joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400ae750
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rbx
sub rsp, 0x20
xor eax, eax
mov rbx, rcx
mov dword [rcx], eax
mov qword [rcx + 0x208], rax
mov qword [rcx + 0x210], rax
mov ecx, dword [0x14015ec30]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ecx, dword [0x14015ec30]
mov rdx, rbx
mov qword [rbx + 0x218], rax
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
jne 0x1400ae79d
mov ecx, 0xc0000001
call qword [sym.imp.ntdll.dll_RtlRaiseStatus]
int3
add rsp, 0x20
pop rbx
ret

Function at 0x1400ae7b0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
call sym.ProcessHacker.exe_PhDrainAutoPool
mov ecx, dword [0x14015ec30]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp rax, rbx
je 0x1400ae7db
mov ecx, 0xc0000001
call qword [sym.imp.ntdll.dll_RtlRaiseStatus]
int3
mov rdx, qword [rbx + 0x218]
mov ecx, dword [0x14015ec30]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
jne 0x1400ae7fe
mov ecx, 0xc0000001
call qword [sym.imp.ntdll.dll_RtlRaiseStatus]
int3
mov r8, qword [rbx + 0x210]
test r8, r8
je 0x1400ae81f
mov rcx, qword [sym.ProcessHacker.exe_PhHeapHandle]
xor edx, edx
add rsp, 0x20
pop rbx
jmp qword [sym.imp.ntdll.dll_RtlFreeHeap]
add rsp, 0x20
pop rbx
ret

Function at 0x1400ae910
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
mov ecx, dword [0x14015ec30]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, rax
test rdi, rdi
jne 0x1400ae93e
xor eax, eax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
mov eax, dword [rax]
cmp eax, 0x40
jae 0x1400ae95a
mov qword [rbx + rax*8 + 8], rdi
mov rax, rdi
inc dword [rbx]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
cmp qword [rbx + 0x210], 0
jne 0x1400ae98d
mov dword [rbx + 0x20c], 0x40
mov edx, 4
mov rcx, qword [sym.ProcessHacker.exe_PhHeapHandle]
mov r8d, 0x200
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov qword [rbx + 0x210], rax
mov eax, dword [rbx + 0x20c]
cmp dword [rbx + 0x208], eax
jne 0x1400ae9ca
mov r8, qword [rbx + 0x210]
add eax, eax
mov r9d, eax
mov edx, 4
mov dword [rbx + 0x20c], eax
mov rcx, qword [sym.ProcessHacker.exe_PhHeapHandle]
shl r9, 3
call qword [sym.imp.ntdll.dll_RtlReAllocateHeap]
mov qword [rbx + 0x210], rax
mov ecx, dword [rbx + 0x208]
mov rax, qword [rbx + 0x210]
mov qword [rax + rcx*8], rdi
mov rax, rdi
inc dword [rbx + 0x208]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x1400aed10
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
mov rbp, rcx
mov rdi, r8
lea rcx, [0x14015ec40]
mov rsi, rdx
call qword [sym.imp.ntdll.dll_RtlInterlockedPopEntrySList]
test rax, rax
je 0x1400aed48
lock dec dword [0x14015ec50]
jmp 0x1400aed65
mov r8, qword [0x14015ec58]
mov edx, 4
mov rcx, qword [sym.ProcessHacker.exe_PhHeapHandle]
add r8, 0x10
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
lea rbx, [rax + 0x10]
xor eax, eax
lea r8, [0x1400aec90]
mov qword [rbx], rsi
mov qword [rsp + 0x28], rax
mov r9, rbx
mov rdx, rbp
mov dword [rsp + 0x20], eax
xor ecx, ecx
mov qword [rbx + 8], rdi
call qword [sym.imp.KERNEL32.dll_CreateThread]
test rax, rax
jne 0x1400aedd1
mov eax, dword [0x14015ec54]
lea r8, [rbx - 0x10]
cmp dword [0x14015ec50], eax
jae 0x1400aedc0
mov rdx, r8
lea rcx, [0x14015ec40]
call qword [sym.imp.ntdll.dll_RtlInterlockedPushEntrySList]
lock inc dword [0x14015ec50]
jmp 0x1400aedcf
mov rcx, qword [sym.ProcessHacker.exe_PhHeapHandle]
xor edx, edx
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
xor eax, eax
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret

Function at 0x1400aef50
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 8], rcx
push rbx
sub rsp, 0x30
mov rbx, rdx
mov dword [rsp + 0x28], 4
lea rdx, [rsp + 0x50]
mov qword [rsp + 0x50], 0
lea r9, [rsp + 0x40]
mov dword [rsp + 0x20], 0x1000
xor r8d, r8d
or rcx, 0xffffffffffffffff
call qword [sym.imp.ntdll.dll_NtAllocateVirtualMemory]
test eax, eax
js 0x1400aefa9
test rbx, rbx
je 0x1400aef9e
mov rax, qword [rsp + 0x40]
mov qword [rbx], rax
mov rax, qword [rsp + 0x50]
add rsp, 0x30
pop rbx
ret
xor eax, eax
add rsp, 0x30
pop rbx
ret

Function at 0x1400b3760
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
xor eax, eax
mov r8, rcx
test rdx, rdx
je 0x1400b3786
nop word [rax + rax]
movzx ecx, byte [r8]
lea r8, [r8 + 1]
xor eax, ecx
imul eax, eax, 0x1000193
sub rdx, 1
jne 0x1400b3770
ret

Function at 0x1400b3790
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push rbx
sub rsp, 0x20
mov r8, qword [rcx]
xor ebx, ebx
test r8, r8
jne 0x1400b37a8
xor eax, eax
add rsp, 0x20
pop rbx
ret
mov qword [rsp + 0x30], rsi
mov rsi, r8
shr rsi, 1
mov qword [rsp + 0x38], rdi
mov rdi, qword [rcx + 8]
test dl, dl
jne 0x1400b37f0
movzx eax, byte [rdi]
lea rdi, [rdi + 1]
xor ebx, eax
imul ebx, ebx, 0x1000193
sub r8, 1
jne 0x1400b37c0
mov rsi, qword [rsp + 0x30]
mov eax, ebx
mov rdi, qword [rsp + 0x38]
add rsp, 0x20
pop rbx
ret
movzx ecx, word [rdi]
lea rdi, [rdi + 2]
call qword [sym.imp.ntdll.dll_RtlUpcaseUnicodeChar]
movzx eax, ax
xor eax, ebx
imul ebx, eax, 0x1000193
sub rsi, 1
jne 0x1400b37f0
mov rsi, qword [rsp + 0x30]
mov eax, ebx
mov rdi, qword [rsp + 0x38]
add rsp, 0x20
pop rbx
ret
Function at 0x1400b4b30
Capabilities:
Get file attributes

Disassembly:
push rbx
sub rsp, 0x40
test byte [rcx + 8], 0xc
mov rbx, rcx
jne 0x1400b4b84
mov rcx, qword [rcx]
lea r8, [rsp + 0x50]
mov r9d, 8
mov dword [rsp + 0x20], 0xe
lea rdx, [rsp + 0x30]
call qword [sym.imp.ntdll.dll_NtQueryInformationFile]
test eax, eax
jns 0x1400b4b6d
mov ecx, eax
call qword [sym.imp.ntdll.dll_RtlRaiseStatus]
int3
mov rax, qword [rsp + 0x50]
cmp qword [rbx + 0x10], rax
je 0x1400b4b84
mov ecx, 0xc00000e5
call qword [sym.imp.ntdll.dll_RtlRaiseStatus]
int3
add rsp, 0x40
pop rbx
ret

