joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14016fbc0
Capabilities:
Resume thread

Disassembly:
mov r11, rsp
push rbp
push rdi
push r14
sub rsp, 0xb0
mov rax, qword [0x1402c0040]
xor rax, rsp
mov qword [rsp + 0xa8], rax
xor r14d, r14d
lea r8, [r11 - 0x28]
mov rbp, rdx
mov qword [r11 - 0x70], r14
mov edx, 0x1a
mov qword [r11 - 0x78], r14
mov r9d, 8
mov qword [r11 - 0x68], r14
mov qword [r11 - 0x60], r14
mov rdi, rcx
mov qword [rsp + 0x20], r14
call qword [sym.imp.ntdll.dll_NtQueryInformationProcess]
test eax, eax
js 0x14016fdbf
cmp qword [rsp + 0xa0], r14
lea rax, [0x1402c6d88]
mov qword [rsp + 0xe0], rbx
lea rbx, [0x1402c6ec8]
mov qword [rsp + 0xe8], rsi
setne sil
test sil, sil
cmove rbx, rax
lfence
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], r14
xor r9d, r9d
mov qword [rsp + 0x20], rax
lea r8, str.RtlExitUserThread
mov rdx, rbx
mov rcx, rdi
call sym.SystemInformer.exe_PhGetProcedureAddressRemote
test eax, eax
js 0x14016fdaf
lfence
lea rax, [rsp + 0x50]
mov qword [rsp + 0x28], r14
xor r9d, r9d
mov qword [rsp + 0x20], rax
lea r8, str.RtlFlushHeaps
mov rdx, rbx
mov rcx, rdi
call sym.SystemInformer.exe_PhGetProcedureAddressRemote
test eax, eax
js 0x14016fdaf
cmp dword [0x1402c0f40], 0x3e
jb 0x14016fcd0
lfence
lea rdx, [rsp + 0x68]
mov rcx, rdi
call fcn.14016eb20
mov ebx, eax
test eax, eax
js 0x14016fd9e
lfence
mov qword [rsp + 0x48], r14
lea rax, [rsp + 0x60]
mov qword [rsp + 0x40], rax
mov r8d, 1
mov rax, qword [rsp + 0x58]
mov rcx, rdi
mov qword [rsp + 0x38], r14
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], r14
call fcn.140142ae0
mov rdi, qword [rsp + 0x60]
mov ebx, eax
test eax, eax
js 0x14016fd90
mov rdx, qword [rsp + 0x50]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], r14
mov rcx, rdi
test sil, sil
je 0x14016fd34
call qword [sym.imp.ntdll.dll_RtlQueueApcWow64Thread]
jmp 0x14016fd3a
call qword [sym.imp.ntdll.dll_NtQueueApcThread]
mov ebx, eax
test eax, eax
js 0x14016fd90
xor edx, edx
mov rcx, rdi
call qword [sym.imp.ntdll.dll_NtResumeThread]
mov ebx, eax
test eax, eax
js 0x14016fd90
mov r8, rbp
xor edx, edx
mov rcx, rdi
call qword [sym.imp.ntdll.dll_NtWaitForSingleObject]
mov ebx, eax
test eax, eax
js 0x14016fd90
mov r9d, 0x30
mov qword [rsp + 0x20], r14
lea r8, [rsp + 0x70]
xor edx, edx
mov rcx, rdi
call qword [sym.imp.ntdll.dll_NtQueryInformationThread]
test eax, eax
mov ebx, eax
cmovns ebx, dword [rsp + 0x70]
test rdi, rdi
je 0x14016fd9e
mov rcx, rdi
call qword [sym.imp.ntdll.dll_NtClose]
mov rcx, qword [rsp + 0x68]
test rcx, rcx
je 0x14016fdad
call fcn.14016ec20
mov eax, ebx
mov rbx, qword [rsp + 0xe0]
mov rsi, qword [rsp + 0xe8]
mov rcx, qword [rsp + 0xa8]
xor rcx, rsp
call fcn.1401e5e20
add rsp, 0xb0
pop r14
pop rdi
pop rbp
ret
Function at 0x140171880
Capabilities:
Parse pe header

Disassembly:
push rdi
sub rsp, 0x40
xor edi, edi
test byte [0x1402c7100], 1
jne 0x1401719fc
lock bts qword [0x1402c7100], 0x1f
