joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14016ddc0
Capabilities:
Get system information on windows

Disassembly:
mov qword [rsp + 8], rcx
push rbx
push rsi
push rdi
push r13
sub rsp, 0x48
mov eax, dword [0x1402c5dc4]
mov edx, 4
mov rcx, qword [0x1402caad0]
mov r8d, eax
mov dword [rsp + 0x78], 0xffff
mov dword [rsp + 0x70], eax
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov ecx, dword ds:[rsp + 0x70]
lea rdx, [rsp + 0x78]
mov rbx, rax
mov r8d, 4
lea rax, [rsp + 0x70]
mov r9, rbx
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], ecx
mov ecx, 0x6b
call qword [sym.imp.ntdll.dll_NtQuerySystemInformationEx]
xor r13d, r13d
mov esi, eax
mov edi, r13d
cmp eax, 0xc0000004
jne 0x14016de9f
cmp edi, 8
jae 0x14016dea4
mov rcx, qword [0x1402caad0]
mov r8, rbx
xor edx, edx
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
mov r8d, dword ds:[rsp + 0x70]
mov edx, 4
mov rcx, qword [0x1402caad0]
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov r8d, 4
lea rdx, [rsp + 0x78]
mov rbx, rax
mov ecx, 0x6b
lea rax, [rsp + 0x70]
mov r9, rbx
mov qword [rsp + 0x28], rax
mov eax, dword [rsp + 0x70]
mov dword [rsp + 0x20], eax
call qword [sym.imp.ntdll.dll_NtQuerySystemInformationEx]
inc edi
mov esi, eax
cmp eax, 0xc0000004
je 0x14016de35
nop
test esi, esi
jns 0x14016dec5
lfence
mov rcx, qword [0x1402caad0]
mov r8, rbx
xor edx, edx
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
mov eax, esi
add rsp, 0x48
pop r13
pop rdi
pop rsi
pop rbx
ret
mov eax, dword ds:[rsp + 0x70]
mov qword [rsp + 0x80], rbp
mov qword [rsp + 0x40], r12
mov qword [rsp + 0x38], r14
cmp eax, 0x100000
ja 0x14016deed
mov dword [0x1402c5dc4], eax
lfence
lea r14, [rbx + rax]
mov ebp, r13d
mov r11d, r13d
mov r9d, r13d
mov edi, r13d
mov r12, rbx
cmp rbx, r14
jae 0x14016dfbb
mov qword [rsp + 0x30], r15
mov r15d, dword [0x1402bf00c]
mov ecx, dword [rbx]
test ecx, ecx
je 0x14016df33
nop
sub ecx, 1
je 0x14016df2e
cmp ecx, 2
jne 0x14016dfa7
inc edi
jmp 0x14016dfa7
inc r11d
jmp 0x14016dfa7
movzx eax, word [rbx + 0x1e]
inc ebp
cmp r13w, ax
jae 0x14016dfa7
mov r10d, r15d
lea rdx, [rbx + 0x20]
and r10d, 4
mov r8d, eax
nop dword [rax]
mov rax, qword [rdx]
test r10d, r10d
je 0x14016df5f
popcnt rax, rax
jmp 0x14016df9a
mov rcx, rax
shr rcx, 1
and ecx, 0x55555555
sub rax, rcx
mov rcx, rax
and eax, 0x33333333
shr rcx, 2
and ecx, 0x33333333
add rcx, rax
mov rax, rcx
shr rax, 4
add eax, ecx
and eax, 0xf0f0f0f
imul eax, eax, 0x1010101
shr eax, 0x18
add r9d, eax
add rdx, 0x10
sub r8, 1
jne 0x14016df50
mov ecx, dword [rbx + 4]
add rbx, rcx
cmp rbx, r14
jb 0x14016df18
mov r15, qword [rsp + 0x30]
mov rcx, qword [0x1402caad0]
mov r8, r12
xor edx, edx
mov dword [0x1402cd580], ebp
mov dword [0x1402cd584], r11d
mov dword [0x1402cd588], r9d
mov dword [0x1402cd58c], edi
