joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140019380
Capabilities:
Delete registry key
Persist via windows service
Set registry value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
lea rbp, [rsp - 0x47]
sub rsp, 0xc0
mov rsi, rdx
mov qword [rbp + 0x7f], 0
lea rdx, str.SystemCurrentControlSetServices_
mov ecx, 3
lea r9, str.Parameters
lea r8, str.KProcessHacker2
call sym.ProcessHacker.exe_PhConcatStrings
mov rdi, rax
cmp qword [rax], 0xfffe
movzx ecx, word [rax]
mov word [rbp - 0x29], cx
mov word [rbp - 0x27], cx
mov rcx, qword [rax + 8]
mov qword [rbp - 0x21], rcx
jbe 0x1400193e9
mov ebx, 0xc0000106
jmp 0x14001944d
xor r8d, r8d
lea rax, [rbp + 0x77]
lea r9, [rbp + 0x17]
mov qword [rsp + 0x20], rax
lea rdx, [rbp - 0x29]
lea rcx, [r8 - 3]
call fcn.140023c80
mov ebx, eax
test eax, eax
js 0x14001944d
lea rax, [rbp + 0x67]
xor r9d, r9d
mov qword [rsp + 0x30], rax
lea r8, [rbp + 0x17]
mov dword [rsp + 0x28], 0
lea rcx, [rbp + 0x7f]
mov edx, 0x30006
mov qword [rsp + 0x20], 0
call qword [sym.imp.ntdll.dll_NtCreateKey]
mov rcx, qword [rbp + 0x77]
mov ebx, eax
test rcx, rcx
je 0x14001944d
call qword [sym.imp.ntdll.dll_NtClose]
lea rcx, [rdi - 0x10]
or edx, 0xffffffff
lock xadd dword [rcx + 8], edx
cmp edx, 1
jne 0x140019463
call fcn.1400258b0
test ebx, ebx
js 0x140019522
mov rcx, qword [rbp + 0x7f]
lea rax, str.SecurityLevel
mov dword [rsp + 0x28], 4
lea rdx, [rbp - 0x39]
mov r9d, 4
mov qword [rbp - 0x31], rax
xor r8d, r8d
mov dword [rbp - 0x39], 0x1c001a
mov qword [rsp + 0x20], rsi
call qword [sym.imp.ntdll.dll_NtSetValueKey]
mov ebx, eax
test eax, eax
js 0x140019508
cmp byte [rsi + 4], 0
je 0x140019504
lea rax, str.DynamicConfiguration
mov dword [rbp - 0x39], 0x2a0028
lea rcx, [rbp - 0x11]
mov qword [rbp - 0x31], rax
mov dword [rbp - 0x19], 2
mov dword [rbp - 0x15], 1
call fcn.140019b40
test eax, eax
js 0x140019504
mov rcx, qword [rbp + 0x7f]
lea rax, [rbp - 0x19]
mov dword [rsp + 0x28], 0x2c
lea rdx, [rbp - 0x39]
mov r9d, 3
mov qword [rsp + 0x20], rax
xor r8d, r8d
call qword [sym.imp.ntdll.dll_NtSetValueKey]
mov ebx, eax
test ebx, ebx
jns 0x140019518
cmp dword [rbp + 0x67], 1
jne 0x140019518
mov rcx, qword [rbp + 0x7f]
call qword [sym.imp.ntdll.dll_NtDeleteKey]
mov rcx, qword [rbp + 0x7f]
call qword [sym.imp.ntdll.dll_NtClose]
mov eax, ebx
mov rbx, qword [rsp + 0xe8]
add rsp, 0xc0
pop rdi
pop rsi
pop rbp
ret
Function at 0x140019540
Capabilities:
Create service
Delete service
Start service