Function at 0x1400b4b90
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x30
mov eax, dword [rcx + 0x20]
lea r9, [rsp + 0x48]
mov rbx, rcx
mov dword [rsp + 0x28], 4
xor edi, edi
mov qword [rsp + 0x48], rax
or rcx, 0xffffffffffffffff
mov qword [rsp + 0x40], rdi
xor r8d, r8d
mov dword [rsp + 0x20], 0x1000
lea rdx, [rsp + 0x40]
call qword [sym.imp.ntdll.dll_NtAllocateVirtualMemory]
test eax, eax
mov edx, edi
mov eax, 0xc0000017
cmovns rdx, qword [rsp + 0x40]
test rdx, rdx
mov qword [rbx + 0x18], rdx
mov rbx, qword [rsp + 0x50]
cmovne eax, edi
add rsp, 0x30
pop rdi
ret
Function at 0x1400b4c00
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x60
xor eax, eax
mov rdi, r9
test byte [rcx + 8], 8
mov rbx, rcx
je 0x1400b4c1c
lea rax, [rcx + 0x10]
mov rcx, qword [rcx]
xor r9d, r9d
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x50]
mov dword [rsp + 0x30], r8d
xor r8d, r8d
mov qword [rsp + 0x28], rdx
xor edx, edx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntdll.dll_NtReadFile]
cmp eax, 0x103
jne 0x1400b4c6c
mov rcx, qword [rbx]
xor r8d, r8d
xor edx, edx
call qword [sym.imp.ntdll.dll_NtWaitForSingleObject]
test eax, eax
js 0x1400b4c80
mov eax, dword [rsp + 0x50]
test eax, eax
js 0x1400b4c80
mov rcx, qword [rsp + 0x58]
add qword [rbx + 0x10], rcx
test rdi, rdi
je 0x1400b4c80
mov dword [rdi], ecx
mov rbx, qword [rsp + 0x70]
add rsp, 0x60
pop rdi
ret
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push r13
push r14
push r15
sub rsp, 0x20
xor r13d, r13d
mov r14, r9
test byte [rcx + 8], 2
mov ebp, r8d
mov r15, rdx
mov rbx, rcx
mov esi, r13d
je 0x1400b4ccf
mov rbx, qword [rsp + 0x68]
add rsp, 0x20
pop r15
pop r14
pop r13
pop rsi
pop rbp
jmp 0x1400b4c00
mov qword [rsp + 0x58], rdi
mov edi, dword [rcx + 0x28]
sub edi, dword [rcx + 0x24]
jne 0x1400b4d67
mov r8d, dword [rcx + 0x2c]
test r8d, r8d
je 0x1400b4cfe
mov rdx, qword [rcx + 0x18]
call fcn.1400b4de0
test eax, eax
js 0x1400b4dc9
mov dword [rbx + 0x2c], r13d
cmp ebp, dword [rbx + 0x20]
jb 0x1400b4d1d
mov r9, r14
mov qword [rbx + 0x24], r13
mov r8d, ebp
mov rdx, r15
mov rcx, rbx
call 0x1400b4c00
jmp 0x1400b4dc9
cmp qword [rbx + 0x18], rsi
jne 0x1400b4d33
mov rcx, rbx
call fcn.1400b4b90
test eax, eax
js 0x1400b4dc9
mov r8d, dword [rbx + 0x20]
lea r9, [rsp + 0x50]
mov rdx, qword [rbx + 0x18]
mov rcx, rbx
call 0x1400b4c00
mov esi, eax
test eax, eax
js 0x1400b4dc9
mov edi, dword [rsp + 0x50]
test edi, edi
jne 0x1400b4d60
test r14, r14
je 0x1400b4dc9
mov dword [r14], r13d
jmp 0x1400b4dc9
mov dword [rbx + 0x24], r13d
mov dword [rbx + 0x28], edi
mov edx, dword [rbx + 0x24]
cmp edi, ebp
mov rcx, r15
mov qword [rsp + 0x60], r12
cmova edi, ebp
add rdx, qword [rbx + 0x18]
mov r8d, edi
call fcn.1400e31d0
add dword [rbx + 0x24], edi
cmp edi, ebp
jae 0x1400b4db6
mov eax, dword [rbx + 0x20]
cmp dword [rbx + 0x28], eax
jne 0x1400b4db6
sub ebp, edi
lea rdx, [rdi + r15]
mov r8d, ebp
lea r9, [rsp + 0x50]
mov rcx, rbx
call 0x1400b4c00
mov esi, eax
test eax, eax
js 0x1400b4dc2
add edi, dword [rsp + 0x50]
mov qword [rbx + 0x24], r13
test esi, esi
js 0x1400b4dc2
test r14, r14
je 0x1400b4dc2
mov dword [r14], edi
mov r12, qword [rsp + 0x60]
mov eax, esi
mov rdi, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x68]
add rsp, 0x20
pop r15
pop r14
pop r13
pop rsi
pop rbp
ret
Function at 0x1400b4c90
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x60
xor eax, eax
