joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400128d0
Capabilities:
Get file attributes
Set file attributes

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x60
mov rbx, rcx
xor ecx, ecx
mov rdi, rdx
test r8d, r8d
je 0x140012949
sub r8d, 1
je 0x140012940
cmp r8d, 1
jne 0x140012950
lea r9d, [rcx + 0x18]
mov rcx, qword [rbx]
lea r8, [rsp + 0x40]
lea rdx, [rsp + 0x30]
mov dword [rsp + 0x20], 5
call qword [sym.imp.ntdll.dll_NtQueryInformationFile]
mov r11d, eax
mov ecx, eax
test eax, eax
js 0x140012924
mov rax, qword [rsp + 0x48]
mov qword [rbx + 0x10], rax
test r11d, r11d
jns 0x140012937
mov eax, r11d
mov rbx, qword [rsp + 0x70]
add rsp, 0x60
pop rdi
ret
mov rax, qword [rdi]
add qword [rbx + 0x10], rax
jmp 0x140012950
mov rax, qword [rdx]
add qword [rbx + 0x10], rax
jmp 0x140012950
mov rax, qword [rdx]
mov qword [rbx + 0x10], rax
test byte [rbx + 8], 8
jne 0x14001298c
mov rax, qword [rbx + 0x10]
mov rcx, qword [rbx]
lea r8, [rsp + 0x88]
lea rdx, [rsp + 0x30]
mov r9d, 8
mov qword [rsp + 0x88], rax
mov dword [rsp + 0x20], 0xe
call qword [sym.imp.ntdll.dll_NtSetInformationFile]
mov ecx, eax
test eax, eax
js 0x14001298e
mov eax, ecx
mov rbx, qword [rsp + 0x70]
add rsp, 0x60
pop rdi
ret
Function at 0x140012d60
Capabilities:
Create service
Delete service
Start service

Disassembly:
push rbp
push rsi
push r12
push r13
push r14
sub rsp, 0x280
mov r14, r8
mov r13, rcx
lea rbp, str.KProcessHacker2
xor sil, sil
xor r12b, r12b
test rdx, rdx
cmovne rbp, rdx
lea r8, str.Device_s
lea rcx, [rsp + 0x70]
mov r9, rbp
mov edx, 0x104
call fcn.140094c64
lea rdx, [rsp + 0x70]
mov rcx, r13
call sym.ProcessHacker.exe_KphConnect
test eax, eax
jns 0x140012f26
cmp eax, 0xc000000e
je 0x140012dd8
cmp eax, 0xc000000f
je 0x140012dd8
cmp eax, 0xc0000034
je 0x140012dd8
cmp eax, 0xc000003a
jne 0x140012f26
mov qword [rsp + 0x2b0], rbx
mov qword [rsp + 0x2c0], rdi
mov qword [rsp + 0x2c8], r15
mov r15d, 1
xor edx, edx
xor ecx, ecx
mov r8d, r15d
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov rdi, rax
test rax, rax
je 0x140012e58
lea r8d, [r15 + 0xf]
mov rdx, rbp
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov rbx, rax
test rax, rax
je 0x140012e44
xor r8d, r8d
xor edx, edx
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_StartServiceW]
movzx esi, sil
mov rcx, rbx
test eax, eax
cmovne esi, r15d
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
test sil, sil
jne 0x140012ee6
jmp 0x140012e60
mov rbx, qword [rsp + 0x2b8]
xor edx, edx
xor ecx, ecx
lea r8d, [rdx + 2]
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov rdi, rax
test rax, rax
je 0x140012ee6
lea rax, [0x1400aa7c0]
mov r9d, 0xf01ff
mov r8, rbp
mov qword [rsp + 0x60], rax
xor eax, eax
mov rdx, rbp
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], r14
mov dword [rsp + 0x30], eax
mov rcx, rdi
mov dword [rsp + 0x28], 3
mov dword [rsp + 0x20], r15d
call qword [sym.imp.ADVAPI32.dll_CreateServiceW]
mov rbx, rax
test rax, rax
je 0x140012edd
xor r8d, r8d
xor edx, edx
mov rcx, rax
movzx r12d, r15b
call qword [sym.imp.ADVAPI32.dll_StartServiceW]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
lea rdx, [rsp + 0x70]
mov rcx, r13
call sym.ProcessHacker.exe_KphConnect
mov r15, qword [rsp + 0x2c8]
mov edi, eax
test r12b, r12b
je 0x140012f14
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_DeleteService]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rbx, qword [rsp + 0x2b0]
mov eax, edi
mov rdi, qword [rsp + 0x2c0]
add rsp, 0x280
pop r14
pop r13
pop r12
pop rsi
pop rbp
ret
Function at 0x140012f80
Capabilities:
Create service
Start service