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
mov r14, qword [rsp + 0x38]
mov eax, esi
mov r12, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x80]
add rsp, 0x48
pop r13
pop rdi
pop rsi
pop rbx
ret
Function at 0x14016e080
Capabilities:
Get system information on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
push rsi
push rdi
push r14
sub rsp, 0x30
mov eax, dword [0x1402c5dc0]
mov r14, rdx
movzx ebp, cx
mov r8d, eax
mov rcx, qword [0x1402caad0]
mov edx, 4
mov dword [rsp + 0x68], 4
mov dword [rsp + 0x60], eax
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov r8d, dword [rsp + 0x60]
lea rdx, [rsp + 0x68]
mov rdi, rax
mov ecx, 0x6b
lea rax, [rsp + 0x60]
mov r9, rdi
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], r8d
mov r8d, 4
call qword [sym.imp.ntdll.dll_NtQuerySystemInformationEx]
xor esi, esi
mov ebx, eax
cmp eax, 0xc0000004
jne 0x14016e167
nop word [rax + rax]
cmp esi, 8
jae 0x14016e167
mov rcx, qword [0x1402caad0]
mov r8, rdi
xor edx, edx
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
mov r8d, dword [rsp + 0x60]
mov edx, 4
mov rcx, qword [0x1402caad0]
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov r8d, 4
lea rdx, [rsp + 0x68]
mov rdi, rax
mov ecx, 0x6b
lea rax, [rsp + 0x60]
mov r9, rdi
mov qword [rsp + 0x28], rax
mov eax, dword [rsp + 0x60]
mov dword [rsp + 0x20], eax
call qword [sym.imp.ntdll.dll_NtQuerySystemInformationEx]
inc esi
mov ebx, eax
cmp eax, 0xc0000004
je 0x14016e100
test ebx, ebx
jns 0x14016e170
lfence
jmp 0x14016e1a7
mov eax, dword [rsp + 0x60]
cmp eax, 0x100000
ja 0x14016e181
mov dword [0x1402c5dc0], eax
lfence
cmp bp, word [rdi + 0xa]
jae 0x14016e1a2
lea rax, [rbp*2]
add rax, rbp
add rax, rax
mov rax, qword [rdi + rax*8 + 0x48]
mov qword [r14], rax
jmp 0x14016e1a7
mov ebx, 0xc0000001
mov rcx, qword [0x1402caad0]
mov r8, rdi
xor edx, edx
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
mov rbp, qword [rsp + 0x58]
mov eax, ebx
mov rbx, qword [rsp + 0x50]
add rsp, 0x30
pop r14
pop rdi
pop rsi
ret
Function at 0x14016e700
Capabilities:
Resume thread

Disassembly:
mov r11, rsp
push rbp
push rdi
push r14
sub rsp, 0xb0
mov rax, qword [0x1402bf040]
xor rax, rsp
mov qword [rsp + 0xa8], rax
xor r14d, r14d
lea r8, [r11 - 0x28]
mov rbp, rdx
mov qword [r11 - 0x70], r14
mov edx, 0x1a
mov qword [r11 - 0x78], r14
mov r9d, 8
mov qword [r11 - 0x68], r14
mov qword [r11 - 0x60], r14
mov rdi, rcx
mov qword [rsp + 0x20], r14
call qword [sym.imp.ntdll.dll_NtQueryInformationProcess]
test eax, eax
js 0x14016e8ff
cmp qword [rsp + 0xa0], r14
lea rax, [0x1402c5e28]
mov qword [rsp + 0xe0], rbx
lea rbx, [0x1402c5f68]
mov qword [rsp + 0xe8], rsi
setne sil
test sil, sil
cmove rbx, rax
lfence
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], r14
xor r9d, r9d
mov qword [rsp + 0x20], rax
lea r8, str.RtlExitUserThread