setb al
test al, al
je 0x1401718ca
test byte [0x1402c7100], 1
jne 0x1401719fc
xor edx, edx
lea rcx, [0x1402c7100]
call sym.SystemInformer.exe_PhfWaitForEvent
jmp 0x1401719fc
mov qword [rsp + 0x50], rbx
lea rdx, [rsp + 0x30]
lea rbx, [0x14023fe60]
mov qword [rsp + 0x30], 0x12
mov qword [rsp + 0x38], rbx
call fcn.14017ede0
mov rcx, rax
test rax, rax
jne 0x140171955
xor edx, edx
mov r8d, 0x800
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
test rax, rax
jne 0x140171955
xor edx, edx
mov r8d, 0x200
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
test rax, rax
jne 0x140171955
cmp dword [0x1402c0f40], 0x3e
jae 0x1401719eb
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
test rax, rax
je 0x1401719eb
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x1401719eb
mov edx, dword [rcx + 0x3c]
lea eax, [rdx - 1]
cmp eax, 0x7ffffffd
ja 0x1401719eb
cmp dword [rdx + rcx], 0x4550
jne 0x1401719eb
add rdx, 0x88
add rdx, rcx
mov eax, dword [rdx]
test eax, eax
je 0x1401719eb
cmp dword [rdx + 4], edi
je 0x1401719eb
lea r8, [rcx + rax]
mov word [rsp + 0x20], di
lea r9, str.NtQueryInformationEnlistment
call fcn.14017f180
mov r9, rax
test rax, rax
je 0x1401719eb
mov r8, qword [0x7ffe0320]
mov ecx, dword [0x7ffe0004]
mov eax, r8d
shr r8, 0x20
imul rax, rcx
imul r8, rcx
shr rax, 0x18
shl r8, 8
add rax, r8
mov qword [0x1402cef10], rax
xor rax, r9
mov qword [0x1402ceef0], rax
lea rcx, [0x1402c7100]
call sym.SystemInformer.exe_PhfSetEvent
mov rbx, qword [rsp + 0x50]
mov rax, qword [0x1402ceef0]
test rax, rax
je 0x140171a1d
mov rcx, qword [0x1402cef10]
test rcx, rcx
je 0x140171a1d
xor rax, rcx
add rsp, 0x40
pop rdi
ret
mov rax, rdi
add rsp, 0x40
pop rdi
ret
Function at 0x140171a40
Capabilities:
Parse pe header

Disassembly:
push rdi
sub rsp, 0x40
xor edi, edi
test byte [0x1402c7150], 1
jne 0x140171bbc
lock bts qword [0x1402c7150], 0x1f
setb al
test al, al
je 0x140171a8a
test byte [0x1402c7150], 1
jne 0x140171bbc
xor edx, edx
lea rcx, [0x1402c7150]
call sym.SystemInformer.exe_PhfWaitForEvent
jmp 0x140171bbc
mov qword [rsp + 0x50], rbx
lea rdx, [rsp + 0x30]
lea rbx, [0x14023fe60]
mov qword [rsp + 0x30], 0x12
mov qword [rsp + 0x38], rbx
call fcn.14017ede0
mov rcx, rax
test rax, rax
jne 0x140171b15
xor edx, edx
mov r8d, 0x800
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
test rax, rax
jne 0x140171b15
xor edx, edx
mov r8d, 0x200
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
test rax, rax
jne 0x140171b15
cmp dword [0x1402c0f40], 0x3e
jae 0x140171bab
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
test rax, rax
je 0x140171bab
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x140171bab
mov edx, dword [rcx + 0x3c]
lea eax, [rdx - 1]
cmp eax, 0x7ffffffd
ja 0x140171bab
cmp dword [rdx + rcx], 0x4550
jne 0x140171bab
add rdx, 0x88
add rdx, rcx
mov eax, dword [rdx]
test eax, eax
je 0x140171bab
cmp dword [rdx + 4], edi
