joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140136d20
Capabilities:
Parse pe header

Disassembly:
push rbx
sub rsp, 0x30
xor ebx, ebx
test byte [0x140210dd0], 1
jne 0x140136e1f
lock bts qword [0x140210dd0], 0x1f
nop
jae 0x140136d65
test byte [0x140210dd0], 1
jne 0x140136e1f
xor edx, edx
lea rcx, [0x140210dd0]
call sym.ProcessHacker.exe_PhfWaitForEvent
nop dword [rax]
jmp 0x140136e1f
lea rcx, str.dnsapi.dll
call fcn.1401047c0
mov rcx, rax
test rax, rax
jne 0x140136d92
lea rcx, str.dnsapi.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rcx, rax
test rax, rax
je 0x140136e13
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x140136e13
mov edx, dword [rcx + 0x3c]
lea eax, [rdx - 1]
cmp eax, 0xffffffe
ja 0x140136e13
cmp dword [rdx + rcx], 0x4550
jne 0x140136e13
lea r8, ds:[rcx + 0x88]
add r8, rdx
mov eax, dword [r8]
test eax, eax
je 0x140136e13
cmp dword [r8 + 4], ebx
je 0x140136e13
lea r9, ds:[rcx + rax]
mov word [rsp + 0x28], bx
lea rax, str.DnsWriteQuestionToBuffer_W
mov qword [rsp + 0x20], rax
call fcn.140104bd0
test rax, rax
je 0x140136e13
mov ecx, dword [0x7ffe0004]
mov rdx, qword [0x7ffe0320]
imul rcx, rdx
shr rcx, 0x18
mov ecx, ecx
mov dword [0x1402177e0], ecx
xor rcx, rax
mov qword [0x140217768], rcx
lea rcx, [0x140210dd0]
call sym.ProcessHacker.exe_PhfSetEvent
mov rcx, qword [0x140217768]
test rcx, rcx
je 0x140136e3e
mov eax, dword [0x1402177e0]
test eax, eax
je 0x140136e3e
xor rax, rcx
add rsp, 0x30
pop rbx
ret
mov rax, rbx
add rsp, 0x30
pop rbx
ret

Function at 0x140136e50
Capabilities:
Parse pe header

Disassembly:
push rbx
sub rsp, 0x30
xor ebx, ebx
test byte [0x140210e30], 1
jne 0x140136f4f
lock bts qword [0x140210e30], 0x1f
nop
jae 0x140136e95
test byte [0x140210e30], 1
jne 0x140136f4f
xor edx, edx
lea rcx, [0x140210e30]
call sym.ProcessHacker.exe_PhfWaitForEvent
nop dword [rax]
jmp 0x140136f4f
lea rcx, str.dnsapi.dll
call fcn.1401047c0
mov rcx, rax
test rax, rax
jne 0x140136ec2
lea rcx, str.dnsapi.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rcx, rax
test rax, rax
je 0x140136f43
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x140136f43
mov edx, dword [rcx + 0x3c]
lea eax, [rdx - 1]
cmp eax, 0xffffffe
ja 0x140136f43
cmp dword [rdx + rcx], 0x4550
jne 0x140136f43
lea r8, ds:[rcx + 0x88]
add r8, rdx
mov eax, dword [r8]
test eax, eax
je 0x140136f43
cmp dword [r8 + 4], ebx
je 0x140136f43
lea r9, ds:[rcx + rax]
mov word [rsp + 0x28], bx
lea rax, str.DnsFree
mov qword [rsp + 0x20], rax
call fcn.140104bd0
test rax, rax
je 0x140136f43
mov ecx, dword [0x7ffe0004]
mov rdx, qword [0x7ffe0320]
imul rcx, rdx
shr rcx, 0x18
mov ecx, ecx
mov dword [0x140217730], ecx
xor rcx, rax
mov qword [0x1402176b8], rcx
lea rcx, [0x140210e30]
call sym.ProcessHacker.exe_PhfSetEvent
mov rcx, qword [0x1402176b8]
test rcx, rcx
je 0x140136f6e
mov eax, dword [0x140217730]
test eax, eax
je 0x140136f6e
xor rax, rcx
add rsp, 0x30
pop rbx
ret
mov rax, rbx
add rsp, 0x30
pop rbx
ret
Function at 0x140136f80
Capabilities:
Parse pe header

Disassembly:
push rbx
sub rsp, 0x30
xor ebx, ebx
test byte [0x140210ef0], 1
jne 0x14013707f
lock bts qword [0x140210ef0], 0x1f
nop
jae 0x140136fc5
test byte [0x140210ef0], 1
jne 0x14013707f
xor edx, edx
lea rcx, [0x140210ef0]
call sym.ProcessHacker.exe_PhfWaitForEvent
nop dword [rax]
jmp 0x14013707f
lea rcx, str.shell32.dll
call fcn.1401047c0
mov rcx, rax
test rax, rax
jne 0x140136ff2
lea rcx, str.shell32.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rcx, rax
test rax, rax
je 0x140137073
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x140137073
mov edx, dword [rcx + 0x3c]
lea eax, [rdx - 1]
cmp eax, 0xffffffe
ja 0x140137073
cmp dword [rdx + rcx], 0x4550
jne 0x140137073
lea r8, ds:[rcx + 0x88]
add r8, rdx
mov eax, dword [r8]
test eax, eax
je 0x140137073
cmp dword [r8 + 4], ebx
je 0x140137073
lea r9, ds:[rcx + rax]
mov word [rsp + 0x28], bx
lea rax, str.SHGetFolderPathW
mov qword [rsp + 0x20], rax
call fcn.140104bd0
test rax, rax
je 0x140137073
mov ecx, dword [0x7ffe0004]
mov rdx, qword [0x7ffe0320]
imul rcx, rdx
shr rcx, 0x18
mov ecx, ecx
mov dword [0x1402176b4], ecx
xor rcx, rax
mov qword [0x140217710], rcx
lea rcx, [0x140210ef0]
call sym.ProcessHacker.exe_PhfSetEvent
mov rcx, qword [0x140217710]
test rcx, rcx
je 0x14013709e
mov eax, dword [0x1402176b4]
test eax, eax
je 0x14013709e
xor rax, rcx
add rsp, 0x30
pop rbx
ret
mov rax, rbx
add rsp, 0x30
pop rbx
ret

Function at 0x1401370b0
Capabilities:
Parse pe header

Disassembly:
push rbx
sub rsp, 0x30
xor ebx, ebx
test byte [0x140210d90], 1
jne 0x1401371af
lock bts qword [0x140210d90], 0x1f
nop
jae 0x1401370f5
test byte [0x140210d90], 1
jne 0x1401371af
xor edx, edx
lea rcx, [0x140210d90]
call sym.ProcessHacker.exe_PhfWaitForEvent
nop dword [rax]
jmp 0x1401371af
lea rcx, str.shell32.dll
call fcn.1401047c0
mov rcx, rax
test rax, rax
jne 0x140137122
lea rcx, str.shell32.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rcx, rax
test rax, rax
je 0x1401371a3
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x1401371a3
mov edx, dword [rcx + 0x3c]
lea eax, [rdx - 1]
cmp eax, 0xffffffe
ja 0x1401371a3
cmp dword [rdx + rcx], 0x4550
jne 0x1401371a3
lea r8, ds:[rcx + 0x88]
add r8, rdx
mov eax, dword [r8]
test eax, eax
je 0x1401371a3
cmp dword [r8 + 4], ebx
je 0x1401371a3
lea r9, ds:[rcx + rax]
mov word [rsp + 0x28], bx
lea rax, str.SHGetFileInfoW
mov qword [rsp + 0x20], rax
call fcn.140104bd0
test rax, rax
je 0x1401371a3
mov ecx, dword [0x7ffe0004]
mov rdx, qword [0x7ffe0320]
imul rcx, rdx
shr rcx, 0x18
mov ecx, ecx
mov dword [0x1402176e8], ecx
xor rcx, rax
mov qword [0x1402176f0], rcx
lea rcx, [0x140210d90]
call sym.ProcessHacker.exe_PhfSetEvent
mov rcx, qword [0x1402176f0]
test rcx, rcx
je 0x1401371ce
mov eax, dword [0x1402176e8]
test eax, eax
je 0x1401371ce
xor rax, rcx
add rsp, 0x30
pop rbx
ret
mov rax, rbx
add rsp, 0x30
pop rbx
ret
Function at 0x1401371e0
Capabilities:
Parse pe header

Disassembly:
push rbx
sub rsp, 0x30
xor ebx, ebx
test byte [0x140210e50], 1
jne 0x1401372df
lock bts qword [0x140210e50], 0x1f
nop
jae 0x140137225
test byte [0x140210e50], 1
jne 0x1401372df
xor edx, edx
lea rcx, [0x140210e50]
call sym.ProcessHacker.exe_PhfWaitForEvent
nop dword [rax]
jmp 0x1401372df
lea rcx, str.kernel32.dll
call fcn.1401047c0
mov rcx, rax
test rax, rax
jne 0x140137252
lea rcx, str.kernel32.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rcx, rax
test rax, rax
je 0x1401372d3
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x1401372d3
mov edx, dword [rcx + 0x3c]
lea eax, [rdx - 1]
cmp eax, 0xffffffe
ja 0x1401372d3
cmp dword [rdx + rcx], 0x4550
jne 0x1401372d3
lea r8, ds:[rcx + 0x88]
add r8, rdx
mov eax, dword [r8]
test eax, eax
je 0x1401372d3
cmp dword [r8 + 4], ebx
je 0x1401372d3
lea r9, ds:[rcx + rax]
mov word [rsp + 0x28], bx
lea rax, str.PssCaptureSnapshot
mov qword [rsp + 0x20], rax
call fcn.140104bd0
test rax, rax
je 0x1401372d3
mov ecx, dword [0x7ffe0004]
mov rdx, qword [0x7ffe0320]
imul rcx, rdx
shr rcx, 0x18
mov ecx, ecx
mov dword [0x1402177cc], ecx
xor rcx, rax
mov qword [0x1402176d8], rcx
lea rcx, [0x140210e50]
call sym.ProcessHacker.exe_PhfSetEvent
mov rcx, qword [0x1402176d8]
test rcx, rcx
je 0x1401372fe
mov eax, dword [0x1402177cc]
test eax, eax
je 0x1401372fe
xor rax, rcx
add rsp, 0x30
pop rbx
ret
mov rax, rbx
add rsp, 0x30
pop rbx
ret

Function at 0x140137310
Capabilities:
Parse pe header

Disassembly:
push rbx
sub rsp, 0x30
xor ebx, ebx
test byte [0x140210ed0], 1
jne 0x14013740f
lock bts qword [0x140210ed0], 0x1f
nop
jae 0x140137355
test byte [0x140210ed0], 1
jne 0x14013740f
xor edx, edx
lea rcx, [0x140210ed0]
call sym.ProcessHacker.exe_PhfWaitForEvent
nop dword [rax]
jmp 0x14013740f
lea rcx, str.kernel32.dll
call fcn.1401047c0
mov rcx, rax
test rax, rax
jne 0x140137382
lea rcx, str.kernel32.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rcx, rax
test rax, rax
je 0x140137403
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x140137403
mov edx, dword [rcx + 0x3c]
lea eax, [rdx - 1]
cmp eax, 0xffffffe
ja 0x140137403
cmp dword [rdx + rcx], 0x4550
jne 0x140137403
lea r8, ds:[rcx + 0x88]
add r8, rdx
mov eax, dword [r8]
test eax, eax
je 0x140137403
cmp dword [r8 + 4], ebx
je 0x140137403
lea r9, ds:[rcx + rax]
mov word [rsp + 0x28], bx
lea rax, str.PssQuerySnapshot
mov qword [rsp + 0x20], rax
call fcn.140104bd0
test rax, rax
je 0x140137403
mov ecx, dword [0x7ffe0004]
mov rdx, qword [0x7ffe0320]
imul rcx, rdx
shr rcx, 0x18
mov ecx, ecx
mov dword [0x1402176e4], ecx
xor rcx, rax
mov qword [0x1402176c0], rcx
lea rcx, [0x140210ed0]
call sym.ProcessHacker.exe_PhfSetEvent
mov rcx, qword [0x1402176c0]
test rcx, rcx
je 0x14013742e
mov eax, dword [0x1402176e4]
test eax, eax
je 0x14013742e
xor rax, rcx
add rsp, 0x30
pop rbx
ret
mov rax, rbx
add rsp, 0x30
pop rbx
ret
Function at 0x140137440
Capabilities:
Parse pe header

Disassembly:
push rbx
sub rsp, 0x30
xor ebx, ebx
test byte [0x140210f00], 1
jne 0x14013753f
lock bts qword [0x140210f00], 0x1f
nop
jae 0x140137485
test byte [0x140210f00], 1
jne 0x14013753f
xor edx, edx
lea rcx, [0x140210f00]
call sym.ProcessHacker.exe_PhfWaitForEvent
nop dword [rax]
jmp 0x14013753f
lea rcx, str.kernel32.dll
call fcn.1401047c0
mov rcx, rax
test rax, rax
jne 0x1401374b2
lea rcx, str.kernel32.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rcx, rax
test rax, rax
je 0x140137533
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x140137533
mov edx, dword [rcx + 0x3c]
lea eax, [rdx - 1]
cmp eax, 0xffffffe
ja 0x140137533
cmp dword [rdx + rcx], 0x4550
jne 0x140137533
lea r8, ds:[rcx + 0x88]
add r8, rdx
mov eax, dword [r8]
test eax, eax
je 0x140137533
cmp dword [r8 + 4], ebx
je 0x140137533
lea r9, ds:[rcx + rax]
mov word [rsp + 0x28], bx
lea rax, str.PssFreeSnapshot
mov qword [rsp + 0x20], rax
call fcn.140104bd0
test rax, rax
je 0x140137533
mov ecx, dword [0x7ffe0004]
mov rdx, qword [0x7ffe0320]
imul rcx, rdx
shr rcx, 0x18
mov ecx, ecx
mov dword [0x140217778], ecx
xor rcx, rax
mov qword [0x1402176f8], rcx
lea rcx, [0x140210f00]
call sym.ProcessHacker.exe_PhfSetEvent
mov rcx, qword [0x1402176f8]
test rcx, rcx
je 0x14013755e
mov eax, dword [0x140217778]
test eax, eax
je 0x14013755e
xor rax, rcx
add rsp, 0x30
pop rbx
ret
mov rax, rbx
add rsp, 0x30
pop rbx
ret

Function at 0x140137570
Capabilities:
Parse pe header

Disassembly:
push rbx
sub rsp, 0x30
xor ebx, ebx
test byte [0x140210eb0], 1
jne 0x14013766f
lock bts qword [0x140210eb0], 0x1f
nop
jae 0x1401375b5
test byte [0x140210eb0], 1
jne 0x14013766f
xor edx, edx
lea rcx, [0x140210eb0]
call sym.ProcessHacker.exe_PhfWaitForEvent
nop dword [rax]
jmp 0x14013766f
lea rcx, str.userenv.dll
call fcn.1401047c0
mov rcx, rax
test rax, rax
jne 0x1401375e2
lea rcx, str.userenv.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rcx, rax
test rax, rax
je 0x140137663
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x140137663
mov edx, dword [rcx + 0x3c]
lea eax, [rdx - 1]
cmp eax, 0xffffffe
ja 0x140137663
cmp dword [rdx + rcx], 0x4550
jne 0x140137663
lea r8, ds:[rcx + 0x88]
add r8, rdx
mov eax, dword [r8]
test eax, eax
je 0x140137663
cmp dword [r8 + 4], ebx
je 0x140137663
lea r9, ds:[rcx + rax]
mov word [rsp + 0x28], bx
lea rax, str.CreateEnvironmentBlock
mov qword [rsp + 0x20], rax
call fcn.140104bd0
test rax, rax
je 0x140137663
mov ecx, dword [0x7ffe0004]
mov rdx, qword [0x7ffe0320]
imul rcx, rdx
shr rcx, 0x18
mov ecx, ecx
mov dword [0x140217728], ecx
xor rcx, rax
mov qword [0x140217798], rcx
lea rcx, [0x140210eb0]
call sym.ProcessHacker.exe_PhfSetEvent
mov rcx, qword [0x140217798]
test rcx, rcx
je 0x14013768e
mov eax, dword [0x140217728]
test eax, eax
je 0x14013768e
xor rax, rcx
add rsp, 0x30
pop rbx
ret
mov rax, rbx
add rsp, 0x30
pop rbx
ret
Function at 0x1401376a0
Capabilities:
Parse pe header

Disassembly:
push rbx
sub rsp, 0x30
xor ebx, ebx
test byte [0x140210da0], 1
jne 0x14013779f
lock bts qword [0x140210da0], 0x1f
nop
jae 0x1401376e5
test byte [0x140210da0], 1
jne 0x14013779f
xor edx, edx
lea rcx, [0x140210da0]
call sym.ProcessHacker.exe_PhfWaitForEvent
nop dword [rax]
jmp 0x14013779f
lea rcx, str.userenv.dll
call fcn.1401047c0
mov rcx, rax
test rax, rax
jne 0x140137712
lea rcx, str.userenv.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rcx, rax
test rax, rax
je 0x140137793
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x140137793
mov edx, dword [rcx + 0x3c]
lea eax, [rdx - 1]
cmp eax, 0xffffffe
ja 0x140137793
cmp dword [rdx + rcx], 0x4550
jne 0x140137793
lea r8, ds:[rcx + 0x88]
add r8, rdx
mov eax, dword [r8]
test eax, eax
je 0x140137793
cmp dword [r8 + 4], ebx
je 0x140137793
lea r9, ds:[rcx + rax]
mov word [rsp + 0x28], bx
lea rax, str.DestroyEnvironmentBlock
mov qword [rsp + 0x20], rax
call fcn.140104bd0
test rax, rax
je 0x140137793
mov ecx, dword [0x7ffe0004]
mov rdx, qword [0x7ffe0320]
imul rcx, rdx
shr rcx, 0x18
mov ecx, ecx
mov dword [0x1402176ec], ecx
xor rcx, rax
mov qword [0x140217748], rcx
lea rcx, [0x140210da0]
call sym.ProcessHacker.exe_PhfSetEvent
mov rcx, qword [0x140217748]
test rcx, rcx
je 0x1401377be
mov eax, dword [0x1402176ec]
test eax, eax
je 0x1401377be
xor rax, rcx
add rsp, 0x30
pop rbx
ret
mov rax, rbx
add rsp, 0x30
pop rbx
ret

Function at 0x1401377d0
Capabilities:
Parse pe header

Disassembly:
push rbx
sub rsp, 0x30
xor ebx, ebx
test byte [0x140210ec0], 1
jne 0x1401378cf
lock bts qword [0x140210ec0], 0x1f
nop
jae 0x140137815
test byte [0x140210ec0], 1
jne 0x1401378cf
xor edx, edx
lea rcx, [0x140210ec0]
call sym.ProcessHacker.exe_PhfWaitForEvent
nop dword [rax]
jmp 0x1401378cf
lea rcx, str.userenv.dll
call fcn.1401047c0
mov rcx, rax
test rax, rax
jne 0x140137842
lea rcx, str.userenv.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rcx, rax
test rax, rax
je 0x1401378c3
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x1401378c3
mov edx, dword [rcx + 0x3c]
lea eax, [rdx - 1]
cmp eax, 0xffffffe
ja 0x1401378c3
cmp dword [rdx + rcx], 0x4550
jne 0x1401378c3
lea r8, ds:[rcx + 0x88]
add r8, rdx
mov eax, dword [r8]
test eax, eax
je 0x1401378c3
cmp dword [r8 + 4], ebx
je 0x1401378c3
lea r9, ds:[rcx + rax]
mov word [rsp + 0x28], bx
lea rax, str.GetAppContainerRegistryLocation
mov qword [rsp + 0x20], rax
call fcn.140104bd0
test rax, rax
je 0x1401378c3
mov ecx, dword [0x7ffe0004]
mov rdx, qword [0x7ffe0320]
imul rcx, rdx
shr rcx, 0x18
mov ecx, ecx
mov dword [0x140217774], ecx
xor rcx, rax
mov qword [0x140217740], rcx
lea rcx, [0x140210ec0]
call sym.ProcessHacker.exe_PhfSetEvent
mov rcx, qword [0x140217740]
test rcx, rcx
je 0x1401378ee
mov eax, dword [0x140217774]
test eax, eax
je 0x1401378ee
xor rax, rcx
add rsp, 0x30
pop rbx
ret
mov rax, rbx
add rsp, 0x30
pop rbx
ret
Function at 0x140137900
Capabilities:
Parse pe header

Disassembly:
push rbx
sub rsp, 0x30
xor ebx, ebx
test byte [0x140210e80], 1
jne 0x1401379ff
lock bts qword [0x140210e80], 0x1f
nop
jae 0x140137945
test byte [0x140210e80], 1
jne 0x1401379ff
xor edx, edx
lea rcx, [0x140210e80]
call sym.ProcessHacker.exe_PhfWaitForEvent
nop dword [rax]
jmp 0x1401379ff
lea rcx, str.userenv.dll
call fcn.1401047c0
mov rcx, rax
test rax, rax
jne 0x140137972
lea rcx, str.userenv.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rcx, rax
test rax, rax
je 0x1401379f3
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x1401379f3
mov edx, dword [rcx + 0x3c]
lea eax, [rdx - 1]
cmp eax, 0xffffffe
ja 0x1401379f3
cmp dword [rdx + rcx], 0x4550
jne 0x1401379f3
lea r8, ds:[rcx + 0x88]
add r8, rdx
mov eax, dword [r8]
test eax, eax
je 0x1401379f3
cmp dword [r8 + 4], ebx
je 0x1401379f3
lea r9, ds:[rcx + rax]
mov word [rsp + 0x28], bx
lea rax, str.GetAppContainerFolderPath
mov qword [rsp + 0x20], rax
call fcn.140104bd0
test rax, rax
je 0x1401379f3
mov ecx, dword [0x7ffe0004]
mov rdx, qword [0x7ffe0320]
imul rcx, rdx
shr rcx, 0x18
mov ecx, ecx
mov dword [0x14021772c], ecx
xor rcx, rax
mov qword [0x140217788], rcx
lea rcx, [0x140210e80]
call sym.ProcessHacker.exe_PhfSetEvent
mov rcx, qword [0x140217788]
test rcx, rcx
je 0x140137a1e
mov eax, dword [0x14021772c]
test eax, eax
je 0x140137a1e
xor rax, rcx
add rsp, 0x30
pop rbx
ret
mov rax, rbx
add rsp, 0x30
pop rbx
ret

Function at 0x140137a30
Capabilities:
Parse pe header

Disassembly:
push rbx
sub rsp, 0x30
xor ebx, ebx
test byte [0x140210f10], 1
jne 0x140137b2f
lock bts qword [0x140210f10], 0x1f
nop
jae 0x140137a75
test byte [0x140210f10], 1
jne 0x140137b2f
xor edx, edx
lea rcx, [0x140210f10]
call sym.ProcessHacker.exe_PhfWaitForEvent
nop dword [rax]
jmp 0x140137b2f
lea rcx, str.winsta.dll
call fcn.1401047c0
mov rcx, rax
test rax, rax
jne 0x140137aa2
lea rcx, str.winsta.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rcx, rax
test rax, rax
je 0x140137b23
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x140137b23
mov edx, dword [rcx + 0x3c]
lea eax, [rdx - 1]
cmp eax, 0xffffffe
ja 0x140137b23
cmp dword [rdx + rcx], 0x4550
jne 0x140137b23
lea r8, ds:[rcx + 0x88]
add r8, rdx
mov eax, dword [r8]
test eax, eax
je 0x140137b23
cmp dword [r8 + 4], ebx
je 0x140137b23
lea r9, ds:[rcx + rax]
mov word [rsp + 0x28], bx
lea rax, [0x1401cb368]
mov qword [rsp + 0x20], rax
call fcn.140104bd0
test rax, rax
je 0x140137b23
mov ecx, dword [0x7ffe0004]
mov rdx, qword [0x7ffe0320]
imul rcx, rdx
shr rcx, 0x18
mov ecx, ecx
mov dword [0x140217754], ecx
xor rcx, rax
mov qword [0x1402177b0], rcx
lea rcx, [0x140210f10]
call sym.ProcessHacker.exe_PhfSetEvent
mov rcx, qword [0x1402177b0]
test rcx, rcx
je 0x140137b4e
mov eax, dword [0x140217754]
test eax, eax
je 0x140137b4e
xor rax, rcx
add rsp, 0x30
pop rbx
ret
mov rax, rbx
add rsp, 0x30
pop rbx
ret
Function at 0x1401382e0
Capabilities:
Create thread

Disassembly:
sub rsp, 0x48
mov rax, qword ds:[rsp + 0x78]
mov byte [rsp + 0x30], 0
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x70]
mov qword [rsp + 0x20], rax
call fcn.140138320
mov rdx, rax
lea rcx, [0x140138160]
add rsp, 0x48
jmp sym.ProcessHacker.exe_PhCreateThread2
Function at 0x14013d330
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
push rdi
push r15
sub rsp, 0x28
mov rdi, rdx
mov r15, rcx
call qword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x14013d4a1
lea rcx, str.BinaryData
mov qword [rsp + 0x48], rbp
call qword [sym.imp.USER32.dll_RegisterClipboardFormatW]
mov ecx, eax
call qword [sym.imp.USER32.dll_GetClipboardData]
mov rbp, rax
test rax, rax
jne 0x14013d383
lea ecx, [rax + 1]
call qword [sym.imp.USER32.dll_GetClipboardData]
mov rbp, rax
test rax, rax
je 0x14013d496
mov qword [rsp + 0x40], rbx
mov rcx, rbp
mov qword [rsp + 0x50], rsi
mov qword [rsp + 0x58], r12
mov qword [rsp + 0x20], r14
call qword [sym.imp.KERNEL32.dll_GlobalLock]
mov rcx, rbp
mov r12, rax
call qword [sym.imp.KERNEL32.dll_GlobalSize]
mov ecx, dword [rdi + 0x1c]
mov rsi, rax
mov r9d, dword [rdi + 0x20]
mov ebx, ecx
mov r14d, dword [rdi + 0x14]
cmp ecx, r9d
jle 0x14013d3cd
mov ebx, r9d
mov dword [rdi + 0x20], ecx
mov dword [rdi + 0x1c], ebx
mov r9d, ecx
test byte [rdi + 0x2c], 0x10
je 0x14013d432
cmp ebx, 0xffffffff
jne 0x14013d3fb
cmp dword [rdi + 0x18], 3
mov ebx, r14d
jne 0x14013d3e8
lea ebx, [r14 + 1]
mov dword [rdi + 0x14], ebx
mov r9d, esi
mov r8d, ebx
mov rdx, rdi
mov rcx, r15
call fcn.14013d5a0
jmp 0x14013d451
mov r8d, ebx
mov rdx, rdi
mov rcx, r15
call fcn.14013d4b0
mov r9d, esi
mov r8d, ebx
mov rdx, rdi
mov rcx, r15
call fcn.14013d5a0
mov r9d, 0xffffffff
mov rdx, rdi
mov r8d, r9d
mov rcx, r15
call fcn.14013cf20
nop
jmp 0x14013d451
cmp ebx, 0xffffffff
jne 0x14013d447
cmp dword [rdi + 0x18], 3
mov ebx, r14d
jne 0x14013d447
lea ebx, [r14 + 1]
mov dword [rdi + 0x14], ebx
mov eax, dword [rdi + 8]
sub eax, ebx
cmp esi, eax
cmova esi, eax
mov ecx, ebx
mov rdx, r12
add rcx, qword [rdi]
mov r8d, esi
call fcn.140165120
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov r9d, 0x105
mov dword [rdi + 0x14], r14d
xor r8d, r8d
xor edx, edx
mov rcx, r15
call qword [sym.imp.USER32.dll_RedrawWindow]
mov r14, qword [rsp + 0x20]
mov r12, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x40]
call qword [sym.imp.USER32.dll_CloseClipboard]
mov rbp, qword [rsp + 0x48]
add rsp, 0x28
pop r15
pop rdi
ret
Function at 0x140140ae0
Capabilities:
Capture screenshot