mov rdi, r9
test byte [rcx + 8], 8
mov rbx, rcx
je 0x1400b4c1c
lea rax, [rcx + 0x10]
mov rcx, qword [rcx]
xor r9d, r9d
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x50]
mov dword [rsp + 0x30], r8d
xor r8d, r8d
mov qword [rsp + 0x28], rdx
xor edx, edx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntdll.dll_NtReadFile]
cmp eax, 0x103
jne 0x1400b4c6c
mov rcx, qword [rbx]
xor r8d, r8d
xor edx, edx
call qword [sym.imp.ntdll.dll_NtWaitForSingleObject]
test eax, eax
js 0x1400b4c80
mov eax, dword [rsp + 0x50]
test eax, eax
js 0x1400b4c80
mov rcx, qword [rsp + 0x58]
add qword [rbx + 0x10], rcx
test rdi, rdi
je 0x1400b4c80
mov dword [rdi], ecx
mov rbx, qword [rsp + 0x70]
add rsp, 0x60
pop rdi
ret
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push r13
push r14
push r15
sub rsp, 0x20
xor r13d, r13d
mov r14, r9
test byte [rcx + 8], 2
mov ebp, r8d
mov r15, rdx
mov rbx, rcx
mov esi, r13d
je 0x1400b4ccf
mov rbx, qword [rsp + 0x68]
add rsp, 0x20
pop r15
pop r14
pop r13
pop rsi
pop rbp
jmp 0x1400b4c00
mov qword [rsp + 0x58], rdi
mov edi, dword [rcx + 0x28]
sub edi, dword [rcx + 0x24]
jne 0x1400b4d67
mov r8d, dword [rcx + 0x2c]
test r8d, r8d
je 0x1400b4cfe
mov rdx, qword [rcx + 0x18]
call fcn.1400b4de0
test eax, eax
js 0x1400b4dc9
mov dword [rbx + 0x2c], r13d
cmp ebp, dword [rbx + 0x20]
jb 0x1400b4d1d
mov r9, r14
mov qword [rbx + 0x24], r13
mov r8d, ebp
mov rdx, r15
mov rcx, rbx
call 0x1400b4c00
jmp 0x1400b4dc9
cmp qword [rbx + 0x18], rsi
jne 0x1400b4d33
mov rcx, rbx
call fcn.1400b4b90
test eax, eax
js 0x1400b4dc9
mov r8d, dword [rbx + 0x20]
lea r9, [rsp + 0x50]
mov rdx, qword [rbx + 0x18]
mov rcx, rbx
call 0x1400b4c00
mov esi, eax
test eax, eax
js 0x1400b4dc9
mov edi, dword [rsp + 0x50]
test edi, edi
jne 0x1400b4d60
test r14, r14
je 0x1400b4dc9
mov dword [r14], r13d
jmp 0x1400b4dc9
mov dword [rbx + 0x24], r13d
mov dword [rbx + 0x28], edi
mov edx, dword [rbx + 0x24]
cmp edi, ebp
mov rcx, r15
mov qword [rsp + 0x60], r12
cmova edi, ebp
add rdx, qword [rbx + 0x18]
mov r8d, edi
call fcn.1400e31d0
add dword [rbx + 0x24], edi
cmp edi, ebp
jae 0x1400b4db6
mov eax, dword [rbx + 0x20]
cmp dword [rbx + 0x28], eax
jne 0x1400b4db6
sub ebp, edi
lea rdx, [rdi + r15]
mov r8d, ebp
lea r9, [rsp + 0x50]
mov rcx, rbx
call 0x1400b4c00
mov esi, eax
test eax, eax
js 0x1400b4dc2
add edi, dword [rsp + 0x50]
mov qword [rbx + 0x24], r13
test esi, esi
js 0x1400b4dc2
test r14, r14
je 0x1400b4dc2
mov dword [r14], edi
mov r12, qword [rsp + 0x60]
mov eax, esi
mov rdi, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x68]
add rsp, 0x20
pop r15
pop r14
pop r13
pop rsi
pop rbp
ret
Function at 0x1400b4de0
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x60
xor eax, eax
mov rbx, rcx
test byte [rcx + 8], 8
je 0x1400b4df5
lea rax, [rcx + 0x10]
mov rcx, qword [rcx]
xor r9d, r9d
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x50]
mov dword [rsp + 0x30], r8d
xor r8d, r8d
mov qword [rsp + 0x28], rdx
xor edx, edx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntdll.dll_NtWriteFile]
mov ecx, eax
cmp eax, 0x103
jne 0x1400b4e47
mov rcx, qword [rbx]
xor r8d, r8d
xor edx, edx
call qword [sym.imp.ntdll.dll_NtWaitForSingleObject]
test eax, eax
js 0x1400b4e5d
mov ecx, dword [rsp + 0x50]
test ecx, ecx
js 0x1400b4e5b
mov rax, qword [rsp + 0x58]
add qword [rbx + 0x10], rax
or dword [rbx + 8], 0x80000000
mov eax, ecx
add rsp, 0x60
pop rbx
ret