je 0x140171bab
lea r8, [rcx + rax]
mov word [rsp + 0x20], di
lea r9, str.NtQueryInformationResourceManager
call fcn.14017f180
mov r9, rax
test rax, rax
je 0x140171bab
mov r8, qword [0x7ffe0320]
mov ecx, dword [0x7ffe0004]
mov eax, r8d
shr r8, 0x20
imul rax, rcx
imul r8, rcx
shr rax, 0x18
shl r8, 8
add rax, r8
mov qword [0x1402cefa0], rax
xor rax, r9
mov qword [0x1402cf020], rax
lea rcx, [0x1402c7150]
call sym.SystemInformer.exe_PhfSetEvent
mov rbx, qword [rsp + 0x50]
mov rax, qword [0x1402cf020]
test rax, rax
je 0x140171bdd
mov rcx, qword [0x1402cefa0]
test rcx, rcx
je 0x140171bdd
xor rax, rcx
add rsp, 0x40
pop rdi
ret
mov rax, rdi
add rsp, 0x40
pop rdi
ret
Function at 0x140171c00
Capabilities:
Parse pe header

Disassembly:
push rdi
sub rsp, 0x40
xor edi, edi
test byte [0x1402c7130], 1
jne 0x140171d7c
lock bts qword [0x1402c7130], 0x1f
setb al
test al, al
je 0x140171c4a
test byte [0x1402c7130], 1
jne 0x140171d7c
xor edx, edx
lea rcx, [0x1402c7130]
call sym.SystemInformer.exe_PhfWaitForEvent
jmp 0x140171d7c
mov qword [rsp + 0x50], rbx
lea rdx, [rsp + 0x30]
lea rbx, [0x14023fe60]
mov qword [rsp + 0x30], 0x12
mov qword [rsp + 0x38], rbx
call fcn.14017ede0
mov rcx, rax
test rax, rax
jne 0x140171cd5
xor edx, edx
mov r8d, 0x800
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
test rax, rax
jne 0x140171cd5
xor edx, edx
mov r8d, 0x200
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
test rax, rax
jne 0x140171cd5
cmp dword [0x1402c0f40], 0x3e
jae 0x140171d6b
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
test rax, rax
je 0x140171d6b
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x140171d6b
mov edx, dword [rcx + 0x3c]
lea eax, [rdx - 1]
cmp eax, 0x7ffffffd
ja 0x140171d6b
cmp dword [rdx + rcx], 0x4550
jne 0x140171d6b
add rdx, 0x88
add rdx, rcx
mov eax, dword [rdx]
test eax, eax
je 0x140171d6b
cmp dword [rdx + 4], edi
je 0x140171d6b
lea r8, [rcx + rax]
mov word [rsp + 0x20], di
lea r9, str.NtQueryInformationTransaction
call fcn.14017f180
mov r9, rax
test rax, rax
je 0x140171d6b
mov r8, qword [0x7ffe0320]
mov ecx, dword [0x7ffe0004]
mov eax, r8d
shr r8, 0x20
imul rax, rcx
imul r8, rcx
shr rax, 0x18
shl r8, 8
add rax, r8
mov qword [0x1402cefc8], rax
xor rax, r9
mov qword [0x1402cef30], rax
lea rcx, [0x1402c7130]
call sym.SystemInformer.exe_PhfSetEvent
mov rbx, qword [rsp + 0x50]
mov rax, qword [0x1402cef30]
test rax, rax
je 0x140171d9d
mov rcx, qword [0x1402cefc8]
test rcx, rcx
je 0x140171d9d
xor rax, rcx
add rsp, 0x40
pop rdi
ret
mov rax, rdi
add rsp, 0x40
pop rdi
ret
Function at 0x140171dc0
Capabilities:
Parse pe header

Disassembly:
push rdi
sub rsp, 0x40
xor edi, edi
test byte [0x1402c71a0], 1
jne 0x140171f3c
lock bts qword [0x1402c71a0], 0x1f
setb al
test al, al
je 0x140171e0a
test byte [0x1402c71a0], 1
jne 0x140171f3c
xor edx, edx
lea rcx, [0x1402c71a0]
call sym.SystemInformer.exe_PhfWaitForEvent
jmp 0x140171f3c
mov qword [rsp + 0x50], rbx