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x70
xor ebx, ebx
test rcx, rcx
mov rbp, rdx
lea rdi, str.KProcessHacker2
lea r8d, [rbx + 2]
cmovne rdi, rcx
xor edx, edx
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov rsi, rax
test rax, rax
jne 0x140012fe5
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jg 0x140012fd2
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x1400130b2
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx eax, ax
or eax, 0xc0070000
jmp 0x1400130b2
lea rax, [0x1400aa7c0]
mov r9d, 0xf01ff
mov r8, rdi
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x58], rbx
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x38], rbp
mov dword [rsp + 0x30], ebx
mov rdx, rdi
mov rcx, rsi
mov dword [rsp + 0x28], 1
mov dword [rsp + 0x20], 1
call qword [sym.imp.ADVAPI32.dll_CreateServiceW]
mov rdi, rax
test rax, rax
je 0x140013084
xor r8d, r8d
xor edx, edx
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_StartServiceW]
test eax, eax
jne 0x140013079
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jg 0x14001306a
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, rdi
mov ebx, eax
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x1400130a7
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ebx, ax
or ebx, 0xc0070000
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x1400130a7
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jg 0x140013098
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
jmp 0x1400130a7
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ebx, ax
or ebx, 0xc0070000
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, ebx
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x1400130d0
Capabilities:
Delete service
Stop service

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x40
xor ebx, ebx
test rcx, rcx
lea rdi, str.KProcessHacker2
cmovne rdi, rcx
lea r8d, [rbx + 1]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov rsi, rax
test rax, rax
jne 0x140013143
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jg 0x140013125
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
jmp qword [sym.imp.KERNEL32.dll_GetLastError]
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx eax, ax
or eax, 0xc0070000
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret
mov r8d, 0x10020
mov rdx, rdi
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov rdi, rax
test rax, rax
je 0x1400131b4
lea r8, [rsp + 0x20]
mov edx, 1
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_ControlService]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_DeleteService]
test eax, eax
jne 0x1400131a9
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jg 0x14001319a
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, rdi
mov ebx, eax
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x1400131d7
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ebx, ax
or ebx, 0xc0070000
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x1400131d7
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jg 0x1400131c8
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
jmp 0x1400131d7
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ebx, ax
or ebx, 0xc0070000
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rsi, qword [rsp + 0x58]
mov eax, ebx
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret

Function at 0x140013450
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x70
xor eax, eax
mov ebx, r8d
mov qword [rsp + 0x50], rdx
mov dword [rsp + 0x48], eax
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x38], 0x10
lea rax, [rsp + 0x50]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x60]
xor edx, edx
mov dword [rsp + 0x28], 0x999920dc
mov dword [rsp + 0x58], ebx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntdll.dll_NtDeviceIoControlFile]
cmp eax, 0xc00000db
jne 0x1400134af
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
add rsp, 0x70
pop rbx
ret
Function at 0x1400149c0
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rsi, r8
mov rdi, rdx
mov rbx, rcx
mov qword [rcx], rdx
mov qword [rcx + 8], r8
mov r8d, 0x40
call fcn.140014d10
nop
mov eax, 0x5a4d
cmp word [rdi], ax
je 0x1400149ff
mov eax, 0xc000012f
jmp 0x140014ab4
mov eax, dword [rdi + 0x3c]
test eax, eax
jne 0x140014a10
mov eax, 0xc000007b
jmp 0x140014ab4
cmp eax, 0x10000000
jae 0x140014aad
cmp rax, rsi
jae 0x140014aad
lea rdx, [rax + rdi]
mov qword [rbx + 0x10], rdx
mov r8d, 0x18
mov rcx, rbx
call fcn.140014d10
mov rdx, qword [rbx + 0x10]
movzx eax, word [rdx + 0x14]
add eax, 0x18
movsxd r8, eax
movzx eax, word [rdx + 6]
lea rcx, [rax + rax*4]
lea r8, [r8 + rcx*8]
mov rcx, rbx
call fcn.140014d10
nop
mov rcx, qword [rbx + 0x10]
cmp dword [rcx], 0x4550
je 0x140014a70
mov eax, 0xc000007b
jmp 0x140014ab4
movzx eax, word [rcx + 0x18]
mov word [rbx + 0x28], ax
mov edx, 0x10b
cmp ax, dx
je 0x140014a93
mov edx, 0x20b
cmp ax, dx
je 0x140014a93
mov eax, 0xc000007b
jmp 0x140014ab4
movzx eax, word [rcx + 6]
mov dword [rbx + 0x18], eax
movzx eax, word [rcx + 0x14]
lea rcx, [rax + rcx + 0x18]
mov qword [rbx + 0x20], rcx
xor eax, eax
jmp 0x140014ab4
mov eax, 0xc000007b
jmp 0x140014ab4
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x140014b20
Capabilities:
Get file attributes
Map section object

