joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140172480
Capabilities:
Parse pe header

Disassembly:
push rdi
sub rsp, 0x40
xor edi, edi
test byte [0x1402c6230], 1
jne 0x1401725fc
lock bts qword [0x1402c6230], 0x1f
setb al
test al, al
je 0x1401724ca
test byte [0x1402c6230], 1
jne 0x1401725fc
xor edx, edx
lea rcx, [0x1402c6230]
call sym.SystemInformer.exe_PhfWaitForEvent
jmp 0x1401725fc
mov qword [rsp + 0x50], rbx
lea rdx, [rsp + 0x30]
lea rbx, str.advapi32.dll
mov qword [rsp + 0x30], 0x18
mov qword [rsp + 0x38], rbx
call fcn.14017e120
mov rcx, rax
test rax, rax
jne 0x140172555
xor edx, edx
mov r8d, 0x800
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
test rax, rax
jne 0x140172555
xor edx, edx
mov r8d, 0x200
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
test rax, rax
jne 0x140172555
cmp dword [0x1402bff40], 0x3e
jae 0x1401725eb
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
test rax, rax
je 0x1401725eb
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x1401725eb
mov edx, dword [rcx + 0x3c]
lea eax, [rdx - 1]
cmp eax, 0x7ffffffd
ja 0x1401725eb
cmp dword [rdx + rcx], 0x4550
jne 0x1401725eb
add rdx, 0x88
add rdx, rcx
mov eax, dword [rdx]
test eax, eax
je 0x1401725eb
cmp dword [rdx + 4], edi
je 0x1401725eb
lea r8, [rcx + rax]
mov word [rsp + 0x20], di
lea r9, str.ConvertStringSecurityDescriptorToSecurityDescriptorW
call fcn.14017e4c0
mov r9, rax
test rax, rax
je 0x1401725eb
mov r8, qword [0x7ffe0320]
mov ecx, dword [0x7ffe0004]
mov eax, r8d
shr r8, 0x20
imul rax, rcx
imul r8, rcx
shr rax, 0x18
shl r8, 8
add rax, r8
mov qword [0x1402ce0b0], rax
xor rax, r9
mov qword [0x1402ce078], rax
lea rcx, [0x1402c6230]
call sym.SystemInformer.exe_PhfSetEvent
mov rbx, qword [rsp + 0x50]
mov rax, qword [0x1402ce078]
test rax, rax
je 0x14017261d
mov rcx, qword [0x1402ce0b0]
test rcx, rcx
je 0x14017261d
xor rax, rcx
add rsp, 0x40
pop rdi
ret
mov rax, rdi
add rsp, 0x40
pop rdi
ret
Function at 0x140172640
Capabilities:
Parse pe header

Disassembly:
push rdi
sub rsp, 0x40
xor edi, edi
test byte [0x1402c61b0], 1
jne 0x1401727bc
lock bts qword [0x1402c61b0], 0x1f
setb al
test al, al
je 0x14017268a
test byte [0x1402c61b0], 1
jne 0x1401727bc
xor edx, edx
lea rcx, [0x1402c61b0]
call sym.SystemInformer.exe_PhfWaitForEvent
jmp 0x1401727bc
mov qword [rsp + 0x50], rbx
lea rdx, [rsp + 0x30]
lea rbx, str.shlwapi.dll
mov qword [rsp + 0x30], 0x16
mov qword [rsp + 0x38], rbx
call fcn.14017e120
mov rcx, rax
test rax, rax
jne 0x140172715
xor edx, edx
mov r8d, 0x800
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
test rax, rax
jne 0x140172715
xor edx, edx
mov r8d, 0x200
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
test rax, rax
jne 0x140172715
cmp dword [0x1402bff40], 0x3e
jae 0x1401727ab
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
test rax, rax
je 0x1401727ab
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x1401727ab
mov edx, dword [rcx + 0x3c]
lea eax, [rdx - 1]
cmp eax, 0x7ffffffd
ja 0x1401727ab
cmp dword [rdx + rcx], 0x4550
jne 0x1401727ab
add rdx, 0x88
add rdx, rcx
