joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140123480
Capabilities:
Parse pe header

Disassembly:
push rbx
sub rsp, 0x30
xor ebx, ebx
test byte [0x14023e4f0], 1
jne 0x1401235b6
lock bts qword [0x14023e4f0], 0x1f
nop
jae 0x1401234c5
test byte [0x14023e4f0], 1
jne 0x1401235b6
xor edx, edx
lea rcx, [0x14023e4f0]
call sym.ProcessHacker.exe_PhfWaitForEvent
nop dword [rax]
jmp 0x1401235b6
lea rcx, str.userenv.dll
call fcn.1400f9d00
mov rcx, rax
test rax, rax
jne 0x140123517
xor edx, edx
lea rcx, str.userenv.dll
mov r8d, 0x800
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
test rax, rax
jne 0x140123517
xor edx, edx
lea rcx, str.userenv.dll
mov r8d, 0xa00
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
test rax, rax
je 0x1401235aa
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x1401235aa
mov edx, dword [rcx + 0x3c]
lea eax, [rdx - 1]
cmp eax, 0x7ffffffd
ja 0x1401235aa
cmp dword [rdx + rcx], 0x4550
jne 0x1401235aa
add rdx, 0x88
add rdx, rcx
mov eax, dword [rdx]
test eax, eax
je 0x1401235aa
cmp dword [rdx + 4], ebx
je 0x1401235aa
lea r8, [rcx + rax]
mov word [rsp + 0x20], bx
lea r9, str.CreateEnvironmentBlock
call fcn.1400fa1a0
mov r9, rax
test rax, rax
je 0x1401235aa
mov rcx, qword [0x7ffe0320]
mov edx, dword [0x7ffe0004]
mov eax, ecx
shr rcx, 0x20
imul rax, rdx
imul rcx, rdx
shr rax, 0x18
shl rcx, 8
add rax, rcx
mov qword [0x140244c68], rax
xor rax, r9
mov qword [0x140244d40], rax
lea rcx, [0x14023e4f0]
call sym.ProcessHacker.exe_PhfSetEvent
mov rax, qword [0x140244d40]
nop dword [rax]
test rax, rax
je 0x1401235da
mov rcx, qword [0x140244c68]
test rcx, rcx
je 0x1401235da
xor rax, rcx
add rsp, 0x30
pop rbx
ret
mov rax, rbx
add rsp, 0x30
pop rbx
ret
Function at 0x140123600
Capabilities:
Parse pe header

Disassembly:
push rbx
sub rsp, 0x30
xor ebx, ebx
test byte [0x14023e3a0], 1
jne 0x140123736
lock bts qword [0x14023e3a0], 0x1f
nop
jae 0x140123645
test byte [0x14023e3a0], 1
jne 0x140123736
xor edx, edx
lea rcx, [0x14023e3a0]
call sym.ProcessHacker.exe_PhfWaitForEvent
nop dword [rax]
jmp 0x140123736
lea rcx, str.userenv.dll
call fcn.1400f9d00
mov rcx, rax
test rax, rax
jne 0x140123697
xor edx, edx
lea rcx, str.userenv.dll
mov r8d, 0x800
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
test rax, rax
jne 0x140123697
xor edx, edx
lea rcx, str.userenv.dll
mov r8d, 0xa00
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
test rax, rax
je 0x14012372a
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x14012372a
mov edx, dword [rcx + 0x3c]
lea eax, [rdx - 1]
cmp eax, 0x7ffffffd
ja 0x14012372a
cmp dword [rdx + rcx], 0x4550
jne 0x14012372a
add rdx, 0x88
add rdx, rcx
mov eax, dword [rdx]
test eax, eax
je 0x14012372a
cmp dword [rdx + 4], ebx
je 0x14012372a
lea r8, [rcx + rax]
mov word [rsp + 0x20], bx
lea r9, str.DestroyEnvironmentBlock
call fcn.1400fa1a0
mov r9, rax
test rax, rax
je 0x14012372a
mov rcx, qword [0x7ffe0320]
mov edx, dword [0x7ffe0004]
mov eax, ecx
shr rcx, 0x20
imul rax, rdx
imul rcx, rdx
shr rax, 0x18
shl rcx, 8
add rax, rcx
mov qword [0x140244c30], rax
xor rax, r9
mov qword [0x140244cb8], rax
lea rcx, [0x14023e3a0]
call sym.ProcessHacker.exe_PhfSetEvent
mov rax, qword [0x140244cb8]
nop dword [rax]
test rax, rax
je 0x14012375a
mov rcx, qword [0x140244c30]
test rcx, rcx
je 0x14012375a
xor rax, rcx
add rsp, 0x30
pop rbx
ret
mov rax, rbx
add rsp, 0x30
pop rbx
ret
Function at 0x140123780
Capabilities:
Parse pe header

Disassembly:
push rbx
sub rsp, 0x30
xor ebx, ebx
test byte [0x14023e510], 1
jne 0x1401238b6
lock bts qword [0x14023e510], 0x1f
nop
jae 0x1401237c5
test byte [0x14023e510], 1
jne 0x1401238b6
xor edx, edx
lea rcx, [0x14023e510]
call sym.ProcessHacker.exe_PhfWaitForEvent
nop dword [rax]
jmp 0x1401238b6
lea rcx, str.userenv.dll
call fcn.1400f9d00
mov rcx, rax
test rax, rax
jne 0x140123817
xor edx, edx
lea rcx, str.userenv.dll
mov r8d, 0x800
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
test rax, rax
jne 0x140123817
xor edx, edx
lea rcx, str.userenv.dll
mov r8d, 0xa00
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
test rax, rax
je 0x1401238aa
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x1401238aa
mov edx, dword [rcx + 0x3c]
lea eax, [rdx - 1]
cmp eax, 0x7ffffffd
ja 0x1401238aa
cmp dword [rdx + rcx], 0x4550
jne 0x1401238aa
add rdx, 0x88
add rdx, rcx
mov eax, dword [rdx]
test eax, eax
je 0x1401238aa
cmp dword [rdx + 4], ebx
je 0x1401238aa
lea r8, [rcx + rax]
mov word [rsp + 0x20], bx
lea r9, str.GetAppContainerRegistryLocation
call fcn.1400fa1a0
mov r9, rax
test rax, rax
je 0x1401238aa
mov rcx, qword [0x7ffe0320]
mov edx, dword [0x7ffe0004]
mov eax, ecx
shr rcx, 0x20
imul rax, rdx
imul rcx, rdx
shr rax, 0x18
shl rcx, 8
add rax, rcx
mov qword [0x140244d10], rax
xor rax, r9
mov qword [0x140244cb0], rax
lea rcx, [0x14023e510]
call sym.ProcessHacker.exe_PhfSetEvent
mov rax, qword [0x140244cb0]
nop dword [rax]
test rax, rax
je 0x1401238da
mov rcx, qword [0x140244d10]
test rcx, rcx
je 0x1401238da
xor rax, rcx
add rsp, 0x30
pop rbx
ret
mov rax, rbx
add rsp, 0x30
pop rbx
ret
Function at 0x140123900
Capabilities:
Parse pe header

Disassembly:
push rbx
sub rsp, 0x30
xor ebx, ebx
test byte [0x14023e4c0], 1
jne 0x140123a36
lock bts qword [0x14023e4c0], 0x1f
nop
jae 0x140123945
test byte [0x14023e4c0], 1
jne 0x140123a36
xor edx, edx
lea rcx, [0x14023e4c0]
call sym.ProcessHacker.exe_PhfWaitForEvent
nop dword [rax]
jmp 0x140123a36
lea rcx, str.userenv.dll
call fcn.1400f9d00
mov rcx, rax
test rax, rax
jne 0x140123997
xor edx, edx
lea rcx, str.userenv.dll
mov r8d, 0x800
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
test rax, rax
jne 0x140123997
xor edx, edx
lea rcx, str.userenv.dll
mov r8d, 0xa00
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
test rax, rax
je 0x140123a2a
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x140123a2a
mov edx, dword [rcx + 0x3c]
lea eax, [rdx - 1]
cmp eax, 0x7ffffffd
ja 0x140123a2a
cmp dword [rdx + rcx], 0x4550
jne 0x140123a2a
add rdx, 0x88
add rdx, rcx
mov eax, dword [rdx]
test eax, eax
je 0x140123a2a
cmp dword [rdx + 4], ebx
je 0x140123a2a
lea r8, [rcx + rax]
mov word [rsp + 0x20], bx
lea r9, str.GetAppContainerFolderPath
call fcn.1400fa1a0
mov r9, rax
test rax, rax
je 0x140123a2a
mov rcx, qword [0x7ffe0320]
mov edx, dword [0x7ffe0004]
mov eax, ecx
shr rcx, 0x20
imul rax, rdx
imul rcx, rdx
shr rax, 0x18
shl rcx, 8
add rax, rcx
mov qword [0x140244c70], rax
xor rax, r9
mov qword [0x140244d28], rax
lea rcx, [0x14023e4c0]
call sym.ProcessHacker.exe_PhfSetEvent
mov rax, qword [0x140244d28]
nop dword [rax]
test rax, rax
je 0x140123a5a
mov rcx, qword [0x140244c70]
test rcx, rcx
je 0x140123a5a
xor rax, rcx
add rsp, 0x30
pop rbx
ret
mov rax, rbx
add rsp, 0x30
pop rbx
ret
Function at 0x140123a80
Capabilities:
Parse pe header

Disassembly:
push rbx
sub rsp, 0x30
xor ebx, ebx
test byte [0x14023e370], 1
jne 0x140123bb6
lock bts qword [0x14023e370], 0x1f
nop
jae 0x140123ac5
test byte [0x14023e370], 1
jne 0x140123bb6
xor edx, edx
lea rcx, [0x14023e370]
call sym.ProcessHacker.exe_PhfWaitForEvent
nop dword [rax]
jmp 0x140123bb6
lea rcx, [0x1401d9d58]
call fcn.1400f9d00
mov rcx, rax
test rax, rax
jne 0x140123b17
xor edx, edx
lea rcx, [0x1401d9d58]
mov r8d, 0x800
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
test rax, rax
jne 0x140123b17
xor edx, edx
lea rcx, [0x1401d9d58]
mov r8d, 0xa00
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
test rax, rax
je 0x140123baa
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x140123baa
mov edx, dword [rcx + 0x3c]
lea eax, [rdx - 1]
cmp eax, 0x7ffffffd
ja 0x140123baa
cmp dword [rdx + rcx], 0x4550
jne 0x140123baa
add rdx, 0x88
add rdx, rcx
mov eax, dword [rdx]
test eax, eax
je 0x140123baa
cmp dword [rdx + 4], ebx
je 0x140123baa
lea r8, [rcx + rax]
mov word [rsp + 0x20], bx
lea r9, str.MessageBeep
call fcn.1400fa1a0
mov r9, rax
test rax, rax
je 0x140123baa
mov rcx, qword [0x7ffe0320]
mov edx, dword [0x7ffe0004]
mov eax, ecx
shr rcx, 0x20
imul rax, rdx
imul rcx, rdx
shr rax, 0x18
shl rcx, 8
add rax, rcx
mov qword [0x140244c08], rax
xor rax, r9
mov qword [0x140244d48], rax
lea rcx, [0x14023e370]
call sym.ProcessHacker.exe_PhfSetEvent
mov rax, qword [0x140244d48]
nop dword [rax]
test rax, rax
je 0x140123bda
mov rcx, qword [0x140244c08]
test rcx, rcx
je 0x140123bda
xor rax, rcx
add rsp, 0x30
pop rbx
ret
mov rax, rbx
add rsp, 0x30
pop rbx
ret
Function at 0x140123c00
Capabilities:
Parse pe header

Disassembly:
push rbx
sub rsp, 0x30
xor ebx, ebx
test byte [0x14023e560], 1
jne 0x140123d36
lock bts qword [0x14023e560], 0x1f
nop
jae 0x140123c45
test byte [0x14023e560], 1
jne 0x140123d36
xor edx, edx
lea rcx, [0x14023e560]
call sym.ProcessHacker.exe_PhfWaitForEvent
nop dword [rax]
jmp 0x140123d36
lea rcx, str.winsta.dll
call fcn.1400f9d00
mov rcx, rax
test rax, rax
jne 0x140123c97
xor edx, edx
lea rcx, str.winsta.dll
mov r8d, 0x800
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
test rax, rax
jne 0x140123c97
xor edx, edx
lea rcx, str.winsta.dll
mov r8d, 0xa00
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
test rax, rax
je 0x140123d2a
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x140123d2a
mov edx, dword [rcx + 0x3c]
lea eax, [rdx - 1]
cmp eax, 0x7ffffffd
ja 0x140123d2a
cmp dword [rdx + rcx], 0x4550
jne 0x140123d2a
add rdx, 0x88
add rdx, rcx
mov eax, dword [rdx]
test eax, eax
je 0x140123d2a
cmp dword [rdx + 4], ebx
je 0x140123d2a
lea r8, [rcx + rax]
mov word [rsp + 0x20], bx
lea r9, [0x1401f1740]
call fcn.1400fa1a0
mov r9, rax
test rax, rax
je 0x140123d2a
mov rcx, qword [0x7ffe0320]
mov edx, dword [0x7ffe0004]
mov eax, ecx
shr rcx, 0x20
imul rax, rdx
imul rcx, rdx
shr rax, 0x18
shl rcx, 8
add rax, rcx
mov qword [0x140244cd0], rax
xor rax, r9
mov qword [0x140244d60], rax
lea rcx, [0x14023e560]
call sym.ProcessHacker.exe_PhfSetEvent
mov rax, qword [0x140244d60]
nop dword [rax]
test rax, rax
je 0x140123d5a
mov rcx, qword [0x140244cd0]
test rcx, rcx
je 0x140123d5a
xor rax, rcx
add rsp, 0x30
pop rbx
ret
mov rax, rbx
add rsp, 0x30
pop rbx
ret
Function at 0x140128640
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x38
test byte [0x14023e5b8], 1
jne 0x140128896
lock bts qword [0x14023e5b8], 0x1f
jae 0x140128684
test byte [0x14023e5b8], 1
jne 0x140128896
xor edx, edx
lea rcx, [0x14023e5b8]
call sym.ProcessHacker.exe_PhfWaitForEvent
mov rax, qword [0x140244dc8]
add rsp, 0x38
ret
cmp dword [0x140237d34], 0x3e
lea rcx, str.appresolver.dll
jae 0x140128785
call fcn.1400f9d00
mov rcx, rax
test rax, rax
jne 0x1401286e9
xor edx, edx
lea rcx, str.appresolver.dll
mov r8d, 0x800
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
test rax, rax
jne 0x1401286e9
xor edx, edx
lea rcx, str.appresolver.dll
mov r8d, 0xa00
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
test rax, rax
je 0x14012888a
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x14012888a
mov edx, dword ds:[rcx + 0x3c]
lea eax, [rdx - 1]
cmp eax, 0x7ffffffd
ja 0x14012888a
cmp dword [rdx + rcx], 0x4550
jne 0x14012888a
add rdx, 0x88
add rdx, rcx
mov eax, dword [rdx]
test eax, eax
je 0x14012888a
cmp dword [rdx + 4], 0
je 0x14012888a
lea r8, [rcx + rax]
xor eax, eax
lea r9, str.DllGetClassObject
mov word [rsp + 0x20], ax
call fcn.1400fa1a0
test rax, rax
je 0x14012888a
lea r8, [rsp + 0x40]
lea rdx, [0x1401ad590]
lea rcx, [0x14023e5e8]
call qword [case.0x1400f654f.0]
test eax, eax
js 0x14012888a
lea r8, [0x14023e5a8]
nop
jmp 0x14012885d
call fcn.1400f9d00
mov rcx, rax
test rax, rax
jne 0x1401287d2
xor edx, edx
lea rcx, str.appresolver.dll
mov r8d, 0x800
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
test rax, rax
jne 0x1401287d2
xor edx, edx
lea rcx, str.appresolver.dll
mov r8d, 0xa00
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
test rax, rax
je 0x14012888a
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x14012888a
mov edx, dword [rcx + 0x3c]
lea eax, [rdx - 1]
cmp eax, 0x7ffffffd
ja 0x14012888a
cmp dword [rdx + rcx], 0x4550
jne 0x14012888a
add rdx, 0x88
add rdx, rcx
mov eax, dword [rdx]
test eax, eax
je 0x14012888a
cmp dword [rdx + 4], 0
je 0x14012888a
lea r8, [rcx + rax]
xor eax, eax
lea r9, str.DllGetClassObject
mov word [rsp + 0x20], ax
call fcn.1400fa1a0
test rax, rax
je 0x14012888a
lea r8, [rsp + 0x40]
lea rdx, [0x1401ad590]
lea rcx, [0x14023e5e8]
call qword [case.0x1400f654f.0]
test eax, eax
js 0x14012888a
lea r8, [0x14023e628]
mov rcx, qword [rsp + 0x40]
lea r9, [0x140244dc8]
xor edx, edx
mov rax, qword [rcx]
mov rax, qword [rax + 0x18]
call qword [case.0x1400f654f.0]
mov rcx, qword [rsp + 0x40]
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [case.0x1400f654f.0]
lea rcx, [0x14023e5b8]
call sym.ProcessHacker.exe_PhfSetEvent
mov rax, qword [0x140244dc8]
add rsp, 0x38
ret
Function at 0x14012a820
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push rbx
push rbp
push rsi
push rdi
sub rsp, 0x68
mov rax, qword [0x140237008]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov rsi, rdx
mov qword [rsp + 0x40], r8
xor ebx, ebx
mov qword [rsp + 0x38], 4
mov edi, r9d
mov qword [rsp + 0x48], rbx
mov rbp, rcx
lea r9, [rsp + 0x28]
lea rdx, [rsp + 0x38]
mov rcx, rsi
lea r8d, [rbx + 3]
call qword [sym.imp.ntdll.dll_LdrFindResource_U]
test eax, eax
js 0x14012a89e
lfence
mov rdx, qword [rsp + 0x28]
lea r9, [rsp + 0x20]
lea r8, [rsp + 0x30]
mov rcx, rsi
call qword [sym.imp.ntdll.dll_LdrAccessResource]
test eax, eax
js 0x14012a89e
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.USER32.dll_LoadMenuIndirectW]
mov rbx, rax
nop
cmp edi, 0xffffffff
je 0x14012a8b2
mov edx, edi
mov rcx, rbx
call qword [sym.imp.USER32.dll_GetSubMenu]
jmp 0x14012a8b5
mov rax, rbx
mov rdx, rax
mov rcx, rbp
call fcn.14012a560
mov rcx, rbx
call qword [sym.imp.USER32.dll_DestroyMenu]
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.1401848a0
add rsp, 0x68
pop rdi
pop rsi
pop rbp
pop rbx
ret

Function at 0x14012ac20
Capabilities:
Enumerate services

Disassembly:
mov qword ss:[rsp + 8], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x50
mov r14, r9
mov ebx, edx
mov rbp, rcx
test edx, edx
jne 0x14012ac66
mov eax, dword [0x140237d34]
cmp eax, 0x66
jb 0x14012ac56
mov ebx, 0x3ff
jmp 0x14012ac66
cmp eax, 0x64
mov ebx, 0x3b
mov ecx, 0x1ff
cmovae ebx, ecx
mov edi, dword [0x14023e574]
test r8d, r8d
mov rcx, qword [0x140241998]
mov r15d, 3
cmovne r15d, r8d
mov edx, 4
mov r8d, edi
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
xor r12d, r12d
mov r9d, r15d
mov qword [rsp + 0x48], r12
mov rsi, rax
mov qword [rsp + 0x40], r12
lea rax, [rsp + 0x90]
mov qword [rsp + 0x38], rax
mov r8d, ebx
lea rax, [rsp + 0x88]
xor edx, edx
mov qword [rsp + 0x30], rax
mov rcx, rbp
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rsi
call qword [sym.imp.ADVAPI32.dll_EnumServicesStatusExW]
test eax, eax
jne 0x14012ad7a
nop word [rax + rax]
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xea
jne 0x14012ad64
mov rcx, qword [0x140241998]
mov r8, rsi
xor edx, edx
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
add edi, dword [rsp + 0x88]
lea edx, [r12 + 4]
mov rcx, qword [0x140241998]
mov r8d, edi
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov qword [rsp + 0x48], r12
mov r9d, r15d
mov rsi, rax
mov qword [rsp + 0x40], r12
lea rax, [rsp + 0x90]
mov r8d, ebx
mov qword [rsp + 0x38], rax
xor edx, edx
lea rax, [rsp + 0x88]
mov rcx, rbp
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rsi
call qword [sym.imp.ADVAPI32.dll_EnumServicesStatusExW]
nop dword [rax]
test eax, eax
jne 0x14012ad7a
mov rcx, qword [0x140241998]
mov r8, rsi
xor edx, edx
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
xor eax, eax
jmp 0x14012ad9c
mov eax, dword [0x14023e574]
cmp edi, 0x20000
cmovbe eax, edi
mov dword [0x14023e574], eax
mov eax, dword [rsp + 0x90]
mov dword [r14], eax
mov rax, rsi
lea r11, [rsp + 0x50]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
Function at 0x14012b140
Capabilities:
Modify service

Disassembly:
sub rsp, 0x28
movzx eax, dl
lea r8, [rsp + 0x38]
mov edx, 3
mov dword [rsp + 0x38], eax
call qword [sym.imp.ADVAPI32.dll_ChangeServiceConfig2W]
test eax, eax
setne al
add rsp, 0x28
ret

Function at 0x14012b340
Capabilities:
Parse pe header

Disassembly:
mov qword ss:[rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x50
mov rax, qword [0x140244df0]
xor esi, esi
mov rbx, rdx
mov rdi, rcx
test rax, rax
jne 0x14012b3fa
lea rcx, str.advapi32.dll
call fcn.1400f9d00
mov rcx, rax
test rax, rax
je 0x14012b49e
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x14012b49e
mov edx, dword ds:[rcx + 0x3c]
lea eax, [rdx - 1]
cmp eax, 0x7ffffffd
ja 0x14012b49e
cmp dword [rdx + rcx], 0x4550
jne 0x14012b49e
add rdx, 0x88
add rdx, rcx
mov eax, dword [rdx]
test eax, eax
je 0x14012b49e
cmp dword [rdx + 4], esi
je 0x14012b49e
lea r8, [rcx + rax]
mov word [rsp + 0x20], si
lea r9, str.I_QueryTagInformation
call fcn.1400fa1a0
mov qword [0x140244df0], rax
test rax, rax
je 0x14012b4a5
xorps xmm0, xmm0
mov dword [rsp + 0x30], edi
lea r8, [rsp + 0x30]
mov dword [rsp + 0x34], ebx
mov edx, 1
xor ecx, ecx
movdqu xmmword [rsp + 0x38], xmm0
call qword [case.0x1400f654f.0]
mov rdi, qword [rsp + 0x40]
test rdi, rdi
je 0x14012b48b
mov qword [rsp + 0x60], r14
mov rbx, 0xffffffffffffffff
inc rbx
cmp word [rdi + rbx*2], si
jne 0x14012b433
mov rdx, qword [0x1402418e8]
add rbx, rbx
lea rcx, [rbx + 0x12]
call sym.ProcessHacker.exe_PhCreateObject
mov r14, rax
mov qword [rax], rbx
add rax, 0x10
mov qword [r14 + 8], rax
mov word [rax + rbx], si
test rdi, rdi
je 0x14012b475
mov rcx, qword [r14 + 8]
mov r8, rbx
mov rdx, rdi
call fcn.140188690
mov rcx, qword ds:[rsp + 0x40]
mov rsi, r14
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov r14, qword [rsp + 0x60]
mov rax, rsi
mov rbx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
ret
mov qword [0x140244df0], rsi
mov rbx, qword [rsp + 0x68]
xor eax, eax
mov rsi, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
ret
Function at 0x140130600
Capabilities:
Map section object

Disassembly:
mov r11, rsp
push rbx
sub rsp, 0x50
mov dword [rsp + 0x48], 2
lea rax, [r11 + 0x20]
mov rbx, rdx
mov qword [r11 + 0x20], 1
xor edx, edx
lea r8, [r11 + 0x18]
mov dword [rsp + 0x40], edx
xor r9d, r9d
mov dword [rsp + 0x38], 1
mov qword [r11 - 0x28], rax
mov qword [r11 - 0x30], rdx
mov qword [r11 - 0x38], rdx
mov qword [r11 + 0x18], rdx
lea rdx, [r9 - 1]
call qword [sym.imp.ntdll.dll_NtMapViewOfSection]
test eax, eax
jns 0x14013065b
lfence
add rsp, 0x50
pop rbx
ret
mov rdx, qword [rsp + 0x70]
mov r8, rbx
mov rcx, 0xffffffffffffffff
call sym.ProcessHacker.exe_PhGetProcessMappedFileName
mov rdx, qword ds:[rsp + 0x70]
mov rcx, 0xffffffffffffffff
mov ebx, eax
call qword [sym.imp.ntdll.dll_NtUnmapViewOfSection]
mov eax, ebx
add rsp, 0x50
pop rbx
ret
Function at 0x140132fa0
Capabilities:
Create thread

Disassembly:
push rbx
push rsi
push rdi
push r12
push r13
sub rsp, 0x60
mov r12, r9
mov r13, rdx
call fcn.140132c40
mov rdi, rax
test rax, rax
je 0x140133199
xor ebx, ebx
mov qword [rsp + 0x90], rbp
cmp qword [rax + 0x20], rbx
jne 0x140132ffd
lea r9d, [rbx + 1]
mov byte [rsp + 0x20], bl
xor r8d, r8d
lea rcx, [rax + 0x20]
mov edx, 0x1f0003
call qword [sym.imp.ntdll.dll_NtCreateEvent]
mov esi, eax
test eax, eax
js 0x140133125
mov qword [rsp + 0xa0], r15
cmp qword [rdi + 0x28], rbx
jne 0x140133031
mov r9d, 1
mov byte [rsp + 0x20], bl
xor r8d, r8d
lea rcx, [rdi + 0x28]
mov edx, 0x1f0003
call qword [sym.imp.ntdll.dll_NtCreateEvent]
mov esi, eax
test eax, eax
js 0x14013311d
cmp qword [rdi + 0x30], rbx
mov qword [rsp + 0x98], r14
lea r14, [rdi + 0x30]
jne 0x1401330af
mov rcx, qword [rdi + 0x20]
call qword [sym.imp.ntdll.dll_NtClearEvent]
mov rcx, qword [rdi + 0x28]
call qword [sym.imp.ntdll.dll_NtClearEvent]
lea rax, [rsp + 0x50]
xor edx, edx
mov qword [rsp + 0x48], rax
xor r9d, r9d
mov qword [rsp + 0x40], r14
lea rax, [0x140132f40]
mov qword [rsp + 0x38], rdi
xor r8d, r8d
mov qword [rsp + 0x30], rax
lea rcx, [rdx - 1]
mov qword [rsp + 0x28], 0x8000
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ntdll.dll_RtlCreateUserThread]
mov esi, eax
test eax, eax
js 0x140133115
lfence
mov rcx, qword [rdi + 0x28]
xor r8d, r8d
xor edx, edx
call qword [sym.imp.ntdll.dll_NtWaitForSingleObject]
mov rcx, qword [rdi + 0x20]
lea rax, [0x1401331c0]
xor edx, edx
mov qword [rdi + 0x10], rax
mov qword [rdi + 0x18], r13
call qword [sym.imp.ntdll.dll_NtSetEvent]
mov rcx, qword [rdi + 0x28]
mov r8, r12
xor edx, edx
call qword [sym.imp.ntdll.dll_NtWaitForSingleObject]
mov esi, eax
mov qword [rdi + 0x10], rbx
lock or dword [rsp], ebx
mov qword [rdi + 0x18], rbx
test eax, eax
je 0x140133115
mov rcx, qword [r14]
mov esi, 0xc0000001
mov edx, esi
call qword [sym.imp.ntdll.dll_NtTerminateThread]
mov rcx, qword [r14]
xor r8d, r8d
xor edx, edx
call qword [sym.imp.ntdll.dll_NtWaitForSingleObject]
mov rcx, qword [r14]
call qword [sym.imp.ntdll.dll_NtClose]
mov qword [r14], rbx
mov r14, qword [rsp + 0x98]
mov r15, qword [rsp + 0xa0]
mov rdx, rdi
lea rcx, [0x140244e40]
call qword [sym.imp.ntdll.dll_RtlInterlockedPushEntrySList]
cmp qword [0x140244e58], rbx
mov rbp, qword [rsp + 0x90]
je 0x14013319e
xchg qword [0x140244e58], rbx
test rbx, rbx
je 0x14013319e
mov rdi, qword [rbx]
lock btr dword [rbx + 0x1c], 1
jb 0x140133177
mov rcx, qword [0x140244db0]
xor r9d, r9d
xor r8d, r8d
mov rdx, rbx
call qword [sym.imp.ntdll.dll_NtReleaseKeyedEvent]
test eax, eax
js 0x14013318d
mov rbx, rdi
test rdi, rdi
jne 0x140133152
mov eax, esi
add rsp, 0x60
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret
lfence
mov ecx, eax
call qword [sym.imp.ntdll.dll_RtlRaiseStatus]
int3
mov esi, 0xc0000001
mov eax, esi
add rsp, 0x60
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret
Function at 0x140133680
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x20
mov ebx, edx
mov r12, rcx
mov r14d, edx
mov rdx, qword [0x140241898]
mov edi, r8d
lea rcx, [rbx*8]
call sym.ProcessHacker.exe_PhCreateObject
mov rcx, rax
call sym.ProcessHacker.exe_PhAutoDereferenceObject
mov r15, rax
test ebx, ebx
je 0x1401337d4
mov qword [rsp + 0x40], rbp
mov ebp, edi
mov qword [rsp + 0x48], rsi
mov rsi, rax
shl rbp, 3
nop dword [rax + rax]
mov rdx, qword [0x140241898]
mov rcx, rbp
call sym.ProcessHacker.exe_PhCreateObject
mov ecx, dword [0x140244804]
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, rax
test rdi, rdi
je 0x1401337a7
mov eax, dword [rax]
cmp eax, 0x40
jae 0x14013371d
mov qword [rbx + rax*8 + 8], rdi
inc dword [rbx]
jmp 0x1401337a7
mov rcx, qword [rbx + 0x210]
test rcx, rcx
jne 0x140133753
lea edx, [rcx + 4]
mov dword [rbx + 0x20c], 0x40
mov rcx, qword [0x140241998]
mov r8d, 0x200
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov qword [rbx + 0x210], rax
mov rcx, rax
mov eax, dword ds:[rbx + 0x208]
mov edx, dword [rbx + 0x20c]
cmp eax, edx
jne 0x14013379d
lea eax, [rdx + rdx]
mov r8, rcx
mov rcx, qword [0x140241998]
mov edx, 4
mov r9d, eax
shl r9, 3
mov dword [rbx + 0x20c], eax
call qword [sym.imp.ntdll.dll_RtlReAllocateHeap]
mov qword [rbx + 0x210], rax
mov eax, dword [rbx + 0x208]
mov rcx, qword [rbx + 0x210]
mov qword [rcx + rax*8], rdi
inc dword [rbx + 0x208]
mov r8, rbp
mov qword [rsi], rdi
xor edx, edx
mov rcx, rdi
call fcn.1401868c0
add rsi, 8
sub r14, 1
jne 0x1401336e0
mov rsi, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
mov qword [r12], r15
add rsp, 0x20
pop r15
pop r14
pop r12
ret