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x70
mov rsi, r8
mov rdi, rdx
xor ebx, ebx
xor edx, edx
xor ecx, ecx
lea r8d, [rbx + 2]
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov rbp, rax
test rax, rax
jne 0x14001958d
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x140019671
movzx eax, ax
or eax, 0xc0070000
jmp 0x140019671
lea rax, [0x140122b94]
mov r9d, 0xf01ff
mov qword [rsp + 0x60], rax
lea r8, str.KProcessHacker2
mov qword [rsp + 0x58], rbx
lea rdx, str.KProcessHacker2
mov qword [rsp + 0x50], rbx
mov rcx, rbp
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x38], rdi
mov dword [rsp + 0x30], ebx
mov dword [rsp + 0x28], 1
mov dword [rsp + 0x20], 1
call qword [sym.imp.ADVAPI32.dll_CreateServiceW]
mov rdi, rax
test rax, rax
je 0x14001964f
test rsi, rsi
je 0x140019612
mov rdx, rsi
call fcn.140019380
mov ebx, eax
test eax, eax
jns 0x140019612
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_DeleteService]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x140019666
xor r8d, r8d
xor edx, edx
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_StartServiceW]
test eax, eax
jne 0x140019644
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jg 0x14001963b
mov rcx, rdi
mov ebx, eax
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x140019666
movzx ebx, ax
or ebx, 0xc0070000
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x140019666
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jg 0x14001965d
mov ebx, eax
jmp 0x140019666
movzx ebx, ax
or ebx, 0xc0070000
mov rcx, rbp
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, ebx
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x140019690
Capabilities:
Delete service
Stop service

Disassembly:
mov qword [rsp + 0x10], rbx
push rsi
sub rsp, 0x40
xor ebx, ebx
xor edx, edx
xor ecx, ecx
lea r8d, [rbx + 1]
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov rsi, rax
test rax, rax
jne 0x1400196d3
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x14001975b
movzx eax, ax
or eax, 0xc0070000
mov rbx, qword [rsp + 0x58]
add rsp, 0x40
pop rsi
ret
mov r8d, 0x10020
mov qword [rsp + 0x50], rdi
lea rdx, str.KProcessHacker2
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov rdi, rax
test rax, rax
je 0x140019736
lea r8, [rsp + 0x20]
mov edx, 1
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_ControlService]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_DeleteService]
test eax, eax
jne 0x14001972b
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
test eax, eax
jle 0x14001972b
movzx ebx, ax
or ebx, 0xc0070000
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x14001974b
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
test eax, eax
jle 0x14001974b
movzx ebx, ax
or ebx, 0xc0070000
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rdi, qword [rsp + 0x50]
mov eax, ebx
mov rbx, qword [rsp + 0x58]
add rsp, 0x40
pop rsi
ret

Function at 0x140019770
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x70
xor eax, eax
mov qword [rsp + 0x50], rcx
mov rcx, qword [0x14015a2a8]
mov ebx, edx
mov dword [rsp + 0x48], eax
xor r9d, r9d
mov qword [rsp + 0x40], rax
xor r8d, r8d
mov dword [rsp + 0x38], 0x10
lea rax, [rsp + 0x50]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x60]
mov dword [rsp + 0x58], edx
xor edx, edx
mov dword [rsp + 0x28], 0x999920df
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntdll.dll_NtDeviceIoControlFile]
cmp eax, 0xc00000db
jne 0x1400197d5
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
add rsp, 0x70
pop rbx
ret
Function at 0x14001a060
Capabilities:
Get user security identifier