mov eax, dword [rdx]
test eax, eax
je 0x1401727ab
cmp dword [rdx + 4], edi
je 0x1401727ab
lea r8, [rcx + rax]
mov word [rsp + 0x20], di
lea r9, str.SHAutoComplete
call fcn.14017e4c0
mov r9, rax
test rax, rax
je 0x1401727ab
mov r8, qword [0x7ffe0320]
mov ecx, dword [0x7ffe0004]
mov eax, r8d
shr r8, 0x20
imul rax, rcx
imul r8, rcx
shr rax, 0x18
shl r8, 8
add rax, r8
mov qword [0x1402ce020], rax
xor rax, r9
mov qword [0x1402ce0a0], rax
lea rcx, [0x1402c61b0]
call sym.SystemInformer.exe_PhfSetEvent
mov rbx, qword [rsp + 0x50]
mov rax, qword [0x1402ce0a0]
test rax, rax
je 0x1401727dd
mov rcx, qword [0x1402ce020]
test rcx, rcx
je 0x1401727dd
xor rax, rcx
add rsp, 0x40
pop rdi
ret
mov rax, rdi
add rsp, 0x40
pop rdi
ret
Function at 0x140172800
Capabilities:
Parse pe header

Disassembly:
push rdi
sub rsp, 0x40
xor edi, edi
test byte [0x1402c61d0], 1
jne 0x14017297c
lock bts qword [0x1402c61d0], 0x1f
setb al
test al, al
je 0x14017284a
test byte [0x1402c61d0], 1
jne 0x14017297c
xor edx, edx
lea rcx, [0x1402c61d0]
call sym.SystemInformer.exe_PhfWaitForEvent
jmp 0x14017297c
mov qword [rsp + 0x50], rbx
lea rdx, [rsp + 0x30]
lea rbx, str.kernel32.dll
mov qword [rsp + 0x30], 0x18
mov qword [rsp + 0x38], rbx
call fcn.14017e120
mov rcx, rax
test rax, rax
jne 0x1401728d5
xor edx, edx
mov r8d, 0x800
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
test rax, rax
jne 0x1401728d5
xor edx, edx
mov r8d, 0x200
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
test rax, rax
jne 0x1401728d5
cmp dword [0x1402bff40], 0x3e
jae 0x14017296b
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
test rax, rax
je 0x14017296b
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x14017296b
mov edx, dword [rcx + 0x3c]
lea eax, [rdx - 1]
cmp eax, 0x7ffffffd
ja 0x14017296b
cmp dword [rdx + rcx], 0x4550
jne 0x14017296b
add rdx, 0x88
add rdx, rcx
mov eax, dword [rdx]
test eax, eax
je 0x14017296b
cmp dword [rdx + 4], edi
je 0x14017296b
lea r8, [rcx + rax]
mov word [rsp + 0x20], di
lea r9, str.PssCaptureSnapshot
call fcn.14017e4c0
mov r9, rax
test rax, rax
je 0x14017296b
mov r8, qword [0x7ffe0320]
mov ecx, dword [0x7ffe0004]
mov eax, r8d
shr r8, 0x20
imul rax, rcx
imul r8, rcx
shr rax, 0x18
shl r8, 8
add rax, r8
mov qword [0x1402ce128], rax
xor rax, r9
mov qword [0x1402ce008], rax
lea rcx, [0x1402c61d0]
call sym.SystemInformer.exe_PhfSetEvent
mov rbx, qword [rsp + 0x50]
mov rax, qword [0x1402ce008]
test rax, rax
je 0x14017299d
mov rcx, qword [0x1402ce128]
test rcx, rcx
je 0x14017299d
xor rax, rcx
add rsp, 0x40
pop rdi
ret
mov rax, rdi
add rsp, 0x40
pop rdi
ret
Function at 0x1401729c0
Capabilities:
Parse pe header

Disassembly:
push rdi
sub rsp, 0x40
xor edi, edi
test byte [0x1402c6250], 1
jne 0x140172b3c
lock bts qword [0x1402c6250], 0x1f
setb al
test al, al
je 0x140172a0a
test byte [0x1402c6250], 1
jne 0x140172b3c
xor edx, edx
lea rcx, [0x1402c6250]
call sym.SystemInformer.exe_PhfWaitForEvent
jmp 0x140172b3c
mov qword [rsp + 0x50], rbx
lea rdx, [rsp + 0x30]
lea rbx, str.kernel32.dll
mov qword [rsp + 0x30], 0x18
mov qword [rsp + 0x38], rbx