Function at 0x1400b4e70
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
sub rsp, 0x20
xor edi, edi
mov esi, r8d
test byte [rcx + 8], 2
mov rbp, rdx
mov rbx, rcx
je 0x1400b4e9e
mov rbx, qword [rsp + 0x50]
add rsp, 0x20
pop rdi
pop rsi
pop rbp
jmp fcn.1400b4de0
cmp dword [rcx + 0x2c], edi
jne 0x1400b4eb2
call fcn.1400b4f80
mov edi, eax
test eax, eax
js 0x1400b4f65
mov eax, dword [rbx + 0x2c]
mov qword [rsp + 0x40], r14
mov qword [rsp + 0x48], r15
test eax, eax
je 0x1400b4f13
mov r14d, dword [rbx + 0x20]
sub r14d, eax
je 0x1400b4ef6
mov ecx, eax
cmp r14d, esi
mov rdx, rbp
cmova r14d, esi
add rcx, qword [rbx + 0x18]
mov r8d, r14d
mov r15d, r14d
call fcn.1400e31d0
add dword [rbx + 0x2c], r14d
cmp r14d, esi
je 0x1400b4f59
add rbp, r15
sub esi, r14d
mov r8d, dword [rbx + 0x2c]
mov rcx, rbx
mov rdx, qword [rbx + 0x18]
call fcn.1400b4de0
mov edi, eax
test eax, eax
js 0x1400b4f5b
mov dword [rbx + 0x2c], 0
cmp esi, dword [rbx + 0x20]
jb 0x1400b4f2e
mov r8d, esi
mov rdx, rbp
mov rcx, rbx
call fcn.1400b4de0
mov edi, eax
test eax, eax
jns 0x1400b4f59
jmp 0x1400b4f5b
test esi, esi
je 0x1400b4f59
cmp qword [rbx + 0x18], 0
jne 0x1400b4f47
mov rcx, rbx
call fcn.1400b4b90
mov edi, eax
test eax, eax
js 0x1400b4f5b
mov rcx, qword [rbx + 0x18]
mov rdx, rbp
mov r8d, esi
call fcn.1400e31d0
mov dword [rbx + 0x2c], esi
mov eax, edi
mov r14, qword [rsp + 0x40]
mov r15, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x50]
add rsp, 0x20
pop rdi
pop rsi
pop rbp
ret

Function at 0x1400b4f80
Capabilities:
Set file attributes

Disassembly:
push rbx
sub rsp, 0x40
mov r9d, dword [rcx + 0x28]
xor edx, edx
mov r8d, dword [rcx + 0x24]
mov rbx, rcx
cmp r9d, r8d
je 0x1400b4fe2
sub r8d, r9d
xor ecx, ecx
movsxd rax, r8d
add qword [rbx + 0x10], rax
test byte [rbx + 8], 8
mov rax, qword [rbx + 0x10]
jne 0x1400b4fd4
mov rcx, qword [rbx]
lea r9d, [rdx + 8]
lea rdx, [rsp + 0x30]
mov qword [rsp + 0x50], rax
lea r8, [rsp + 0x50]
mov dword [rsp + 0x20], 0xe
call qword [sym.imp.ntdll.dll_NtSetInformationFile]
mov ecx, eax
mov edx, ecx
test ecx, ecx
jns 0x1400b4fe2
mov eax, ecx
add rsp, 0x40
pop rbx
ret
mov qword [rbx + 0x24], 0
mov eax, edx
add rsp, 0x40
pop rbx
ret
Function at 0x1400b50a0
Capabilities:
Get file attributes
Set file attributes

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x60
mov rbx, rcx
mov rdi, rdx
xor ecx, ecx
test r8d, r8d
je 0x1400b5116
sub r8d, 1
je 0x1400b510d
cmp r8d, 1
jne 0x1400b511d
lea r9d, [rcx + 0x18]
mov dword [rsp + 0x20], 5
mov rcx, qword [rbx]
lea r8, [rsp + 0x40]
lea rdx, [rsp + 0x30]
call qword [sym.imp.ntdll.dll_NtQueryInformationFile]
mov edx, eax
mov ecx, eax
test eax, eax
js 0x1400b50f3
mov rax, qword [rsp + 0x48]
mov qword [rbx + 0x10], rax
test edx, edx
jns 0x1400b5104
mov eax, edx
mov rbx, qword [rsp + 0x70]
add rsp, 0x60
pop rdi
ret
mov rax, qword [rdi]
add qword [rbx + 0x10], rax
jmp 0x1400b511d
mov rax, qword [rdx]
add qword [rbx + 0x10], rax
jmp 0x1400b511d
mov rax, qword [rdx]
mov qword [rbx + 0x10], rax
test byte [rbx + 8], 8
jne 0x1400b5159
mov rax, qword [rbx + 0x10]
lea r8, [rsp + 0x88]
mov rcx, qword [rbx]
lea rdx, [rsp + 0x30]
mov r9d, 8
mov qword [rsp + 0x88], rax
mov dword [rsp + 0x20], 0xe
call qword [sym.imp.ntdll.dll_NtSetInformationFile]
mov ecx, eax
test eax, eax
js 0x1400b515b
mov eax, ecx
mov rbx, qword [rsp + 0x70]
add rsp, 0x60
pop rdi
ret
Function at 0x1400b7160
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x10], rbp
push rsi
push rdi
push r14
sub rsp, 0xa0
cmp qword [r8 + 8], 0
mov rsi, r9
mov rdi, r8
mov rbp, rdx
mov r14, rcx
jne 0x1400b718d
mov eax, 0xc000000d
jmp 0x1400b72d6
mov rcx, qword [0x140156b80]