Disassembly:
mov rax, rsp
push rsi
sub rsp, 0x60
mov qword [rax + 0x10], rbx
mov rbx, rcx
mov qword [rax + 0x18], rbp
mov rbp, rdx
mov qword [rax - 0x10], r14
mov r14, r8
mov qword [rax - 0x18], r15
mov r15, r9
call fcn.140019db0
mov rcx, qword [rbx + 8]
lea r9, [rsp + 0x38]
movzx r10d, word [rbx]
xor edx, edx
mov qword [rsp + 0x40], rcx
xor ecx, ecx
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x70], rcx
lea rcx, [rsp + 0x70]
mov qword [rsp + 0x28], rcx
lea r8d, [rdx + 1]
lea rcx, [rsp + 0x30]
mov word [rsp + 0x38], r10w
mov qword [rsp + 0x20], rcx
mov rcx, rax
mov word [rsp + 0x3a], r10w
call qword [sym.imp.ADVAPI32.dll_LsaLookupNames2]
mov rcx, qword [rsp + 0x70]
mov esi, eax
test eax, eax
js 0x14001a192
mov edx, dword [rcx]
sub edx, 7
cmp edx, 1
jbe 0x14001a18d
test rbp, rbp
je 0x14001a149
mov rcx, qword [rcx + 8]
mov qword [rsp + 0x88], rdi
call qword [sym.imp.ntdll.dll_RtlLengthSid]
mov rcx, qword [sym.ProcessHacker.exe_PhHeapHandle]
mov edx, 4
mov r8d, eax
mov ebx, eax
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov rdx, qword [rsp + 0x70]
mov r8d, ebx
mov rcx, rax
mov rdi, rax
mov rdx, qword [rdx + 8]
call fcn.1400e19b0
mov rcx, qword [rsp + 0x70]
mov qword [rbp], rdi
mov rdi, qword [rsp + 0x88]
test r14, r14
je 0x14001a181
movsxd rax, dword [rcx + 0x10]
test eax, eax
js 0x14001a174
lea r8, [rax + rax*2]
mov rax, qword [rsp + 0x30]
mov rcx, qword [rax + 8]
movzx edx, word [rcx + r8*8]
mov rcx, qword [rcx + r8*8 + 8]
call sym.ProcessHacker.exe_PhCreateStringEx
jmp 0x14001a179
call sym.ProcessHacker.exe_PhReferenceEmptyString
mov rcx, qword [rsp + 0x70]
mov qword [r14], rax
test r15, r15
je 0x14001a192
mov eax, dword [rcx]
mov dword [r15], eax
jmp 0x14001a192
mov esi, 0xc0000073
mov rax, qword [rsp + 0x30]
mov r15, qword [rsp + 0x50]
mov r14, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x80]
mov rbx, qword [rsp + 0x78]
test rax, rax
je 0x14001a1c1
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_LsaFreeMemory]
mov rcx, qword [rsp + 0x70]
test rcx, rcx
je 0x14001a1cc
call qword [sym.imp.ADVAPI32.dll_LsaFreeMemory]
mov eax, esi
add rsp, 0x60
pop rsi
ret
Function at 0x14001a460
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rsi, r8
mov rdi, rdx
mov rbx, rcx
mov qword [rcx], rdx
mov qword [rcx + 8], r8
mov r8d, 0x40
call fcn.14001a7a0
nop
mov eax, 0x5a4d
cmp word [rdi], ax
je 0x14001a49f
mov eax, 0xc000012f
jmp 0x14001a537
mov eax, dword [rdi + 0x3c]
test eax, eax
jne 0x14001a4b0
mov eax, 0xc000007b
jmp 0x14001a537
cmp eax, 0x10000000
jae 0x14001a4a6
cmp rax, rsi
jae 0x14001a4a6
lea rdx, [rax + rdi]
mov qword [rbx + 0x10], rdx
mov r8d, 0x18
mov rcx, rbx
call fcn.14001a7a0
mov rdx, qword [rbx + 0x10]
movzx eax, word [rdx + 0x14]
add eax, 0x18
movsxd r8, eax
movzx eax, word [rdx + 6]
lea rcx, [rax + rax*4]
lea r8, [r8 + rcx*8]
mov rcx, rbx
call fcn.14001a7a0
nop
mov rcx, qword [rbx + 0x10]
cmp dword [rcx], 0x4550
jne 0x14001a4a6
movzx eax, word [rcx + 0x18]
mov word [rbx + 0x28], ax
mov edx, 0x10b
sub ax, dx
mov edx, 0xfeff
test dx, ax
jne 0x14001a4a6
movzx eax, word [rcx + 6]
mov dword [rbx + 0x18], eax
movzx eax, word [rcx + 0x14]
add rcx, 0x18
add rcx, rax
mov qword [rbx + 0x20], rcx
xor eax, eax
jmp 0x14001a537
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x14001a5b0
Capabilities:
Get file attributes
Map section object