mov rdx, rbx
mov rcx, rdi
call sym.SystemInformer.exe_PhGetProcedureAddressRemote
test eax, eax
js 0x14016e8ef
lfence
lea rax, [rsp + 0x50]
mov qword [rsp + 0x28], r14
xor r9d, r9d
mov qword [rsp + 0x20], rax
lea r8, str.RtlFlushHeaps
mov rdx, rbx
mov rcx, rdi
call sym.SystemInformer.exe_PhGetProcedureAddressRemote
test eax, eax
js 0x14016e8ef
cmp dword [0x1402bff40], 0x3e
jb 0x14016e810
lfence
lea rdx, [rsp + 0x68]
mov rcx, rdi
call fcn.14016d6c0
mov ebx, eax
test eax, eax
js 0x14016e8de
lfence
mov qword [rsp + 0x48], r14
lea rax, [rsp + 0x60]
mov qword [rsp + 0x40], rax
mov r8d, 1
mov rax, qword [rsp + 0x58]
mov rcx, rdi
mov qword [rsp + 0x38], r14
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], r14
call fcn.140142580
mov rdi, qword [rsp + 0x60]
mov ebx, eax
test eax, eax
js 0x14016e8d0
mov rdx, qword [rsp + 0x50]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], r14
mov rcx, rdi
test sil, sil
je 0x14016e874
call qword [sym.imp.ntdll.dll_RtlQueueApcWow64Thread]
jmp 0x14016e87a
call qword [sym.imp.ntdll.dll_NtQueueApcThread]
mov ebx, eax
test eax, eax
js 0x14016e8d0
xor edx, edx
mov rcx, rdi
call qword [sym.imp.ntdll.dll_NtResumeThread]
mov ebx, eax
test eax, eax
js 0x14016e8d0
mov r8, rbp
xor edx, edx
mov rcx, rdi
call qword [sym.imp.ntdll.dll_NtWaitForSingleObject]
mov ebx, eax
test eax, eax
js 0x14016e8d0
mov r9d, 0x30
mov qword [rsp + 0x20], r14
lea r8, [rsp + 0x70]
xor edx, edx
mov rcx, rdi
call qword [sym.imp.ntdll.dll_NtQueryInformationThread]
test eax, eax
mov ebx, eax
cmovns ebx, dword [rsp + 0x70]
test rdi, rdi
je 0x14016e8de
mov rcx, rdi
call qword [sym.imp.ntdll.dll_NtClose]
mov rcx, qword [rsp + 0x68]
test rcx, rcx
je 0x14016e8ed
call fcn.14016d7c0
mov eax, ebx
mov rbx, qword [rsp + 0xe0]
mov rsi, qword [rsp + 0xe8]
mov rcx, qword [rsp + 0xa8]
xor rcx, rsp
call fcn.1401e4160
add rsp, 0xb0
pop r14
pop rdi
pop rbp
ret
Function at 0x140170380
Capabilities:
Parse pe header

Disassembly:
push rdi
sub rsp, 0x40
xor edi, edi
test byte [0x1402c61a0], 1
jne 0x1401704fc
lock bts qword [0x1402c61a0], 0x1f
setb al
test al, al
je 0x1401703ca
test byte [0x1402c61a0], 1
jne 0x1401704fc
xor edx, edx
lea rcx, [0x1402c61a0]
call sym.SystemInformer.exe_PhfWaitForEvent
jmp 0x1401704fc
mov qword [rsp + 0x50], rbx
lea rdx, [rsp + 0x30]
lea rbx, [0x14023ec90]
mov qword [rsp + 0x30], 0x12
mov qword [rsp + 0x38], rbx
call fcn.14017d8a0
mov rcx, rax
test rax, rax
jne 0x140170455
xor edx, edx
mov r8d, 0x800
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
test rax, rax
jne 0x140170455
xor edx, edx
mov r8d, 0x200
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
test rax, rax
jne 0x140170455
cmp dword [0x1402bff40], 0x3e
jae 0x1401704eb
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
test rax, rax
je 0x1401704eb