mov rax, qword [str.SoftwareMicrosoftWindows_NTCurrentVersionKnownFunctionTableDlls]
mov qword [rsp + 0xc0], rbx
mov word [rsp + 0x50], cx
mov word [rsp + 0x52], cx
mov qword [rsp + 0x58], rax
cmp rcx, 0xfffe
jbe 0x1400b71c5
mov eax, 0xc0000106
jmp 0x1400b72ce
xor r8d, r8d
lea rax, [rsp + 0x40]
lea r9, [rsp + 0x70]
mov qword [rsp + 0x20], rax
lea rdx, [rsp + 0x50]
lea rcx, [r8 - 3]
call fcn.1400bed90
mov ebx, eax
test eax, eax
js 0x1400b7214
lea r8, [rsp + 0x70]
mov edx, 0x20019
lea rcx, [rsp + 0x30]
call qword [sym.imp.ntdll.dll_NtOpenKey]
mov rcx, qword [rsp + 0x40]
mov ebx, eax
test rcx, rcx
je 0x1400b7212
call qword [sym.imp.ntdll.dll_NtClose]
mov eax, ebx
test ebx, ebx
js 0x1400b72ce
mov rcx, qword [rsp + 0x30]
lea rax, [rsp + 0xd0]
xor r9d, r9d
mov qword [rsp + 0x28], rax
mov rdx, rdi
mov dword [rsp + 0x20], 0
lea r8d, [r9 + 2]
call qword [sym.imp.ntdll.dll_NtQueryValueKey]
mov rcx, qword [rsp + 0x30]
mov ebx, eax
call qword [sym.imp.ntdll.dll_NtClose]
cmp ebx, 0xc0000034
jne 0x1400b7262
mov eax, 0xc0000361
jmp 0x1400b72ce
lea r9, [rsp + 0x38]
mov r8, rdi
xor edx, edx
xor ecx, ecx
call qword [sym.imp.ntdll.dll_LdrLoadDll]
test eax, eax
js 0x1400b72ce
mov rcx, qword [rsp + 0x38]
lea rax, str.OutOfProcessFunctionTableCallback
lea r9, [rsp + 0x48]
mov qword [rsp + 0x68], rax
xor r8d, r8d
mov dword [rsp + 0x60], 0x220021
lea rdx, [rsp + 0x60]
call qword [sym.imp.ntdll.dll_LdrGetProcedureAddress]
mov ebx, eax
test eax, eax
js 0x1400b72c1
mov r8, qword [rsp + 0xe0]
mov r9, rsi
mov rdx, rbp
mov rcx, r14
call qword [rsp + 0x48]
mov ebx, eax
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ntdll.dll_LdrUnloadDll]
mov eax, ebx
mov rbx, qword [rsp + 0xc0]
mov rbp, qword [rsp + 0xc8]
add rsp, 0xa0
pop r14
pop rdi
pop rsi
ret
Function at 0x1400b8610
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
cmp qword [0x14015c480], 0
mov ebx, edx
mov rdi, rcx
je 0x1400b8635
call fcn.1400c00e0
cmp eax, 0xc00000bb
jne 0x1400b8640
mov edx, ebx
mov rcx, rdi
call qword [sym.imp.ntdll.dll_NtTerminateProcess]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x1400b9340
Capabilities:
Allocate or change rwx memory