lea rdx, [rsp + 0x30]
lea rbx, [0x14023fe60]
mov qword [rsp + 0x30], 0x12
mov qword [rsp + 0x38], rbx
call fcn.14017ede0
mov rcx, rax
test rax, rax
jne 0x140171e95
xor edx, edx
mov r8d, 0x800
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
test rax, rax
jne 0x140171e95
xor edx, edx
mov r8d, 0x200
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
test rax, rax
jne 0x140171e95
cmp dword [0x1402c0f40], 0x3e
jae 0x140171f2b
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
test rax, rax
je 0x140171f2b
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x140171f2b
mov edx, dword [rcx + 0x3c]
lea eax, [rdx - 1]
cmp eax, 0x7ffffffd
ja 0x140171f2b
cmp dword [rdx + rcx], 0x4550
jne 0x140171f2b
add rdx, 0x88
add rdx, rcx
mov eax, dword [rdx]
test eax, eax
je 0x140171f2b
cmp dword [rdx + 4], edi
je 0x140171f2b
lea r8, [rcx + rax]
mov word [rsp + 0x20], di
lea r9, str.NtQueryInformationTransactionManager
call fcn.14017f180
mov r9, rax
test rax, rax
je 0x140171f2b
mov r8, qword [0x7ffe0320]
mov ecx, dword [0x7ffe0004]
mov eax, r8d
shr r8, 0x20
imul rax, rcx
imul r8, rcx
shr rax, 0x18
shl r8, 8
add rax, r8
mov qword [0x1402ceef8], rax
xor rax, r9
mov qword [0x1402cf038], rax
lea rcx, [0x1402c71a0]
call sym.SystemInformer.exe_PhfSetEvent
mov rbx, qword [rsp + 0x50]
mov rax, qword [0x1402cf038]
test rax, rax
je 0x140171f5d
mov rcx, qword [0x1402ceef8]
test rcx, rcx
je 0x140171f5d
xor rax, rcx
add rsp, 0x40
pop rdi
ret
mov rax, rdi
add rsp, 0x40
pop rdi
ret
Function at 0x140171f80
Capabilities:
Parse pe header

Disassembly:
push rdi
sub rsp, 0x40
xor edi, edi
test byte [0x1402c7140], 1
jne 0x1401720fc
lock bts qword [0x1402c7140], 0x1f
setb al
test al, al
je 0x140171fca
test byte [0x1402c7140], 1
jne 0x1401720fc
xor edx, edx
lea rcx, [0x1402c7140]
call sym.SystemInformer.exe_PhfWaitForEvent
jmp 0x1401720fc
mov qword [rsp + 0x50], rbx
lea rdx, [rsp + 0x30]
lea rbx, [0x14023fe60]
mov qword [rsp + 0x30], 0x12
mov qword [rsp + 0x38], rbx
call fcn.14017ede0
mov rcx, rax
test rax, rax
jne 0x140172055
xor edx, edx
mov r8d, 0x800
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
test rax, rax
jne 0x140172055
xor edx, edx
mov r8d, 0x200
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
test rax, rax
jne 0x140172055
cmp dword [0x1402c0f40], 0x3e
jae 0x1401720eb
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
test rax, rax
je 0x1401720eb
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x1401720eb
mov edx, dword [rcx + 0x3c]
lea eax, [rdx - 1]
cmp eax, 0x7ffffffd
ja 0x1401720eb
cmp dword [rdx + rcx], 0x4550
jne 0x1401720eb
add rdx, 0x88
add rdx, rcx
mov eax, dword [rdx]
test eax, eax
je 0x1401720eb
cmp dword [rdx + 4], edi
je 0x1401720eb
lea r8, [rcx + rax]
mov word [rsp + 0x20], di
lea r9, str.NtSetInformationVirtualMemory
call fcn.14017f180
mov r9, rax
test rax, rax
je 0x1401720eb
mov r8, qword [0x7ffe0320]
mov ecx, dword [0x7ffe0004]
