joyce8/EMBER2024-capa huggingface dataset:
Function at 0x7ff7c00f51d0
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x38
test byte [0x7ff7c01d0ce0], 1
jne 0x7ff7c00f53d5
lock bts qword [0x7ff7c01d0ce0], 0x1f
jae 0x7ff7c00f5214
test byte [0x7ff7c01d0ce0], 1
jne 0x7ff7c00f53d5
xor edx, edx
lea rcx, [0x7ff7c01d0ce0]
call sym.ProcessHacker.exe_PhfWaitForEvent
movzx eax, byte [0x7ff7c01d65df]
add rsp, 0x38
ret
cmp dword [sym.ProcessHacker.exe_WindowsVersion], 0x3e
jb 0x7ff7c00f53c6
mov qword [rsp + 0x40], rbx
lea rcx, [0x7ff7c018ad68]
mov qword [rsp + 0x30], rdi
call qword [sym.imp.kernel32.dll_LoadLibraryW]
mov rdi, rax
test rax, rax
je 0x7ff7c00f5389
movzx ecx, word [rax]
mov qword [rsp + 0x48], rsi
mov esi, 0x5a4d
cmp cx, si
jne 0x7ff7c00f52b3
mov edx, dword [rax + 0x3c]
lea eax, [rdx - 1]
cmp eax, 0xffffffe
ja 0x7ff7c00f52b3
cmp dword [rdx + rdi], 0x4550
jne 0x7ff7c00f52b3
lea r8, [rdi + 0x88]
add r8, rdx
mov eax, dword [r8]
test eax, eax
je 0x7ff7c00f52a8
cmp dword [r8 + 4], 0
je 0x7ff7c00f52a8
lea r9, [rdi + rax]
xor ebx, ebx
lea rax, [0x7ff7c018ad88]
mov word [rsp + 0x28], bx
mov rcx, rdi
mov qword [rsp + 0x20], rax
call fcn.7ff7c00c4bd0
movzx ecx, word [rdi]
jmp 0x7ff7c00f52b7
xor ebx, ebx
mov qword [0x7ff7c01d7690], rbx
jmp 0x7ff7c00f52c3
xor ebx, ebx
mov eax, ebx
mov qword [0x7ff7c01d7690], rax
cmp cx, si
jne 0x7ff7c00f531d
mov edx, dword ds:[rdi + 0x3c]
lea eax, [rdx - 1]
cmp eax, 0xffffffe
ja 0x7ff7c00f531d
cmp dword [rdx + rdi], 0x4550
jne 0x7ff7c00f531d
lea r8, ds:[rdi + 0x88]
add r8, rdx
mov eax, dword [r8]
test eax, eax
je 0x7ff7c00f531d
cmp dword [r8 + 4], 0
je 0x7ff7c00f531d
lea r9, [rdi + rax]
mov word [rsp + 0x28], bx
lea rax, [0x7ff7c018adb0]
mov rcx, rdi
mov qword [rsp + 0x20], rax
call fcn.7ff7c00c4bd0
movzx ecx, word [rdi]
jmp 0x7ff7c00f5320
mov rax, rbx
cmp cx, si
mov qword [0x7ff7c01d7688], rax
mov rsi, qword [rsp + 0x48]
jne 0x7ff7c00f5380
mov ecx, dword [rdi + 0x3c]
lea eax, [rcx - 1]
cmp eax, 0xffffffe
ja 0x7ff7c00f5380
cmp dword [rcx + rdi], 0x4550
jne 0x7ff7c00f5380
lea r8, [rdi + 0x88]
add r8, rcx
mov eax, dword [r8]
test eax, eax
je 0x7ff7c00f5380
cmp dword [r8 + 4], 0
je 0x7ff7c00f5380
lea r9, [rdi + rax]
mov word [rsp + 0x28], bx
lea rax, [0x7ff7c018add0]
mov rcx, rdi
mov qword [rsp + 0x20], rax
call fcn.7ff7c00c4bd0
mov rbx, rax
mov qword [0x7ff7c01d7680], rbx
jmp 0x7ff7c00f5390
mov rbx, qword [0x7ff7c01d7680]
cmp qword [0x7ff7c01d7690], 0
mov rdi, qword [rsp + 0x30]
je 0x7ff7c00f53c1
cmp qword [0x7ff7c01d7688], 0
je 0x7ff7c00f53c1
movzx eax, byte [0x7ff7c01d65df]
test rbx, rbx
mov ecx, 1
cmovne eax, ecx
mov byte [0x7ff7c01d65df], al
mov rbx, qword [rsp + 0x40]
lea rcx, [0x7ff7c01d0ce0]
nop dword [rax]
call sym.ProcessHacker.exe_PhfSetEvent
movzx eax, byte [0x7ff7c01d65df]
add rsp, 0x38
ret
Function at 0x7ff7c00f5a20
Capabilities:
Parse pe header

Disassembly:
push rbx
sub rsp, 0x30
xor ebx, ebx
test byte [0x7ff7c01d0e20], 1
jne 0x7ff7c00f5b1f
lock bts qword [0x7ff7c01d0e20], 0x1f
nop
jae 0x7ff7c00f5a65
test byte [0x7ff7c01d0e20], 1
jne 0x7ff7c00f5b1f
xor edx, edx
lea rcx, [0x7ff7c01d0e20]
call sym.ProcessHacker.exe_PhfWaitForEvent
nop dword [rax]
jmp 0x7ff7c00f5b1f
lea rcx, [0x7ff7c01759e0]
call fcn.7ff7c00c47c0
mov rcx, rax
test rax, rax
jne 0x7ff7c00f5a92
lea rcx, [0x7ff7c01759e0]
call qword [sym.imp.kernel32.dll_LoadLibraryW]
mov rcx, rax
test rax, rax
je 0x7ff7c00f5b13
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x7ff7c00f5b13
mov edx, dword [rcx + 0x3c]
lea eax, [rdx - 1]
cmp eax, 0xffffffe
ja 0x7ff7c00f5b13
cmp dword [rdx + rcx], 0x4550
jne 0x7ff7c00f5b13
lea r8, ds:[rcx + 0x88]
add r8, rdx
mov eax, dword [r8]
test eax, eax
je 0x7ff7c00f5b13
cmp dword [r8 + 4], ebx
je 0x7ff7c00f5b13
lea r9, ds:[rcx + rax]
mov word [rsp + 0x28], bx
lea rax, [0x7ff7c018b048]
mov qword [rsp + 0x20], rax
call fcn.7ff7c00c4bd0
test rax, rax
je 0x7ff7c00f5b13
mov ecx, dword [0x7ffe0004]
mov rdx, qword [0x7ffe0320]
imul rcx, rdx
shr rcx, 0x18
mov ecx, ecx
mov dword [0x7ff7c01d76b0], ecx
xor rcx, rax
mov qword [0x7ff7c01d76a0], rcx
lea rcx, [0x7ff7c01d0e20]
call sym.ProcessHacker.exe_PhfSetEvent
mov rcx, qword [0x7ff7c01d76a0]
test rcx, rcx
je 0x7ff7c00f5b3e
mov eax, dword [0x7ff7c01d76b0]
test eax, eax
je 0x7ff7c00f5b3e
xor rax, rcx
add rsp, 0x30
pop rbx
ret
mov rax, rbx
add rsp, 0x30
pop rbx
ret

Function at 0x7ff7c00f5b50
Capabilities:
Parse pe header

Disassembly:
push rbx
sub rsp, 0x30
xor ebx, ebx
test byte [0x7ff7c01d0e90], 1
jne 0x7ff7c00f5c4f
lock bts qword [0x7ff7c01d0e90], 0x1f
nop
jae 0x7ff7c00f5b95
test byte [0x7ff7c01d0e90], 1
jne 0x7ff7c00f5c4f
xor edx, edx
lea rcx, [0x7ff7c01d0e90]
call sym.ProcessHacker.exe_PhfWaitForEvent
nop dword [rax]
jmp 0x7ff7c00f5c4f
lea rcx, [0x7ff7c01759e0]
call fcn.7ff7c00c47c0
mov rcx, rax
test rax, rax
jne 0x7ff7c00f5bc2
lea rcx, [0x7ff7c01759e0]
call qword [sym.imp.kernel32.dll_LoadLibraryW]
mov rcx, rax
test rax, rax
je 0x7ff7c00f5c43
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x7ff7c00f5c43
mov edx, dword [rcx + 0x3c]
lea eax, [rdx - 1]
cmp eax, 0xffffffe
ja 0x7ff7c00f5c43
cmp dword [rdx + rcx], 0x4550
jne 0x7ff7c00f5c43
lea r8, ds:[rcx + 0x88]
add r8, rdx
mov eax, dword [r8]
test eax, eax
je 0x7ff7c00f5c43
cmp dword [r8 + 4], ebx
je 0x7ff7c00f5c43
lea r9, ds:[rcx + rax]
mov word [rsp + 0x28], bx
lea rax, [0x7ff7c018b068]
mov qword [rsp + 0x20], rax
call fcn.7ff7c00c4bd0
test rax, rax
je 0x7ff7c00f5c43
mov ecx, dword [0x7ffe0004]
mov rdx, qword [0x7ffe0320]
imul rcx, rdx
shr rcx, 0x18
mov ecx, ecx
mov dword [0x7ff7c01d7738], ecx
xor rcx, rax
mov qword [0x7ff7c01d7790], rcx
lea rcx, [0x7ff7c01d0e90]
call sym.ProcessHacker.exe_PhfSetEvent
mov rcx, qword [0x7ff7c01d7790]
test rcx, rcx
je 0x7ff7c00f5c6e
mov eax, dword [0x7ff7c01d7738]
test eax, eax
je 0x7ff7c00f5c6e
xor rax, rcx
add rsp, 0x30
pop rbx
ret
mov rax, rbx
add rsp, 0x30
pop rbx
ret
Function at 0x7ff7c00f5c80
Capabilities:
Parse pe header

Disassembly:
push rbx
sub rsp, 0x30
xor ebx, ebx
test byte [0x7ff7c01d0e70], 1
jne 0x7ff7c00f5d7f
lock bts qword [0x7ff7c01d0e70], 0x1f
nop
jae 0x7ff7c00f5cc5
test byte [0x7ff7c01d0e70], 1
jne 0x7ff7c00f5d7f
xor edx, edx
lea rcx, [0x7ff7c01d0e70]
call sym.ProcessHacker.exe_PhfWaitForEvent
nop dword [rax]
jmp 0x7ff7c00f5d7f
lea rcx, [0x7ff7c01759e0]
call fcn.7ff7c00c47c0
mov rcx, rax
test rax, rax
jne 0x7ff7c00f5cf2
lea rcx, [0x7ff7c01759e0]
call qword [sym.imp.kernel32.dll_LoadLibraryW]
mov rcx, rax
test rax, rax
je 0x7ff7c00f5d73
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x7ff7c00f5d73
mov edx, dword [rcx + 0x3c]
lea eax, [rdx - 1]
cmp eax, 0xffffffe
ja 0x7ff7c00f5d73
cmp dword [rdx + rcx], 0x4550
jne 0x7ff7c00f5d73
lea r8, ds:[rcx + 0x88]
add r8, rdx
mov eax, dword [r8]
test eax, eax
je 0x7ff7c00f5d73
cmp dword [r8 + 4], ebx
je 0x7ff7c00f5d73
lea r9, ds:[rcx + rax]
mov word [rsp + 0x28], bx
lea rax, [0x7ff7c018b090]
mov qword [rsp + 0x20], rax
call fcn.7ff7c00c4bd0
test rax, rax
je 0x7ff7c00f5d73
mov ecx, dword [0x7ffe0004]
mov rdx, qword [0x7ffe0320]
imul rcx, rdx
shr rcx, 0x18
mov ecx, ecx
mov dword [0x7ff7c01d7750], ecx
xor rcx, rax
mov qword [0x7ff7c01d76d0], rcx
lea rcx, [0x7ff7c01d0e70]
call sym.ProcessHacker.exe_PhfSetEvent
mov rcx, qword [0x7ff7c01d76d0]
test rcx, rcx
je 0x7ff7c00f5d9e
mov eax, dword [0x7ff7c01d7750]
test eax, eax
je 0x7ff7c00f5d9e
xor rax, rcx
add rsp, 0x30
pop rbx
ret
mov rax, rbx
add rsp, 0x30
pop rbx
ret

Function at 0x7ff7c00f5db0
Capabilities:
Parse pe header

Disassembly:
push rbx
sub rsp, 0x30
xor ebx, ebx
test byte [0x7ff7c01d0ee0], 1
jne 0x7ff7c00f5eaf
lock bts qword [0x7ff7c01d0ee0], 0x1f
nop
jae 0x7ff7c00f5df5
test byte [0x7ff7c01d0ee0], 1
jne 0x7ff7c00f5eaf
xor edx, edx
lea rcx, [0x7ff7c01d0ee0]
call sym.ProcessHacker.exe_PhfWaitForEvent
nop dword [rax]
jmp 0x7ff7c00f5eaf
lea rcx, [0x7ff7c01759e0]
call fcn.7ff7c00c47c0
mov rcx, rax
test rax, rax
jne 0x7ff7c00f5e22
lea rcx, [0x7ff7c01759e0]
call qword [sym.imp.kernel32.dll_LoadLibraryW]
mov rcx, rax
test rax, rax
je 0x7ff7c00f5ea3
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x7ff7c00f5ea3
mov edx, dword [rcx + 0x3c]
lea eax, [rdx - 1]
cmp eax, 0xffffffe
ja 0x7ff7c00f5ea3
cmp dword [rdx + rcx], 0x4550
jne 0x7ff7c00f5ea3
lea r8, ds:[rcx + 0x88]
add r8, rdx
mov eax, dword [r8]
test eax, eax
je 0x7ff7c00f5ea3
cmp dword [r8 + 4], ebx
je 0x7ff7c00f5ea3
lea r9, ds:[rcx + rax]
mov word [rsp + 0x28], bx
lea rax, [0x7ff7c018b0b0]
mov qword [rsp + 0x20], rax
call fcn.7ff7c00c4bd0
test rax, rax
je 0x7ff7c00f5ea3
mov ecx, dword [0x7ffe0004]
mov rdx, qword [0x7ffe0320]
imul rcx, rdx
shr rcx, 0x18
mov ecx, ecx
mov dword [0x7ff7c01d6a8c], ecx
xor rcx, rax
mov qword [0x7ff7c01d77b8], rcx
lea rcx, [0x7ff7c01d0ee0]
call sym.ProcessHacker.exe_PhfSetEvent
mov rcx, qword [0x7ff7c01d77b8]
test rcx, rcx
je 0x7ff7c00f5ece
mov eax, dword [0x7ff7c01d6a8c]
test eax, eax
je 0x7ff7c00f5ece
xor rax, rcx
add rsp, 0x30
pop rbx
ret
mov rax, rbx
add rsp, 0x30
pop rbx
ret
Function at 0x7ff7c00f5ee0
Capabilities:
Parse pe header

Disassembly:
push rbx
sub rsp, 0x30
xor ebx, ebx
test byte [0x7ff7c01d0df0], 1
jne 0x7ff7c00f5fdf
lock bts qword [0x7ff7c01d0df0], 0x1f
nop
jae 0x7ff7c00f5f25
test byte [0x7ff7c01d0df0], 1
jne 0x7ff7c00f5fdf
xor edx, edx
lea rcx, [0x7ff7c01d0df0]
call sym.ProcessHacker.exe_PhfWaitForEvent
nop dword [rax]
jmp 0x7ff7c00f5fdf
lea rcx, [0x7ff7c01759e0]
call fcn.7ff7c00c47c0
mov rcx, rax
test rax, rax
jne 0x7ff7c00f5f52
lea rcx, [0x7ff7c01759e0]
call qword [sym.imp.kernel32.dll_LoadLibraryW]
mov rcx, rax
test rax, rax
je 0x7ff7c00f5fd3
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x7ff7c00f5fd3
mov edx, dword [rcx + 0x3c]
lea eax, [rdx - 1]
cmp eax, 0xffffffe
ja 0x7ff7c00f5fd3
cmp dword [rdx + rcx], 0x4550
jne 0x7ff7c00f5fd3
lea r8, ds:[rcx + 0x88]
add r8, rdx
mov eax, dword [r8]
test eax, eax
je 0x7ff7c00f5fd3
cmp dword [r8 + 4], ebx
je 0x7ff7c00f5fd3
lea r9, ds:[rcx + rax]
mov word [rsp + 0x28], bx
lea rax, [0x7ff7c018b0d8]
mov qword [rsp + 0x20], rax
call fcn.7ff7c00c4bd0
test rax, rax
je 0x7ff7c00f5fd3
mov ecx, dword [0x7ffe0004]
mov rdx, qword [0x7ffe0320]
imul rcx, rdx
shr rcx, 0x18
mov ecx, ecx
mov dword [0x7ff7c01d7760], ecx
xor rcx, rax
mov qword [0x7ff7c01d7708], rcx
lea rcx, [0x7ff7c01d0df0]
call sym.ProcessHacker.exe_PhfSetEvent
mov rcx, qword [0x7ff7c01d7708]
test rcx, rcx
je 0x7ff7c00f5ffe
mov eax, dword [0x7ff7c01d7760]
test eax, eax
je 0x7ff7c00f5ffe
xor rax, rcx
add rsp, 0x30
pop rbx
ret
mov rax, rbx
add rsp, 0x30
pop rbx
ret

Function at 0x7ff7c00f6010
Capabilities:
Parse pe header

Disassembly:
push rbx
sub rsp, 0x30
xor ebx, ebx
test byte [0x7ff7c01d0e40], 1
jne 0x7ff7c00f610f
lock bts qword [0x7ff7c01d0e40], 0x1f
nop
jae 0x7ff7c00f6055
test byte [0x7ff7c01d0e40], 1
jne 0x7ff7c00f610f
xor edx, edx
lea rcx, [0x7ff7c01d0e40]
call sym.ProcessHacker.exe_PhfWaitForEvent
nop dword [rax]
jmp 0x7ff7c00f610f
lea rcx, [0x7ff7c01759e0]
call fcn.7ff7c00c47c0
mov rcx, rax
test rax, rax
jne 0x7ff7c00f6082
lea rcx, [0x7ff7c01759e0]
call qword [sym.imp.kernel32.dll_LoadLibraryW]
mov rcx, rax
test rax, rax
je 0x7ff7c00f6103
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x7ff7c00f6103
mov edx, dword [rcx + 0x3c]
lea eax, [rdx - 1]
cmp eax, 0xffffffe
ja 0x7ff7c00f6103
cmp dword [rdx + rcx], 0x4550
jne 0x7ff7c00f6103
lea r8, ds:[rcx + 0x88]
add r8, rdx
mov eax, dword [r8]
test eax, eax
je 0x7ff7c00f6103
cmp dword [r8 + 4], ebx
je 0x7ff7c00f6103
lea r9, ds:[rcx + rax]
mov word [rsp + 0x28], bx
lea rax, [0x7ff7c018b0f0]
mov qword [rsp + 0x20], rax
call fcn.7ff7c00c4bd0
test rax, rax
je 0x7ff7c00f6103
mov ecx, dword [0x7ffe0004]
mov rdx, qword [0x7ffe0320]
imul rcx, rdx
shr rcx, 0x18
mov ecx, ecx
mov dword [0x7ff7c01d7770], ecx
xor rcx, rax
mov qword [0x7ff7c01d7758], rcx
lea rcx, [0x7ff7c01d0e40]
call sym.ProcessHacker.exe_PhfSetEvent
mov rcx, qword [0x7ff7c01d7758]
test rcx, rcx
je 0x7ff7c00f612e
mov eax, dword [0x7ff7c01d7770]
test eax, eax
je 0x7ff7c00f612e
xor rax, rcx
add rsp, 0x30
pop rbx
ret
mov rax, rbx
add rsp, 0x30
pop rbx
ret
Function at 0x7ff7c00f6140
Capabilities:
Parse pe header

Disassembly:
push rbx
sub rsp, 0x30
xor ebx, ebx
test byte [0x7ff7c01d0ea0], 1
jne 0x7ff7c00f623f
lock bts qword [0x7ff7c01d0ea0], 0x1f
nop
jae 0x7ff7c00f6185
test byte [0x7ff7c01d0ea0], 1
jne 0x7ff7c00f623f
xor edx, edx
lea rcx, [0x7ff7c01d0ea0]
call sym.ProcessHacker.exe_PhfWaitForEvent
nop dword [rax]
jmp 0x7ff7c00f623f
lea rcx, [0x7ff7c01759e0]
call fcn.7ff7c00c47c0
mov rcx, rax
test rax, rax
jne 0x7ff7c00f61b2
lea rcx, [0x7ff7c01759e0]
call qword [sym.imp.kernel32.dll_LoadLibraryW]
mov rcx, rax
test rax, rax
je 0x7ff7c00f6233
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x7ff7c00f6233
mov edx, dword [rcx + 0x3c]
lea eax, [rdx - 1]
cmp eax, 0xffffffe
ja 0x7ff7c00f6233
cmp dword [rdx + rcx], 0x4550
jne 0x7ff7c00f6233
lea r8, ds:[rcx + 0x88]
add r8, rdx
mov eax, dword [r8]
test eax, eax
je 0x7ff7c00f6233
cmp dword [r8 + 4], ebx
je 0x7ff7c00f6233
lea r9, ds:[rcx + rax]
mov word [rsp + 0x28], bx
lea rax, [0x7ff7c018b100]
mov qword [rsp + 0x20], rax
call fcn.7ff7c00c4bd0
test rax, rax
je 0x7ff7c00f6233
mov ecx, dword [0x7ffe0004]
mov rdx, qword [0x7ffe0320]
imul rcx, rdx
shr rcx, 0x18
mov ecx, ecx
mov dword [0x7ff7c01d77dc], ecx
xor rcx, rax
mov qword [0x7ff7c01d76a8], rcx
lea rcx, [0x7ff7c01d0ea0]
call sym.ProcessHacker.exe_PhfSetEvent
mov rcx, qword [0x7ff7c01d76a8]
test rcx, rcx
je 0x7ff7c00f625e
mov eax, dword [0x7ff7c01d77dc]
test eax, eax
je 0x7ff7c00f625e
xor rax, rcx
add rsp, 0x30
pop rbx
ret
mov rax, rbx
add rsp, 0x30
pop rbx
ret

Function at 0x7ff7c00f6270
Capabilities:
Parse pe header

Disassembly:
push rbx
sub rsp, 0x30
xor ebx, ebx
test byte [0x7ff7c01d0de0], 1
jne 0x7ff7c00f636f
lock bts qword [0x7ff7c01d0de0], 0x1f
nop
jae 0x7ff7c00f62b5
test byte [0x7ff7c01d0de0], 1
jne 0x7ff7c00f636f
xor edx, edx
lea rcx, [0x7ff7c01d0de0]
call sym.ProcessHacker.exe_PhfWaitForEvent
nop dword [rax]
jmp 0x7ff7c00f636f
lea rcx, [0x7ff7c01759e0]
call fcn.7ff7c00c47c0
mov rcx, rax
test rax, rax
jne 0x7ff7c00f62e2
lea rcx, [0x7ff7c01759e0]
call qword [sym.imp.kernel32.dll_LoadLibraryW]
mov rcx, rax
test rax, rax
je 0x7ff7c00f6363
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x7ff7c00f6363
mov edx, dword [rcx + 0x3c]
lea eax, [rdx - 1]
cmp eax, 0xffffffe
ja 0x7ff7c00f6363
cmp dword [rdx + rcx], 0x4550
jne 0x7ff7c00f6363
lea r8, ds:[rcx + 0x88]
add r8, rdx
mov eax, dword [r8]
test eax, eax
je 0x7ff7c00f6363
cmp dword [r8 + 4], ebx
je 0x7ff7c00f6363
lea r9, ds:[rcx + rax]
mov word [rsp + 0x28], bx
lea rax, [0x7ff7c018b118]
mov qword [rsp + 0x20], rax
call fcn.7ff7c00c4bd0
test rax, rax
je 0x7ff7c00f6363
mov ecx, dword [0x7ffe0004]
mov rdx, qword [0x7ffe0320]
imul rcx, rdx
shr rcx, 0x18
mov ecx, ecx
mov dword [0x7ff7c01d77c8], ecx
xor rcx, rax
mov qword [0x7ff7c01d7718], rcx
lea rcx, [0x7ff7c01d0de0]
call sym.ProcessHacker.exe_PhfSetEvent
mov rcx, qword [0x7ff7c01d7718]
test rcx, rcx
je 0x7ff7c00f638e
mov eax, dword [0x7ff7c01d77c8]
test eax, eax
je 0x7ff7c00f638e
xor rax, rcx
add rsp, 0x30
pop rbx
ret
mov rax, rbx
add rsp, 0x30
pop rbx
ret
Function at 0x7ff7c00f63a0
Capabilities:
Parse pe header

Disassembly:
push rbx
sub rsp, 0x30
xor ebx, ebx
test byte [0x7ff7c01d0d60], 1
jne 0x7ff7c00f649f
lock bts qword [0x7ff7c01d0d60], 0x1f
nop
jae 0x7ff7c00f63e5
test byte [0x7ff7c01d0d60], 1
jne 0x7ff7c00f649f
xor edx, edx
lea rcx, [0x7ff7c01d0d60]
call sym.ProcessHacker.exe_PhfWaitForEvent
nop dword [rax]
jmp 0x7ff7c00f649f
lea rcx, [0x7ff7c01759e0]
call fcn.7ff7c00c47c0
mov rcx, rax
test rax, rax
jne 0x7ff7c00f6412
lea rcx, [0x7ff7c01759e0]
call qword [sym.imp.kernel32.dll_LoadLibraryW]
mov rcx, rax
test rax, rax
je 0x7ff7c00f6493
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x7ff7c00f6493
mov edx, dword [rcx + 0x3c]
lea eax, [rdx - 1]
cmp eax, 0xffffffe
ja 0x7ff7c00f6493
cmp dword [rdx + rcx], 0x4550
jne 0x7ff7c00f6493
lea r8, ds:[rcx + 0x88]
add r8, rdx
mov eax, dword [r8]
test eax, eax
je 0x7ff7c00f6493
cmp dword [r8 + 4], ebx
je 0x7ff7c00f6493
lea r9, ds:[rcx + rax]
mov word [rsp + 0x28], bx
lea rax, [0x7ff7c018b128]
mov qword [rsp + 0x20], rax
call fcn.7ff7c00c4bd0
test rax, rax
je 0x7ff7c00f6493
mov ecx, dword [0x7ffe0004]
mov rdx, qword [0x7ffe0320]
imul rcx, rdx
shr rcx, 0x18
mov ecx, ecx
mov dword [0x7ff7c01d777c], ecx
xor rcx, rax
mov qword [0x7ff7c01d7720], rcx
lea rcx, [0x7ff7c01d0d60]
call sym.ProcessHacker.exe_PhfSetEvent
mov rcx, qword [0x7ff7c01d7720]
test rcx, rcx
je 0x7ff7c00f64be
mov eax, dword [0x7ff7c01d777c]
test eax, eax
je 0x7ff7c00f64be
xor rax, rcx
add rsp, 0x30
pop rbx
ret
mov rax, rbx
add rsp, 0x30
pop rbx
ret

Function at 0x7ff7c00f64d0
Capabilities:
Parse pe header

Disassembly:
push rbx
sub rsp, 0x30
xor ebx, ebx
test byte [0x7ff7c01d0d80], 1
jne 0x7ff7c00f65cf
lock bts qword [0x7ff7c01d0d80], 0x1f
nop
jae 0x7ff7c00f6515
test byte [0x7ff7c01d0d80], 1
jne 0x7ff7c00f65cf
xor edx, edx
lea rcx, [0x7ff7c01d0d80]
call sym.ProcessHacker.exe_PhfWaitForEvent
nop dword [rax]
jmp 0x7ff7c00f65cf
lea rcx, [0x7ff7c01759e0]
call fcn.7ff7c00c47c0
mov rcx, rax
test rax, rax
jne 0x7ff7c00f6542
lea rcx, [0x7ff7c01759e0]
call qword [sym.imp.kernel32.dll_LoadLibraryW]
mov rcx, rax
test rax, rax
je 0x7ff7c00f65c3
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x7ff7c00f65c3
mov edx, dword [rcx + 0x3c]
lea eax, [rdx - 1]
cmp eax, 0xffffffe
ja 0x7ff7c00f65c3
cmp dword [rdx + rcx], 0x4550
jne 0x7ff7c00f65c3
lea r8, ds:[rcx + 0x88]
add r8, rdx
mov eax, dword [r8]
test eax, eax
je 0x7ff7c00f65c3
cmp dword [r8 + 4], ebx
je 0x7ff7c00f65c3
lea r9, ds:[rcx + rax]
mov word [rsp + 0x28], bx
lea rax, [0x7ff7c018b148]
mov qword [rsp + 0x20], rax
call fcn.7ff7c00c4bd0
test rax, rax
je 0x7ff7c00f65c3
mov ecx, dword [0x7ffe0004]
mov rdx, qword [0x7ffe0320]
imul rcx, rdx
shr rcx, 0x18
mov ecx, ecx
mov dword [0x7ff7c01d773c], ecx
xor rcx, rax
mov qword [0x7ff7c01d7700], rcx
lea rcx, [0x7ff7c01d0d80]
call sym.ProcessHacker.exe_PhfSetEvent
mov rcx, qword [0x7ff7c01d7700]
test rcx, rcx
je 0x7ff7c00f65ee
mov eax, dword [0x7ff7c01d773c]
test eax, eax
je 0x7ff7c00f65ee
xor rax, rcx
add rsp, 0x30
pop rbx
ret
mov rax, rbx
add rsp, 0x30
pop rbx
ret
Function at 0x7ff7c00f6600
Capabilities:
Parse pe header

Disassembly:
push rbx
sub rsp, 0x30
xor ebx, ebx
test byte [0x7ff7c01d0db0], 1
jne 0x7ff7c00f66ff
lock bts qword [0x7ff7c01d0db0], 0x1f
nop
jae 0x7ff7c00f6645
test byte [0x7ff7c01d0db0], 1
jne 0x7ff7c00f66ff
xor edx, edx
lea rcx, [0x7ff7c01d0db0]
call sym.ProcessHacker.exe_PhfWaitForEvent
nop dword [rax]
jmp 0x7ff7c00f66ff
lea rcx, [0x7ff7c01759e0]
call fcn.7ff7c00c47c0
mov rcx, rax
test rax, rax
jne 0x7ff7c00f6672
lea rcx, [0x7ff7c01759e0]
call qword [sym.imp.kernel32.dll_LoadLibraryW]
mov rcx, rax
test rax, rax
je 0x7ff7c00f66f3
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x7ff7c00f66f3
mov edx, dword [rcx + 0x3c]
lea eax, [rdx - 1]
cmp eax, 0xffffffe
ja 0x7ff7c00f66f3
cmp dword [rdx + rcx], 0x4550
jne 0x7ff7c00f66f3
lea r8, ds:[rcx + 0x88]
add r8, rdx
mov eax, dword [r8]
test eax, eax
je 0x7ff7c00f66f3
cmp dword [r8 + 4], ebx
je 0x7ff7c00f66f3
lea r9, ds:[rcx + rax]
mov word [rsp + 0x28], bx
lea rax, [0x7ff7c018b170]
mov qword [rsp + 0x20], rax
call fcn.7ff7c00c4bd0
test rax, rax
je 0x7ff7c00f66f3
mov ecx, dword [0x7ffe0004]
mov rdx, qword [0x7ffe0320]
imul rcx, rdx
shr rcx, 0x18
mov ecx, ecx
mov dword [0x7ff7c01d76e0], ecx
xor rcx, rax
mov qword [0x7ff7c01d77d0], rcx
lea rcx, [0x7ff7c01d0db0]
call sym.ProcessHacker.exe_PhfSetEvent
mov rcx, qword [0x7ff7c01d77d0]
test rcx, rcx
je 0x7ff7c00f671e
mov eax, dword [0x7ff7c01d76e0]
test eax, eax
je 0x7ff7c00f671e
xor rax, rcx
add rsp, 0x30
pop rbx
ret
mov rax, rbx
add rsp, 0x30
pop rbx
ret

Function at 0x7ff7c00f6730
Capabilities:
Parse pe header

Disassembly:
push rbx
sub rsp, 0x30
xor ebx, ebx
test byte [0x7ff7c01d0dc0], 1
jne 0x7ff7c00f682f
lock bts qword [0x7ff7c01d0dc0], 0x1f
nop
jae 0x7ff7c00f6775
test byte [0x7ff7c01d0dc0], 1
jne 0x7ff7c00f682f
xor edx, edx
lea rcx, [0x7ff7c01d0dc0]
call sym.ProcessHacker.exe_PhfWaitForEvent
nop dword [rax]
jmp 0x7ff7c00f682f
lea rcx, [0x7ff7c01759e0]
call fcn.7ff7c00c47c0
mov rcx, rax
test rax, rax
jne 0x7ff7c00f67a2
lea rcx, [0x7ff7c01759e0]
call qword [sym.imp.kernel32.dll_LoadLibraryW]
mov rcx, rax
test rax, rax
je 0x7ff7c00f6823
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x7ff7c00f6823
mov edx, dword [rcx + 0x3c]
lea eax, [rdx - 1]
cmp eax, 0xffffffe
ja 0x7ff7c00f6823
cmp dword [rdx + rcx], 0x4550
jne 0x7ff7c00f6823
lea r8, ds:[rcx + 0x88]
add r8, rdx
mov eax, dword [r8]
test eax, eax
je 0x7ff7c00f6823
cmp dword [r8 + 4], ebx
je 0x7ff7c00f6823
lea r9, ds:[rcx + rax]
mov word [rsp + 0x28], bx
lea rax, [0x7ff7c018b190]
mov qword [rsp + 0x20], rax
call fcn.7ff7c00c4bd0
test rax, rax
je 0x7ff7c00f6823
mov ecx, dword [0x7ffe0004]
mov rdx, qword [0x7ffe0320]
imul rcx, rdx
shr rcx, 0x18
mov ecx, ecx
mov dword [0x7ff7c01d7764], ecx
xor rcx, rax
mov qword [0x7ff7c01d77a8], rcx
lea rcx, [0x7ff7c01d0dc0]
call sym.ProcessHacker.exe_PhfSetEvent
mov rcx, qword [0x7ff7c01d77a8]
test rcx, rcx
je 0x7ff7c00f684e
mov eax, dword [0x7ff7c01d7764]
test eax, eax
je 0x7ff7c00f684e
xor rax, rcx
add rsp, 0x30
pop rbx
ret
mov rax, rbx
add rsp, 0x30
pop rbx
ret
Function at 0x7ff7c00f6860
Capabilities:
Parse pe header

Disassembly:
push rbx
sub rsp, 0x30
xor ebx, ebx
test byte [0x7ff7c01d0e10], 1
jne 0x7ff7c00f695f
lock bts qword [0x7ff7c01d0e10], 0x1f
nop
jae 0x7ff7c00f68a5
test byte [0x7ff7c01d0e10], 1
jne 0x7ff7c00f695f
xor edx, edx
lea rcx, [0x7ff7c01d0e10]
call sym.ProcessHacker.exe_PhfWaitForEvent
nop dword [rax]
jmp 0x7ff7c00f695f
lea rcx, [0x7ff7c01759e0]
call fcn.7ff7c00c47c0
mov rcx, rax
test rax, rax
jne 0x7ff7c00f68d2
lea rcx, [0x7ff7c01759e0]
call qword [sym.imp.kernel32.dll_LoadLibraryW]
mov rcx, rax
test rax, rax
je 0x7ff7c00f6953
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x7ff7c00f6953
mov edx, dword [rcx + 0x3c]
lea eax, [rdx - 1]
cmp eax, 0xffffffe
ja 0x7ff7c00f6953
cmp dword [rdx + rcx], 0x4550
jne 0x7ff7c00f6953
lea r8, ds:[rcx + 0x88]
add r8, rdx
mov eax, dword [r8]
test eax, eax
je 0x7ff7c00f6953
cmp dword [r8 + 4], ebx
je 0x7ff7c00f6953
lea r9, ds:[rcx + rax]
mov word [rsp + 0x28], bx
lea rax, [0x7ff7c018b1b0]
mov qword [rsp + 0x20], rax
call fcn.7ff7c00c4bd0
test rax, rax
je 0x7ff7c00f6953
mov ecx, dword [0x7ffe0004]
mov rdx, qword [0x7ffe0320]
imul rcx, rdx
shr rcx, 0x18
mov ecx, ecx
mov dword [0x7ff7c01d77a4], ecx
xor rcx, rax
mov qword [0x7ff7c01d7780], rcx
lea rcx, [0x7ff7c01d0e10]
call sym.ProcessHacker.exe_PhfSetEvent
mov rcx, qword [0x7ff7c01d7780]
test rcx, rcx
je 0x7ff7c00f697e
mov eax, dword [0x7ff7c01d77a4]
test eax, eax
je 0x7ff7c00f697e
xor rax, rcx
add rsp, 0x30
pop rbx
ret
mov rax, rbx
add rsp, 0x30
pop rbx
ret

Function at 0x7ff7c00f6990
Capabilities:
Parse pe header

Disassembly:
push rbx
sub rsp, 0x30
xor ebx, ebx
test byte [0x7ff7c01d0d70], 1
jne 0x7ff7c00f6a8f
lock bts qword [0x7ff7c01d0d70], 0x1f
nop
jae 0x7ff7c00f69d5
test byte [0x7ff7c01d0d70], 1
jne 0x7ff7c00f6a8f
xor edx, edx
lea rcx, [0x7ff7c01d0d70]
call sym.ProcessHacker.exe_PhfWaitForEvent
nop dword [rax]
jmp 0x7ff7c00f6a8f
lea rcx, [0x7ff7c0189888]
call fcn.7ff7c00c47c0
mov rcx, rax
test rax, rax
jne 0x7ff7c00f6a02
lea rcx, [0x7ff7c0189888]
call qword [sym.imp.kernel32.dll_LoadLibraryW]
mov rcx, rax
test rax, rax
je 0x7ff7c00f6a83
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x7ff7c00f6a83
mov edx, dword [rcx + 0x3c]
lea eax, [rdx - 1]
cmp eax, 0xffffffe
ja 0x7ff7c00f6a83
cmp dword [rdx + rcx], 0x4550
jne 0x7ff7c00f6a83
lea r8, ds:[rcx + 0x88]
add r8, rdx
mov eax, dword [r8]
test eax, eax
je 0x7ff7c00f6a83
cmp dword [r8 + 4], ebx
je 0x7ff7c00f6a83
lea r9, ds:[rcx + rax]
mov word [rsp + 0x28], bx
lea rax, [0x7ff7c018b1d0]
mov qword [rsp + 0x20], rax
call fcn.7ff7c00c4bd0
test rax, rax
je 0x7ff7c00f6a83
mov ecx, dword [0x7ffe0004]
mov rdx, qword [0x7ffe0320]
imul rcx, rdx
shr rcx, 0x18
mov ecx, ecx
mov dword [0x7ff7c01d7734], ecx
xor rcx, rax
mov qword [0x7ff7c01d76c8], rcx
lea rcx, [0x7ff7c01d0d70]
call sym.ProcessHacker.exe_PhfSetEvent
mov rcx, qword [0x7ff7c01d76c8]
test rcx, rcx
je 0x7ff7c00f6aae
mov eax, dword [0x7ff7c01d7734]
test eax, eax
je 0x7ff7c00f6aae
xor rax, rcx
add rsp, 0x30
pop rbx
ret
mov rax, rbx
add rsp, 0x30
pop rbx
ret