Disassembly:
mov qword [rsp + 0x10], rdx
push rbx
push rsi
push r12
push r14
push r15
sub rsp, 0x90
xor r12d, r12d
xor sil, sil
mov qword [rsp + 0x50], r12
mov r15, r9
movzx r14d, r8b
mov rbx, rdx
test rcx, rcx
jne 0x14001a5f8
test rdx, rdx
jne 0x14001a656
mov eax, 0xc0000030
add rsp, 0x90
pop r15
pop r14
pop r12
pop rsi
pop rbx
ret
test rdx, rdx
jne 0x14001a656
mov qword [rsp + 0x38], r12
mov r8d, r12d
mov eax, 0x106
mov dword [rsp + 0x30], 0x60
mov rdx, rcx
mov dword [rsp + 0x28], 1
test r14b, r14b
mov dword [rsp + 0x20], 1
lea rcx, [rsp + 0xc8]
cmove r8d, eax
xor r9d, r9d
or r8d, 0x1000a1
call sym.ProcessHacker.exe_PhCreateFileWin32Ex
test eax, eax
js 0x14001a788
mov rbx, qword [rsp + 0xc8]
mov sil, 1
mov r9d, 0x18
mov qword [rsp + 0xd8], rdi
lea r8, [rsp + 0x78]
mov dword [rsp + 0x20], 5
lea rdx, [rsp + 0x68]
mov rcx, rbx
call qword [sym.imp.ntdll.dll_NtQueryInformationFile]
mov ecx, eax
mov edi, eax
test eax, eax
js 0x14001a697
mov rax, qword [rsp + 0x80]
mov qword [rsp + 0xc0], rax
test ecx, ecx
js 0x14001a760
mov qword [rsp + 0xd0], rbp
lea r9, [rsp + 0xc0]
mov eax, 0x20
mov qword [rsp + 0x30], rbx
test r14b, r14b
mov dword [rsp + 0x28], 0x8000000
mov ebp, 0x40
lea rcx, [rsp + 0x50]
cmovne ebp, eax
mov edx, 0xf001f
xor r8d, r8d
mov dword [rsp + 0x20], ebp
call qword [sym.imp.ntdll.dll_NtCreateSection]
mov edi, eax
test eax, eax
js 0x14001a758
mov rax, qword [rsp + 0xc0]
lea r8, [rsp + 0x58]
mov rcx, qword [rsp + 0x50]
xor r9d, r9d
mov dword [rsp + 0x48], ebp
or rdx, 0xffffffffffffffff
mov dword [rsp + 0x40], r12d
mov dword [rsp + 0x38], 1
mov qword [rsp + 0x60], rax
lea rax, [rsp + 0x60]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], r12
mov qword [rsp + 0x58], r12
call qword [sym.imp.ntdll.dll_NtMapViewOfSection]
mov edi, eax
test eax, eax
js 0x14001a758
mov rax, qword [rsp + 0x58]
mov rcx, qword [rsp + 0xe0]
mov qword [r15], rax
mov rax, qword [rsp + 0xc0]
mov qword [rcx], rax
mov rbp, qword [rsp + 0xd0]
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x14001a770
call qword [sym.imp.ntdll.dll_NtClose]
test sil, sil
je 0x14001a77e
mov rcx, rbx
call qword [sym.imp.ntdll.dll_NtClose]
mov eax, edi
mov rdi, qword [rsp + 0xd8]
add rsp, 0x90
pop r15
pop r14
pop r12
pop rsi
pop rbx
ret
Function at 0x14001aab0
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r15
sub rsp, 0x1d0
xor r15d, r15d
mov qword [r8], rdx
