ad2
mov eax, ecx
add rsp, 0x40
pop rbx
ret
mov qword [rbx + 0x24], 0
mov eax, edx
add rsp, 0x40
pop rbx
ret
Function at 0x140018b90
Capabilities:
Get file attributes
Set file attributes

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x60
mov rbx, rcx
mov rdi, rdx
xor ecx, ecx
test r8d, r8d
je 0x140018c06
sub r8d, 1
je 0x140018bfd
cmp r8d, 1
jne 0x140018c0d
lea r9d, [rcx + 0x18]
mov dword [rsp + 0x20], 5
mov rcx, qword [rbx]
lea r8, [rsp + 0x40]
lea rdx, [rsp + 0x30]
call qword [sym.imp.ntdll.dll_NtQueryInformationFile]
mov edx, eax
mov ecx, eax
test eax, eax
js 0x140018be3
mov rax, qword [rsp + 0x48]
mov qword [rbx + 0x10], rax
test edx, edx
jns 0x140018bf4
mov eax, edx
mov rbx, qword [rsp + 0x70]
add rsp, 0x60
pop rdi
ret
mov rax, qword [rdi]
add qword [rbx + 0x10], rax
jmp 0x140018c0d
mov rax, qword [rdx]
add qword [rbx + 0x10], rax
jmp 0x140018c0d
mov rax, qword [rdx]
mov qword [rbx + 0x10], rax
test byte [rbx + 8], 8
jne 0x140018c49
mov rax, qword [rbx + 0x10]
lea r8, [rsp + 0x88]
mov rcx, qword [rbx]
lea rdx, [rsp + 0x30]
mov r9d, 8
mov qword [rsp + 0x88], rax
mov dword [rsp + 0x20], 0xe
call qword [sym.imp.ntdll.dll_NtSetInformationFile]
mov ecx, eax
test eax, eax
js 0x140018c4b
mov eax, ecx
mov rbx, qword [rsp + 0x70]
add rsp, 0x60
pop rdi
ret
Function at 0x140019100
Capabilities:
Create service
Delete service
Start service

Disassembly:
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x2b0
mov edi, 1
mov qword [rsp + 0x80], 0x10
lea rax, str.Device_
mov dword [rsp + 0x70], edi
mov qword [rsp + 0x88], rax
lea rcx, [rsp + 0x70]
mov r15, r8
mov dword [rsp + 0x90], edi
mov r12, rdx
mov qword [rsp + 0xa0], 0x1e
lea rax, str.KProcessHacker2
xor r13d, r13d
lea edx, [rdi + 1]
mov qword [rsp + 0xa8], rax
mov r9d, 0x200
mov qword [rsp + 0x20], r13
lea r8, [rsp + 0xb0]
xor sil, sil
xor r14b, r14b
call sym.ProcessHacker.exe_PhFormatToBuffer
test al, al
jne 0x140019198
mov eax, 0xc0000106
jmp 0x140019363
lea rcx, [rsp + 0xb0]
mov qword [rsp + 0x2e0], rbx
call fcn.140018ff0
mov ebx, eax
mov eax, 0x80000000
lea ecx, [rbx + rax]
test eax, ecx
jne 0x140019359
cmp ebx, 0xc000020a
je 0x140019359
lea eax, [rbx + 0x3ffffff2]
cmp eax, 0x2c
ja 0x140019359
movabs rcx, 0x104000000003
bt rcx, rax
jae 0x140019359
mov r8d, edi
mov qword [rsp + 0x2e8], rbp
xor edx, edx
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov rbp, rax
test rax, rax
je 0x140019265
mov r8d, 0x10
lea rdx, str.KProcessHacker2
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov rdi, rax
test rax, rax
je 0x14001924e
xor r8d, r8d
xor edx, edx
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_StartServiceW]
movzx esi, sil
mov rcx, rdi
test eax, eax
mov eax, 1
cmovne esi, eax
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rbp
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
test sil, sil
jne 0x14001932b
mov edi, 1
mov rcx, r12
call qword [sym.imp.ntdll.dll_RtlDoesFileExists_U]
test al, al
je 0x140019351
xor edx, edx
xor ecx, ecx
lea r8d, [rdx + 2]
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov rbp, rax
test rax, rax
je 0x140019351
lea rax, [0x140122b94]
mov r9d, 0xf01ff
mov qword [rsp + 0x60], rax
lea r8, str.KProcessHacker2
mov qword [rsp + 0x58], r13
lea rdx, str.KProcessHacker2
mov qword [rsp + 0x50], r13
mov rcx, rbp
mov qword [rsp + 0x48], r13
mov qword [rsp + 0x40], r13
mov qword [rsp + 0x38], r12
mov dword [rsp + 0x30], r13d
mov dword [rsp + 0x28], 3
mov dword [rsp + 0x20], edi
call qword [sym.imp.ADVAPI32.dll_CreateServiceW]
mov rdi, rax
test rax, rax
je 0x14001931d
mov r14b, 1
test r15, r15
je 0x140019301
mov rdx, r15
call fcn.140019380
mov ebx, eax
test eax, eax
js 0x14001933f
xor r8d, r8d
xor edx, edx
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_StartServiceW]
test eax, eax
movzx esi, sil
mov eax, 1
cmovne esi, eax
mov rcx, rbp
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
test sil, sil
je 0x14001933a
lea rcx, [rsp + 0xb0]
call fcn.140018ff0
mov ebx, eax
test r14b, r14b
je 0x140019351
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_DeleteService]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rbp, qword [rsp + 0x2e8]
mov eax, ebx
mov rbx, qword [rsp + 0x2e0]
mov rsi, qword [rsp + 0x2f0]
add rsp, 0x2b0
pop r15
pop r14
pop r13
pop r12
pop rdi
ret