mov eax, r8d
shr r8, 0x20
imul rax, rcx
imul r8, rcx
shr rax, 0x18
shl r8, 8
add rax, r8
mov qword [0x1402cef70], rax
xor rax, r9
mov qword [0x1402cefd8], rax
lea rcx, [0x1402c7140]
call sym.SystemInformer.exe_PhfSetEvent
mov rbx, qword [rsp + 0x50]
mov rax, qword [0x1402cefd8]
test rax, rax
je 0x14017211d
mov rcx, qword [0x1402cef70]
test rcx, rcx
je 0x14017211d
xor rax, rcx
add rsp, 0x40
pop rdi
ret
mov rax, rdi
add rsp, 0x40
pop rdi
ret
Function at 0x140172140
Capabilities:
Parse pe header

Disassembly:
push rdi
sub rsp, 0x40
xor edi, edi
test byte [0x1402c70c0], 1
jne 0x1401722bc
lock bts qword [0x1402c70c0], 0x1f
setb al
test al, al
je 0x14017218a
test byte [0x1402c70c0], 1
jne 0x1401722bc
xor edx, edx
lea rcx, [0x1402c70c0]
call sym.SystemInformer.exe_PhfWaitForEvent
jmp 0x1401722bc
mov qword [rsp + 0x50], rbx
lea rdx, [rsp + 0x30]
lea rbx, [0x14023fe60]
mov qword [rsp + 0x30], 0x12
mov qword [rsp + 0x38], rbx
call fcn.14017ede0
mov rcx, rax
test rax, rax
jne 0x140172215
xor edx, edx
mov r8d, 0x800
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
test rax, rax
jne 0x140172215
xor edx, edx
mov r8d, 0x200
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
test rax, rax
jne 0x140172215
cmp dword [0x1402c0f40], 0x3e
jae 0x1401722ab
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
test rax, rax
je 0x1401722ab
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x1401722ab
mov edx, dword [rcx + 0x3c]
lea eax, [rdx - 1]
cmp eax, 0x7ffffffd
ja 0x1401722ab
cmp dword [rdx + rcx], 0x4550
jne 0x1401722ab
add rdx, 0x88
add rdx, rcx
mov eax, dword [rdx]
test eax, eax
je 0x1401722ab
cmp dword [rdx + 4], edi
je 0x1401722ab
lea r8, [rcx + rax]
mov word [rsp + 0x20], di
lea r9, str.NtCreateProcessStateChange
call fcn.14017f180
mov r9, rax
test rax, rax
je 0x1401722ab
mov r8, qword [0x7ffe0320]
mov ecx, dword [0x7ffe0004]
mov eax, r8d
shr r8, 0x20
imul rax, rcx
imul r8, rcx
shr rax, 0x18
shl r8, 8
add rax, r8
mov qword [0x1402cef98], rax
xor rax, r9
mov qword [0x1402cef28], rax
lea rcx, [0x1402c70c0]
call sym.SystemInformer.exe_PhfSetEvent
mov rbx, qword [rsp + 0x50]
mov rax, qword [0x1402cef28]
test rax, rax
je 0x1401722dd
mov rcx, qword [0x1402cef98]
test rcx, rcx
je 0x1401722dd
xor rax, rcx
add rsp, 0x40
pop rdi
ret
mov rax, rdi
add rsp, 0x40
pop rdi
ret
Function at 0x140172300
Capabilities:
Parse pe header

Disassembly:
push rdi
sub rsp, 0x40
xor edi, edi
test byte [0x1402c7120], 1
jne 0x14017247c
lock bts qword [0x1402c7120], 0x1f
setb al
test al, al
je 0x14017234a
test byte [0x1402c7120], 1
jne 0x14017247c
xor edx, edx
lea rcx, [0x1402c7120]
call sym.SystemInformer.exe_PhfWaitForEvent
jmp 0x14017247c
mov qword [rsp + 0x50], rbx
lea rdx, [rsp + 0x30]
lea rbx, [0x14023fe60]
mov qword [rsp + 0x30], 0x12
mov qword [rsp + 0x38], rbx
call fcn.14017ede0
mov rcx, rax
test rax, rax
jne 0x1401723d5
xor edx, edx
mov r8d, 0x800