Disassembly:
mov qword [rsp + 0x10], rdx
push rbx
push rsi
push r12
push r13
push r14
sub rsp, 0x90
xor r14d, r14d
xor sil, sil
mov r12, r9
movzx r13d, r8b
mov rbx, rdx
mov qword [rsp + 0xc0], r14
test rcx, rcx
jne 0x140014b6b
test rdx, rdx
jne 0x140014bc4
mov eax, 0xc0000030
add rsp, 0x90
pop r14
pop r13
pop r12
pop rsi
pop rbx
ret
test rdx, rdx
jne 0x140014bc4
mov r8d, r14d
mov eax, 0x106
mov rdx, rcx
mov dword [rsp + 0x30], 0x60
test r13b, r13b
lea rcx, [rsp + 0xc8]
cmove r8d, eax
xor r9d, r9d
mov dword [rsp + 0x28], 1
or r8d, 0x1000a1
mov dword [rsp + 0x20], 1
call sym.ProcessHacker.exe_PhCreateFileWin32
test eax, eax
js 0x140014cfb
mov rbx, qword [rsp + 0xc8]
mov sil, 1
lea r8, [rsp + 0x78]
lea rdx, [rsp + 0x68]
mov r9d, 0x18
mov rcx, rbx
mov qword [rsp + 0xd8], rdi
mov dword [rsp + 0x20], 5
call qword [sym.imp.ntdll.dll_NtQueryInformationFile]
mov r11d, eax
test eax, eax
jns 0x140014bf8
mov edi, eax
jmp 0x140014c08
mov rax, qword [rsp + 0x80]
mov edi, r11d
mov qword [rsp + 0x50], rax
test r11d, r11d
js 0x140014cd0
mov qword [rsp + 0xd0], rbp
mov eax, 0x20
mov qword [rsp + 0x30], rbx
mov ebp, 0x40
test r13b, r13b
lea r9, [rsp + 0x50]
cmovne ebp, eax
lea rcx, [rsp + 0xc0]
mov edx, 0xf001f
xor r8d, r8d
mov dword [rsp + 0x28], 0x8000000
mov dword [rsp + 0x20], ebp
call qword [sym.imp.ntdll.dll_NtCreateSection]
mov edi, eax
test eax, eax
js 0x140014cc8
mov rax, qword [rsp + 0x50]
mov rcx, qword [rsp + 0xc0]
mov dword [rsp + 0x48], ebp
mov dword [rsp + 0x40], r14d
mov dword [rsp + 0x38], 1
mov qword [rsp + 0x60], rax
lea rax, [rsp + 0x60]
lea r8, [rsp + 0x58]
xor r9d, r9d
mov qword [rsp + 0x30], rax
or rdx, 0xffffffffffffffff
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], r14
mov qword [rsp + 0x58], r14
call qword [sym.imp.ntdll.dll_NtMapViewOfSection]
mov edi, eax
test eax, eax
js 0x140014cc8
mov rax, qword [rsp + 0x58]
mov rcx, qword [rsp + 0xe0]
mov qword [r12], rax
mov rax, qword [rsp + 0x60]
mov qword [rcx], rax
mov rbp, qword [rsp + 0xd0]
mov rcx, qword [rsp + 0xc0]
test rcx, rcx
je 0x140014ce3
call qword [sym.imp.ntdll.dll_NtClose]
test sil, sil
je 0x140014cf1
mov rcx, rbx
call qword [sym.imp.ntdll.dll_NtClose]
mov eax, edi
mov rdi, qword [rsp + 0xd8]
add rsp, 0x90
pop r14
pop r13
pop r12
pop rsi
pop rbx
ret