call fcn.14017e120
mov rcx, rax
test rax, rax
jne 0x140172a95
xor edx, edx
mov r8d, 0x800
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
test rax, rax
jne 0x140172a95
xor edx, edx
mov r8d, 0x200
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
test rax, rax
jne 0x140172a95
cmp dword [0x1402bff40], 0x3e
jae 0x140172b2b
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
test rax, rax
je 0x140172b2b
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x140172b2b
mov edx, dword [rcx + 0x3c]
lea eax, [rdx - 1]
cmp eax, 0x7ffffffd
ja 0x140172b2b
cmp dword [rdx + rcx], 0x4550
jne 0x140172b2b
add rdx, 0x88
add rdx, rcx
mov eax, dword [rdx]
test eax, eax
je 0x140172b2b
cmp dword [rdx + 4], edi
je 0x140172b2b
lea r8, [rcx + rax]
mov word [rsp + 0x20], di
lea r9, str.PssQuerySnapshot
call fcn.14017e4c0
mov r9, rax
test rax, rax
je 0x140172b2b
mov r8, qword [0x7ffe0320]
mov ecx, dword [0x7ffe0004]
mov eax, r8d
shr r8, 0x20
imul rax, rcx
imul r8, rcx
shr rax, 0x18
shl r8, 8
add rax, r8
mov qword [0x1402ce018], rax
xor rax, r9
mov qword [0x1402cdfe8], rax
lea rcx, [0x1402c6250]
call sym.SystemInformer.exe_PhfSetEvent
mov rbx, qword [rsp + 0x50]
mov rax, qword [0x1402cdfe8]
test rax, rax
je 0x140172b5d
mov rcx, qword [0x1402ce018]
test rcx, rcx
je 0x140172b5d
xor rax, rcx
add rsp, 0x40
pop rdi
ret
mov rax, rdi
add rsp, 0x40
pop rdi
ret
Function at 0x140172b80
Capabilities:
Parse pe header

Disassembly:
push rdi
sub rsp, 0x40
xor edi, edi
test byte [0x1402c6270], 1
jne 0x140172cfc
lock bts qword [0x1402c6270], 0x1f
setb al
test al, al
je 0x140172bca
test byte [0x1402c6270], 1
jne 0x140172cfc
xor edx, edx
lea rcx, [0x1402c6270]
call sym.SystemInformer.exe_PhfWaitForEvent
jmp 0x140172cfc
mov qword [rsp + 0x50], rbx
lea rdx, [rsp + 0x30]
lea rbx, str.kernel32.dll
mov qword [rsp + 0x30], 0x18
mov qword [rsp + 0x38], rbx
call fcn.14017e120
mov rcx, rax
test rax, rax
jne 0x140172c55
xor edx, edx
mov r8d, 0x800
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
test rax, rax
jne 0x140172c55
xor edx, edx
mov r8d, 0x200
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
test rax, rax
jne 0x140172c55
cmp dword [0x1402bff40], 0x3e
jae 0x140172ceb
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
test rax, rax
je 0x140172ceb
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x140172ceb
mov edx, dword [rcx + 0x3c]
lea eax, [rdx - 1]
cmp eax, 0x7ffffffd
ja 0x140172ceb
cmp dword [rdx + rcx], 0x4550
jne 0x140172ceb
add rdx, 0x88
add rdx, rcx
mov eax, dword [rdx]
test eax, eax
je 0x140172ceb
cmp dword [rdx + 4], edi
je 0x140172ceb
lea r8, [rcx + rax]
mov word [rsp + 0x20], di
lea r9, str.PssFreeSnapshot
call fcn.14017e4c0
mov r9, rax
test rax, rax
je 0x140172ceb
mov r8, qword [0x7ffe0320]
mov ecx, dword [0x7ffe0004]
mov eax, r8d
shr r8, 0x20
imul rax, rcx
imul r8, rcx
shr rax, 0x18
shl r8, 8
add rax, r8
mov qword [0x1402ce0d8], rax
xor rax, r9
mov qword [0x1402ce030], rax
lea rcx, [0x1402c6270]
call sym.SystemInformer.exe_PhfSetEvent
mov rbx, qword [rsp + 0x50]
mov rax, qword [0x1402ce030]
