joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14001c3f0
Capabilities:
Get system information on windows
Make suspicious ntquerysysteminformation call

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rdi
sub rsp, 0x20
mov ebx, dword [0x1400d1f2c]
mov rbp, rcx
mov rcx, qword [0x1400d8fb0]
mov r8, rbx
xor edx, edx
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov rdi, rax
test rax, rax
jne 0x14001c42e
mov ecx, 0xc000009a
call qword [sym.imp.ntdll.dll_RtlRaiseStatus]
int3
xor r9d, r9d
mov r8d, ebx
mov rdx, rax
lea ecx, [r9 + 0x40]
mov qword [rsp + 0x30], rsi
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
mov esi, eax
cmp eax, 0xc0000004
jne 0x14001c4a2
nop
mov rcx, qword [0x1400d8fb0]
mov r8, rdi
xor edx, edx
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
add ebx, ebx
cmp ebx, 0x1000000
ja 0x14001c4c6
mov rcx, qword [0x1400d8fb0]
mov r8d, ebx
xor edx, edx
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov rdi, rax
test rax, rax
je 0x14001c4ba
xor r9d, r9d
mov r8d, ebx
mov rdx, rax
lea ecx, [r9 + 0x40]
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
mov esi, eax
cmp eax, 0xc0000004
je 0x14001c450
test esi, esi
jns 0x14001c4cd
mov rcx, qword [0x1400d8fb0]
mov r8, rdi
xor edx, edx
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
jmp 0x14001c4e6
mov ecx, 0xc000009a
call qword [sym.imp.ntdll.dll_RtlRaiseStatus]
int3
mov eax, 0xc000009a
jmp 0x14001c4e8
mov eax, dword [0x1400d1f2c]
cmp ebx, 0x200000
mov qword [rbp], rdi
cmovbe eax, ebx
mov dword [0x1400d1f2c], eax
mov eax, esi
mov rsi, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret

Function at 0x14001c500
Capabilities:
Get system information on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rdi
sub rsp, 0x20
mov rbp, rcx
mov rcx, qword [0x1400d8fb0]
mov edi, 0x200
mov r8, rdi
xor edx, edx
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov rbx, rax
test rax, rax
jne 0x14001c53d
mov ecx, 0xc000009a
call qword [sym.imp.ntdll.dll_RtlRaiseStatus]
int3
xor r9d, r9d
mov r8d, edi
mov rdx, rax
lea ecx, [r9 + 0x12]
mov qword [rsp + 0x30], rsi
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
mov esi, eax
cmp eax, 0xc0000004
jne 0x14001c5b8
nop
mov rcx, qword [0x1400d8fb0]
mov r8, rbx
xor edx, edx
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
lea r11d, [rdi + rdi]
mov edi, r11d
cmp r11d, 0x1000000
ja 0x14001c5dc
mov rcx, qword [0x1400d8fb0]
mov r8, rdi
xor edx, edx
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov rbx, rax
test rax, rax
je 0x14001c5d0
xor r9d, r9d
mov r8d, edi
mov rdx, rax
lea ecx, [r9 + 0x12]
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
mov esi, eax
cmp eax, 0xc0000004
je 0x14001c560
test esi, esi
jns 0x14001c5e3
mov rcx, qword [0x1400d8fb0]
mov r8, rbx
xor edx, edx
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
jmp 0x14001c5e7
mov ecx, 0xc000009a
call qword [sym.imp.ntdll.dll_RtlRaiseStatus]
int3
mov eax, 0xc000009a
jmp 0x14001c5e9
mov qword [rbp], rbx
mov eax, esi
mov rsi, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x14001c600
Capabilities:
Get system information on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x40
mov rdi, rcx
mov rcx, qword [0x1400d8fb0]
mov rsi, rdx
mov ebp, pe_nt_image_headers64
xor edx, edx
mov r8, rbp
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov rbx, rax
test rax, rax
jne 0x14001c645
mov ecx, 0xc000009a
call qword [sym.imp.ntdll.dll_RtlRaiseStatus]
int3
xor eax, eax
lea rdx, [rsp + 0x20]
xor r9d, r9d
lea r8d, [rax + 0x18]
lea ecx, [rax + 0x58]
mov qword [rsp + 0x20], rdi
mov word [rsp + 0x28], ax
mov word [rsp + 0x2a], bp
mov qword [rsp + 0x30], rbx
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
mov edi, eax
cmp eax, 0xc0000004
jne 0x14001c6d1
mov rcx, qword [0x1400d8fb0]
mov r8, rbx
xor edx, edx
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
movzx r8d, word [rsp + 0x2a]
mov rcx, qword [0x1400d8fb0]
xor edx, edx
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov rbx, rax
test rax, rax
jne 0x14001c6b4
mov ecx, 0xc000009a
call qword [sym.imp.ntdll.dll_RtlRaiseStatus]
int3
xor r9d, r9d
lea rdx, [rsp + 0x20]
mov qword [rsp + 0x30], rax
lea r8d, [r9 + 0x18]
lea ecx, [r9 + 0x58]
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
mov edi, eax
test edi, edi
js 0x14001c6e7
movzx edx, word [rsp + 0x28]
mov rcx, qword [rsp + 0x30]
call sym.ProcessHacker.exe_PhCreateStringEx
mov qword [rsi], rax
mov rcx, qword [0x1400d8fb0]
mov r8, rbx
xor edx, edx
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov eax, edi
add rsp, 0x40
pop rdi
ret
Function at 0x14001cf80
Capabilities:
Get file attributes

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
mov qword [rsp + 0x10], rdx
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x70
mov r12, rcx
mov rcx, qword [0x1400d8fb0]
mov r15, r8
mov rbx, rdx
mov r13d, 0x400
xor edx, edx
mov r8, r13
mov r14, r9
mov dil, 1
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov rbp, rax
test rax, rax
jne 0x14001cfd7
mov ecx, 0xc000009a
call qword [sym.imp.ntdll.dll_RtlRaiseStatus]
int3
mov qword [rsp + 0xa0], rsi
nop
mov byte [rsp + 0x50], dil
mov qword [rsp + 0x48], rbx
mov byte [rsp + 0x40], 0
mov dword [rsp + 0x38], 1
lea rax, [rsp + 0x60]
mov dword [rsp + 0x30], r13d
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, r12
mov qword [rsp + 0x28], rbp
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntdll.dll_NtQueryDirectoryFile]
mov ebx, eax
cmp eax, 0x103
jne 0x14001d037
xor r8d, r8d
xor edx, edx
mov rcx, r12
call qword [sym.imp.ntdll.dll_NtWaitForSingleObject]
mov ebx, dword [rsp + 0x60]
cmp ebx, 0x80000005
je 0x14001d047
cmp ebx, 0xc0000004
jne 0x14001d08c
mov rcx, qword [0x1400d8fb0]
mov r8, rbp
xor edx, edx
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
mov rcx, qword [0x1400d8fb0]
lea r11d, [r13 + r13]
mov r8d, r11d
xor edx, edx
mov r13d, r11d
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov rbp, rax
test rax, rax
je 0x14001d114
mov rbx, qword [rsp + 0xa8]
jmp 0x14001cfe0
cmp ebx, 0x80000006
je 0x14001d0dc
test ebx, ebx
js 0x14001d0de
mov rdx, r14
mov rcx, rbp
xor esi, esi
mov rdi, rbp
call r15
test al, al
je 0x14001d0de
nop word [rax + rax]
mov eax, dword [rdi]
test eax, eax
je 0x14001d0cc
add esi, eax
mov rdx, r14
mov edi, esi
add rdi, rbp
mov rcx, rdi
call r15
test al, al
jne 0x14001d0b0
jmp 0x14001d0de
mov rbx, qword [rsp + 0xa8]
xor dil, dil
jmp 0x14001cfe0
xor ebx, ebx
mov rcx, qword [0x1400d8fb0]
mov r8, rbp
xor edx, edx
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
mov rsi, qword [rsp + 0xa0]
lea r11, [rsp + 0x70]
mov rbp, qword [r11 + 0x48]
mov eax, ebx
mov rbx, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
mov ecx, 0xc000009a
call qword [sym.imp.ntdll.dll_RtlRaiseStatus]
int3
Function at 0x14001d120
Capabilities:
Get file attributes

Disassembly:
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
sub rsp, 0x40
mov rbp, rcx
mov rcx, qword [0x1400d8fb0]
mov r12, r8
mov esi, 0x200
xor edx, edx
mov r8, rsi
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov rdi, rax
test rax, rax
jne 0x14001a036
mov ecx, 0xc000009a
call qword [sym.imp.ntdll.dll_RtlRaiseStatus]
int3
mov qword [rsp + 0x50], rbx
nop dword [rax + rax]
lea rdx, [rsp + 0x30]
mov r9d, esi
mov r8, rdi
mov rcx, rbp
mov dword [rsp + 0x20], 0x16
call qword [sym.imp.ntdll.dll_NtQueryInformationFile]
mov ebx, eax
cmp eax, 0x80000005
je 0x14001a073
cmp eax, 0xc0000023
je 0x14001a073
cmp eax, 0xc0000004
jne 0x14001a0b2
mov rcx, qword [0x1400d8fb0]
mov r8, rdi
xor edx, edx
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
mov rcx, qword [0x1400d8fb0]
lea r11d, [rsi + rsi]
mov r8d, r11d
xor edx, edx
mov esi, r11d
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov rdi, rax
test rax, rax
jne 0x14001a040
mov ecx, 0xc000009a
call qword [sym.imp.ntdll.dll_RtlRaiseStatus]
int3
test eax, eax
js 0x14001a0be
mov qword [r12], rdi
mov eax, ebx
jmp 0x14001a0d2
mov rcx, qword [0x1400d8fb0]
mov r8, rdi
xor edx, edx
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
mov eax, ebx
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r12
ret
mov r8, rdx
mov edx, 0x16
jmp 0x140019ff0
Function at 0x14001da20
Capabilities:
Get windows directory from kuser_shared_data

Disassembly:
mov qword [rsp + 0x18], rbx
push rsi
push rdi
push r13
sub rsp, 0x20
mov r13, rcx
lea rdx, [0x1400ab9f0]
mov r8d, 4
add rcx, 0x10
call fcn.140095a60
test eax, eax
jne 0x14001dac3
movzx eax, word [r13]
mov rbx, qword [0x1400d91a8]
xor r8d, r8d
sub eax, 8
mov rcx, rbx
movsxd rsi, eax
lea rdi, [rsi + 0x12]
mov rdx, rdi
call fcn.14001fbe0
lock add dword [rbx + 0x18], 1
mov qword [rax + 8], rdi
lea rdi, [rax + 0x20]
mov dword [rax], 1
mov qword [rax + 0x10], rbx
mov word [rdi], si
mov word [rdi + 2], si
lea rcx, [rdi + 0x10]
shr rsi, 1
xor eax, eax
mov qword [rdi + 8], rcx
mov word [rdi + rsi*2 + 0x10], ax
movzx edx, word [r13]
sub edx, 8
movsxd r8, edx
lea rdx, [r13 + 0x18]
call fcn.140094930
mov rax, rdi
mov rbx, qword [rsp + 0x50]
add rsp, 0x20
pop r13
pop rdi
pop rsi
ret
lea rdx, str.SystemRoot
lea rcx, [r13 + 0x10]
mov r8d, 0xb
call fcn.1400a6cd0
test eax, eax
jne 0x14001db9c
mov rbx, qword [0x1400d91a8]
or rcx, 0xffffffffffffffff
xor eax, eax
mov qword [rsp + 0x40], rbp
mov edi, 0x7ffe0030
mov qword [rsp + 0x48], r12
repne scasw ax, word [rdi]
movzx eax, word [r13]
xor r8d, r8d
not rcx
lea ebp, [rcx + rcx - 2]
lea r12, [rcx - 1]
mov rcx, rbx
lea edx, [rax + rbp - 0x16]
mov esi, edx
lea rdi, [rdx + 0x12]
mov rdx, rdi
call fcn.14001fbe0
lock add dword [rbx + 0x18], 1
mov qword [rax + 8], rdi
lea rdi, [rax + 0x20]
mov dword [rax], 1
mov qword [rax + 0x10], rbx
mov word [rdi], si
mov word [rdi + 2], si
lea rcx, [rdi + 0x10]
xor eax, eax
shr rsi, 1
mov qword [rdi + 8], rcx
mov r8d, ebp
mov edx, 0x7ffe0030
mov word [rdi + rsi*2 + 0x10], ax
call fcn.140094930
movzx edx, word [r13]
sub edx, 0x16
mov ecx, r12d
movsxd r8, edx
lea rdx, [r13 + 0x26]
lea rcx, [rdi + rcx*2 + 0x10]
call fcn.140094930
mov r12, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x40]
mov rax, rdi
mov rbx, qword [rsp + 0x50]
add rsp, 0x20
pop r13
pop rdi
pop rsi
ret
cmp word [r13], 0
je 0x14001dc1e
cmp word [r13 + 0x10], 0x5c
jne 0x14001dc1e
mov rcx, r13
call sym.ProcessHacker.exe_PhResolveDevicePrefix
test rax, rax
jne 0x14001dc27
lea r8d, [rax + 8]
lea rdx, str.Windows
lea rcx, [r13 + 0x10]
call fcn.1400a6cd0
test eax, eax
jne 0x14001dc1e
movzx eax, word [r13]
xor ecx, ecx
add eax, 4
movsxd rdx, eax
call sym.ProcessHacker.exe_PhCreateStringEx
mov cx, word [0x7ffe0030]
lea rdx, [r13 + 0x10]
mov word [rax + 0x10], cx
mov rdi, rax
mov eax, 0x3a
mov word [rdi + 0x12], ax
movzx r8d, word [r13]
lea rcx, [rdi + 0x14]
call fcn.140094930
mov rax, rdi
mov rbx, qword [rsp + 0x50]
add rsp, 0x20
pop r13
pop rdi
pop rsi
ret
mov rax, r13
lock add dword [r13 - 0x20], 1
mov rbx, qword [rsp + 0x50]
add rsp, 0x20
pop r13
pop rdi
pop rsi
ret
Function at 0x14001f680
Capabilities:
Allocate thread local storage

Disassembly:
sub rsp, 0x78
lea rcx, [0x1400d57f0]
call qword [sym.imp.ntdll.dll_RtlInitializeSListHead]
xor edx, edx
lea rcx, [rsp + 0x20]
lea r8d, [rdx + 0x50]
mov dword [0x1400d5800], 0
mov dword [0x1400d5804], 0x200
mov qword [0x1400d5808], 0x50
call fcn.14009e740
lea r11, [rsp + 0x20]
lea rdx, str.Type
lea rcx, [0x1400d63f0]
xor r9d, r9d
xor r8d, r8d
mov qword [0x1400d63f0], r11
call sym.ProcessHacker.exe_PhCreateObjectType
test eax, eax
js 0x14001f744
mov rax, qword [0x1400d63f0]
lea rdx, str.Alloc
lea rcx, [0x1400d6400]
mov qword [rax - 0x10], rax
mov rax, qword [0x1400d63f0]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x70], rbx
mov dword [rax + 0x18], 1
call sym.ProcessHacker.exe_PhCreateObjectType
mov ebx, eax
test eax, eax
js 0x14001f73f
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
mov ecx, 0xc000009a
cmp eax, 0xffffffff
mov dword [0x1400d5794], eax
cmove ebx, ecx
mov eax, ebx
mov rbx, qword [rsp + 0x70]
add rsp, 0x78
ret

Function at 0x14001fe40
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rbx
sub rsp, 0x20
xor eax, eax
mov rbx, rcx
mov dword [rcx], eax
mov dword [rcx + 0x208], eax
mov dword [rcx + 0x20c], eax
mov qword [rcx + 0x210], rax
mov ecx, dword [0x1400d5794]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ecx, dword [0x1400d5794]
mov rdx, rbx
mov qword [rbx + 0x218], rax
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
jne 0x14001fe92
mov ecx, 0xc0000001
call qword [sym.imp.ntdll.dll_RtlRaiseStatus]
int3
add rsp, 0x20
pop rbx
ret

Function at 0x14001fea0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
call sym.ProcessHacker.exe_PhDrainAutoPool
mov ecx, dword [0x1400d5794]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp rax, rbx
je 0x14001fecb
mov ecx, 0xc0000001
call qword [sym.imp.ntdll.dll_RtlRaiseStatus]
int3
mov rdx, qword [rbx + 0x218]
mov ecx, dword [0x1400d5794]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
jne 0x14001feee
mov ecx, 0xc0000001
call qword [sym.imp.ntdll.dll_RtlRaiseStatus]
int3
mov r8, qword [rbx + 0x210]
test r8, r8
je 0x14001ff09
mov rcx, qword [0x1400d8fb0]
xor edx, edx
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
add rsp, 0x20
pop rbx
ret
Function at 0x14001ff10
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
mov ecx, dword [0x1400d5794]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, rax
mov eax, dword [rax]
cmp eax, 0x40
jae 0x14001ff45
mov qword [rbx + rax*8 + 8], rdi
inc dword [rbx]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
cmp qword [rbx + 0x210], 0
jne 0x14001ff86
mov rcx, qword [0x1400d8fb0]
xor edx, edx
mov r8d, 0x200
mov dword [rbx + 0x20c], 0x40
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
test rax, rax
jne 0x14001ff7f
mov ecx, 0xc000009a
call qword [sym.imp.ntdll.dll_RtlRaiseStatus]
int3
mov qword [rbx + 0x210], rax
mov eax, dword [rbx + 0x20c]
cmp dword [rbx + 0x208], eax
jne 0x14001ffd1
mov r8, qword [rbx + 0x210]
mov rcx, qword [0x1400d8fb0]
add eax, eax
mov r9d, eax
xor edx, edx
mov dword [rbx + 0x20c], eax
shl r9, 3
call qword [sym.imp.ntdll.dll_RtlReAllocateHeap]
test rax, rax
jne 0x14001ffca
mov ecx, 0xc000009a
call qword [sym.imp.ntdll.dll_RtlRaiseStatus]
int3
mov qword [rbx + 0x210], rax
mov ecx, dword [rbx + 0x208]
mov rax, qword [rbx + 0x210]
mov qword [rax + rcx*8], rdi
inc dword [rbx + 0x208]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x140021440
Capabilities:
Identify system language via api

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x20
mov eax, ecx
mov edi, ecx
and eax, 0xfff0000
cmp eax, 0x70000
je 0x140021469
call qword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
lea rcx, [0x1400ab590]
jmp 0x140021479
movzx edi, cx
call qword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
lea rcx, str.kernel32.dll
movzx ebx, ax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov r9d, edi
mov r8d, ebx
mov edx, 0xb
mov rcx, rax
call sym.ProcessHacker.exe_PhGetMessage
mov rbx, rax
test rax, rax
jne 0x1400214a8
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
cmp word [rbx], 0
je 0x14002150a
cmp word [rbx + 0x10], 0x7b
lea rcx, [rbx + 0x10]
jne 0x14002150a
mov edx, 0xa
call fcn.14009585c
test rax, rax
je 0x14002150a
sub rax, rbx
sub rax, 0x10
sar rax, 1
cmp eax, 0xffffffff
je 0x14002150a
movzx edx, word [rbx]
shr edx, 1
sub edx, eax
dec edx
add rdx, rdx
inc eax
lea rcx, [rbx + rax*2 + 0x10]
call sym.ProcessHacker.exe_PhCreateStringEx
lea rcx, [rbx - 0x20]
or edx, 0xffffffff
mov rdi, rax
lock xadd dword [rcx], edx
add edx, 0xffffffff
jne 0x140021507
call fcn.14001fcd0
mov rbx, rdi
mov rax, rbx
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret

Function at 0x140021520
Capabilities:
Identify system language via api

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov edi, ecx
call qword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
lea rcx, str.kernel32.dll
movzx ebx, ax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov r9d, edi
mov r8d, ebx
mov edx, 0xb
mov rcx, rax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp sym.ProcessHacker.exe_PhGetMessage
Function at 0x140021640
Capabilities:
Identify system language via api

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov edi, edx
mov ebx, ecx
test edx, edx
jne 0x140021692
cmp ecx, 0xc0000022
je 0x140021675
cmp ecx, 0xc0000005
je 0x140021675
mov eax, ecx
and eax, 0xfff0000
cmp eax, 0x70000
jne 0x140021681
movzx edi, cx
jmp 0x14002167d
call qword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
mov edi, eax
test edi, edi
jne 0x140021692
mov ecx, ebx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp sym.ProcessHacker.exe_PhGetNtMessage
call qword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
lea rcx, str.kernel32.dll
movzx ebx, ax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov r9d, edi
mov r8d, ebx
mov edx, 0xb
mov rcx, rax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp sym.ProcessHacker.exe_PhGetMessage
Function at 0x1400230d0
Capabilities:
Get file version info

Disassembly:
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
lea rdx, [rsp + 0x38]
mov rsi, rcx
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov edi, eax
test eax, eax
je 0x140023163
mov rcx, qword [0x1400d8fb0]
mov r8, rdi
xor edx, edx
mov qword [rsp + 0x30], rbx
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov rbx, rax
test rax, rax
jne 0x140023118
mov ecx, 0xc000009a
call qword [sym.imp.ntdll.dll_RtlRaiseStatus]
int3
mov r9, rax
mov r8d, edi
xor edx, edx
mov rcx, rsi
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
jne 0x140023150
mov rcx, qword [0x1400d8fb0]
mov r8, rbx
xor edx, edx
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
mov rbx, qword [rsp + 0x30]
xor eax, eax
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
mov rax, rbx
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
xor eax, eax
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret

Function at 0x140023dd0
Capabilities:
Get common file path

Disassembly:
push rbx
push rbp
push rdi
sub rsp, 0x20
mov rdi, qword [0x1400d91a8]
xor r8d, r8d
mov edx, 0x92
mov rcx, rdi
mov qword [rsp + 0x50], r12
mov qword [rsp + 0x58], r13
call fcn.14001fbe0
lock add dword [rdi + 0x18], 1
lea rbx, [rax + 0x20]
mov dword [rax], 1
mov qword [rax + 8], 0x92
mov qword [rax + 0x10], rdi
mov eax, 0x80
lea rcx, [rbx + 0x10]
mov qword [rbx + 8], rcx
mov word [rbx], ax
mov word [rbx + 2], ax
lea edx, [rax - 0x40]
xor r13d, r13d
mov word [rbx + 0x90], r13w
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
or rbp, 0xffffffffffffffff
mov r12d, eax
cmp eax, 0x40
jbe 0x140023ebf
mov qword [rsp + 0x48], rsi
lea rcx, [rbx - 0x20]
mov edx, ebp
lock xadd dword [rcx], edx
add edx, ebp
jne 0x140023e60
call fcn.14001fcd0
mov rbx, qword [0x1400d91a8]
lea eax, [r12 + r12]
xor r8d, r8d
lea rdi, [rax + 0x12]
mov rcx, rbx
mov esi, eax
mov rdx, rdi
call fcn.14001fbe0
lock add dword [rbx + 0x18], 1
mov qword [rax + 0x10], rbx
lea rbx, [rax + 0x20]
mov dword [rax], 1
mov qword [rax + 8], rdi
mov word [rbx], si
mov word [rbx + 2], si
lea rcx, [rbx + 0x10]
shr rsi, 1
mov edx, r12d
mov qword [rbx + 8], rcx
mov word [rbx + rsi*2 + 0x10], r13w
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov rsi, qword [rsp + 0x48]
mov r12d, eax
mov r13, qword [rsp + 0x58]
test r12d, r12d
mov r12, qword [rsp + 0x50]
jne 0x140023eea
lea rcx, [rbx - 0x20]
lock xadd dword [rcx], ebp
add ebp, 0xffffffff
jne 0x140023ee0
call fcn.14001fcd0
xor eax, eax
add rsp, 0x20
pop rdi
pop rbp
pop rbx
ret
xor eax, eax
lea rdi, [rbx + 0x10]
mov rcx, rbp
repne scasw ax, word [rdi]
mov rax, rbx
not rcx
dec rcx
add cx, cx
mov word [rbx + 2], cx
mov word [rbx], cx
add rsp, 0x20
pop rdi
pop rbp
pop rbx
ret

Function at 0x140023f20
Capabilities:
Get windows directory from kuser_shared_data

Disassembly:
push rdi
sub rsp, 0x20
or rcx, 0xffffffffffffffff
xor eax, eax
mov edi, 0x7ffe0030
repne scasw ax, word [rdi]
not rcx
lea rdx, [rcx + rcx - 2]
mov ecx, 0x7ffe0030
add rsp, 0x20
pop rdi
jmp sym.ProcessHacker.exe_PhCreateStringEx
Function at 0x140023f50
Capabilities:
Access peb ldr_data

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rax, qword gs:[0x30]
mov rbx, rcx
xor edi, edi
mov rcx, qword [rax + 0x60]
mov rcx, qword [rcx + 0x110]
call qword [sym.imp.ntdll.dll_RtlEnterCriticalSection]
mov r11, qword gs:[0x30]
mov rax, qword [r11 + 0x60]
mov rdx, qword [rax + 0x18]
mov rax, qword [rdx + 0x10]
add rdx, 0x10
cmp rax, rdx
je 0x140023faa
cmp qword [rax + 0x30], rbx
je 0x140023fa7
mov rax, qword [rax]
cmp rax, rdx
jne 0x140023f97
jmp 0x140023faa
mov rdi, rax
mov rcx, qword gs:[0x30]
mov rcx, qword [rcx + 0x60]
mov rcx, qword [rcx + 0x110]
call qword [sym.imp.ntdll.dll_RtlLeaveCriticalSection]
mov rbx, qword [rsp + 0x30]
mov rax, rdi
add rsp, 0x20
pop rdi
ret

Function at 0x1400241e0
Capabilities:
Get common file path

Disassembly:
push rdi
sub rsp, 0x240
lea rax, [rsp + 0x30]
mov rdi, rdx
mov edx, ecx
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
mov qword [rsp + 0x20], rax
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
cmp eax, 0x80070057
je 0x1400242c9
test rdi, rdi
je 0x14002422c
lea rcx, [rsp + 0x30]
mov rdx, rdi
call sym.ProcessHacker.exe_PhConcatStrings2
add rsp, 0x240
pop rdi
ret
or rcx, 0xffffffffffffffff
xor eax, eax
mov qword [rsp + 0x250], rbx
mov rbx, qword [0x1400d91a8]
mov qword [rsp + 0x258], rsi
lea rdi, [rsp + 0x30]
repne scasw ax, word [rdi]
xor r8d, r8d
not rcx
lea rsi, [rcx - 1]
mov rcx, rbx
add rsi, rsi
lea rdi, [rsi + 0x12]
mov rdx, rdi
call fcn.14001fbe0
lock add dword [rbx + 0x18], 1
mov qword [rax + 8], rdi
lea rdi, [rax + 0x20]
mov dword [rax], 1
mov qword [rax + 0x10], rbx
lea rcx, [rdi + 0x10]
xor eax, eax
mov word [rdi], si
mov word [rdi + 2], si
mov qword [rdi + 8], rcx
mov rdx, rsi
mov r8, rsi
shr rdx, 1
mov word [rdi + rdx*2 + 0x10], ax
lea rdx, [rsp + 0x30]
call fcn.140094930
mov rsi, qword [rsp + 0x258]
mov rbx, qword [rsp + 0x250]
mov rax, rdi
add rsp, 0x240
pop rdi
ret
xor eax, eax
add rsp, 0x240
pop rdi
ret