Function at 0x140016bb0
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x70
mov rax, rcx
mov rcx, qword [0x1400d62b8]
mov ebx, edx
test rcx, rcx
je 0x140016c1d
mov qword [rsp + 0x50], rax
xor eax, eax
mov dword [rsp + 0x58], edx
mov dword [rsp + 0x48], eax
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x38], 0x10
lea rax, [rsp + 0x50]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x60]
xor edx, edx
mov dword [rsp + 0x28], 0x999920dc
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntdll.dll_NtDeviceIoControlFile]
cmp eax, 0xc00000db
jne 0x140016c26
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov rcx, rax
call qword [sym.imp.ntdll.dll_NtTerminateProcess]
add rsp, 0x70
pop rbx
ret
Function at 0x140018700
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x50
mov rdi, rcx
lea rcx, str.kernel32.dll
mov rsi, r8
mov ebx, edx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea rdx, str.SetProcessDEPPolicy
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r9, rax
test rax, rax
jne 0x140018751
mov eax, 0xc00000bb
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x50
pop rdi
ret
xor edx, edx
test bl, 1
mov ecx, 1
mov eax, edx
cmovne eax, ecx
test bl, 2
je 0x140018768
or eax, 2
cmp dword [0x1400d8fc0], 0x3c
jb 0x1400187a5
mov qword [rsp + 0x48], rdx
lea rcx, [rsp + 0x78]
xor r8d, r8d
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r9
mov qword [rsp + 0x28], rdx
xor r9d, r9d
mov rcx, rdi
mov qword [rsp + 0x20], rdx
call qword [sym.imp.ntdll.dll_RtlCreateUserThread]
jmp 0x1400187ef
mov qword [rsp + 0x30], rdx
mov dword [rsp + 0x28], edx
xor r8d, r8d
mov rcx, rdi
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_CreateRemoteThread]
mov qword [rsp + 0x78], rax
test rax, rax
jne 0x1400187eb
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jg 0x1400187db
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x1400187ef
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx eax, ax
or eax, 0xc0070000
jmp 0x1400187ef
mov eax, dword [rsp + 0x78]
test eax, eax
js 0x140018812
mov rcx, qword [rsp + 0x78]
mov r8, rsi
xor edx, edx
call qword [sym.imp.ntdll.dll_NtWaitForSingleObject]
mov rcx, qword [rsp + 0x78]
mov ebx, eax
call qword [sym.imp.ntdll.dll_NtClose]
mov eax, ebx
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x50
pop rdi
ret
Function at 0x140019f00
Capabilities:
Check mutex on windows

Disassembly:
sub rsp, 0x38
mov r8, rdx
mov r9d, 8
xor edx, edx
mov qword [rsp + 0x20], 0
call qword [sym.imp.ntdll.dll_NtQueryMutant]
add rsp, 0x38
ret

Function at 0x140019f30
Capabilities:
Check mutex on windows

Disassembly:
sub rsp, 0x38
mov r9d, 0x10
mov r8, rdx
mov qword [rsp + 0x20], 0
lea edx, [r9 - 0xf]
call qword [sym.imp.ntdll.dll_NtQueryMutant]
add rsp, 0x38
ret

Function at 0x14001a0f0
Capabilities:
Get file attributes

Disassembly:
push rbx
sub rsp, 0x60
mov rbx, rdx
lea r8, [rsp + 0x40]
lea rdx, [rsp + 0x30]
mov r9d, 0x18
mov dword [rsp + 0x20], 5
call qword [sym.imp.ntdll.dll_NtQueryInformationFile]
mov r11d, eax
test eax, eax
js 0x14001a129
mov rax, qword [rsp + 0x48]
mov qword [rbx], rax
mov eax, r11d
add rsp, 0x60
pop rbx
ret

Function at 0x14001a130
Capabilities:
Set file attributes

Disassembly:
sub rsp, 0x48
mov rax, qword [rdx]
lea r8, [rsp + 0x58]
lea rdx, [rsp + 0x30]
mov r9d, 8
mov dword [rsp + 0x20], 0x14
mov qword [rsp + 0x58], rax
call qword [sym.imp.ntdll.dll_NtSetInformationFile]
add rsp, 0x48
ret
Function at 0x14001be60
Capabilities:
Get system information on windows
Make suspicious ntquerysysteminformation call