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x1401704eb
mov edx, dword [rcx + 0x3c]
lea eax, [rdx - 1]
cmp eax, 0x7ffffffd
ja 0x1401704eb
cmp dword [rdx + rcx], 0x4550
jne 0x1401704eb
add rdx, 0x88
add rdx, rcx
mov eax, dword [rdx]
test eax, eax
je 0x1401704eb
cmp dword [rdx + 4], edi
je 0x1401704eb
lea r8, [rcx + rax]
mov word [rsp + 0x20], di
lea r9, str.NtQueryInformationEnlistment
call fcn.14017dc40
mov r9, rax
test rax, rax
je 0x1401704eb
mov r8, qword [0x7ffe0320]
mov ecx, dword [0x7ffe0004]
mov eax, r8d
shr r8, 0x20
imul rax, rcx
imul r8, rcx
shr rax, 0x18
shl r8, 8
add rax, r8
mov qword [0x1402cdfc0], rax
xor rax, r9
mov qword [0x1402cdfa0], rax
lea rcx, [0x1402c61a0]
call sym.SystemInformer.exe_PhfSetEvent
mov rbx, qword [rsp + 0x50]
mov rax, qword [0x1402cdfa0]
test rax, rax
je 0x14017051d
mov rcx, qword [0x1402cdfc0]
test rcx, rcx
je 0x14017051d
xor rax, rcx
add rsp, 0x40
pop rdi
ret
mov rax, rdi
add rsp, 0x40
pop rdi
ret
Function at 0x140170540
Capabilities:
Parse pe header

Disassembly:
push rdi
sub rsp, 0x40
xor edi, edi
test byte [0x1402c61f0], 1
jne 0x1401706bc
lock bts qword [0x1402c61f0], 0x1f
setb al
test al, al
je 0x14017058a
test byte [0x1402c61f0], 1
jne 0x1401706bc
xor edx, edx
lea rcx, [0x1402c61f0]
call sym.SystemInformer.exe_PhfWaitForEvent
jmp 0x1401706bc
mov qword [rsp + 0x50], rbx
lea rdx, [rsp + 0x30]
lea rbx, [0x14023ec90]
mov qword [rsp + 0x30], 0x12
mov qword [rsp + 0x38], rbx
call fcn.14017d8a0
mov rcx, rax
test rax, rax
jne 0x140170615
xor edx, edx
mov r8d, 0x800
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
test rax, rax
jne 0x140170615
xor edx, edx
mov r8d, 0x200
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
test rax, rax
jne 0x140170615
cmp dword [0x1402bff40], 0x3e
jae 0x1401706ab
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
test rax, rax
je 0x1401706ab
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x1401706ab
mov edx, dword [rcx + 0x3c]
lea eax, [rdx - 1]
cmp eax, 0x7ffffffd
ja 0x1401706ab
cmp dword [rdx + rcx], 0x4550
jne 0x1401706ab
add rdx, 0x88
add rdx, rcx
mov eax, dword [rdx]
test eax, eax
je 0x1401706ab
cmp dword [rdx + 4], edi
je 0x1401706ab
lea r8, [rcx + rax]
mov word [rsp + 0x20], di
lea r9, str.NtQueryInformationResourceManager
call fcn.14017dc40
mov r9, rax
test rax, rax
je 0x1401706ab
mov r8, qword [0x7ffe0320]
mov ecx, dword [0x7ffe0004]
mov eax, r8d
shr r8, 0x20
imul rax, rcx
imul r8, rcx
shr rax, 0x18
shl r8, 8
add rax, r8
mov qword [0x1402ce050], rax
xor rax, r9
mov qword [0x1402ce0d0], rax
lea rcx, [0x1402c61f0]
call sym.SystemInformer.exe_PhfSetEvent
mov rbx, qword [rsp + 0x50]
mov rax, qword [0x1402ce0d0]
test rax, rax
je 0x1401706dd
mov rcx, qword [0x1402ce050]
test rcx, rcx
je 0x1401706dd
xor rax, rcx
add rsp, 0x40
pop rdi
ret
mov rax, rdi
