joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14011f160
Capabilities:
Delete service
Stop service

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x50
mov rax, qword [0x140237008]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov rdi, rcx
xor ebx, ebx
xor edx, edx
xor ecx, ecx
lea r8d, [rbx + 1]
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov rsi, rax
test rax, rax
jne 0x14011f1b5
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop
test eax, eax
jle 0x14011f248
movzx eax, ax
or eax, 0xc0070000
jmp 0x14011f248
test rdi, rdi
lea rdx, str.KProcessHacker3
mov r8d, 0x10020
mov rcx, rsi
cmovne rdx, rdi
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov rdi, rax
test rax, rax
je 0x14011f222
lea r8, [rsp + 0x20]
mov edx, 1
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_ControlService]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_DeleteService]
test eax, eax
jne 0x14011f215
nop word [rax + rax]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
test eax, eax
jle 0x14011f215
movzx ebx, ax
or ebx, 0xc0070000
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
nop
jmp 0x14011f237
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
test eax, eax
jle 0x14011f237
movzx ebx, ax
or ebx, 0xc0070000
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, ebx
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.1401848a0
mov rbx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
ret
Function at 0x140120c00
Capabilities:
Parse pe header

Disassembly:
push rbx
sub rsp, 0x30
xor ebx, ebx
test byte [0x14023e440], 1
jne 0x140120d36
lock bts qword [0x14023e440], 0x1f
nop
jae 0x140120c45
test byte [0x14023e440], 1
jne 0x140120d36
xor edx, edx
lea rcx, [0x14023e440]
call sym.ProcessHacker.exe_PhfWaitForEvent
nop dword [rax]
jmp 0x140120d36
lea rcx, [0x1401db740]
call fcn.1400f9d00
mov rcx, rax
test rax, rax
jne 0x140120c97
xor edx, edx
lea rcx, [0x1401db740]
mov r8d, 0x800
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
test rax, rax
jne 0x140120c97
xor edx, edx
lea rcx, [0x1401db740]
mov r8d, 0xa00
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
test rax, rax
je 0x140120d2a
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x140120d2a
mov edx, dword [rcx + 0x3c]
lea eax, [rdx - 1]
cmp eax, 0x7ffffffd
ja 0x140120d2a
cmp dword [rdx + rcx], 0x4550
jne 0x140120d2a
add rdx, 0x88
add rdx, rcx
mov eax, dword [rdx]
test eax, eax
je 0x140120d2a
cmp dword [rdx + 4], ebx
je 0x140120d2a
lea r8, [rcx + rax]
mov word [rsp + 0x20], bx
lea r9, str.NtQueryInformationEnlistment
call fcn.1400fa1a0
mov r9, rax
test rax, rax
je 0x140120d2a
mov rcx, qword [0x7ffe0320]
mov edx, dword [0x7ffe0004]
mov eax, ecx
shr rcx, 0x20
imul rax, rdx
imul rcx, rdx
shr rax, 0x18
shl rcx, 8
add rax, rcx
mov qword [0x140244bb8], rax
xor rax, r9
mov qword [0x140244b98], rax
lea rcx, [0x14023e440]
call sym.ProcessHacker.exe_PhfSetEvent
mov rax, qword [0x140244b98]
nop dword [rax]
test rax, rax
je 0x140120d5a
mov rcx, qword [0x140244bb8]
test rcx, rcx
je 0x140120d5a
xor rax, rcx
add rsp, 0x30
pop rbx
ret
mov rax, rbx
add rsp, 0x30
pop rbx
ret
Function at 0x140120d80
Capabilities:
Parse pe header

Disassembly:
push rbx
sub rsp, 0x30
xor ebx, ebx
test byte [0x14023e4d0], 1
jne 0x140120eb6
lock bts qword [0x14023e4d0], 0x1f
nop
jae 0x140120dc5
test byte [0x14023e4d0], 1
jne 0x140120eb6
xor edx, edx
lea rcx, [0x14023e4d0]
call sym.ProcessHacker.exe_PhfWaitForEvent
nop dword [rax]
jmp 0x140120eb6
lea rcx, [0x1401db740]
call fcn.1400f9d00
mov rcx, rax
test rax, rax
jne 0x140120e17
xor edx, edx
lea rcx, [0x1401db740]
mov r8d, 0x800
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
test rax, rax
jne 0x140120e17
xor edx, edx
lea rcx, [0x1401db740]
mov r8d, 0xa00
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
test rax, rax
je 0x140120eaa
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x140120eaa
mov edx, dword [rcx + 0x3c]
lea eax, [rdx - 1]
cmp eax, 0x7ffffffd
ja 0x140120eaa
cmp dword [rdx + rcx], 0x4550
jne 0x140120eaa
add rdx, 0x88
add rdx, rcx
mov eax, dword [rdx]
test eax, eax
je 0x140120eaa
cmp dword [rdx + 4], ebx
je 0x140120eaa
lea r8, [rcx + rax]
mov word [rsp + 0x20], bx
lea r9, str.NtQueryInformationResourceManager
call fcn.1400fa1a0
mov r9, rax
test rax, rax
je 0x140120eaa
mov rcx, qword [0x7ffe0320]
mov edx, dword [0x7ffe0004]
mov eax, ecx
shr rcx, 0x20
imul rax, rdx
imul rcx, rdx
shr rax, 0x18
shl rcx, 8
add rax, rcx
mov qword [0x140244c98], rax
xor rax, r9
mov qword [0x140244d38], rax
lea rcx, [0x14023e4d0]
call sym.ProcessHacker.exe_PhfSetEvent
mov rax, qword [0x140244d38]
nop dword [rax]
test rax, rax
je 0x140120eda
mov rcx, qword [0x140244c98]
test rcx, rcx
je 0x140120eda
xor rax, rcx
add rsp, 0x30
pop rbx
ret
mov rax, rbx
add rsp, 0x30
pop rbx
ret
Function at 0x140120f00
Capabilities:
Parse pe header

Disassembly:
push rbx
sub rsp, 0x30
xor ebx, ebx
test byte [0x14023e4a0], 1
jne 0x140121036
lock bts qword [0x14023e4a0], 0x1f
nop
jae 0x140120f45
test byte [0x14023e4a0], 1
jne 0x140121036
xor edx, edx
lea rcx, [0x14023e4a0]
call sym.ProcessHacker.exe_PhfWaitForEvent
nop dword [rax]
jmp 0x140121036
lea rcx, [0x1401db740]
call fcn.1400f9d00
mov rcx, rax
test rax, rax
jne 0x140120f97
xor edx, edx
lea rcx, [0x1401db740]
mov r8d, 0x800
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
test rax, rax
jne 0x140120f97
xor edx, edx
lea rcx, [0x1401db740]
mov r8d, 0xa00
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
test rax, rax
je 0x14012102a
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x14012102a
mov edx, dword [rcx + 0x3c]
lea eax, [rdx - 1]
cmp eax, 0x7ffffffd
ja 0x14012102a
cmp dword [rdx + rcx], 0x4550
jne 0x14012102a
add rdx, 0x88
add rdx, rcx
mov eax, dword [rdx]
test eax, eax
je 0x14012102a
cmp dword [rdx + 4], ebx
je 0x14012102a
lea r8, [rcx + rax]
mov word [rsp + 0x20], bx
lea r9, str.NtQueryInformationTransaction
call fcn.1400fa1a0
mov r9, rax
test rax, rax
je 0x14012102a
mov rcx, qword [0x7ffe0320]
mov edx, dword [0x7ffe0004]
mov eax, ecx
shr rcx, 0x20
imul rax, rdx
imul rcx, rdx
shr rax, 0x18
shl rcx, 8
add rax, rcx
mov qword [0x140244cc0], rax
xor rax, r9
mov qword [0x140244bf0], rax
lea rcx, [0x14023e4a0]
call sym.ProcessHacker.exe_PhfSetEvent
mov rax, qword [0x140244bf0]
nop dword [rax]
test rax, rax
je 0x14012105a
mov rcx, qword [0x140244cc0]
test rcx, rcx
je 0x14012105a
xor rax, rcx
add rsp, 0x30
pop rbx
ret
mov rax, rbx
add rsp, 0x30
pop rbx
ret
Function at 0x140121080
Capabilities:
Parse pe header

Disassembly:
push rbx
sub rsp, 0x30
xor ebx, ebx
test byte [0x14023e530], 1
jne 0x1401211b6
lock bts qword [0x14023e530], 0x1f
nop
jae 0x1401210c5
test byte [0x14023e530], 1
jne 0x1401211b6
xor edx, edx
lea rcx, [0x14023e530]
call sym.ProcessHacker.exe_PhfWaitForEvent
nop dword [rax]
jmp 0x1401211b6
lea rcx, [0x1401db740]
call fcn.1400f9d00
mov rcx, rax
test rax, rax
jne 0x140121117
xor edx, edx
lea rcx, [0x1401db740]
mov r8d, 0x800
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
test rax, rax
jne 0x140121117
xor edx, edx
lea rcx, [0x1401db740]
mov r8d, 0xa00
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
test rax, rax
je 0x1401211aa
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x1401211aa
mov edx, dword [rcx + 0x3c]
lea eax, [rdx - 1]
cmp eax, 0x7ffffffd
ja 0x1401211aa
cmp dword [rdx + rcx], 0x4550
jne 0x1401211aa
add rdx, 0x88
add rdx, rcx
mov eax, dword [rdx]
test eax, eax
je 0x1401211aa
cmp dword [rdx + 4], ebx
je 0x1401211aa
lea r8, [rcx + rax]
mov word [rsp + 0x20], bx
lea r9, str.NtQueryInformationTransactionManager
call fcn.1400fa1a0
mov r9, rax
test rax, rax
je 0x1401211aa
mov rcx, qword [0x7ffe0320]
mov edx, dword [0x7ffe0004]
mov eax, ecx
shr rcx, 0x20
imul rax, rdx
imul rcx, rdx
shr rax, 0x18
shl rcx, 8
add rax, rcx
mov qword [0x140244ba0], rax
xor rax, r9
mov qword [0x140244d68], rax
lea rcx, [0x14023e530]
call sym.ProcessHacker.exe_PhfSetEvent
mov rax, qword [0x140244d68]
nop dword [rax]
test rax, rax
je 0x1401211da
mov rcx, qword [0x140244ba0]
test rcx, rcx
je 0x1401211da
xor rax, rcx
add rsp, 0x30
pop rbx
ret
mov rax, rbx
add rsp, 0x30
pop rbx
ret
Function at 0x140121200
Capabilities:
Parse pe header

Disassembly:
push rbx
sub rsp, 0x30
xor ebx, ebx
test byte [0x14023e400], 1
jne 0x140121336
lock bts qword [0x14023e400], 0x1f
nop
jae 0x140121245
test byte [0x14023e400], 1
jne 0x140121336
xor edx, edx
lea rcx, [0x14023e400]
call sym.ProcessHacker.exe_PhfWaitForEvent
nop dword [rax]
jmp 0x140121336
lea rcx, [0x1401db740]
call fcn.1400f9d00
mov rcx, rax
test rax, rax
jne 0x140121297
xor edx, edx
lea rcx, [0x1401db740]
mov r8d, 0x800
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
test rax, rax
jne 0x140121297
xor edx, edx
lea rcx, [0x1401db740]
mov r8d, 0xa00
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
test rax, rax
je 0x14012132a
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x14012132a
mov edx, dword [rcx + 0x3c]
lea eax, [rdx - 1]
cmp eax, 0x7ffffffd
ja 0x14012132a
cmp dword [rdx + rcx], 0x4550
jne 0x14012132a
add rdx, 0x88
add rdx, rcx
mov eax, dword [rdx]
test eax, eax
je 0x14012132a
cmp dword [rdx + 4], ebx
je 0x14012132a
lea r8, [rcx + rax]
mov word [rsp + 0x20], bx
lea r9, str.NtQueryDefaultLocale
call fcn.1400fa1a0
mov r9, rax
test rax, rax
je 0x14012132a
mov rcx, qword [0x7ffe0320]
mov edx, dword [0x7ffe0004]
mov eax, ecx
shr rcx, 0x20
imul rax, rdx
imul rcx, rdx
shr rax, 0x18
shl rcx, 8
add rax, rcx
mov qword [0x140244cd8], rax
xor rax, r9
mov qword [0x140244c48], rax
lea rcx, [0x14023e400]
call sym.ProcessHacker.exe_PhfSetEvent
mov rax, qword [0x140244c48]
nop dword [rax]
test rax, rax
je 0x14012135a
mov rcx, qword [0x140244cd8]
test rcx, rcx
je 0x14012135a
xor rax, rcx
add rsp, 0x30
pop rbx
ret
mov rax, rbx
add rsp, 0x30
pop rbx
ret
Function at 0x140121380
Capabilities:
Parse pe header

Disassembly:
push rbx
sub rsp, 0x30
xor ebx, ebx
test byte [0x14023e460], 1
jne 0x1401214b6
lock bts qword [0x14023e460], 0x1f
nop
jae 0x1401213c5
test byte [0x14023e460], 1
jne 0x1401214b6
xor edx, edx
lea rcx, [0x14023e460]
call sym.ProcessHacker.exe_PhfWaitForEvent
nop dword [rax]
jmp 0x1401214b6
lea rcx, [0x1401db740]
call fcn.1400f9d00
mov rcx, rax
test rax, rax
jne 0x140121417
xor edx, edx
lea rcx, [0x1401db740]
mov r8d, 0x800
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
test rax, rax
jne 0x140121417
xor edx, edx
lea rcx, [0x1401db740]
mov r8d, 0xa00
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
test rax, rax
je 0x1401214aa
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x1401214aa
mov edx, dword [rcx + 0x3c]
lea eax, [rdx - 1]
cmp eax, 0x7ffffffd
ja 0x1401214aa
cmp dword [rdx + rcx], 0x4550
jne 0x1401214aa
add rdx, 0x88
add rdx, rcx
mov eax, dword [rdx]
test eax, eax
je 0x1401214aa
cmp dword [rdx + 4], ebx
je 0x1401214aa
lea r8, [rcx + rax]
mov word [rsp + 0x20], bx
lea r9, str.NtTraceControl
call fcn.1400fa1a0
mov r9, rax
test rax, rax
je 0x1401214aa
mov rcx, qword [0x7ffe0320]
mov edx, dword [0x7ffe0004]
mov eax, ecx
shr rcx, 0x20
imul rax, rdx
imul rcx, rdx
shr rax, 0x18
shl rcx, 8
add rax, rcx
mov qword [0x140244d08], rax
xor rax, r9
mov qword [0x140244cc8], rax
lea rcx, [0x14023e460]
call sym.ProcessHacker.exe_PhfSetEvent
mov rax, qword [0x140244cc8]
nop dword [rax]
test rax, rax
je 0x1401214da
mov rcx, qword [0x140244d08]
test rcx, rcx
je 0x1401214da
xor rax, rcx
add rsp, 0x30
pop rbx
ret
mov rax, rbx
add rsp, 0x30
pop rbx
ret
Function at 0x140121500
Capabilities:
Parse pe header

Disassembly:
push rbx
sub rsp, 0x30
xor ebx, ebx
test byte [0x14023e4e0], 1
jne 0x140121636
lock bts qword [0x14023e4e0], 0x1f
nop
jae 0x140121545
test byte [0x14023e4e0], 1
jne 0x140121636
xor edx, edx
lea rcx, [0x14023e4e0]
call sym.ProcessHacker.exe_PhfWaitForEvent
nop dword [rax]
jmp 0x140121636
lea rcx, [0x1401db740]
call fcn.1400f9d00
mov rcx, rax
test rax, rax
jne 0x140121597
xor edx, edx
lea rcx, [0x1401db740]
mov r8d, 0x800
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
test rax, rax
jne 0x140121597
xor edx, edx
lea rcx, [0x1401db740]
mov r8d, 0xa00
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
test rax, rax
je 0x14012162a
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x14012162a
mov edx, dword [rcx + 0x3c]
lea eax, [rdx - 1]
cmp eax, 0x7ffffffd
ja 0x14012162a
cmp dword [rdx + rcx], 0x4550
jne 0x14012162a
add rdx, 0x88
add rdx, rcx
mov eax, dword [rdx]
test eax, eax
je 0x14012162a
cmp dword [rdx + 4], ebx
je 0x14012162a
lea r8, [rcx + rax]
mov word [rsp + 0x20], bx
lea r9, str.NtQueryOpenSubKeysEx
call fcn.1400fa1a0
mov r9, rax
test rax, rax
je 0x14012162a
mov rcx, qword [0x7ffe0320]
mov edx, dword [0x7ffe0004]
mov eax, ecx
shr rcx, 0x20
imul rax, rdx
imul rcx, rdx
shr rax, 0x18
shl rcx, 8
add rax, rcx
mov qword [0x140244da0], rax
xor rax, r9
mov qword [0x140244ba8], rax
lea rcx, [0x14023e4e0]
call sym.ProcessHacker.exe_PhfSetEvent
mov rax, qword [0x140244ba8]
nop dword [rax]
test rax, rax
je 0x14012165a
mov rcx, qword [0x140244da0]
test rcx, rcx
je 0x14012165a
xor rax, rcx
add rsp, 0x30
pop rbx
ret
mov rax, rbx
add rsp, 0x30
pop rbx
ret
Function at 0x140121680
Capabilities:
Parse pe header

Disassembly:
push rbx
sub rsp, 0x30
xor ebx, ebx
test byte [0x14023e3e0], 1
jne 0x1401217b6
lock bts qword [0x14023e3e0], 0x1f
nop
jae 0x1401216c5
test byte [0x14023e3e0], 1
jne 0x1401217b6
xor edx, edx
lea rcx, [0x14023e3e0]
call sym.ProcessHacker.exe_PhfWaitForEvent
nop dword [rax]
jmp 0x1401217b6
lea rcx, [0x1401db740]
call fcn.1400f9d00
mov rcx, rax
test rax, rax
jne 0x140121717
xor edx, edx
lea rcx, [0x1401db740]
mov r8d, 0x800
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
test rax, rax
jne 0x140121717
xor edx, edx
lea rcx, [0x1401db740]
mov r8d, 0xa00
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
test rax, rax
je 0x1401217aa
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x1401217aa
mov edx, dword [rcx + 0x3c]
lea eax, [rdx - 1]
cmp eax, 0x7ffffffd
ja 0x1401217aa
cmp dword [rdx + rcx], 0x4550
jne 0x1401217aa
add rdx, 0x88
add rdx, rcx
mov eax, dword [rdx]
test eax, eax
je 0x1401217aa
cmp dword [rdx + 4], ebx
je 0x1401217aa
lea r8, [rcx + rax]
mov word [rsp + 0x20], bx
lea r9, str.NtCreateProcessStateChange
call fcn.1400fa1a0
mov r9, rax
test rax, rax
je 0x1401217aa
mov rcx, qword [0x7ffe0320]
mov edx, dword [0x7ffe0004]
mov eax, ecx
shr rcx, 0x20
imul rax, rdx
imul rcx, rdx
shr rax, 0x18
shl rcx, 8
add rax, rcx
mov qword [0x140244c90], rax
xor rax, r9
mov qword [0x140244be8], rax
lea rcx, [0x14023e3e0]
call sym.ProcessHacker.exe_PhfSetEvent
mov rax, qword [0x140244be8]
nop dword [rax]
test rax, rax
je 0x1401217da
mov rcx, qword [0x140244c90]
test rcx, rcx
je 0x1401217da
xor rax, rcx
add rsp, 0x30
pop rbx
ret
mov rax, rbx
add rsp, 0x30
pop rbx
ret
Function at 0x140121800
Capabilities:
Parse pe header

Disassembly:
push rbx
sub rsp, 0x30
xor ebx, ebx
test byte [0x14023e480], 1
jne 0x140121936
lock bts qword [0x14023e480], 0x1f
nop
jae 0x140121845
test byte [0x14023e480], 1
jne 0x140121936
xor edx, edx
lea rcx, [0x14023e480]
call sym.ProcessHacker.exe_PhfWaitForEvent
nop dword [rax]
jmp 0x140121936
lea rcx, [0x1401db740]
call fcn.1400f9d00
mov rcx, rax
test rax, rax
jne 0x140121897
xor edx, edx
lea rcx, [0x1401db740]
mov r8d, 0x800
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
test rax, rax
jne 0x140121897
xor edx, edx
lea rcx, [0x1401db740]
mov r8d, 0xa00
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
test rax, rax
je 0x14012192a
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x14012192a
mov edx, dword [rcx + 0x3c]
lea eax, [rdx - 1]
cmp eax, 0x7ffffffd
ja 0x14012192a
cmp dword [rdx + rcx], 0x4550
jne 0x14012192a
add rdx, 0x88
add rdx, rcx
mov eax, dword [rdx]
test eax, eax
je 0x14012192a
cmp dword [rdx + 4], ebx
je 0x14012192a
lea r8, [rcx + rax]
mov word [rsp + 0x20], bx
lea r9, str.NtChangeProcessState
call fcn.1400fa1a0
mov r9, rax
test rax, rax
je 0x14012192a
mov rcx, qword [0x7ffe0320]
mov edx, dword [0x7ffe0004]
mov eax, ecx
shr rcx, 0x20
imul rax, rdx
imul rcx, rdx
shr rax, 0x18
shl rcx, 8
add rax, rcx
mov qword [0x140244d00], rax
xor rax, r9
mov qword [0x140244bb0], rax
lea rcx, [0x14023e480]
call sym.ProcessHacker.exe_PhfSetEvent
mov rax, qword [0x140244bb0]
nop dword [rax]
test rax, rax
je 0x14012195a
mov rcx, qword [0x140244d00]
test rcx, rcx
je 0x14012195a
xor rax, rcx
add rsp, 0x30
pop rbx
ret
mov rax, rbx
add rsp, 0x30
pop rbx
ret
Function at 0x140121980
Capabilities:
Parse pe header

Disassembly:
push rbx
sub rsp, 0x30
xor ebx, ebx
test byte [0x14023e3f0], 1
jne 0x140121ab6
lock bts qword [0x14023e3f0], 0x1f
nop
jae 0x1401219c5
test byte [0x14023e3f0], 1
jne 0x140121ab6
xor edx, edx
lea rcx, [0x14023e3f0]
call sym.ProcessHacker.exe_PhfWaitForEvent
nop dword [rax]
jmp 0x140121ab6
lea rcx, [0x1401db740]
call fcn.1400f9d00
mov rcx, rax
test rax, rax
jne 0x140121a17
xor edx, edx
lea rcx, [0x1401db740]
mov r8d, 0x800
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
test rax, rax
jne 0x140121a17
xor edx, edx
lea rcx, [0x1401db740]
mov r8d, 0xa00
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
test rax, rax
je 0x140121aaa
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x140121aaa
mov edx, dword [rcx + 0x3c]
lea eax, [rdx - 1]
cmp eax, 0x7ffffffd
ja 0x140121aaa
cmp dword [rdx + rcx], 0x4550
jne 0x140121aaa
add rdx, 0x88
add rdx, rcx
mov eax, dword [rdx]
test eax, eax
je 0x140121aaa
cmp dword [rdx + 4], ebx
je 0x140121aaa
lea r8, [rcx + rax]
mov word [rsp + 0x20], bx
lea r9, str.RtlDefaultNpAcl
call fcn.1400fa1a0
mov r9, rax
test rax, rax
je 0x140121aaa
mov rcx, qword [0x7ffe0320]
mov edx, dword [0x7ffe0004]
mov eax, ecx
shr rcx, 0x20
imul rax, rdx
imul rcx, rdx
shr rax, 0x18
shl rcx, 8
add rax, rcx
mov qword [0x140244d80], rax
xor rax, r9
mov qword [0x140244c58], rax
lea rcx, [0x14023e3f0]
call sym.ProcessHacker.exe_PhfSetEvent
mov rax, qword [0x140244c58]
nop dword [rax]
test rax, rax
je 0x140121ada
mov rcx, qword [0x140244d80]
test rcx, rcx
je 0x140121ada
xor rax, rcx
add rsp, 0x30
pop rbx
ret
mov rax, rbx
add rsp, 0x30
pop rbx
ret
Function at 0x140121b00
Capabilities:
Parse pe header

Disassembly:
push rbx
sub rsp, 0x30
xor ebx, ebx
test byte [0x14023e350], 1
jne 0x140121c36
lock bts qword [0x14023e350], 0x1f
nop
jae 0x140121b45
test byte [0x14023e350], 1
jne 0x140121c36
xor edx, edx
lea rcx, [0x14023e350]
call sym.ProcessHacker.exe_PhfWaitForEvent
nop dword [rax]
jmp 0x140121c36
lea rcx, [0x1401db740]
call fcn.1400f9d00
mov rcx, rax
test rax, rax
jne 0x140121b97
xor edx, edx
lea rcx, [0x1401db740]
mov r8d, 0x800
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
test rax, rax
jne 0x140121b97
xor edx, edx
lea rcx, [0x1401db740]
mov r8d, 0xa00
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
test rax, rax
je 0x140121c2a
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x140121c2a
mov edx, dword [rcx + 0x3c]
lea eax, [rdx - 1]
cmp eax, 0x7ffffffd
ja 0x140121c2a
cmp dword [rdx + rcx], 0x4550
jne 0x140121c2a
add rdx, 0x88
add rdx, rcx
mov eax, dword [rdx]
test eax, eax
je 0x140121c2a
cmp dword [rdx + 4], ebx
je 0x140121c2a
lea r8, [rcx + rax]
mov word [rsp + 0x20], bx
lea r9, str.RtlGetTokenNamedObjectPath
call fcn.1400fa1a0
mov r9, rax
test rax, rax
je 0x140121c2a
mov rcx, qword [0x7ffe0320]
mov edx, dword [0x7ffe0004]
mov eax, ecx
shr rcx, 0x20
imul rax, rdx
imul rcx, rdx
shr rax, 0x18
shl rcx, 8
add rax, rcx
mov qword [0x140244d30], rax
xor rax, r9
mov qword [0x140244c60], rax
lea rcx, [0x14023e350]
call sym.ProcessHacker.exe_PhfSetEvent
mov rax, qword [0x140244c60]
nop dword [rax]
test rax, rax
je 0x140121c5a
mov rcx, qword [0x140244d30]
test rcx, rcx
je 0x140121c5a
xor rax, rcx
add rsp, 0x30
pop rbx
ret
mov rax, rbx
add rsp, 0x30
pop rbx
ret
Function at 0x140121c80
Capabilities:
Parse pe header

Disassembly:
push rbx
sub rsp, 0x30
xor ebx, ebx
test byte [0x14023e380], 1
jne 0x140121db6
lock bts qword [0x14023e380], 0x1f
nop
jae 0x140121cc5
test byte [0x14023e380], 1
jne 0x140121db6
xor edx, edx
lea rcx, [0x14023e380]
call sym.ProcessHacker.exe_PhfWaitForEvent
nop dword [rax]
jmp 0x140121db6
lea rcx, [0x1401db740]
call fcn.1400f9d00
mov rcx, rax
test rax, rax
jne 0x140121d17