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
mov rcx, qword [0x1400d8fb0]
xor edx, edx
mov r8d, 0x800
mov dword [rsp + 0x38], 0x800
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov rbx, rax
test rax, rax
jne 0x14001be9e
mov ecx, 0xc000009a
call qword [sym.imp.ntdll.dll_RtlRaiseStatus]
int3
mov r8d, dword [rsp + 0x38]
lea r9, [rsp + 0x38]
mov rdx, rax
mov ecx, 0xb
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
cmp eax, 0xc0000004
jne 0x14001bf0f
mov rcx, qword [0x1400d8fb0]
mov r8, rbx
xor edx, edx
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
mov r8d, dword [rsp + 0x38]
mov rcx, qword [0x1400d8fb0]
xor edx, edx
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov rbx, rax
test rax, rax
jne 0x14001bef7
mov ecx, 0xc000009a
call qword [sym.imp.ntdll.dll_RtlRaiseStatus]
int3
mov r8d, dword [rsp + 0x38]
lea r9, [rsp + 0x38]
mov rdx, rax
mov ecx, 0xb
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
test eax, eax
js 0x14001bf16
mov qword [rdi], rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x14001bfa0
Capabilities:
Enumerate processes via ntquerysysteminformation
Get system information on windows

Disassembly:
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov eax, dword [0x1400d1b5c]
mov rsi, rcx
mov rcx, qword [0x1400d8fb0]
mov r8, rax
xor edx, edx
mov dword [rsp + 0x38], eax
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov rdi, rax
test rax, rax
jne 0x14001bfdd
mov ecx, 0xc000009a
call qword [sym.imp.ntdll.dll_RtlRaiseStatus]
int3
mov qword [rsp + 0x30], rbx
mov r8d, dword [rsp + 0x38]
lea r9, [rsp + 0x38]
mov rdx, rdi
mov ecx, 5
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
mov ebx, eax
cmp eax, 0xc0000023
je 0x14001c00a
cmp eax, 0xc0000004
jne 0x14001c044
mov rcx, qword [0x1400d8fb0]
mov r8, rdi
xor edx, edx
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
mov r8d, dword [rsp + 0x38]
mov rcx, qword [0x1400d8fb0]
xor edx, edx
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov rdi, rax
test rax, rax
jne 0x14001bfe2
mov ecx, 0xc000009a
call qword [sym.imp.ntdll.dll_RtlRaiseStatus]
int3
test eax, eax
jns 0x14001c06c
mov rcx, qword [0x1400d8fb0]
mov r8, rdi
xor edx, edx
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
mov eax, ebx
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
mov eax, dword [rsp + 0x38]
mov ecx, dword [0x1400d1b5c]
mov qword [rsi], rdi
mov rsi, qword [rsp + 0x40]
cmp eax, 0x20000
cmovbe ecx, eax
mov eax, ebx
mov rbx, qword [rsp + 0x30]
mov dword [0x1400d1b5c], ecx
add rsp, 0x20
pop rdi
ret
Function at 0x14001c0a0
Capabilities:
Get system information on windows
Make suspicious ntquerysysteminformation call

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
mov eax, dword [0x1400d1ea8]
mov rsi, rcx
mov rcx, qword [0x1400d8fb0]
mov ebx, edx
xor edx, edx
mov r8, rax
mov dword [rsp + 0x50], eax
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov rdi, rax
test rax, rax
jne 0x14001c0e4
mov ecx, 0xc000009a
call qword [sym.imp.ntdll.dll_RtlRaiseStatus]
int3
mov dword [rsp + 0x20], ebx
nop dword [rax + rax]
mov eax, dword [rsp + 0x50]
mov r8d, 0x10
lea r9, [rsp + 0x50]
lea rdx, [rsp + 0x20]
lea ecx, [r8 + 0x25]
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x24], eax
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
mov ebx, eax
cmp eax, 0xc0000023
je 0x14001c127
cmp eax, 0xc0000004
jne 0x14001c161
mov rcx, qword [0x1400d8fb0]
mov r8, rdi
xor edx, edx
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
mov r8d, dword [rsp + 0x50]
mov rcx, qword [0x1400d8fb0]
xor edx, edx
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov rdi, rax
test rax, rax
jne 0x14001c0f0
mov ecx, 0xc000009a
call qword [sym.imp.ntdll.dll_RtlRaiseStatus]
int3
test eax, eax
jns 0x14001c189
mov rcx, qword [0x1400d8fb0]
mov r8, rdi
xor edx, edx
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
mov eax, ebx
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
mov eax, dword [rsp + 0x50]
mov ecx, dword [0x1400d1ea8]
mov qword [rsi], rdi
mov rsi, qword [rsp + 0x48]
cmp eax, 0x20000
cmovbe ecx, eax
mov eax, ebx
mov rbx, qword [rsp + 0x40]
mov dword [0x1400d1ea8], ecx
add rsp, 0x30
pop rdi
ret

Function at 0x14001c1c0
Capabilities:
Get system information on windows

Disassembly:
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov eax, dword [0x1400d1eac]
mov rsi, rcx
mov rcx, qword [0x1400d8fb0]
mov r8, rax
xor edx, edx
mov dword [rsp + 0x38], eax
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov rdi, rax
test rax, rax
jne 0x14001c1fd
mov ecx, 0xc000009a
call qword [sym.imp.ntdll.dll_RtlRaiseStatus]
int3
mov qword [rsp + 0x30], rbx
mov r8d, dword [rsp + 0x38]
lea r9, [rsp + 0x38]
mov rdx, rdi
mov ecx, 0x39
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
mov ebx, eax
cmp eax, 0xc0000023
je 0x14001c22a
cmp eax, 0xc0000004
jne 0x14001c264
mov rcx, qword [0x1400d8fb0]
mov r8, rdi
xor edx, edx
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
mov r8d, dword [rsp + 0x38]
mov rcx, qword [0x1400d8fb0]
xor edx, edx
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov rdi, rax
test rax, rax
jne 0x14001c202
mov ecx, 0xc000009a
call qword [sym.imp.ntdll.dll_RtlRaiseStatus]
int3
test eax, eax
jns 0x14001c28c
mov rcx, qword [0x1400d8fb0]
mov r8, rdi
xor edx, edx
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
mov eax, ebx
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
mov eax, dword [rsp + 0x38]
mov ecx, dword [0x1400d1eac]
mov qword [rsi], rdi
mov rsi, qword [rsp + 0x40]
cmp eax, 0x20000
cmovbe ecx, eax
mov eax, ebx
mov rbx, qword [rsp + 0x30]
mov dword [0x1400d1eac], ecx
add rsp, 0x20
pop rdi
ret
Function at 0x14001c2e0
Capabilities:
Get system information on windows
Make suspicious ntquerysysteminformation call

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rdi
sub rsp, 0x20
mov ebx, dword [0x1400d1f28]
mov rbp, rcx
mov rcx, qword [0x1400d8fb0]
mov r8, rbx
xor edx, edx
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov rdi, rax
test rax, rax
jne 0x14001c31e
mov ecx, 0xc000009a
call qword [sym.imp.ntdll.dll_RtlRaiseStatus]
int3
xor r9d, r9d
mov r8d, ebx
mov rdx, rax
lea ecx, [r9 + 0x10]
mov qword [rsp + 0x30], rsi
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
mov esi, eax
cmp eax, 0xc0000004
jne 0x14001c392
nop
mov rcx, qword [0x1400d8fb0]
mov r8, rdi
xor edx, edx
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
add ebx, ebx
cmp ebx, 0x1000000
ja 0x14001c3b6
mov rcx, qword [0x1400d8fb0]
mov r8d, ebx
xor edx, edx
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov rdi, rax
test rax, rax
je 0x14001c3aa
xor r9d, r9d
mov r8d, ebx
mov rdx, rax
lea ecx, [r9 + 0x10]
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
mov esi, eax
cmp eax, 0xc0000004
je 0x14001c340
test esi, esi
jns 0x14001c3bd
mov rcx, qword [0x1400d8fb0]
mov r8, rdi
xor edx, edx
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
jmp 0x14001c3d6
mov ecx, 0xc000009a
call qword [sym.imp.ntdll.dll_RtlRaiseStatus]
int3
mov eax, 0xc000009a
jmp 0x14001c3d8
mov eax, dword [0x1400d1f28]
cmp ebx, 0x100000
mov qword [rbp], rdi
cmovbe eax, ebx
mov dword [0x1400d1f28], eax
mov eax, esi
mov rsi, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret