joyce8/EMBER2024-capa huggingface dataset:
Function at 0x7ff7c00f6ac0
Capabilities:
Parse pe header

Disassembly:
push rbx
sub rsp, 0x30
xor ebx, ebx
test byte [0x7ff7c01d0e00], 1
jne 0x7ff7c00f6bbf
lock bts qword [0x7ff7c01d0e00], 0x1f
nop
jae 0x7ff7c00f6b05
test byte [0x7ff7c01d0e00], 1
jne 0x7ff7c00f6bbf
xor edx, edx
lea rcx, [0x7ff7c01d0e00]
call sym.ProcessHacker.exe_PhfWaitForEvent
nop dword [rax]
jmp 0x7ff7c00f6bbf
lea rcx, [0x7ff7c018b218]
call fcn.7ff7c00c47c0
mov rcx, rax
test rax, rax
jne 0x7ff7c00f6b32
lea rcx, [0x7ff7c018b218]
call qword [sym.imp.kernel32.dll_LoadLibraryW]
mov rcx, rax
test rax, rax
je 0x7ff7c00f6bb3
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x7ff7c00f6bb3
mov edx, dword [rcx + 0x3c]
lea eax, [rdx - 1]
cmp eax, 0xffffffe
ja 0x7ff7c00f6bb3
cmp dword [rdx + rcx], 0x4550
jne 0x7ff7c00f6bb3
lea r8, ds:[rcx + 0x88]
add r8, rdx
mov eax, dword [r8]
test eax, eax
je 0x7ff7c00f6bb3
cmp dword [r8 + 4], ebx
je 0x7ff7c00f6bb3
lea r9, ds:[rcx + rax]
mov word [rsp + 0x28], bx
lea rax, [0x7ff7c018b208]
mov qword [rsp + 0x20], rax
call fcn.7ff7c00c4bd0
test rax, rax
je 0x7ff7c00f6bb3
mov ecx, dword [0x7ffe0004]
mov rdx, qword [0x7ffe0320]
imul rcx, rdx
shr rcx, 0x18
mov ecx, ecx
mov dword [0x7ff7c01d77a0], ecx
xor rcx, rax
mov qword [0x7ff7c01d7698], rcx
lea rcx, [0x7ff7c01d0e00]
call sym.ProcessHacker.exe_PhfSetEvent
mov rcx, qword [0x7ff7c01d7698]
test rcx, rcx
je 0x7ff7c00f6bde
mov eax, dword [0x7ff7c01d77a0]
test eax, eax
je 0x7ff7c00f6bde
xor rax, rcx
add rsp, 0x30
pop rbx
ret
mov rax, rbx
add rsp, 0x30
pop rbx
ret

Function at 0x7ff7c00f6bf0
Capabilities:
Parse pe header

Disassembly:
push rbx
sub rsp, 0x30
xor ebx, ebx
test byte [0x7ff7c01d0e60], 1
jne 0x7ff7c00f6cef
lock bts qword [0x7ff7c01d0e60], 0x1f
nop
jae 0x7ff7c00f6c35
test byte [0x7ff7c01d0e60], 1
jne 0x7ff7c00f6cef
xor edx, edx
lea rcx, [0x7ff7c01d0e60]
call sym.ProcessHacker.exe_PhfWaitForEvent
nop dword [rax]
jmp 0x7ff7c00f6cef
lea rcx, [0x7ff7c018b218]
call fcn.7ff7c00c47c0
mov rcx, rax
test rax, rax
jne 0x7ff7c00f6c62
lea rcx, [0x7ff7c018b218]
call qword [sym.imp.kernel32.dll_LoadLibraryW]
mov rcx, rax
test rax, rax
je 0x7ff7c00f6ce3
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x7ff7c00f6ce3
mov edx, dword [rcx + 0x3c]
lea eax, [rdx - 1]
cmp eax, 0xffffffe
ja 0x7ff7c00f6ce3
cmp dword [rdx + rcx], 0x4550
jne 0x7ff7c00f6ce3
lea r8, ds:[rcx + 0x88]
add r8, rdx
mov eax, dword [r8]
test eax, eax
je 0x7ff7c00f6ce3
cmp dword [r8 + 4], ebx
je 0x7ff7c00f6ce3
lea r9, ds:[rcx + rax]
mov word [rsp + 0x28], bx
lea rax, [0x7ff7c018b230]
mov qword [rsp + 0x20], rax
call fcn.7ff7c00c4bd0
test rax, rax
je 0x7ff7c00f6ce3
mov ecx, dword [0x7ffe0004]
mov rdx, qword [0x7ffe0320]
imul rcx, rdx
shr rcx, 0x18
mov ecx, ecx
mov dword [0x7ff7c01d77d8], ecx
xor rcx, rax
mov qword [0x7ff7c01d77c0], rcx
lea rcx, [0x7ff7c01d0e60]
call sym.ProcessHacker.exe_PhfSetEvent
mov rcx, qword [0x7ff7c01d77c0]
test rcx, rcx
je 0x7ff7c00f6d0e
mov eax, dword [0x7ff7c01d77d8]
test eax, eax
je 0x7ff7c00f6d0e
xor rax, rcx
add rsp, 0x30
pop rbx
ret
mov rax, rbx
add rsp, 0x30
pop rbx
ret
Function at 0x7ff7c00f6d20
Capabilities:
Parse pe header

Disassembly:
push rbx
sub rsp, 0x30
xor ebx, ebx
test byte [0x7ff7c01d0dd0], 1
jne 0x7ff7c00f6e1f
lock bts qword [0x7ff7c01d0dd0], 0x1f
nop
jae 0x7ff7c00f6d65
test byte [0x7ff7c01d0dd0], 1
jne 0x7ff7c00f6e1f
xor edx, edx
lea rcx, [0x7ff7c01d0dd0]
call sym.ProcessHacker.exe_PhfWaitForEvent
nop dword [rax]
jmp 0x7ff7c00f6e1f
lea rcx, [0x7ff7c018b218]
call fcn.7ff7c00c47c0
mov rcx, rax
test rax, rax
jne 0x7ff7c00f6d92
lea rcx, [0x7ff7c018b218]
call qword [sym.imp.kernel32.dll_LoadLibraryW]
mov rcx, rax
test rax, rax
je 0x7ff7c00f6e13
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x7ff7c00f6e13
mov edx, dword [rcx + 0x3c]
lea eax, [rdx - 1]
cmp eax, 0xffffffe
ja 0x7ff7c00f6e13
cmp dword [rdx + rcx], 0x4550
jne 0x7ff7c00f6e13
lea r8, ds:[rcx + 0x88]
add r8, rdx
mov eax, dword [r8]
test eax, eax
je 0x7ff7c00f6e13
cmp dword [r8 + 4], ebx
je 0x7ff7c00f6e13
lea r9, ds:[rcx + rax]
mov word [rsp + 0x28], bx
lea rax, [0x7ff7c018b250]
mov qword [rsp + 0x20], rax
call fcn.7ff7c00c4bd0
test rax, rax
je 0x7ff7c00f6e13
mov ecx, dword [0x7ffe0004]
mov rdx, qword [0x7ffe0320]
imul rcx, rdx
shr rcx, 0x18
mov ecx, ecx
mov dword [0x7ff7c01d77e0], ecx
xor rcx, rax
mov qword [0x7ff7c01d7768], rcx
lea rcx, [0x7ff7c01d0dd0]
call sym.ProcessHacker.exe_PhfSetEvent
mov rcx, qword [0x7ff7c01d7768]
test rcx, rcx
je 0x7ff7c00f6e3e
mov eax, dword [0x7ff7c01d77e0]
test eax, eax
je 0x7ff7c00f6e3e
xor rax, rcx
add rsp, 0x30
pop rbx
ret
mov rax, rbx
add rsp, 0x30
pop rbx
ret

Function at 0x7ff7c00f6e50
Capabilities:
Parse pe header

Disassembly:
push rbx
sub rsp, 0x30
xor ebx, ebx
test byte [0x7ff7c01d0e30], 1
jne 0x7ff7c00f6f4f
lock bts qword [0x7ff7c01d0e30], 0x1f
nop
jae 0x7ff7c00f6e95
test byte [0x7ff7c01d0e30], 1
jne 0x7ff7c00f6f4f
xor edx, edx
lea rcx, [0x7ff7c01d0e30]
call sym.ProcessHacker.exe_PhfWaitForEvent
nop dword [rax]
jmp 0x7ff7c00f6f4f
lea rcx, [0x7ff7c018b218]
call fcn.7ff7c00c47c0
mov rcx, rax
test rax, rax
jne 0x7ff7c00f6ec2
lea rcx, [0x7ff7c018b218]
call qword [sym.imp.kernel32.dll_LoadLibraryW]
mov rcx, rax
test rax, rax
je 0x7ff7c00f6f43
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x7ff7c00f6f43
mov edx, dword [rcx + 0x3c]
lea eax, [rdx - 1]
cmp eax, 0xffffffe
ja 0x7ff7c00f6f43
cmp dword [rdx + rcx], 0x4550
jne 0x7ff7c00f6f43
lea r8, ds:[rcx + 0x88]
add r8, rdx
mov eax, dword [r8]
test eax, eax
je 0x7ff7c00f6f43
cmp dword [r8 + 4], ebx
je 0x7ff7c00f6f43
lea r9, ds:[rcx + rax]
mov word [rsp + 0x28], bx
lea rax, [0x7ff7c018b270]
mov qword [rsp + 0x20], rax
call fcn.7ff7c00c4bd0
test rax, rax
je 0x7ff7c00f6f43
mov ecx, dword [0x7ffe0004]
mov rdx, qword [0x7ffe0320]
imul rcx, rdx
shr rcx, 0x18
mov ecx, ecx
mov dword [0x7ff7c01d7730], ecx
xor rcx, rax
mov qword [0x7ff7c01d76b8], rcx
lea rcx, [0x7ff7c01d0e30]
call sym.ProcessHacker.exe_PhfSetEvent
mov rcx, qword [0x7ff7c01d76b8]
test rcx, rcx
je 0x7ff7c00f6f6e
mov eax, dword [0x7ff7c01d7730]
test eax, eax
je 0x7ff7c00f6f6e
xor rax, rcx
add rsp, 0x30
pop rbx
ret
mov rax, rbx
add rsp, 0x30
pop rbx
ret
Function at 0x7ff7c00f6f80
Capabilities:
Parse pe header

Disassembly:
push rbx
sub rsp, 0x30
xor ebx, ebx
test byte [0x7ff7c01d0ef0], 1
jne 0x7ff7c00f707f
lock bts qword [0x7ff7c01d0ef0], 0x1f
nop
jae 0x7ff7c00f6fc5
test byte [0x7ff7c01d0ef0], 1
jne 0x7ff7c00f707f
xor edx, edx
lea rcx, [0x7ff7c01d0ef0]
call sym.ProcessHacker.exe_PhfWaitForEvent
nop dword [rax]
jmp 0x7ff7c00f707f
lea rcx, [0x7ff7c0188860]
call fcn.7ff7c00c47c0
mov rcx, rax
test rax, rax
jne 0x7ff7c00f6ff2
lea rcx, [0x7ff7c0188860]
call qword [sym.imp.kernel32.dll_LoadLibraryW]
mov rcx, rax
test rax, rax
je 0x7ff7c00f7073
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x7ff7c00f7073
mov edx, dword [rcx + 0x3c]
lea eax, [rdx - 1]
cmp eax, 0xffffffe
ja 0x7ff7c00f7073
cmp dword [rdx + rcx], 0x4550
jne 0x7ff7c00f7073
lea r8, ds:[rcx + 0x88]
add r8, rdx
mov eax, dword [r8]
test eax, eax
je 0x7ff7c00f7073
cmp dword [r8 + 4], ebx
je 0x7ff7c00f7073
lea r9, ds:[rcx + rax]
mov word [rsp + 0x28], bx
lea rax, [0x7ff7c018b278]
mov qword [rsp + 0x20], rax
call fcn.7ff7c00c4bd0
test rax, rax
je 0x7ff7c00f7073
mov ecx, dword [0x7ffe0004]
mov rdx, qword [0x7ffe0320]
imul rcx, rdx
shr rcx, 0x18
mov ecx, ecx
mov dword [0x7ff7c01d76b4], ecx
xor rcx, rax
mov qword [0x7ff7c01d7710], rcx
lea rcx, [0x7ff7c01d0ef0]
call sym.ProcessHacker.exe_PhfSetEvent
mov rcx, qword [0x7ff7c01d7710]
test rcx, rcx
je 0x7ff7c00f709e
mov eax, dword [0x7ff7c01d76b4]
test eax, eax
je 0x7ff7c00f709e
xor rax, rcx
add rsp, 0x30
pop rbx
ret
mov rax, rbx
add rsp, 0x30
pop rbx
ret

Function at 0x7ff7c00f70b0
Capabilities:
Parse pe header

Disassembly:
push rbx
sub rsp, 0x30
xor ebx, ebx
test byte [0x7ff7c01d0d90], 1
jne 0x7ff7c00f71af
lock bts qword [0x7ff7c01d0d90], 0x1f
nop
jae 0x7ff7c00f70f5
test byte [0x7ff7c01d0d90], 1
jne 0x7ff7c00f71af
xor edx, edx
lea rcx, [0x7ff7c01d0d90]
call sym.ProcessHacker.exe_PhfWaitForEvent
nop dword [rax]
jmp 0x7ff7c00f71af
lea rcx, [0x7ff7c0188860]
call fcn.7ff7c00c47c0
mov rcx, rax
test rax, rax
jne 0x7ff7c00f7122
lea rcx, [0x7ff7c0188860]
call qword [sym.imp.kernel32.dll_LoadLibraryW]
mov rcx, rax
test rax, rax
je 0x7ff7c00f71a3
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x7ff7c00f71a3
mov edx, dword [rcx + 0x3c]
lea eax, [rdx - 1]
cmp eax, 0xffffffe
ja 0x7ff7c00f71a3
cmp dword [rdx + rcx], 0x4550
jne 0x7ff7c00f71a3
lea r8, ds:[rcx + 0x88]
add r8, rdx
mov eax, dword [r8]
test eax, eax
je 0x7ff7c00f71a3
cmp dword [r8 + 4], ebx
je 0x7ff7c00f71a3
lea r9, ds:[rcx + rax]
mov word [rsp + 0x28], bx
lea rax, [0x7ff7c018b290]
mov qword [rsp + 0x20], rax
call fcn.7ff7c00c4bd0
test rax, rax
je 0x7ff7c00f71a3
mov ecx, dword [0x7ffe0004]
mov rdx, qword [0x7ffe0320]
imul rcx, rdx
shr rcx, 0x18
mov ecx, ecx
mov dword [0x7ff7c01d76e8], ecx
xor rcx, rax
mov qword [0x7ff7c01d76f0], rcx
lea rcx, [0x7ff7c01d0d90]
call sym.ProcessHacker.exe_PhfSetEvent
mov rcx, qword [0x7ff7c01d76f0]
test rcx, rcx
je 0x7ff7c00f71ce
mov eax, dword [0x7ff7c01d76e8]
test eax, eax
je 0x7ff7c00f71ce
xor rax, rcx
add rsp, 0x30
pop rbx
ret
mov rax, rbx
add rsp, 0x30
pop rbx
ret
Function at 0x7ff7c00f71e0
Capabilities:
Parse pe header