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
test rax, rax
jne 0x1401723d5
xor edx, edx
mov r8d, 0x200
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
test rax, rax
jne 0x1401723d5
cmp dword [0x1402c0f40], 0x3e
jae 0x14017246b
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
test rax, rax
je 0x14017246b
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x14017246b
mov edx, dword [rcx + 0x3c]
lea eax, [rdx - 1]
cmp eax, 0x7ffffffd
ja 0x14017246b
cmp dword [rdx + rcx], 0x4550
jne 0x14017246b
add rdx, 0x88
add rdx, rcx
mov eax, dword [rdx]
test eax, eax
je 0x14017246b
cmp dword [rdx + 4], edi
je 0x14017246b
lea r8, [rcx + rax]
mov word [rsp + 0x20], di
lea r9, str.NtChangeProcessState
call fcn.14017f180
mov r9, rax
test rax, rax
je 0x14017246b
mov r8, qword [0x7ffe0320]
mov ecx, dword [0x7ffe0004]
mov eax, r8d
shr r8, 0x20
imul rax, rcx
imul r8, rcx
shr rax, 0x18
shl r8, 8
add rax, r8
mov qword [0x1402ceff0], rax
xor rax, r9
mov qword [0x1402cef00], rax
lea rcx, [0x1402c7120]
call sym.SystemInformer.exe_PhfSetEvent
mov rbx, qword [rsp + 0x50]
mov rax, qword [0x1402cef00]
test rax, rax
je 0x14017249d
mov rcx, qword [0x1402ceff0]
test rcx, rcx
je 0x14017249d
xor rax, rcx
add rsp, 0x40
pop rdi
ret
mov rax, rdi
add rsp, 0x40
pop rdi
ret
Function at 0x1401724c0
Capabilities:
Parse pe header

Disassembly:
push rdi
sub rsp, 0x40
xor edi, edi
test byte [0x1402c70d0], 1
jne 0x14017263c
lock bts qword [0x1402c70d0], 0x1f
setb al
test al, al
je 0x14017250a
test byte [0x1402c70d0], 1
jne 0x14017263c
xor edx, edx
lea rcx, [0x1402c70d0]
call sym.SystemInformer.exe_PhfWaitForEvent
jmp 0x14017263c
mov qword [rsp + 0x50], rbx
lea rdx, [rsp + 0x30]
lea rbx, [0x14023fe60]
mov qword [rsp + 0x30], 0x12
mov qword [rsp + 0x38], rbx
call fcn.14017ede0
mov rcx, rax
test rax, rax
jne 0x140172595
xor edx, edx
mov r8d, 0x800
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
test rax, rax
jne 0x140172595
xor edx, edx
mov r8d, 0x200
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
test rax, rax
jne 0x140172595
cmp dword [0x1402c0f40], 0x3e
jae 0x14017262b
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
test rax, rax
je 0x14017262b
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x14017262b
mov edx, dword [rcx + 0x3c]
lea eax, [rdx - 1]
cmp eax, 0x7ffffffd
ja 0x14017262b
cmp dword [rdx + rcx], 0x4550
jne 0x14017262b
add rdx, 0x88
add rdx, rcx
mov eax, dword [rdx]
test eax, eax
je 0x14017262b
cmp dword [rdx + 4], edi
je 0x14017262b
lea r8, [rcx + rax]
mov word [rsp + 0x20], di
lea r9, str.RtlDefaultNpAcl
call fcn.14017f180
mov r9, rax
test rax, rax
je 0x14017262b
mov r8, qword [0x7ffe0320]
mov ecx, dword [0x7ffe0004]
mov eax, r8d
shr r8, 0x20
imul rax, rcx
imul r8, rcx
shr rax, 0x18
shl r8, 8
add rax, r8
mov qword [0x1402cf048], rax
xor rax, r9
mov qword [0x1402cef78], rax
lea rcx, [0x1402c70d0]
call sym.SystemInformer.exe_PhfSetEvent
mov rbx, qword [rsp + 0x50]
mov rax, qword [0x1402cef78]
test rax, rax
je 0x14017265d
mov rcx, qword [0x1402cf048]
test rcx, rcx
je 0x14017265d
xor rax, rcx
add rsp, 0x40
pop rdi
ret
mov rax, rdi
add rsp, 0x40
pop rdi
ret
Function at 0x140172680
Capabilities:
Parse pe header

Disassembly:
push rdi
sub rsp, 0x40
xor edi, edi
test byte [0x1402c7050], 1
jne 0x1401727fc
lock bts qword [0x1402c7050], 0x1f
setb al
test al, al
je 0x1401726ca
test byte [0x1402c7050], 1
jne 0x1401727fc
xor edx, edx
lea rcx, [0x1402c7050]
call sym.SystemInformer.exe_PhfWaitForEvent
jmp 0x1401727fc
mov qword [rsp + 0x50], rbx
lea rdx, [rsp + 0x30]
lea rbx, [0x14023fe60]
mov qword [rsp + 0x30], 0x12
mov qword [rsp + 0x38], rbx
call fcn.14017ede0
mov rcx, rax
test rax, rax
jne 0x140172755
xor edx, edx
mov r8d, 0x800
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
test rax, rax
jne 0x140172755
xor edx, edx
mov r8d, 0x200
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
test rax, rax
jne 0x140172755
cmp dword [0x1402c0f40], 0x3e
jae 0x1401727eb
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
test rax, rax
je 0x1401727eb
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x1401727eb
mov edx, dword [rcx + 0x3c]
lea eax, [rdx - 1]
cmp eax, 0x7ffffffd
ja 0x1401727eb
cmp dword [rdx + rcx], 0x4550
jne 0x1401727eb
add rdx, 0x88
add rdx, rcx
mov eax, dword [rdx]
test eax, eax
je 0x1401727eb
cmp dword [rdx + 4], edi
je 0x1401727eb
lea r8, [rcx + rax]
mov word [rsp + 0x20], di
lea r9, str.RtlGetTokenNamedObjectPath
call fcn.14017f180
mov r9, rax
test rax, rax
je 0x1401727eb
mov r8, qword [0x7ffe0320]
mov ecx, dword [0x7ffe0004]
mov eax, r8d
shr r8, 0x20
imul rax, rcx
imul r8, rcx
shr rax, 0x18
shl r8, 8
add rax, r8
mov qword [0x1402cf018], rax
xor rax, r9
mov qword [0x1402cef80], rax
lea rcx, [0x1402c7050]
call sym.SystemInformer.exe_PhfSetEvent
mov rbx, qword [rsp + 0x50]
mov rax, qword [0x1402cef80]
test rax, rax
je 0x14017281d
mov rcx, qword [0x1402cf018]
test rcx, rcx
je 0x14017281d
xor rax, rcx
add rsp, 0x40
pop rdi
ret
mov rax, rdi
add rsp, 0x40
pop rdi
ret
Function at 0x140172840
Capabilities:
Parse pe header

Disassembly:
push rdi
sub rsp, 0x40
xor edi, edi
test byte [0x1402c7080], 1
jne 0x1401729bc
lock bts qword [0x1402c7080], 0x1f
setb al
test al, al
je 0x14017288a
test byte [0x1402c7080], 1
jne 0x1401729bc
xor edx, edx
lea rcx, [0x1402c7080]
call sym.SystemInformer.exe_PhfWaitForEvent
jmp 0x1401729bc
mov qword [rsp + 0x50], rbx
lea rdx, [rsp + 0x30]
lea rbx, [0x14023fe60]
mov qword [rsp + 0x30], 0x12
mov qword [rsp + 0x38], rbx
call fcn.14017ede0
mov rcx, rax
test rax, rax
jne 0x140172915
xor edx, edx
mov r8d, 0x800
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
test rax, rax
jne 0x140172915
xor edx, edx
mov r8d, 0x200
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
test rax, rax
jne 0x140172915
cmp dword [0x1402c0f40], 0x3e
jae 0x1401729ab