mov rdi, r8
mov qword [rsp + 0x20], r15
lea r8, [rsp + 0x90]
mov rsi, rdx
mov rbp, rcx
lea r9d, [r15 + 0x40]
call qword [sym.imp.ntdll.dll_NtReadVirtualMemory]
cmp eax, 0xc0000022
jne 0x14001ab5e
mov rcx, qword [0x14015a2a8]
test rcx, rcx
je 0x14001ac81
mov dword [rsp + 0x48], r15d
lea rax, [rsp + 0x90]
mov qword [rsp + 0x40], r15
xor r9d, r9d
mov qword [rsp + 0x60], rax
xor r8d, r8d
mov dword [rsp + 0x38], 0x28
lea rax, [rsp + 0x50]
mov qword [rsp + 0x30], rax
xor edx, edx
lea rax, [rsp + 0x78]
mov dword [rsp + 0x28], 0x999920e3
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x50], rbp
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x68], 0x40
mov qword [rsp + 0x70], r15
call qword [sym.imp.ntdll.dll_NtDeviceIoControlFile]
test eax, eax
js 0x14001ac81
mov eax, 0x5a4d
cmp word [rsp + 0x90], ax
je 0x14001ab7f
mov eax, 0xc000012f
jmp 0x14001ac81
mov ecx, dword [rsp + 0xcc]
lea eax, [rcx - 1]
cmp eax, 0xffffffe
ja 0x14001acad
lea rdx, [rcx + rsi]
mov qword [rsp + 0x1f8], r14
mov r14d, ecx
mov qword [rsp + 0x20], r15
mov rcx, rbp
lea r8, [rsp + 0xd0]
mov r9d, 0xf8
call sym.ProcessHacker.exe_PhReadVirtualMemory
test eax, eax
js 0x14001ac79
cmp dword [rsp + 0xd0], 0x4550
jne 0x14001ac15
movzx eax, word [rsp + 0xe8]
mov ecx, 0x10b
mov word [rdi + 0x20], ax
sub ax, cx
mov ecx, 0xfeff
test cx, ax
jne 0x14001ac15
movzx eax, word [rsp + 0xd6]
mov dword [rdi + 0x10], eax
lea edx, [rax + rax*4]
movzx eax, word [rsp + 0xe4]
lea edx, [rdx + 3]
lea edx, [rax + rdx*8]
cmp edx, 0x100000
jbe 0x14001ac1c
mov eax, 0xc000007b
jmp 0x14001ac79
mov rcx, qword [sym.ProcessHacker.exe_PhHeapHandle]
mov r8d, edx
mov qword [rsp + 0x1f0], rbx
mov ebx, edx
mov edx, 4
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
lea rdx, [r14 + rsi]
mov qword [rsp + 0x20], r15
mov r8, rax
mov qword [rdi + 8], rax
mov r9d, ebx
mov rcx, rbp
call sym.ProcessHacker.exe_PhReadVirtualMemory
mov ebx, eax
test eax, eax
jns 0x14001ac95
mov r8, qword [rdi + 8]
xor edx, edx
mov rcx, qword [sym.ProcessHacker.exe_PhHeapHandle]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
mov eax, ebx
mov rbx, qword [rsp + 0x1f0]
mov r14, qword [rsp + 0x1f8]
mov rbp, qword [rsp + 0x200]
add rsp, 0x1d0
pop r15
pop rdi
pop rsi
ret
movzx ecx, word [rsp + 0xe4]
add rcx, 0x18
add rcx, qword [rdi + 8]
mov qword [rdi + 0x18], rcx
xor eax, eax
jmp 0x14001ac71
mov eax, 0xc000007b
jmp 0x14001ac81