Disassembly:
push rbx
sub rsp, 0x30
xor ebx, ebx
test byte [0x7ff7c01d0e50], 1
jne 0x7ff7c00f72df
lock bts qword [0x7ff7c01d0e50], 0x1f
nop
jae 0x7ff7c00f7225
test byte [0x7ff7c01d0e50], 1
jne 0x7ff7c00f72df
xor edx, edx
lea rcx, [0x7ff7c01d0e50]
call sym.ProcessHacker.exe_PhfWaitForEvent
nop dword [rax]
jmp 0x7ff7c00f72df
lea rcx, [0x7ff7c0186948]
call fcn.7ff7c00c47c0
mov rcx, rax
test rax, rax
jne 0x7ff7c00f7252
lea rcx, [0x7ff7c0186948]
call qword [sym.imp.kernel32.dll_LoadLibraryW]
mov rcx, rax
test rax, rax
je 0x7ff7c00f72d3
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x7ff7c00f72d3
mov edx, dword [rcx + 0x3c]
lea eax, [rdx - 1]
cmp eax, 0xffffffe
ja 0x7ff7c00f72d3
cmp dword [rdx + rcx], 0x4550
jne 0x7ff7c00f72d3
lea r8, ds:[rcx + 0x88]
add r8, rdx
mov eax, dword [r8]
test eax, eax
je 0x7ff7c00f72d3
cmp dword [r8 + 4], ebx
je 0x7ff7c00f72d3
lea r9, ds:[rcx + rax]
mov word [rsp + 0x28], bx
lea rax, [0x7ff7c018b2a0]
mov qword [rsp + 0x20], rax
call fcn.7ff7c00c4bd0
test rax, rax
je 0x7ff7c00f72d3
mov ecx, dword [0x7ffe0004]
mov rdx, qword [0x7ffe0320]
imul rcx, rdx
shr rcx, 0x18
mov ecx, ecx
mov dword [0x7ff7c01d77cc], ecx
xor rcx, rax
mov qword [0x7ff7c01d76d8], rcx
lea rcx, [0x7ff7c01d0e50]
call sym.ProcessHacker.exe_PhfSetEvent
mov rcx, qword [0x7ff7c01d76d8]
test rcx, rcx
je 0x7ff7c00f72fe
mov eax, dword [0x7ff7c01d77cc]
test eax, eax
je 0x7ff7c00f72fe
xor rax, rcx
add rsp, 0x30
pop rbx
ret
mov rax, rbx
add rsp, 0x30
pop rbx
ret

Function at 0x7ff7c00f7310
Capabilities:
Parse pe header

Disassembly:
push rbx
sub rsp, 0x30
xor ebx, ebx
test byte [0x7ff7c01d0ed0], 1
jne 0x7ff7c00f740f
lock bts qword [0x7ff7c01d0ed0], 0x1f
nop
jae 0x7ff7c00f7355
test byte [0x7ff7c01d0ed0], 1
jne 0x7ff7c00f740f
xor edx, edx
lea rcx, [0x7ff7c01d0ed0]
call sym.ProcessHacker.exe_PhfWaitForEvent
nop dword [rax]
jmp 0x7ff7c00f740f
lea rcx, [0x7ff7c0186948]
call fcn.7ff7c00c47c0
mov rcx, rax
test rax, rax
jne 0x7ff7c00f7382
lea rcx, [0x7ff7c0186948]
call qword [sym.imp.kernel32.dll_LoadLibraryW]
mov rcx, rax
test rax, rax
je 0x7ff7c00f7403
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x7ff7c00f7403
mov edx, dword [rcx + 0x3c]
lea eax, [rdx - 1]
cmp eax, 0xffffffe
ja 0x7ff7c00f7403
cmp dword [rdx + rcx], 0x4550
jne 0x7ff7c00f7403
lea r8, ds:[rcx + 0x88]
add r8, rdx
mov eax, dword [r8]
test eax, eax
je 0x7ff7c00f7403
cmp dword [r8 + 4], ebx
je 0x7ff7c00f7403
lea r9, ds:[rcx + rax]
mov word [rsp + 0x28], bx
lea rax, [0x7ff7c018b2b8]
mov qword [rsp + 0x20], rax
call fcn.7ff7c00c4bd0
test rax, rax
je 0x7ff7c00f7403
mov ecx, dword [0x7ffe0004]
mov rdx, qword [0x7ffe0320]
imul rcx, rdx
shr rcx, 0x18
mov ecx, ecx
mov dword [0x7ff7c01d76e4], ecx
xor rcx, rax
mov qword [0x7ff7c01d76c0], rcx
lea rcx, [0x7ff7c01d0ed0]
call sym.ProcessHacker.exe_PhfSetEvent
mov rcx, qword [0x7ff7c01d76c0]
test rcx, rcx
je 0x7ff7c00f742e
mov eax, dword [0x7ff7c01d76e4]
test eax, eax
je 0x7ff7c00f742e
xor rax, rcx
add rsp, 0x30
pop rbx
ret
mov rax, rbx
add rsp, 0x30
pop rbx
ret
Function at 0x7ff7c00f7440
Capabilities:
Parse pe header

Disassembly:
push rbx
sub rsp, 0x30
xor ebx, ebx
test byte [0x7ff7c01d0f00], 1
jne 0x7ff7c00f753f
lock bts qword [0x7ff7c01d0f00], 0x1f
nop
jae 0x7ff7c00f7485
test byte [0x7ff7c01d0f00], 1
jne 0x7ff7c00f753f
xor edx, edx
lea rcx, [0x7ff7c01d0f00]
call sym.ProcessHacker.exe_PhfWaitForEvent
nop dword [rax]
jmp 0x7ff7c00f753f
lea rcx, [0x7ff7c0186948]
call fcn.7ff7c00c47c0
mov rcx, rax
test rax, rax
jne 0x7ff7c00f74b2
lea rcx, [0x7ff7c0186948]
call qword [sym.imp.kernel32.dll_LoadLibraryW]
mov rcx, rax
test rax, rax
je 0x7ff7c00f7533
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x7ff7c00f7533
mov edx, dword [rcx + 0x3c]
lea eax, [rdx - 1]
cmp eax, 0xffffffe
ja 0x7ff7c00f7533
cmp dword [rdx + rcx], 0x4550
jne 0x7ff7c00f7533
lea r8, ds:[rcx + 0x88]
add r8, rdx
mov eax, dword [r8]
test eax, eax
je 0x7ff7c00f7533
cmp dword [r8 + 4], ebx
je 0x7ff7c00f7533
lea r9, ds:[rcx + rax]
mov word [rsp + 0x28], bx
lea rax, [0x7ff7c018b2d0]
mov qword [rsp + 0x20], rax
call fcn.7ff7c00c4bd0
test rax, rax
je 0x7ff7c00f7533
mov ecx, dword [0x7ffe0004]
mov rdx, qword [0x7ffe0320]
imul rcx, rdx
shr rcx, 0x18
mov ecx, ecx
mov dword [0x7ff7c01d7778], ecx
xor rcx, rax
mov qword [0x7ff7c01d76f8], rcx
lea rcx, [0x7ff7c01d0f00]
call sym.ProcessHacker.exe_PhfSetEvent
mov rcx, qword [0x7ff7c01d76f8]
test rcx, rcx
je 0x7ff7c00f755e
mov eax, dword [0x7ff7c01d7778]
test eax, eax
je 0x7ff7c00f755e
xor rax, rcx
add rsp, 0x30
pop rbx
ret
mov rax, rbx
add rsp, 0x30
pop rbx
ret

Function at 0x7ff7c00f7570
Capabilities:
Parse pe header

Disassembly:
push rbx
sub rsp, 0x30
xor ebx, ebx
test byte [0x7ff7c01d0eb0], 1
jne 0x7ff7c00f766f
lock bts qword [0x7ff7c01d0eb0], 0x1f
nop
jae 0x7ff7c00f75b5
test byte [0x7ff7c01d0eb0], 1
jne 0x7ff7c00f766f
xor edx, edx
lea rcx, [0x7ff7c01d0eb0]
call sym.ProcessHacker.exe_PhfWaitForEvent
nop dword [rax]
jmp 0x7ff7c00f766f
lea rcx, [0x7ff7c018b2f8]
call fcn.7ff7c00c47c0
mov rcx, rax
test rax, rax
jne 0x7ff7c00f75e2
lea rcx, [0x7ff7c018b2f8]
call qword [sym.imp.kernel32.dll_LoadLibraryW]
mov rcx, rax
test rax, rax
je 0x7ff7c00f7663
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x7ff7c00f7663
mov edx, dword [rcx + 0x3c]
lea eax, [rdx - 1]
cmp eax, 0xffffffe
ja 0x7ff7c00f7663
cmp dword [rdx + rcx], 0x4550
jne 0x7ff7c00f7663
lea r8, ds:[rcx + 0x88]
add r8, rdx
mov eax, dword [r8]
test eax, eax
je 0x7ff7c00f7663
cmp dword [r8 + 4], ebx
je 0x7ff7c00f7663
lea r9, ds:[rcx + rax]
mov word [rsp + 0x28], bx
lea rax, [0x7ff7c018b2e0]
mov qword [rsp + 0x20], rax
call fcn.7ff7c00c4bd0
test rax, rax
je 0x7ff7c00f7663
mov ecx, dword [0x7ffe0004]
mov rdx, qword [0x7ffe0320]
imul rcx, rdx
shr rcx, 0x18
mov ecx, ecx
mov dword [0x7ff7c01d7728], ecx
xor rcx, rax
mov qword [0x7ff7c01d7798], rcx
lea rcx, [0x7ff7c01d0eb0]
call sym.ProcessHacker.exe_PhfSetEvent
mov rcx, qword [0x7ff7c01d7798]
test rcx, rcx
je 0x7ff7c00f768e
mov eax, dword [0x7ff7c01d7728]
test eax, eax
je 0x7ff7c00f768e
xor rax, rcx
add rsp, 0x30
pop rbx
ret
mov rax, rbx
add rsp, 0x30
pop rbx
ret
Function at 0x7ff7c00f76a0
Capabilities:
Parse pe header

Disassembly:
push rbx
sub rsp, 0x30
xor ebx, ebx
test byte [0x7ff7c01d0da0], 1
jne 0x7ff7c00f779f
lock bts qword [0x7ff7c01d0da0], 0x1f
nop
jae 0x7ff7c00f76e5
test byte [0x7ff7c01d0da0], 1
jne 0x7ff7c00f779f
xor edx, edx
lea rcx, [0x7ff7c01d0da0]
call sym.ProcessHacker.exe_PhfWaitForEvent
nop dword [rax]
jmp 0x7ff7c00f779f
lea rcx, [0x7ff7c018b2f8]
call fcn.7ff7c00c47c0
mov rcx, rax
test rax, rax
jne 0x7ff7c00f7712
lea rcx, [0x7ff7c018b2f8]
call qword [sym.imp.kernel32.dll_LoadLibraryW]
mov rcx, rax
test rax, rax
je 0x7ff7c00f7793
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x7ff7c00f7793
mov edx, dword [rcx + 0x3c]
lea eax, [rdx - 1]
cmp eax, 0xffffffe
ja 0x7ff7c00f7793
cmp dword [rdx + rcx], 0x4550
jne 0x7ff7c00f7793
lea r8, ds:[rcx + 0x88]
add r8, rdx
mov eax, dword [r8]
test eax, eax
je 0x7ff7c00f7793
cmp dword [r8 + 4], ebx
je 0x7ff7c00f7793
lea r9, ds:[rcx + rax]
mov word [rsp + 0x28], bx
lea rax, [0x7ff7c018b310]
mov qword [rsp + 0x20], rax
call fcn.7ff7c00c4bd0
test rax, rax
je 0x7ff7c00f7793
mov ecx, dword [0x7ffe0004]
mov rdx, qword [0x7ffe0320]
imul rcx, rdx
shr rcx, 0x18
mov ecx, ecx
mov dword [0x7ff7c01d76ec], ecx
xor rcx, rax
mov qword [0x7ff7c01d7748], rcx
lea rcx, [0x7ff7c01d0da0]
call sym.ProcessHacker.exe_PhfSetEvent
mov rcx, qword [0x7ff7c01d7748]
test rcx, rcx
je 0x7ff7c00f77be
mov eax, dword [0x7ff7c01d76ec]
test eax, eax
je 0x7ff7c00f77be
xor rax, rcx
add rsp, 0x30
pop rbx
ret
mov rax, rbx
add rsp, 0x30
pop rbx
ret

Function at 0x7ff7c00f77d0
Capabilities:
Parse pe header

Disassembly:
push rbx
sub rsp, 0x30
xor ebx, ebx
test byte [0x7ff7c01d0ec0], 1
jne 0x7ff7c00f78cf
lock bts qword [0x7ff7c01d0ec0], 0x1f
nop
jae 0x7ff7c00f7815
test byte [0x7ff7c01d0ec0], 1
jne 0x7ff7c00f78cf
xor edx, edx
lea rcx, [0x7ff7c01d0ec0]
call sym.ProcessHacker.exe_PhfWaitForEvent
nop dword [rax]
jmp 0x7ff7c00f78cf
lea rcx, [0x7ff7c018b2f8]
call fcn.7ff7c00c47c0
mov rcx, rax
test rax, rax
jne 0x7ff7c00f7842
lea rcx, [0x7ff7c018b2f8]
call qword [sym.imp.kernel32.dll_LoadLibraryW]
mov rcx, rax
test rax, rax
je 0x7ff7c00f78c3
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x7ff7c00f78c3
mov edx, dword [rcx + 0x3c]
lea eax, [rdx - 1]
cmp eax, 0xffffffe
ja 0x7ff7c00f78c3
cmp dword [rdx + rcx], 0x4550
jne 0x7ff7c00f78c3
lea r8, ds:[rcx + 0x88]
add r8, rdx
mov eax, dword [r8]
test eax, eax
je 0x7ff7c00f78c3
cmp dword [r8 + 4], ebx
je 0x7ff7c00f78c3
lea r9, ds:[rcx + rax]
mov word [rsp + 0x28], bx
lea rax, [0x7ff7c018b328]
mov qword [rsp + 0x20], rax
call fcn.7ff7c00c4bd0
test rax, rax
je 0x7ff7c00f78c3
mov ecx, dword [0x7ffe0004]
mov rdx, qword [0x7ffe0320]
imul rcx, rdx
shr rcx, 0x18
mov ecx, ecx
mov dword [0x7ff7c01d7774], ecx
xor rcx, rax
mov qword [0x7ff7c01d7740], rcx
lea rcx, [0x7ff7c01d0ec0]
call sym.ProcessHacker.exe_PhfSetEvent
mov rcx, qword [0x7ff7c01d7740]
test rcx, rcx
je 0x7ff7c00f78ee
mov eax, dword [0x7ff7c01d7774]
test eax, eax
je 0x7ff7c00f78ee
xor rax, rcx
add rsp, 0x30
pop rbx
ret
mov rax, rbx
add rsp, 0x30
pop rbx
ret
Function at 0x7ff7c00f7900
Capabilities:
Parse pe header

Disassembly:
push rbx
sub rsp, 0x30
xor ebx, ebx
test byte [0x7ff7c01d0e80], 1
jne 0x7ff7c00f79ff
lock bts qword [0x7ff7c01d0e80], 0x1f
nop
jae 0x7ff7c00f7945
test byte [0x7ff7c01d0e80], 1
jne 0x7ff7c00f79ff
xor edx, edx
lea rcx, [0x7ff7c01d0e80]
call sym.ProcessHacker.exe_PhfWaitForEvent
nop dword [rax]
jmp 0x7ff7c00f79ff
lea rcx, [0x7ff7c018b2f8]
call fcn.7ff7c00c47c0
mov rcx, rax
test rax, rax
jne 0x7ff7c00f7972
lea rcx, [0x7ff7c018b2f8]
call qword [sym.imp.kernel32.dll_LoadLibraryW]
mov rcx, rax
test rax, rax
je 0x7ff7c00f79f3
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x7ff7c00f79f3
mov edx, dword [rcx + 0x3c]
lea eax, [rdx - 1]
cmp eax, 0xffffffe
ja 0x7ff7c00f79f3
cmp dword [rdx + rcx], 0x4550
jne 0x7ff7c00f79f3
lea r8, ds:[rcx + 0x88]
add r8, rdx
mov eax, dword [r8]
test eax, eax
je 0x7ff7c00f79f3
cmp dword [r8 + 4], ebx
je 0x7ff7c00f79f3
lea r9, ds:[rcx + rax]
mov word [rsp + 0x28], bx
lea rax, [0x7ff7c018b348]
mov qword [rsp + 0x20], rax
call fcn.7ff7c00c4bd0
test rax, rax
je 0x7ff7c00f79f3
mov ecx, dword [0x7ffe0004]
mov rdx, qword [0x7ffe0320]
imul rcx, rdx
shr rcx, 0x18
mov ecx, ecx
mov dword [0x7ff7c01d772c], ecx
xor rcx, rax
mov qword [0x7ff7c01d7788], rcx
lea rcx, [0x7ff7c01d0e80]
call sym.ProcessHacker.exe_PhfSetEvent
mov rcx, qword [0x7ff7c01d7788]
test rcx, rcx
je 0x7ff7c00f7a1e
mov eax, dword [0x7ff7c01d772c]
test eax, eax
je 0x7ff7c00f7a1e
xor rax, rcx
add rsp, 0x30
pop rbx
ret
mov rax, rbx
add rsp, 0x30
pop rbx
ret

Function at 0x7ff7c00f7a30
Capabilities:
Parse pe header

Disassembly:
push rbx
sub rsp, 0x30
xor ebx, ebx
test byte [0x7ff7c01d0f10], 1
jne 0x7ff7c00f7b2f
lock bts qword [0x7ff7c01d0f10], 0x1f
nop
jae 0x7ff7c00f7a75
test byte [0x7ff7c01d0f10], 1
jne 0x7ff7c00f7b2f
xor edx, edx
lea rcx, [0x7ff7c01d0f10]
call sym.ProcessHacker.exe_PhfWaitForEvent
nop dword [rax]
jmp 0x7ff7c00f7b2f
lea rcx, [0x7ff7c018b388]
call fcn.7ff7c00c47c0
mov rcx, rax
test rax, rax
jne 0x7ff7c00f7aa2
lea rcx, [0x7ff7c018b388]
call qword [sym.imp.kernel32.dll_LoadLibraryW]
mov rcx, rax
test rax, rax
je 0x7ff7c00f7b23
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x7ff7c00f7b23
mov edx, dword [rcx + 0x3c]
lea eax, [rdx - 1]
cmp eax, 0xffffffe
ja 0x7ff7c00f7b23
cmp dword [rdx + rcx], 0x4550
jne 0x7ff7c00f7b23
lea r8, ds:[rcx + 0x88]
add r8, rdx
mov eax, dword [r8]
test eax, eax
je 0x7ff7c00f7b23
cmp dword [r8 + 4], ebx
je 0x7ff7c00f7b23
lea r9, ds:[rcx + rax]
mov word [rsp + 0x28], bx
lea rax, [0x7ff7c018b368]
mov qword [rsp + 0x20], rax
call fcn.7ff7c00c4bd0
test rax, rax
je 0x7ff7c00f7b23
mov ecx, dword [0x7ffe0004]
mov rdx, qword [0x7ffe0320]
imul rcx, rdx
shr rcx, 0x18
mov ecx, ecx
mov dword [0x7ff7c01d7754], ecx
xor rcx, rax
mov qword [0x7ff7c01d77b0], rcx
lea rcx, [0x7ff7c01d0f10]
call sym.ProcessHacker.exe_PhfSetEvent
mov rcx, qword [0x7ff7c01d77b0]
test rcx, rcx
je 0x7ff7c00f7b4e
mov eax, dword [0x7ff7c01d7754]
test eax, eax
je 0x7ff7c00f7b4e
xor rax, rcx
add rsp, 0x30
pop rbx
ret
mov rax, rbx
add rsp, 0x30
pop rbx
ret
Function at 0x7ff7c00f82e0
Capabilities:
Create thread

Disassembly:
sub rsp, 0x48
mov rax, qword ds:[rsp + 0x78]
mov byte [rsp + 0x30], 0
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x70]
mov qword [rsp + 0x20], rax
call fcn.7ff7c00f8320
mov rdx, rax
lea rcx, [0x7ff7c00f8160]
add rsp, 0x48
jmp sym.ProcessHacker.exe_PhCreateThread2
Function at 0x7ff7c00fd330
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
push rdi
push r15
sub rsp, 0x28
mov rdi, rdx
mov r15, rcx
call qword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x7ff7c00fd4a1
lea rcx, [0x7ff7c018d258]
mov qword [rsp + 0x48], rbp
call qword [sym.imp.USER32.dll_RegisterClipboardFormatW]
mov ecx, eax
call qword [sym.imp.USER32.dll_GetClipboardData]
mov rbp, rax
test rax, rax
jne 0x7ff7c00fd383
lea ecx, [rax + 1]
call qword [sym.imp.USER32.dll_GetClipboardData]
mov rbp, rax
test rax, rax
je 0x7ff7c00fd496
mov qword [rsp + 0x40], rbx
mov rcx, rbp
mov qword [rsp + 0x50], rsi
mov qword [rsp + 0x58], r12
mov qword [rsp + 0x20], r14
call qword [sym.imp.kernel32.dll_GlobalLock]
mov rcx, rbp
mov r12, rax
call qword [sym.imp.kernel32.dll_GlobalSize]
mov ecx, dword [rdi + 0x1c]
mov rsi, rax
mov r9d, dword [rdi + 0x20]
mov ebx, ecx
mov r14d, dword [rdi + 0x14]
cmp ecx, r9d
jle 0x7ff7c00fd3cd
mov ebx, r9d
mov dword [rdi + 0x20], ecx
mov dword [rdi + 0x1c], ebx
mov r9d, ecx
test byte [rdi + 0x2c], 0x10
je 0x7ff7c00fd432
cmp ebx, 0xffffffff
jne 0x7ff7c00fd3fb
cmp dword [rdi + 0x18], 3
mov ebx, r14d
jne 0x7ff7c00fd3e8
lea ebx, [r14 + 1]
mov dword [rdi + 0x14], ebx
mov r9d, esi
mov r8d, ebx
mov rdx, rdi
mov rcx, r15
call fcn.7ff7c00fd5a0
jmp 0x7ff7c00fd451
mov r8d, ebx
mov rdx, rdi
mov rcx, r15
call fcn.7ff7c00fd4b0
mov r9d, esi
mov r8d, ebx
mov rdx, rdi
mov rcx, r15
call fcn.7ff7c00fd5a0
mov r9d, 0xffffffff
mov rdx, rdi
mov r8d, r9d
mov rcx, r15
call fcn.7ff7c00fcf20
nop
jmp 0x7ff7c00fd451
cmp ebx, 0xffffffff
jne 0x7ff7c00fd447
cmp dword [rdi + 0x18], 3
mov ebx, r14d
jne 0x7ff7c00fd447
lea ebx, [r14 + 1]
mov dword [rdi + 0x14], ebx
mov eax, dword [rdi + 8]
sub eax, ebx
cmp esi, eax
cmova esi, eax
mov ecx, ebx
mov rdx, r12
add rcx, qword [rdi]
mov r8d, esi
call fcn.7ff7c0125120
mov rcx, rbp
call qword [sym.imp.kernel32.dll_GlobalUnlock]
mov r9d, 0x105
mov dword [rdi + 0x14], r14d
xor r8d, r8d
xor edx, edx
mov rcx, r15
call qword [sym.imp.USER32.dll_RedrawWindow]
mov r14, qword [rsp + 0x20]
mov r12, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x40]
call qword [sym.imp.USER32.dll_CloseClipboard]
mov rbp, qword [rsp + 0x48]
add rsp, 0x28
pop r15
pop rdi
ret