add rsp, 0x40
pop rdi
ret
Function at 0x140170700
Capabilities:
Parse pe header

Disassembly:
push rdi
sub rsp, 0x40
xor edi, edi
test byte [0x1402c61d0], 1
jne 0x14017087c
lock bts qword [0x1402c61d0], 0x1f
setb al
test al, al
je 0x14017074a
test byte [0x1402c61d0], 1
jne 0x14017087c
xor edx, edx
lea rcx, [0x1402c61d0]
call sym.SystemInformer.exe_PhfWaitForEvent
jmp 0x14017087c
mov qword [rsp + 0x50], rbx
lea rdx, [rsp + 0x30]
lea rbx, [0x14023ec90]
mov qword [rsp + 0x30], 0x12
mov qword [rsp + 0x38], rbx
call fcn.14017d8a0
mov rcx, rax
test rax, rax
jne 0x1401707d5
xor edx, edx
mov r8d, 0x800
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
test rax, rax
jne 0x1401707d5
xor edx, edx
mov r8d, 0x200
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
test rax, rax
jne 0x1401707d5
cmp dword [0x1402bff40], 0x3e
jae 0x14017086b
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
test rax, rax
je 0x14017086b
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x14017086b
mov edx, dword [rcx + 0x3c]
lea eax, [rdx - 1]
cmp eax, 0x7ffffffd
ja 0x14017086b
cmp dword [rdx + rcx], 0x4550
jne 0x14017086b
add rdx, 0x88
add rdx, rcx
mov eax, dword [rdx]
test eax, eax
je 0x14017086b
cmp dword [rdx + 4], edi
je 0x14017086b
lea r8, [rcx + rax]
mov word [rsp + 0x20], di
lea r9, str.NtQueryInformationTransaction
call fcn.14017dc40
mov r9, rax
test rax, rax
je 0x14017086b
mov r8, qword [0x7ffe0320]
mov ecx, dword [0x7ffe0004]
mov eax, r8d
shr r8, 0x20
imul rax, rcx
imul r8, rcx
shr rax, 0x18
shl r8, 8
add rax, r8
mov qword [0x1402ce078], rax
xor rax, r9
mov qword [0x1402cdfe0], rax
lea rcx, [0x1402c61d0]
call sym.SystemInformer.exe_PhfSetEvent
mov rbx, qword [rsp + 0x50]
mov rax, qword [0x1402cdfe0]
test rax, rax
je 0x14017089d
mov rcx, qword [0x1402ce078]
test rcx, rcx
je 0x14017089d
xor rax, rcx
add rsp, 0x40
pop rdi
ret
mov rax, rdi
add rsp, 0x40
pop rdi
ret
Function at 0x1401708c0
Capabilities:
Parse pe header

Disassembly:
push rdi
sub rsp, 0x40
xor edi, edi
test byte [0x1402c6240], 1
jne 0x140170a3c
lock bts qword [0x1402c6240], 0x1f
setb al
test al, al
je 0x14017090a
test byte [0x1402c6240], 1
jne 0x140170a3c
xor edx, edx
lea rcx, [0x1402c6240]
call sym.SystemInformer.exe_PhfWaitForEvent
jmp 0x140170a3c
mov qword [rsp + 0x50], rbx
lea rdx, [rsp + 0x30]
lea rbx, [0x14023ec90]
mov qword [rsp + 0x30], 0x12
mov qword [rsp + 0x38], rbx
call fcn.14017d8a0
mov rcx, rax
test rax, rax
jne 0x140170995
xor edx, edx
mov r8d, 0x800
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
test rax, rax
jne 0x140170995
xor edx, edx
mov r8d, 0x200
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
test rax, rax
jne 0x140170995
cmp dword [0x1402bff40], 0x3e
jae 0x140170a2b
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
test rax, rax
je 0x140170a2b
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x140170a2b
mov edx, dword [rcx + 0x3c]
lea eax, [rdx - 1]
cmp eax, 0x7ffffffd
ja 0x140170a2b
cmp dword [rdx + rcx], 0x4550
jne 0x140170a2b
add rdx, 0x88
add rdx, rcx
mov eax, dword [rdx]
test eax, eax
je 0x140170a2b
cmp dword [rdx + 4], edi
je 0x140170a2b
lea r8, [rcx + rax]
mov word [rsp + 0x20], di
lea r9, str.NtQueryInformationTransactionManager
call fcn.14017dc40
mov r9, rax
test rax, rax
je 0x140170a2b
mov r8, qword [0x7ffe0320]
mov ecx, dword [0x7ffe0004]
mov eax, r8d
shr r8, 0x20
imul rax, rcx
imul r8, rcx
shr rax, 0x18
shl r8, 8
add rax, r8
mov qword [0x1402cdfa8], rax
xor rax, r9
mov qword [0x1402ce0e8], rax
lea rcx, [0x1402c6240]
call sym.SystemInformer.exe_PhfSetEvent
mov rbx, qword [rsp + 0x50]
mov rax, qword [0x1402ce0e8]
test rax, rax
je 0x140170a5d
mov rcx, qword [0x1402cdfa8]
test rcx, rcx
je 0x140170a5d
xor rax, rcx
add rsp, 0x40
pop rdi
ret
mov rax, rdi
add rsp, 0x40
pop rdi
ret
Function at 0x140170a80
Capabilities:
Parse pe header

Disassembly:
push rdi
sub rsp, 0x40
xor edi, edi
test byte [0x1402c61e0], 1
jne 0x140170bfc
lock bts qword [0x1402c61e0], 0x1f
setb al
test al, al
je 0x140170aca
test byte [0x1402c61e0], 1
jne 0x140170bfc
xor edx, edx
lea rcx, [0x1402c61e0]
call sym.SystemInformer.exe_PhfWaitForEvent
jmp 0x140170bfc
mov qword [rsp + 0x50], rbx
lea rdx, [rsp + 0x30]
lea rbx, [0x14023ec90]
mov qword [rsp + 0x30], 0x12
mov qword [rsp + 0x38], rbx
call fcn.14017d8a0
mov rcx, rax
test rax, rax
jne 0x140170b55
xor edx, edx
mov r8d, 0x800
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
test rax, rax
jne 0x140170b55
xor edx, edx
mov r8d, 0x200
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
test rax, rax
jne 0x140170b55
cmp dword [0x1402bff40], 0x3e
jae 0x140170beb
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
test rax, rax
je 0x140170beb
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x140170beb
mov edx, dword [rcx + 0x3c]
lea eax, [rdx - 1]
cmp eax, 0x7ffffffd
ja 0x140170beb
cmp dword [rdx + rcx], 0x4550
jne 0x140170beb
add rdx, 0x88
add rdx, rcx
mov eax, dword [rdx]
test eax, eax
je 0x140170beb
cmp dword [rdx + 4], edi
je 0x140170beb
lea r8, [rcx + rax]
mov word [rsp + 0x20], di
lea r9, str.NtSetInformationVirtualMemory
call fcn.14017dc40
mov r9, rax
test rax, rax
je 0x140170beb
mov r8, qword [0x7ffe0320]
mov ecx, dword [0x7ffe0004]
mov eax, r8d
shr r8, 0x20
imul rax, rcx
imul r8, rcx
shr rax, 0x18
shl r8, 8
add rax, r8
mov qword [0x1402ce020], rax
xor rax, r9
mov qword [0x1402ce088], rax
lea rcx, [0x1402c61e0]
call sym.SystemInformer.exe_PhfSetEvent
mov rbx, qword [rsp + 0x50]
mov rax, qword [0x1402ce088]
test rax, rax
je 0x140170c1d
mov rcx, qword [0x1402ce020]
test rcx, rcx
je 0x140170c1d
xor rax, rcx
add rsp, 0x40
pop rdi
ret
mov rax, rdi
add rsp, 0x40
pop rdi
ret
Function at 0x140170c40
Capabilities:
Parse pe header

Disassembly:
push rdi
sub rsp, 0x40
xor edi, edi
test byte [0x1402c6160], 1
jne 0x140170dbc
lock bts qword [0x1402c6160], 0x1f
setb al
test al, al
je 0x140170c8a
test byte [0x1402c6160], 1
jne 0x140170dbc
xor edx, edx
lea rcx, [0x1402c6160]
call sym.SystemInformer.exe_PhfWaitForEvent
jmp 0x140170dbc
mov qword [rsp + 0x50], rbx
lea rdx, [rsp + 0x30]
lea rbx, [0x14023ec90]
mov qword [rsp + 0x30], 0x12
mov qword [rsp + 0x38], rbx
call fcn.14017d8a0
mov rcx, rax
test rax, rax
jne 0x140170d15
xor edx, edx
mov r8d, 0x800
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
test rax, rax
jne 0x140170d15
xor edx, edx
mov r8d, 0x200
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
test rax, rax
jne 0x140170d15
cmp dword [0x1402bff40], 0x3e
jae 0x140170dab
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
test rax, rax
je 0x140170dab
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x140170dab
mov edx, dword [rcx + 0x3c]
lea eax, [rdx - 1]
cmp eax, 0x7ffffffd
ja 0x140170dab
cmp dword [rdx + rcx], 0x4550
jne 0x140170dab
add rdx, 0x88
add rdx, rcx
mov eax, dword [rdx]
test eax, eax
je 0x140170dab
cmp dword [rdx + 4], edi
je 0x140170dab
lea r8, [rcx + rax]
mov word [rsp + 0x20], di
lea r9, str.NtCreateProcessStateChange
call fcn.14017dc40
mov r9, rax
test rax, rax
je 0x140170dab
mov r8, qword [0x7ffe0320]
mov ecx, dword [0x7ffe0004]
mov eax, r8d
shr r8, 0x20
imul rax, rcx
imul r8, rcx
shr rax, 0x18
shl r8, 8
add rax, r8
mov qword [0x1402ce048], rax
xor rax, r9
mov qword [0x1402cdfd8], rax
lea rcx, [0x1402c6160]
call sym.SystemInformer.exe_PhfSetEvent
mov rbx, qword [rsp + 0x50]
mov rax, qword [0x1402cdfd8]
test rax, rax
je 0x140170ddd
mov rcx, qword [0x1402ce048]
test rcx, rcx
je 0x140170ddd
xor rax, rcx
add rsp, 0x40
pop rdi
ret
mov rax, rdi
add rsp, 0x40
pop rdi
ret
Function at 0x140170e00
Capabilities:
Parse pe header

Disassembly:
push rdi
sub rsp, 0x40
xor edi, edi
test byte [0x1402c61c0], 1
jne 0x140170f7c
lock bts qword [0x1402c61c0], 0x1f
setb al
test al, al
je 0x140170e4a
test byte [0x1402c61c0], 1
jne 0x140170f7c
xor edx, edx
lea rcx, [0x1402c61c0]
call sym.SystemInformer.exe_PhfWaitForEvent
jmp 0x140170f7c
mov qword [rsp + 0x50], rbx
lea rdx, [rsp + 0x30]
lea rbx, [0x14023ec90]
mov qword [rsp + 0x30], 0x12
mov qword [rsp + 0x38], rbx
call fcn.14017d8a0
mov rcx, rax
test rax, rax
jne 0x140170ed5
xor edx, edx
mov r8d, 0x800
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
test rax, rax
jne 0x140170ed5
xor edx, edx
mov r8d, 0x200
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
test rax, rax
jne 0x140170ed5
cmp dword [0x1402bff40], 0x3e
jae 0x140170f6b
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
test rax, rax
je 0x140170f6b
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x140170f6b
mov edx, dword [rcx + 0x3c]
lea eax, [rdx - 1]
cmp eax, 0x7ffffffd
ja 0x140170f6b
cmp dword [rdx + rcx], 0x4550
jne 0x140170f6b
add rdx, 0x88
add rdx, rcx
mov eax, dword [rdx]
test eax, eax
je 0x140170f6b
cmp dword [rdx + 4], edi
je 0x140170f6b
lea r8, [rcx + rax]
mov word [rsp + 0x20], di
lea r9, str.NtChangeProcessState
call fcn.14017dc40
mov r9, rax
test rax, rax
je 0x140170f6b
mov r8, qword [0x7ffe0320]
mov ecx, dword [0x7ffe0004]
mov eax, r8d
shr r8, 0x20
imul rax, rcx
imul r8, rcx
shr rax, 0x18
shl r8, 8
add rax, r8
mov qword [0x1402ce0a0], rax
xor rax, r9
mov qword [0x1402cdfb0], rax
lea rcx, [0x1402c61c0]
call sym.SystemInformer.exe_PhfSetEvent
mov rbx, qword [rsp + 0x50]
mov rax, qword [0x1402cdfb0]
test rax, rax
je 0x140170f9d
mov rcx, qword [0x1402ce0a0]
test rcx, rcx
je 0x140170f9d
xor rax, rcx
add rsp, 0x40
pop rdi
ret
mov rax, rdi
add rsp, 0x40
pop rdi
ret
Function at 0x140170fc0
Capabilities:
Parse pe header

Disassembly:
push rdi
sub rsp, 0x40
xor edi, edi
test byte [0x1402c6170], 1
jne 0x14017113c
lock bts qword [0x1402c6170], 0x1f
setb al
test al, al
je 0x14017100a
test byte [0x1402c6170], 1
jne 0x14017113c
xor edx, edx
lea rcx, [0x1402c6170]
call sym.SystemInformer.exe_PhfWaitForEvent
jmp 0x14017113c
mov qword [rsp + 0x50], rbx
lea rdx, [rsp + 0x30]
lea rbx, [0x14023ec90]
mov qword [rsp + 0x30], 0x12
mov qword [rsp + 0x38], rbx
call fcn.14017d8a0
mov rcx, rax
test rax, rax
jne 0x140171095
xor edx, edx
mov r8d, 0x800
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
test rax, rax
jne 0x140171095
xor edx, edx
mov r8d, 0x200
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
test rax, rax
jne 0x140171095
cmp dword [0x1402bff40], 0x3e
jae 0x14017112b
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
test rax, rax
je 0x14017112b
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x14017112b
mov edx, dword [rcx + 0x3c]
lea eax, [rdx - 1]
cmp eax, 0x7ffffffd
ja 0x14017112b
cmp dword [rdx + rcx], 0x4550
jne 0x14017112b
add rdx, 0x88
add rdx, rcx
mov eax, dword [rdx]
test eax, eax
je 0x14017112b
cmp dword [rdx + 4], edi
je 0x14017112b
lea r8, [rcx + rax]
mov word [rsp + 0x20], di
lea r9, str.RtlDefaultNpAcl
call fcn.14017dc40
mov r9, rax
test rax, rax
je 0x14017112b
mov r8, qword [0x7ffe0320]
mov ecx, dword [0x7ffe0004]
mov eax, r8d
shr r8, 0x20
imul rax, rcx
imul r8, rcx
shr rax, 0x18
shl r8, 8
add rax, r8
mov qword [0x1402ce0f8], rax
xor rax, r9
mov qword [0x1402ce028], rax
lea rcx, [0x1402c6170]
call sym.SystemInformer.exe_PhfSetEvent
mov rbx, qword [rsp + 0x50]
mov rax, qword [0x1402ce028]
test rax, rax
je 0x14017115d
mov rcx, qword [0x1402ce0f8]
test rcx, rcx
je 0x14017115d
xor rax, rcx
add rsp, 0x40
pop rdi
ret
mov rax, rdi
add rsp, 0x40
pop rdi
ret