Function at 0x14001cdc0
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
cmp qword [0x14015a2a8], 0
mov ebx, edx
mov rdi, rcx
je 0x14001cde5
call fcn.140019770
cmp eax, 0xc00000bb
jne 0x14001cdf0
mov edx, ebx
mov rcx, rdi
call qword [sym.imp.ntdll.dll_NtTerminateProcess]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x14001de00
Capabilities:
Allocate or change rwx memory

Disassembly:
push rbx
push rsi
push r12
push r14
sub rsp, 0xb8
xor ebx, ebx
mov r14, r9
mov qword [rsp + 0x20], rbx
mov r12, r8
mov rsi, rcx
test dl, 1
jne 0x14001de94
lea r9d, [rbx + 0x30]
xor edx, edx
lea r8, [rsp + 0x78]
call qword [sym.imp.ntdll.dll_NtQueryInformationProcess]
test eax, eax
js 0x14001dff3
mov rdx, qword [rsp + 0x80]
lea r9d, [rbx + 8]
add rdx, 0x20
mov qword [rsp + 0x20], rbx
lea r8, [rsp + 0x30]
mov rcx, rsi
call sym.ProcessHacker.exe_PhReadVirtualMemory
test eax, eax
js 0x14001dff3
mov rdx, qword [rsp + 0x30]
lea r9d, [rbx + 8]
sub rdx, 0xffffffffffffff80
mov qword [rsp + 0x20], rbx
lea r8, [rsp + 0x38]
mov rcx, rsi
call sym.ProcessHacker.exe_PhReadVirtualMemory
test eax, eax
js 0x14001dff3
mov rdx, qword [rsp + 0x38]
jmp 0x14001df11
mov r9d, 8
lea r8, [rsp + 0x40]
lea edx, [r9 + 0x12]
call qword [sym.imp.ntdll.dll_NtQueryInformationProcess]
test eax, eax
js 0x14001dff3
mov rdx, qword [rsp + 0x40]
lea r8, [rsp + 0xe8]
add rdx, 0x10
mov qword [rsp + 0x20], rbx
mov r9d, 4
mov rcx, rsi
call sym.ProcessHacker.exe_PhReadVirtualMemory
test eax, eax
js 0x14001dff3
mov edx, dword [rsp + 0xe8]
lea r8, [rsp + 0x30]
add rdx, 0x48
mov qword [rsp + 0x20], rbx
mov r9d, 4
mov rcx, rsi
call sym.ProcessHacker.exe_PhReadVirtualMemory
test eax, eax
js 0x14001dff3
mov edx, dword [rsp + 0x30]
mov qword [rsp + 0x38], rdx
mov qword [rsp + 0x28], rbx
lea r9, [rsp + 0x48]
xor r8d, r8d
mov qword [rsp + 0x20], 0x30
mov rcx, rsi
call qword [sym.imp.ntdll.dll_NtQueryVirtualMemory]
test eax, eax
js 0x14001dff3
mov qword [rsp + 0xe0], rbp
lea r9, [rsp + 0x40]
mov ebp, dword [rsp + 0x60]
lea rdx, [rsp + 0x30]
sub ebp, dword [rsp + 0x38]
xor r8d, r8d
add ebp, dword [rsp + 0x48]
or rcx, 0xffffffffffffffff
mov qword [rsp + 0xf0], rdi
mov qword [rsp + 0xb0], r15
mov r15d, ebp
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x40], r15
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x20], 0x1000
call qword [sym.imp.ntdll.dll_NtAllocateVirtualMemory]
test eax, eax
js 0x14001dfd6
mov rdi, qword [rsp + 0x30]
test rdi, rdi
je 0x14001dfd6
mov rdx, qword [rsp + 0x38]
mov r9d, r15d
mov r8, rdi
mov qword [rsp + 0x20], rbx
mov rcx, rsi
call sym.ProcessHacker.exe_PhReadVirtualMemory
mov ebx, eax
test eax, eax
jns 0x14001dfc8
mov rcx, rdi
call sym.ProcessHacker.exe_PhFreePage
mov eax, ebx
jmp 0x14001dfdb
mov qword [r12], rdi
test r14, r14
je 0x14001dfdb
mov dword [r14], ebp
jmp 0x14001dfdb
mov eax, 0xc0000017
mov rdi, qword [rsp + 0xf0]
mov rbp, qword [rsp + 0xe0]
mov r15, qword [rsp + 0xb0]
add rsp, 0xb8
pop r14
pop r12
pop rsi
pop rbx
ret
Function at 0x14001e560
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x50
mov rdi, rcx
mov rsi, r8
lea rcx, str.kernel32.dll
mov ebx, edx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14001e66c
lea rdx, str.SetProcessDEPPolicy
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r9, rax
test rax, rax
je 0x14001e66c
xor r8d, r8d
mov eax, 1
movzx ecx, bl
mov edx, r8d
and cl, al
cmovne edx, eax
test bl, 2
je 0x14001e5c4
or edx, 2
mov eax, edx
xor edx, edx
cmp dword [sym.ProcessHacker.exe_WindowsVersion], 0x3c
jb 0x14001e602
mov qword [rsp + 0x48], r8
lea rcx, [rsp + 0x78]
mov qword [rsp + 0x40], rcx
mov rcx, rdi
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r9
xor r9d, r9d
mov qword [rsp + 0x28], r8
mov qword [rsp + 0x20], r8
call qword [sym.imp.ntdll.dll_RtlCreateUserThread]
jmp 0x14001e636
mov qword [rsp + 0x30], r8
mov rcx, rdi
mov dword [rsp + 0x28], r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_CreateRemoteThread]
mov qword [rsp + 0x78], rax
test rax, rax
jne 0x14001e63f
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x14001e638
movzx eax, ax
or eax, 0xc0070000
test eax, eax
js 0x14001e671
mov rax, qword [rsp + 0x78]
mov r8, rsi
xor edx, edx
mov rcx, rax
call qword [sym.imp.ntdll.dll_NtWaitForSingleObject]
mov rcx, qword [rsp + 0x78]
mov ebx, eax
call qword [sym.imp.ntdll.dll_NtClose]
mov eax, ebx
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x50
pop rdi
ret
mov eax, 0xc00000bb
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x50
pop rdi
ret
Function at 0x14001f200
Capabilities:
Get file attributes

Disassembly:
push rbx
sub rsp, 0x60
mov rbx, rdx
mov dword [rsp + 0x20], 5
lea rdx, [rsp + 0x30]
mov r9d, 0x18
lea r8, [rsp + 0x40]
call qword [sym.imp.ntdll.dll_NtQueryInformationFile]
mov ecx, eax
test eax, eax
js 0x14001f237
mov rax, qword [rsp + 0x48]
mov qword [rbx], rax
mov eax, ecx
add rsp, 0x60
pop rbx
ret

Function at 0x14001f240
Capabilities:
Set file attributes

Disassembly:
sub rsp, 0x48
mov rax, qword [rdx]
lea r8, [rsp + 0x58]
lea rdx, [rsp + 0x30]
mov qword [rsp + 0x58], rax
mov r9d, 8
mov dword [rsp + 0x20], 0x14
call qword [sym.imp.ntdll.dll_NtSetInformationFile]
add rsp, 0x48
ret
Function at 0x140021180
Capabilities:
Get system information on windows
Make suspicious ntquerysysteminformation call

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
mov dword [rsp + 0x38], 0x800
mov rcx, qword [sym.ProcessHacker.exe_PhHeapHandle]
mov edx, 4
mov r8d, 0x800
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov r8d, dword [rsp + 0x38]
lea r9, [rsp + 0x38]
mov rdx, rax
mov ecx, 0xb
mov rbx, rax
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
cmp eax, 0xc0000004
jne 0x140021213
mov rcx, qword [sym.ProcessHacker.exe_PhHeapHandle]
mov r8, rbx
xor edx, edx
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
mov r8d, dword [rsp + 0x38]
mov edx, 4
mov rcx, qword [sym.ProcessHacker.exe_PhHeapHandle]
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov r8d, dword [rsp + 0x38]
lea r9, [rsp + 0x38]
mov rdx, rax
mov ecx, 0xb
mov rbx, rax
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
test eax, eax
js 0x14002121a
mov qword [rdi], rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x140021230
Capabilities:
Get system information on windows
Make suspicious ntquerysysteminformation call

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x20
mov rcx, qword [sym.ProcessHacker.exe_PhHeapHandle]
xor edi, edi
mov r8d, 0x800
mov dword [rsp + 0x30], 0x800
lea edx, [rdi + 4]
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov r8d, dword [rsp + 0x30]
lea r9, [rsp + 0x30]
mov rdx, rax
lea ecx, [rdi + 0xb]
mov rbx, rax
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
cmp eax, 0xc0000004
jne 0x1400212ba
mov rcx, qword [sym.ProcessHacker.exe_PhHeapHandle]
mov r8, rbx
xor edx, edx
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
mov r8d, dword [rsp + 0x30]
lea edx, [rdi + 4]
mov rcx, qword [sym.ProcessHacker.exe_PhHeapHandle]
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov r8d, dword [rsp + 0x30]
lea r9, [rsp + 0x30]
mov rdx, rax
lea ecx, [rdi + 0xb]
mov rbx, rax
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
test eax, eax
jns 0x1400212cb
xor eax, eax
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
cmp dword [rbx], 1
jb 0x1400212f1
lea rcx, [rbx + 0x30]
or rdx, 0xffffffffffffffff
nop dword [rax + rax]
inc rdx
cmp byte [rcx + rdx], dil
jne 0x1400212e0
call sym.ProcessHacker.exe_PhConvertMultiByteToUtf16Ex
mov rdi, rax
mov rcx, qword [sym.ProcessHacker.exe_PhHeapHandle]
mov r8, rbx
xor edx, edx
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
mov rbx, qword [rsp + 0x38]
mov rax, rdi
add rsp, 0x20
pop rdi
ret

Function at 0x140021320
Capabilities:
Get system information on windows

Disassembly:
mov edx, 5
jmp sym.ProcessHacker.exe_PhEnumProcessesEx