test rax, rax
je 0x140172d1d
mov rcx, qword [0x1402ce0d8]
test rcx, rcx
je 0x140172d1d
xor rax, rcx
add rsp, 0x40
pop rdi
ret
mov rax, rdi
add rsp, 0x40
pop rdi
ret
Function at 0x140172d40
Capabilities:
Parse pe header

Disassembly:
push rdi
sub rsp, 0x40
xor edi, edi
test byte [0x1402c6220], 1
jne 0x140172ebc
lock bts qword [0x1402c6220], 0x1f
setb al
test al, al
je 0x140172d8a
test byte [0x1402c6220], 1
jne 0x140172ebc
xor edx, edx
lea rcx, [0x1402c6220]
call sym.SystemInformer.exe_PhfWaitForEvent
jmp 0x140172ebc
mov qword [rsp + 0x50], rbx
lea rdx, [rsp + 0x30]
lea rbx, str.userenv.dll
mov qword [rsp + 0x30], 0x16
mov qword [rsp + 0x38], rbx
call fcn.14017e120
mov rcx, rax
test rax, rax
jne 0x140172e15
xor edx, edx
mov r8d, 0x800
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
test rax, rax
jne 0x140172e15
xor edx, edx
mov r8d, 0x200
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
test rax, rax
jne 0x140172e15
cmp dword [0x1402bff40], 0x3e
jae 0x140172eab
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
test rax, rax
je 0x140172eab
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x140172eab
mov edx, dword [rcx + 0x3c]
lea eax, [rdx - 1]
cmp eax, 0x7ffffffd
ja 0x140172eab
cmp dword [rdx + rcx], 0x4550
jne 0x140172eab
add rdx, 0x88
add rdx, rcx
mov eax, dword [rdx]
test eax, eax
je 0x140172eab
cmp dword [rdx + 4], edi
je 0x140172eab
lea r8, [rcx + rax]
mov word [rsp + 0x20], di
lea r9, str.CreateEnvironmentBlock
call fcn.14017e4c0
mov r9, rax
test rax, rax
je 0x140172eab
mov r8, qword [0x7ffe0320]
mov ecx, dword [0x7ffe0004]
mov eax, r8d
shr r8, 0x20
imul rax, rcx
imul r8, rcx
shr rax, 0x18
shl r8, 8
add rax, r8
mov qword [0x1402ce058], rax
xor rax, r9
mov qword [0x1402ce0f8], rax
lea rcx, [0x1402c6220]
call sym.SystemInformer.exe_PhfSetEvent
mov rbx, qword [rsp + 0x50]
mov rax, qword [0x1402ce0f8]
test rax, rax
je 0x140172edd
mov rcx, qword [0x1402ce058]
test rcx, rcx
je 0x140172edd
xor rax, rcx
add rsp, 0x40
pop rdi
ret
mov rax, rdi
add rsp, 0x40
pop rdi
ret
Function at 0x140172f00
Capabilities:
Parse pe header

Disassembly:
push rdi
sub rsp, 0x40
xor edi, edi
test byte [0x1402c6150], 1
jne 0x14017307c
lock bts qword [0x1402c6150], 0x1f
setb al
test al, al
je 0x140172f4a
test byte [0x1402c6150], 1
jne 0x14017307c
xor edx, edx
lea rcx, [0x1402c6150]
call sym.SystemInformer.exe_PhfWaitForEvent
jmp 0x14017307c
mov qword [rsp + 0x50], rbx
lea rdx, [rsp + 0x30]
lea rbx, str.userenv.dll
mov qword [rsp + 0x30], 0x16
mov qword [rsp + 0x38], rbx
call fcn.14017e120
mov rcx, rax
test rax, rax
jne 0x140172fd5
xor edx, edx
mov r8d, 0x800
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
test rax, rax
jne 0x140172fd5
xor edx, edx
mov r8d, 0x200
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
test rax, rax
jne 0x140172fd5
cmp dword [0x1402bff40], 0x3e
jae 0x14017306b
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
test rax, rax
je 0x14017306b
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x14017306b
mov edx, dword [rcx + 0x3c]
lea eax, [rdx - 1]
cmp eax, 0x7ffffffd
ja 0x14017306b
cmp dword [rdx + rcx], 0x4550
jne 0x14017306b
add rdx, 0x88
add rdx, rcx
mov eax, dword [rdx]
test eax, eax
je 0x14017306b
cmp dword [rdx + 4], edi
je 0x14017306b
lea r8, [rcx + rax]
mov word [rsp + 0x20], di
lea r9, str.DestroyEnvironmentBlock
call fcn.14017e4c0
mov r9, rax
test rax, rax
je 0x14017306b
mov r8, qword [0x7ffe0320]
mov ecx, dword [0x7ffe0004]
mov eax, r8d
shr r8, 0x20
imul rax, rcx
imul r8, rcx
shr rax, 0x18
shl r8, 8
add rax, r8
mov qword [0x1402ce028], rax
xor rax, r9
mov qword [0x1402ce090], rax
lea rcx, [0x1402c6150]
call sym.SystemInformer.exe_PhfSetEvent
mov rbx, qword [rsp + 0x50]
mov rax, qword [0x1402ce090]
test rax, rax
je 0x14017309d
mov rcx, qword [0x1402ce028]
test rcx, rcx
je 0x14017309d
xor rax, rcx
add rsp, 0x40
pop rdi
ret
mov rax, rdi
add rsp, 0x40
pop rdi
ret
Function at 0x1401730c0
Capabilities:
Parse pe header

Disassembly:
push rdi
sub rsp, 0x40
xor edi, edi
test byte [0x1402c6240], 1
jne 0x14017323c
lock bts qword [0x1402c6240], 0x1f
setb al
test al, al
je 0x14017310a
test byte [0x1402c6240], 1
jne 0x14017323c
xor edx, edx
lea rcx, [0x1402c6240]
call sym.SystemInformer.exe_PhfWaitForEvent
jmp 0x14017323c
mov qword [rsp + 0x50], rbx
lea rdx, [rsp + 0x30]
lea rbx, str.userenv.dll
mov qword [rsp + 0x30], 0x16
mov qword [rsp + 0x38], rbx
call fcn.14017e120
mov rcx, rax
test rax, rax
jne 0x140173195
xor edx, edx
mov r8d, 0x800
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
test rax, rax
jne 0x140173195
xor edx, edx
mov r8d, 0x200
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
test rax, rax
jne 0x140173195
cmp dword [0x1402bff40], 0x3e
jae 0x14017322b
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
test rax, rax
je 0x14017322b
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x14017322b
mov edx, dword [rcx + 0x3c]
lea eax, [rdx - 1]
cmp eax, 0x7ffffffd
ja 0x14017322b
cmp dword [rdx + rcx], 0x4550
jne 0x14017322b
add rdx, 0x88
add rdx, rcx
mov eax, dword [rdx]
test eax, eax
je 0x14017322b
cmp dword [rdx + 4], edi
je 0x14017322b
lea r8, [rcx + rax]
mov word [rsp + 0x20], di
lea r9, str.GetAppContainerRegistryLocation
call fcn.14017e4c0
mov r9, rax
test rax, rax
je 0x14017322b
mov r8, qword [0x7ffe0320]
mov ecx, dword [0x7ffe0004]
mov eax, r8d
shr r8, 0x20
imul rax, rcx
imul r8, rcx
shr rax, 0x18
shl r8, 8
add rax, r8
mov qword [0x1402ce0d0], rax
xor rax, r9
mov qword [0x1402ce088], rax
lea rcx, [0x1402c6240]
call sym.SystemInformer.exe_PhfSetEvent
mov rbx, qword [rsp + 0x50]
mov rax, qword [0x1402ce088]
test rax, rax
je 0x14017325d
mov rcx, qword [0x1402ce0d0]
test rcx, rcx
je 0x14017325d
xor rax, rcx
add rsp, 0x40
pop rdi
ret
mov rax, rdi
add rsp, 0x40
pop rdi
ret
Function at 0x140173280
Capabilities:
Parse pe header

Disassembly:
push rdi
sub rsp, 0x40
xor edi, edi
test byte [0x1402c6130], 1
jne 0x1401733fc
lock bts qword [0x1402c6130], 0x1f
setb al
test al, al
je 0x1401732ca
test byte [0x1402c6130], 1
jne 0x1401733fc
xor edx, edx
lea rcx, [0x1402c6130]
call sym.SystemInformer.exe_PhfWaitForEvent
jmp 0x1401733fc
mov qword [rsp + 0x50], rbx
lea rdx, [rsp + 0x30]
lea rbx, [0x1402675e0]
mov qword [rsp + 0x30], 0x14
mov qword [rsp + 0x38], rbx
call fcn.14017e120
mov rcx, rax
test rax, rax
jne 0x140173355
xor edx, edx
mov r8d, 0x800
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
test rax, rax
jne 0x140173355
xor edx, edx
mov r8d, 0x200
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
test rax, rax
jne 0x140173355
cmp dword [0x1402bff40], 0x3e
jae 0x1401733eb
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
test rax, rax
je 0x1401733eb
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x1401733eb
mov edx, dword [rcx + 0x3c]
lea eax, [rdx - 1]
cmp eax, 0x7ffffffd
ja 0x1401733eb
cmp dword [rdx + rcx], 0x4550
jne 0x1401733eb
add rdx, 0x88
add rdx, rcx
mov eax, dword [rdx]
test eax, eax
je 0x1401733eb
cmp dword [rdx + 4], edi
je 0x1401733eb
lea r8, [rcx + rax]
mov word [rsp + 0x20], di
lea r9, str.SetWindowDisplayAffinity
call fcn.14017e4c0
mov r9, rax
test rax, rax
je 0x1401733eb
mov r8, qword [0x7ffe0320]
mov ecx, dword [0x7ffe0004]
mov eax, r8d
shr r8, 0x20
imul rax, rcx
imul r8, rcx
shr rax, 0x18
shl r8, 8
add rax, r8
mov qword [0x1402cdfd8], rax
xor rax, r9
mov qword [0x1402ce0c8], rax
lea rcx, [0x1402c6130]
call sym.SystemInformer.exe_PhfSetEvent
mov rbx, qword [rsp + 0x50]
mov rax, qword [0x1402ce0c8]
test rax, rax
je 0x14017341d
mov rcx, qword [0x1402cdfd8]
test rcx, rcx
je 0x14017341d
xor rax, rcx
add rsp, 0x40
pop rdi
ret
mov rax, rdi
add rsp, 0x40
pop rdi
ret
Function at 0x1401740e0
Capabilities:
Enumerate services

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x50
mov eax, dword [0x1402bff40]
mov r15, rdx
mov r12, rcx
cmp eax, 0x66
jb 0x14017410c
mov edi, 0x3ff
jmp 0x14017411c
cmp eax, 0x64
mov edi, 0x3b
mov ecx, 0x1ff
cmovae edi, ecx
xor r13d, r13d
xor eax, eax
lock cmpxchg qword [0x1402ce150], r13
mov rbp, rax
jne 0x140174166
xor edx, edx
xor ecx, ecx
mov r8d, 5
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov rcx, rax
test rax, rax
je 0x140174166
xor eax, eax
lock cmpxchg qword [0x1402ce150], rcx
mov rbp, rax
jne 0x14017415c
mov rbp, rcx
jmp 0x140174166
nop dword [rax]
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov esi, dword [0x1402c6284]
mov edx, 4
mov rcx, qword [0x1402caaf0]
mov r8d, esi
mov qword [rsp + 0x90], rbx
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov qword [rsp + 0x48], r13
mov r9d, 3
mov r14, rax
mov qword [rsp + 0x40], r13
lea rax, [rsp + 0xa8]
mov r8d, edi
mov qword [rsp + 0x38], rax
xor edx, edx
lea rax, [rsp + 0xa0]
mov rcx, rbp
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], r14
call qword [sym.imp.ADVAPI32.dll_EnumServicesStatusExW]
test eax, eax
jne 0x1401742ca
cmp dword [0x1402bff40], 0xffffffff
jae 0x1401741ec
mov rax, qword gs:[0x30]
mov eax, dword [rax + 0x68]
jmp 0x1401741f2
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call sym.SystemInformer.exe_PhDosErrorToNtStatus
mov ebx, eax
cmp eax, 0x105
jne 0x1401742af
mov rcx, qword [0x1402caaf0]
mov r8, r14
xor edx, edx
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
add esi, dword [rsp + 0xa0]
mov edx, 4
mov rcx, qword [0x1402caaf0]
mov r8d, esi
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov qword [rsp + 0x48], r13
mov r9d, 3
mov r14, rax
mov qword [rsp + 0x40], r13
lea rax, [rsp + 0xa8]
mov r8d, edi
mov qword [rsp + 0x38], rax
xor edx, edx
lea rax, [rsp + 0xa0]
mov rcx, rbp
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], r14
call qword [sym.imp.ADVAPI32.dll_EnumServicesStatusExW]
nop dword [rax]
test eax, eax
jne 0x1401742ca
cmp dword [0x1402bff40], 0xffffffff
jae 0x14017429b
mov rax, qword gs:[0x30]
mov eax, dword [rax + 0x68]
jmp 0x1401742a6
nop dword [rax + rax]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call sym.SystemInformer.exe_PhDosErrorToNtStatus
mov ebx, eax
test ebx, ebx
jns 0x1401742cd
lfence
mov rcx, qword [0x1402caaf0]
mov r8, r14
xor edx, edx
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
jmp 0x1401742ec
mov ebx, r13d
lfence
cmp esi, 0x20000
ja 0x1401742de
mov dword [0x1402c6284], esi
mov eax, dword [rsp + 0xa8]
mov dword [r15], eax
mov qword [r12], r14
mov eax, ebx
mov rbx, qword [rsp + 0x90]
add rsp, 0x50
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x140174320
Capabilities:
Enumerate services

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
push rsi
push rdi
push r14
sub rsp, 0x40
mov rsi, r8
mov r14, rdx
mov rbp, rcx
mov edx, 4
mov rcx, qword [0x1402caaf0]
mov r8d, 0x800
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov r9d, 0x800
mov edx, 3
mov rdi, rax
mov rcx, rbp
lea rax, [rsp + 0x30]
mov r8, rdi
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x78]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_EnumDependentServicesW]
test eax, eax
je 0x1401743ad
xor ebx, ebx
lfence
mov eax, dword [rsp + 0x30]
mov qword [r14], rdi
mov dword [rsi], eax
mov rbp, qword [rsp + 0x68]
mov eax, ebx
mov rbx, qword [rsp + 0x60]
add rsp, 0x40
pop r14
pop rdi
pop rsi
ret
cmp dword [0x1402bff40], 0xffffffff
jae 0x1401743c4
mov rax, qword gs:[0x30]
mov eax, dword [rax + 0x68]
jmp 0x1401743ca
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call sym.SystemInformer.exe_PhDosErrorToNtStatus
mov ebx, eax
cmp eax, 0x105
jne 0x140174467
mov rcx, qword [0x1402caaf0]
mov r8, rdi
xor edx, edx
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
mov ebx, dword [rsp + 0x78]
mov edx, 4
mov rcx, qword [0x1402caaf0]
mov r8d, ebx
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov r9d, ebx
mov edx, 3
mov rdi, rax
mov rcx, rbp
lea rax, [rsp + 0x30]
mov r8, rdi
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x78]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_EnumDependentServicesW]
test eax, eax
jne 0x14017438a
cmp dword [0x1402bff40], 0xffffffff
jae 0x140174453
mov rax, qword gs:[0x30]
mov eax, dword [rax + 0x68]
jmp 0x140174459
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call sym.SystemInformer.exe_PhDosErrorToNtStatus
mov ebx, eax
test ebx, ebx
jns 0x14017438c
lfence
mov rcx, qword [0x1402caaf0]
mov r8, rdi
xor edx, edx
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
jmp 0x140174398