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
test rax, rax
je 0x1401729ab
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x1401729ab
mov edx, dword [rcx + 0x3c]
lea eax, [rdx - 1]
cmp eax, 0x7ffffffd
ja 0x1401729ab
cmp dword [rdx + rcx], 0x4550
jne 0x1401729ab
add rdx, 0x88
add rdx, rcx
mov eax, dword [rdx]
test eax, eax
je 0x1401729ab
cmp dword [rdx + 4], edi
je 0x1401729ab
lea r8, [rcx + rax]
mov word [rsp + 0x20], di
lea r9, str.RtlGetAppContainerNamedObjectPath
call fcn.14017f180
mov r9, rax
test rax, rax
je 0x1401729ab
mov r8, qword [0x7ffe0320]
mov ecx, dword [0x7ffe0004]
mov eax, r8d
shr r8, 0x20
imul rax, rcx
imul r8, rcx
shr rax, 0x18
shl r8, 8
add rax, r8
mov qword [0x1402cefb0], rax
xor rax, r9
mov qword [0x1402cef68], rax
lea rcx, [0x1402c7080]
call sym.SystemInformer.exe_PhfSetEvent
mov rbx, qword [rsp + 0x50]
mov rax, qword [0x1402cef68]
test rax, rax
je 0x1401729dd
mov rcx, qword [0x1402cefb0]
test rcx, rcx
je 0x1401729dd
xor rax, rcx
add rsp, 0x40
pop rdi
ret
mov rax, rdi
add rsp, 0x40
pop rdi
ret
Function at 0x140172a00
Capabilities:
Parse pe header

Disassembly:
push rdi
sub rsp, 0x40
xor edi, edi
test byte [0x1402c70a0], 1
jne 0x140172b7c
lock bts qword [0x1402c70a0], 0x1f
setb al
test al, al
je 0x140172a4a
test byte [0x1402c70a0], 1
jne 0x140172b7c
xor edx, edx
lea rcx, [0x1402c70a0]
call sym.SystemInformer.exe_PhfWaitForEvent
jmp 0x140172b7c
mov qword [rsp + 0x50], rbx
lea rdx, [rsp + 0x30]
lea rbx, [0x14023fe60]
mov qword [rsp + 0x30], 0x12
mov qword [rsp + 0x38], rbx
call fcn.14017ede0
mov rcx, rax
test rax, rax
jne 0x140172ad5
xor edx, edx
mov r8d, 0x800
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
test rax, rax
jne 0x140172ad5
xor edx, edx
mov r8d, 0x200
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
test rax, rax
jne 0x140172ad5
cmp dword [0x1402c0f40], 0x3e
jae 0x140172b6b
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
test rax, rax
je 0x140172b6b
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x140172b6b
mov edx, dword [rcx + 0x3c]
lea eax, [rdx - 1]
cmp eax, 0x7ffffffd
ja 0x140172b6b
cmp dword [rdx + rcx], 0x4550
jne 0x140172b6b
add rdx, 0x88
add rdx, rcx
mov eax, dword [rdx]
test eax, eax
je 0x140172b6b
cmp dword [rdx + 4], edi
je 0x140172b6b
lea r8, [rcx + rax]
mov word [rsp + 0x20], di
lea r9, str.RtlGetAppContainerSidType
call fcn.14017f180
mov r9, rax
test rax, rax
je 0x140172b6b
mov r8, qword [0x7ffe0320]
mov ecx, dword [0x7ffe0004]
mov eax, r8d
shr r8, 0x20
imul rax, rcx
imul r8, rcx
shr rax, 0x18
shl r8, 8
add rax, r8
mov qword [0x1402cef40], rax
xor rax, r9
mov qword [0x1402cf050], rax
lea rcx, [0x1402c70a0]
call sym.SystemInformer.exe_PhfSetEvent
mov rbx, qword [rsp + 0x50]
mov rax, qword [0x1402cf050]
test rax, rax
je 0x140172b9d
mov rcx, qword [0x1402cef40]
test rcx, rcx
je 0x140172b9d
xor rax, rcx
add rsp, 0x40
pop rdi
ret
mov rax, rdi
add rsp, 0x40
pop rdi
ret