Disassembly:
push rbx
push rsi
push r12
push r14
sub rsp, 0xb8
xor ebx, ebx
mov r14, r9
mov qword [rsp + 0x20], rbx
mov r12, r8
mov rsi, rcx
test dl, 1
jne 0x1400b93d4
lea r9d, [rbx + 0x30]
xor edx, edx
lea r8, [rsp + 0x78]
call qword [sym.imp.ntdll.dll_NtQueryInformationProcess]
test eax, eax
js 0x1400b9533
mov rdx, qword [rsp + 0x80]
lea r9d, [rbx + 8]
add rdx, 0x20
mov qword [rsp + 0x20], rbx
lea r8, [rsp + 0x30]
mov rcx, rsi
call sym.ProcessHacker.exe_PhReadVirtualMemory
test eax, eax
js 0x1400b9533
mov rdx, qword [rsp + 0x30]
lea r9d, [rbx + 8]
sub rdx, 0xffffffffffffff80
mov qword [rsp + 0x20], rbx
lea r8, [rsp + 0x38]
mov rcx, rsi
call sym.ProcessHacker.exe_PhReadVirtualMemory
test eax, eax
js 0x1400b9533
mov rdx, qword [rsp + 0x38]
jmp 0x1400b9451
mov r9d, 8
lea r8, [rsp + 0x40]
lea edx, [r9 + 0x12]
call qword [sym.imp.ntdll.dll_NtQueryInformationProcess]
test eax, eax
js 0x1400b9533
mov rdx, qword [rsp + 0x40]
lea r8, [rsp + 0xe8]
add rdx, 0x10
mov qword [rsp + 0x20], rbx
mov r9d, 4
mov rcx, rsi
call sym.ProcessHacker.exe_PhReadVirtualMemory
test eax, eax
js 0x1400b9533
mov edx, dword [rsp + 0xe8]
lea r8, [rsp + 0x30]
add rdx, 0x48
mov qword [rsp + 0x20], rbx
mov r9d, 4
mov rcx, rsi
call sym.ProcessHacker.exe_PhReadVirtualMemory
test eax, eax
js 0x1400b9533
mov edx, dword [rsp + 0x30]
mov qword [rsp + 0x38], rdx
mov qword [rsp + 0x28], rbx
lea r9, [rsp + 0x48]
xor r8d, r8d
mov qword [rsp + 0x20], 0x30
mov rcx, rsi
call qword [sym.imp.ntdll.dll_NtQueryVirtualMemory]
test eax, eax
js 0x1400b9533
mov qword [rsp + 0xe0], rbp
lea r9, [rsp + 0x40]
mov ebp, dword [rsp + 0x60]
lea rdx, [rsp + 0x30]
sub ebp, dword [rsp + 0x38]
xor r8d, r8d
add ebp, dword [rsp + 0x48]
or rcx, 0xffffffffffffffff
mov qword [rsp + 0xf0], rdi
mov qword [rsp + 0xb0], r15
mov r15d, ebp
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x40], r15
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x20], 0x1000
call qword [sym.imp.ntdll.dll_NtAllocateVirtualMemory]
test eax, eax
js 0x1400b9516
mov rdi, qword [rsp + 0x30]
test rdi, rdi
je 0x1400b9516
mov rdx, qword [rsp + 0x38]
mov r9d, r15d
mov r8, rdi
mov qword [rsp + 0x20], rbx
mov rcx, rsi
call sym.ProcessHacker.exe_PhReadVirtualMemory
mov ebx, eax
test eax, eax
jns 0x1400b9508
mov rcx, rdi
call sym.ProcessHacker.exe_PhFreePage
mov eax, ebx
jmp 0x1400b951b
mov qword [r12], rdi
test r14, r14
je 0x1400b951b
mov dword [r14], ebp
jmp 0x1400b951b
mov eax, 0xc0000017
mov rdi, qword [rsp + 0xf0]
mov rbp, qword [rsp + 0xe0]
mov r15, qword [rsp + 0xb0]
add rsp, 0xb8
pop r14
pop r12
pop rsi
pop rbx
ret
Function at 0x1400ba4f0
Capabilities:
Get file attributes

Disassembly:
push rbx
sub rsp, 0x60
mov rbx, rdx
mov dword [rsp + 0x20], 5
lea rdx, [rsp + 0x30]
mov r9d, 0x18
lea r8, [rsp + 0x40]
call qword [sym.imp.ntdll.dll_NtQueryInformationFile]
mov ecx, eax
test eax, eax
js 0x1400ba527
mov rax, qword [rsp + 0x48]
mov qword [rbx], rax
mov eax, ecx
add rsp, 0x60
pop rbx
ret

Function at 0x1400ba530
Capabilities:
Set file attributes

Disassembly:
sub rsp, 0x48
mov rax, qword [rdx]
lea r8, [rsp + 0x58]
lea rdx, [rsp + 0x30]
mov qword [rsp + 0x58], rax
mov r9d, 8
mov dword [rsp + 0x20], 0x14
call qword [sym.imp.ntdll.dll_NtSetInformationFile]
add rsp, 0x48
ret