xor edx, edx
lea rcx, [0x1401db740]
mov r8d, 0x800
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
test rax, rax
jne 0x140121d17
xor edx, edx
lea rcx, [0x1401db740]
mov r8d, 0xa00
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
test rax, rax
je 0x140121daa
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x140121daa
mov edx, dword [rcx + 0x3c]
lea eax, [rdx - 1]
cmp eax, 0x7ffffffd
ja 0x140121daa
cmp dword [rdx + rcx], 0x4550
jne 0x140121daa
add rdx, 0x88
add rdx, rcx
mov eax, dword [rdx]
test eax, eax
je 0x140121daa
cmp dword [rdx + 4], ebx
je 0x140121daa
lea r8, [rcx + rax]
mov word [rsp + 0x20], bx
lea r9, str.RtlGetAppContainerNamedObjectPath
call fcn.1400fa1a0
mov r9, rax
test rax, rax
je 0x140121daa
mov rcx, qword [0x7ffe0320]
mov edx, dword [0x7ffe0004]
mov eax, ecx
shr rcx, 0x20
imul rax, rdx
imul rcx, rdx
shr rax, 0x18
shl rcx, 8
add rax, rcx
mov qword [0x140244ca8], rax
xor rax, r9
mov qword [0x140244c40], rax
lea rcx, [0x14023e380]
call sym.ProcessHacker.exe_PhfSetEvent
mov rax, qword [0x140244c40]
nop dword [rax]
test rax, rax
je 0x140121dda
mov rcx, qword [0x140244ca8]
test rcx, rcx
je 0x140121dda
xor rax, rcx
add rsp, 0x30
pop rbx
ret
mov rax, rbx
add rsp, 0x30
pop rbx
ret
Function at 0x140121e00
Capabilities:
Parse pe header

Disassembly:
push rbx
sub rsp, 0x30
xor ebx, ebx
test byte [0x14023e3b0], 1
jne 0x140121f36
lock bts qword [0x14023e3b0], 0x1f
nop
jae 0x140121e45
test byte [0x14023e3b0], 1
jne 0x140121f36
xor edx, edx
lea rcx, [0x14023e3b0]
call sym.ProcessHacker.exe_PhfWaitForEvent
nop dword [rax]
jmp 0x140121f36
lea rcx, [0x1401db740]
call fcn.1400f9d00
mov rcx, rax
test rax, rax
jne 0x140121e97
xor edx, edx
lea rcx, [0x1401db740]
mov r8d, 0x800
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
test rax, rax
jne 0x140121e97
xor edx, edx
lea rcx, [0x1401db740]
mov r8d, 0xa00
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
test rax, rax
je 0x140121f2a
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x140121f2a
mov edx, dword [rcx + 0x3c]
lea eax, [rdx - 1]
cmp eax, 0x7ffffffd
ja 0x140121f2a
cmp dword [rdx + rcx], 0x4550
jne 0x140121f2a
add rdx, 0x88
add rdx, rcx
mov eax, dword [rdx]
test eax, eax
je 0x140121f2a
cmp dword [rdx + 4], ebx
je 0x140121f2a
lea r8, [rcx + rax]
mov word [rsp + 0x20], bx
lea r9, str.RtlGetAppContainerSidType
call fcn.1400fa1a0
mov r9, rax
test rax, rax
je 0x140121f2a
mov rcx, qword [0x7ffe0320]
mov edx, dword [0x7ffe0004]
mov eax, ecx
shr rcx, 0x20
imul rax, rdx
imul rcx, rdx
shr rax, 0x18
shl rcx, 8
add rax, rcx
mov qword [0x140244c00], rax
xor rax, r9
mov qword [0x140244d88], rax
lea rcx, [0x14023e3b0]
call sym.ProcessHacker.exe_PhfSetEvent
mov rax, qword [0x140244d88]
nop dword [rax]
test rax, rax
je 0x140121f5a
mov rcx, qword [0x140244c00]
test rcx, rcx
je 0x140121f5a
xor rax, rcx
add rsp, 0x30
pop rbx
ret
mov rax, rbx
add rsp, 0x30
pop rbx
ret