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0xc0
mov rax, qword [0x14020a008]
xor rax, rsp
mov qword [rsp + 0xb0], rax
mov rbx, rdx
xor r8d, r8d
lea rdx, [rsp + 0x50]
mov rdi, rcx
call qword [sym.imp.USER32.dll_GetUpdateRect]
test eax, eax
je 0x140140d1b
mov eax, dword [rsp + 0x5c]
or eax, dword [rsp + 0x54]
or eax, dword [rsp + 0x58]
or eax, dword [rsp + 0x50]
je 0x140140d1b
cmp dword [rbx + 0x240], 0
mov qword [rsp + 0xe0], rsi
jg 0x140140bb4
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.GDI32.dll_CreateRectRgn]
xor r8d, r8d
mov rcx, rdi
mov rdx, rax
mov rsi, rax
call qword [sym.imp.USER32.dll_GetUpdateRgn]
mov rcx, qword [rbx + 0x248]
test rcx, rcx
jne 0x140140b7b
mov qword [rbx + 0x248], rsi
jmp 0x140140b96
mov r9d, 2
mov r8, rsi
mov rdx, rcx
call qword [sym.imp.GDI32.dll_CombineRgn]
mov rcx, rsi
call qword [sym.imp.GDI32.dll_DeleteObject]
lea rdx, ds:[rsp + 0x60]
mov rcx, rdi
call qword [sym.imp.USER32.dll_BeginPaint]
test rax, rax
je 0x140140d13
jmp 0x140140d05
test dword ds:[rbx + 0x40], 0x200000
je 0x140140c73
cmp qword [rbx + 0x200], 0
jne 0x140140c73
mov rcx, qword [rbx]
call qword [sym.imp.USER32.dll_GetDC]
mov rsi, rax
test rax, rax
je 0x140140c73
mov rcx, rax
call qword [sym.imp.GDI32.dll_CreateCompatibleDC]
mov qword [rbx + 0x200], rax
test rax, rax
je 0x140140c73
movups xmm0, xmmword ds:[rbx + 0x68]
mov rcx, rsi
movups xmmword [rbx + 0x218], xmm0
mov edx, dword [rbx + 0x220]
mov r8d, dword [rbx + 0x224]
inc edx
call qword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
mov qword [rbx + 0x210], rax
test rax, rax
jne 0x140140c4c
mov rcx, qword [rbx + 0x200]
call qword [sym.imp.GDI32.dll_DeleteDC]
mov qword [rbx + 0x200], 0
jmp 0x140140c73
mov rcx, qword [rbx]
mov rdx, rsi
call qword [sym.imp.USER32.dll_ReleaseDC]
mov rdx, qword [rbx + 0x210]
mov rcx, qword [rbx + 0x200]
call qword [sym.imp.GDI32.dll_SelectObject]
mov qword [rbx + 0x208], rax
lea rdx, ds:[rsp + 0x60]
mov rcx, rdi
call qword [sym.imp.USER32.dll_BeginPaint]
mov rsi, rax
test rax, rax
je 0x140140d13
movups xmm0, xmmword [rsp + 0x6c]
mov r8, qword [rbx + 0x200]
lea r9, [rsp + 0x50]
mov rdx, rbx
mov rcx, rdi
movups xmmword [rsp + 0x50], xmm0
test r8, r8
je 0x140140cfc
call fcn.140147110
mov ecx, dword [rsp + 0x5c]
mov r8d, dword [rsp + 0x54]
sub ecx, r8d
mov edx, dword [rsp + 0x50]
mov rax, qword [rbx + 0x200]
mov r9d, dword [rsp + 0x58]
mov dword [rsp + 0x40], 0xcc0020
sub r9d, edx
mov dword [rsp + 0x38], r8d
mov dword [rsp + 0x30], edx
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], ecx
mov rcx, rsi
call qword [sym.imp.GDI32.dll_BitBlt]
jmp 0x140140d05
mov r8, rsi
call fcn.140147110
lea rdx, [rsp + 0x60]
mov rcx, rdi
call qword [sym.imp.USER32.dll_EndPaint]
mov rsi, qword [rsp + 0xe0]
mov rcx, qword [rsp + 0xb0]
xor rcx, rsp
call fcn.140161390
mov rbx, qword [rsp + 0xe8]
add rsp, 0xc0
pop rdi
ret
Function at 0x14014c840
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rsi, r8
mov rdi, rdx
mov rbx, rcx
mov qword [rcx + 8], rdx
mov qword [rcx + 0x10], r8
mov r8d, 0x40
call fcn.14014cc90
nop
mov eax, 0x5a4d
cmp word [rdi], ax
je 0x14014c88b
mov eax, 0xc000012f
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov ecx, dword [rdi + 0x3c]
lea eax, [rcx - 1]
cmp eax, 0xffffffe
ja 0x14014c932
nop dword [rax]
cmp rcx, rsi
jae 0x14014c932
lea rdx, [rcx + rdi]
mov qword [rbx + 0x18], rdx
mov r8d, 0x18
mov rcx, rbx
call fcn.14014cc90
mov rdx, qword [rbx + 0x18]
movzx eax, word [rdx + 6]
lea rcx, [rax + rax*4]
movzx eax, word [rdx + 0x14]
lea rcx, [rcx + 3]
lea r8, [rax + rcx*8]
mov rcx, rbx
call fcn.14014cc90
nop
mov rcx, qword [rbx + 0x18]
cmp dword [rcx], 0x4550
jne 0x14014c932
movzx eax, word [rcx + 0x18]
mov word [rbx + 0x30], ax
mov edx, 0x10b
cmp ax, dx
je 0x14014c908
mov edx, 0x20b
cmp ax, dx
jne 0x14014c932
movzx eax, word [rcx + 6]
mov dword [rbx + 0x20], eax
movzx eax, word [rcx + 0x14]
add rcx, 0x18
add rcx, rax
mov qword [rbx + 0x28], rcx
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov eax, 0xc000007b
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret