joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140005b40
Capabilities:
Resume thread

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x10]
sub rsp, 0x110
mov rdi, rdx
xor r15b, r15b
xor edx, edx
mov r12d, r8d
mov r13, rcx
mov sil, 1
mov r14d, edx
test r8d, r8d
je 0x140005d48
mov qword [rsp + 0x150], rbx
nop dword [rax]
mov rax, qword [rdi]
lea r9, [rsp + 0x20]
mov qword [rsp + 0x20], rdx
lea r8, [rsp + 0x30]
mov qword [rsp + 0x38], rdx
xorps xmm0, xmm0
mov dword [rsp + 0x48], edx
mov rcx, qword [rax]
mov qword [rsp + 0x28], rcx
lea rcx, [rbp + 0x68]
mov qword [rsp + 0x40], rdx
mov edx, 2
mov dword [rsp + 0x30], 0x30
movdqu xmmword [rsp + 0x50], xmm0
call qword [sym.imp.ntdll.dll_NtOpenThread]
mov ebx, eax
cmp eax, 0xc0000022
jne 0x140005bef
cmp byte [0x1401937ba], 0
je 0x140005bef
lea r8, [rsp + 0x20]
mov edx, 2
lea rcx, [rbp + 0x68]
call fcn.1400dcda0
mov ebx, eax
test ebx, ebx
js 0x140005c13
mov rcx, qword [rbp + 0x68]
xor edx, edx
call qword [sym.imp.ntdll.dll_NtResumeThread]
mov rcx, qword [rbp + 0x68]
mov ebx, eax
call qword [sym.imp.ntdll.dll_NtClose]
test ebx, ebx
jns 0x140005d14
xor sil, sil
test r15b, r15b
jne 0x140005ce5
mov rax, qword [rdi]
lea rcx, str.Unable_to_resume_thread__u
mov edx, dword [rax]
call fcn.1400013e0
lea r9, [rbp + 0x60]
mov r8d, ebx
mov rcx, r13
mov rdx, qword [rax + 8]
call fcn.140001570
test al, al
je 0x140005ce5
cmp byte [rbp + 0x60], r15b
je 0x140005ce0
mov rcx, qword [0x140197620]
test rcx, rcx
jne 0x140005c98
mov ebx, 0xc0000037
mov rax, qword [rdi]
lea rdx, str.resume
lea rcx, str.Unable_to__s_thread__u
mov r8d, dword [rax]
call fcn.1400013e0
xor r9d, r9d
mov r8d, ebx
mov rcx, r13
mov rdx, qword [rax + 8]
call sym.ProcessHacker.exe_PhShowContinueStatus
call sym.ProcessHacker.exe_PhUiDisconnectFromPhSvc
jmp 0x140005d14
mov rax, qword [rdi]
lea r8, [rsp + 0x60]
mov dword [rbp - 0x78], 0xa
mov qword [rbp - 0x68], 3
mov qword [rsp + 0x60], 0xb00088
mov rdx, qword [rax]
mov qword [rbp - 0x70], rdx
lea rdx, [rsp + 0x60]
call qword [sym.imp.ntdll.dll_NtRequestWaitReplyPort]
mov ebx, dword [rbp - 0x74]
test eax, eax
cmovs ebx, eax
test ebx, ebx
js 0x140005c66
mov sil, 1
call sym.ProcessHacker.exe_PhUiDisconnectFromPhSvc
jmp 0x140005d14
mov r15b, 1
jmp 0x140005d14
mov rax, qword [rdi]
lea rdx, str.resume
lea rcx, str.Unable_to__s_thread__u
mov r8d, dword [rax]
call fcn.1400013e0
xor r9d, r9d
mov r8d, ebx
mov rcx, r13
mov rdx, qword [rax + 8]
call sym.ProcessHacker.exe_PhShowContinueStatus
test al, al
je 0x140005d29
inc r14d
add rdi, 8
mov edx, 0
cmp r14d, r12d
jb 0x140005b80
mov rbx, qword [rsp + 0x150]
movzx eax, sil
add rsp, 0x110
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
movzx eax, sil
jmp 0x140005d35
Function at 0x1400095a0
Capabilities:
Get graphical window text

Disassembly:
push rbx
push rdi
push r14
sub rsp, 0x100
mov rbx, qword [0x140194240]
xor r14d, r14d
mov rdi, rcx
test rbx, rbx
jne 0x14000964f
lea rax, [0x140158ac8]
mov dword [rsp + 0x38], 0x160014
lea r9, [rsp + 0x130]
mov qword [rsp + 0x40], rax
lea r8, [rsp + 0x38]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.ntdll.dll_LdrGetDllHandle]
test eax, eax
js 0x140009632
mov rcx, qword [rsp + 0x130]
test rcx, rcx
je 0x140009632
lea rax, str.GetSendMessageReceiver
mov dword [rsp + 0x48], 0x170016
lea r9, [rsp + 0x30]
mov qword [rsp + 0x50], rax
xor r8d, r8d
lea rdx, [rsp + 0x48]
call qword [sym.imp.ntdll.dll_LdrGetProcedureAddress]
mov rbx, qword [rsp + 0x30]
test eax, eax
cmovs rbx, r14
jmp 0x140009635
mov rbx, r14
mov qword [0x140194240], rbx
test rbx, rbx
jne 0x14000964f
xor eax, eax
add rsp, 0x100
pop r14
pop rdi
pop rbx
ret
mov rcx, rbx
mov qword [rsp + 0xf0], rsi
call qword [sym.ProcessHacker.exe_PhDeleteCallback]
mov rcx, rdi
call rbx
mov rsi, rax
test rax, rax
je 0x140009793
lea rdx, [rsp + 0x128]
mov qword [rsp + 0xf8], rbp
mov rcx, rsi
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov ecx, dword [rsp + 0x128]
mov qword [rsp + 0x58], rcx
lea rcx, [rsp + 0x58]
mov eax, eax
mov qword [rsp + 0x60], rax
call sym.ProcessHacker.exe_PhGetClientIdName
mov rcx, rax
call sym.ProcessHacker.exe_PhAutoDereferenceObject
mov r8d, 0x40
lea rdx, [rsp + 0x70]
mov rcx, rsi
mov rbp, rax
call qword [sym.imp.USER32.dll_GetClassNameW]
test eax, eax
jne 0x1400096d0
mov word [rsp + 0x70], r14w
mov rcx, rsi
call qword [sym.imp.USER32.dll_GetWindowTextLengthW]
test eax, eax
je 0x14000974c
mov rdx, qword [0x140196800]
mov ebx, eax
add rbx, rbx
lea rcx, [rbx + 0x12]
call sym.ProcessHacker.exe_PhCreateObject
mov rdi, rax
mov rcx, rsi
mov qword [rax], rbx
add rax, 0x10
mov qword [rdi + 8], rax
mov word [rax + rbx], r14w
mov r8d, dword [rdi]
mov rdx, qword [rdi + 8]
shr r8d, 1
inc r8d
call qword [sym.imp.USER32.dll_GetWindowTextW]
test eax, eax
jne 0x140009754
call sym.ProcessHacker.exe_PhReferenceEmptyString
mov qword [rsp + 0x138], rax
lea rcx, [rdi - 0x10]
or eax, 0xffffffff
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x140009742
call fcn.1400c8bc0
mov rdi, qword [rsp + 0x138]
jmp 0x140009754
call sym.ProcessHacker.exe_PhReferenceEmptyString
mov rdi, rax
mov rcx, rdi
call sym.ProcessHacker.exe_PhAutoDereferenceObject
test rax, rax
je 0x140009767
mov rcx, qword [rax + 8]
jmp 0x14000976e
lea rcx, [0x14013ca58]
mov r8, qword [rbp + 8]
lea r9, [rsp + 0x70]
mov qword [rsp + 0x20], rcx
mov rdx, rsi
lea rcx, str.Window_0x_Ix___s_:__s___s_
call fcn.1400013e0
mov rbp, qword [rsp + 0xf8]
mov rsi, qword [rsp + 0xf0]
add rsp, 0x100
pop r14
pop rdi
pop rbx
ret
Function at 0x140009d80
Capabilities:
Query or enumerate registry value

Disassembly:
mov rax, rsp
push rsi
sub rsp, 0xa0
mov rdx, qword [0x140196800]
xor esi, esi
mov qword [rax + 0x20], rbx
mov rbx, qword [0x14018aaa0]
add rbx, qword [rcx]
mov qword [rax - 0x18], rdi
mov rdi, rcx
mov qword [rax - 0x28], r15
lea rcx, [rbx + 0x12]
call sym.ProcessHacker.exe_PhCreateObject
mov r15, rax
mov qword [rax], rbx
add rax, 0x10
mov qword [r15 + 8], rax
mov word [rax + rbx], si
mov r8, qword [0x14018aaa0]
mov rdx, qword [str.SoftwareClassesLocal_SettingsSoftwareMicrosoftWindowsCurrentVersionAppModelRepositoryPackages_]
mov rcx, qword [r15 + 8]
call fcn.14010e700
mov rcx, qword [r15 + 8]
add rcx, qword [0x14018aaa0]
mov r8, qword [rdi]
mov rdx, qword [rdi + 8]
call fcn.14010e700
movzx eax, word [r15]
mov word [rsp + 0x30], ax
add ax, 2
cmp qword [r15], 0xfffe
mov word [rsp + 0x32], ax
mov rax, qword [r15 + 8]
mov qword [rsp + 0x38], rax
ja 0x140009fbe
lea rax, [rsp + 0xc0]
xor r8d, r8d
lea r9, [rsp + 0x50]
mov qword [rsp + 0x20], rax
lea rdx, [rsp + 0x30]
lea rcx, [rsi - 9]
call fcn.1400da6c0
test eax, eax
js 0x140009fbe
lea r8, [rsp + 0x50]
mov edx, 0x20019
lea rcx, [rsp + 0xb8]
call qword [sym.imp.ntdll.dll_NtOpenKey]
mov rcx, qword [rsp + 0xc0]
mov ebx, eax
test rcx, rcx
je 0x140009e76
call qword [sym.imp.ntdll.dll_NtClose]
test ebx, ebx
js 0x140009fbe
mov rcx, qword [0x140196670]
lea rax, str.PackageRootFolder
mov qword [rsp + 0x98], rbp
mov r8d, 0x100
mov ebp, 0x10
mov qword [rsp + 0x88], r14
mov r14, qword [rsp + 0xb8]
mov dword [rsp + 0x40], 0x240022
mov qword [rsp + 0x48], rax
lea edx, [rbp - 0xc]
mov dword [rsp + 0xb0], 0x100
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov rbx, rax
nop dword [rax]
nop word [rax + rax]
lea rax, [rsp + 0xb0]
mov r9, rbx
mov qword [rsp + 0x28], rax
lea rdx, [rsp + 0x40]
mov eax, dword [rsp + 0xb0]
mov r8d, 2
mov rcx, r14
mov dword [rsp + 0x20], eax
call qword [sym.imp.ntdll.dll_NtQueryValueKey]
mov edi, eax
test eax, eax
jns 0x140009f5b
mov rcx, qword [0x140196670]
mov r8, rbx
xor edx, edx
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
cmp edi, 0x80000005
jne 0x140009f53
mov r8d, dword [rsp + 0xb0]
mov edx, 4
mov rcx, qword [0x140196670]
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov rbx, rax
add ebp, 0xffffffff
jne 0x140009ee0
jmp 0x140009f5b
mov rbx, qword [rsp + 0xb0]
mov r14, qword [rsp + 0x88]
mov rbp, qword [rsp + 0x98]
test edi, edi
js 0x140009fb0
mov ecx, dword [rbx + 4]
lea eax, [rcx - 1]
cmp eax, 1
jbe 0x140009f7f
cmp ecx, 7
jne 0x140009f9e
mov eax, dword [rbx + 8]
cmp eax, 2
jb 0x140009f96
lea rdx, [rax - 2]
lea rcx, [rbx + 0xc]
call sym.ProcessHacker.exe_PhCreateStringEx
jmp 0x140009f9b
call sym.ProcessHacker.exe_PhReferenceEmptyString
mov rsi, rax
mov rcx, qword [0x140196670]
mov r8, rbx
xor edx, edx
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
mov rcx, qword [rsp + 0xb8]
call qword [sym.imp.ntdll.dll_NtClose]
lea rcx, [r15 - 0x10]
or edx, 0xffffffff
lock xadd dword [rcx + 8], edx
mov r15, qword [rsp + 0x80]
mov rdi, qword [rsp + 0x90]
mov rbx, qword [rsp + 0xc8]
cmp edx, 1
jne 0x140009fec
call fcn.1400c8bc0
mov rax, rsi
add rsp, 0xa0
pop rsi
ret
Function at 0x14000bd10
Capabilities:
Log keystrokes via polling

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rdx
cmp qword [rcx], rdx
jne 0x14000bd54
cmp dword [rcx + 0x10], 0xffffff65
jne 0x14000bd54
movzx eax, word [rcx + 0x18]
cmp ax, 0x41
je 0x14000bd54
cmp ax, 0x43
jne 0x14000bd54
mov ecx, 0x11
call qword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jns 0x14000bd54
mov rcx, rbx
add rsp, 0x20
pop rbx
jmp sym.ProcessHacker.exe_PhCopyListView
add rsp, 0x20
pop rbx
ret

Function at 0x14000c670
Capabilities:
Create process on windows

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x20]
sub rsp, 0x120
mov r15, rcx
mov dword [rsp + 0x70], 0x1a0018
lea rsi, str.kernel32.dll
xor ecx, ecx
lea r9, [rbp + 0x68]
mov qword [rsp + 0x78], rsi
lea r8, [rsp + 0x70]
xor edx, edx
mov r14d, 0x18
call qword [sym.imp.ntdll.dll_LdrGetDllHandle]
test eax, eax
js 0x14000c852
mov rcx, qword [rbp + 0x68]
test rcx, rcx
je 0x14000c852
lea rax, str.DebugSetProcessKillOnExit
mov dword [rbp - 0x80], 0x1a0019
lea r9, [rbp + 0x70]
mov qword [rbp - 0x78], rax
xor r8d, r8d
lea rdx, [rbp - 0x80]
call qword [sym.imp.ntdll.dll_LdrGetProcedureAddress]
mov rdi, qword [rbp + 0x70]
xor r12d, r12d
test eax, eax
cmovs rdi, r12
test rdi, rdi
je 0x14000c852
lea r9, [rbp + 0x78]
mov dword [rbp - 0x70], 0x1a0018
lea r8, [rbp - 0x70]
mov qword [rbp - 0x68], rsi
xor edx, edx
xor ecx, ecx
call qword [sym.imp.ntdll.dll_LdrGetDllHandle]
test eax, eax
js 0x14000c852
mov rcx, qword [rbp + 0x78]
test rcx, rcx
je 0x14000c852
lea rax, str.DebugActiveProcessStop
mov dword [rbp - 0x60], 0x170016
lea r9, [rsp + 0x68]
mov qword [rbp - 0x58], rax
xor r8d, r8d
lea rdx, [rbp - 0x60]
call qword [sym.imp.ntdll.dll_LdrGetProcedureAddress]
mov rbx, qword [rsp + 0x68]
test eax, eax
cmovs rbx, r12
test rbx, rbx
je 0x14000c852
mov rax, qword gs:[0x30]
lea r8d, [r12 + 0x68]
xor sil, sil
xor edx, edx
mov rcx, qword [rax + 0x60]
mov rax, qword gs:[0x30]
movzx r14d, byte [rcx + 1]
mov rcx, qword [rax + 0x60]
mov byte [rcx + 1], sil
lea rcx, [rbp - 0x50]
call fcn.14010ed90
xor eax, eax
mov dword [rbp - 0x50], 0x68
mov qword [rsp + 0x50], rax
xor r9d, r9d
mov qword [rsp + 0x58], rax
xor r8d, r8d
mov qword [rsp + 0x60], rax
xor edx, edx
lea rax, [rsp + 0x50]
mov rcx, r15
mov qword [rsp + 0x48], rax
lea rax, [rbp - 0x50]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], 3
mov dword [rsp + 0x20], r12d
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x14000c81b
mov rcx, rdi
call qword [sym.ProcessHacker.exe_PhDeleteCallback]
xor ecx, ecx
call rdi
mov rcx, rbx
call qword [sym.ProcessHacker.exe_PhDeleteCallback]
mov ecx, dword [rsp + 0x60]
call rbx
mov sil, 1
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x14000c82b
call qword [sym.imp.ntdll.dll_NtClose]
mov rcx, qword [rsp + 0x58]
test rcx, rcx
je 0x14000c83b
call qword [sym.imp.ntdll.dll_NtClose]
mov rcx, qword gs:[0x30]
movzx eax, sil
mov rdx, qword [rcx + 0x60]
mov byte [rdx + 1], r14b
jmp 0x14000c854
xor al, al
add rsp, 0x120
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
Function at 0x140012b60
Capabilities:
Get graphical window text

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x500
mov rbx, rcx
mov dword [rsp + 0x24], edx
xor ecx, ecx
mov dword [rsp + 0x84], r8d
lea rax, [rsp + 0xe0]
mov dword [rsp + 0x28], ecx
mov qword [rsp + 0x38], rax
lea r9, [rsp + 0x20]
mov dword [rsp + 0x88], ecx
lea rax, [rsp + 0x2f0]
mov edi, r8d
mov qword [rsp + 0x98], rax
mov esi, edx
mov dword [rsp + 0x20], 0xd
mov rcx, rbx
mov dword [rsp + 0x30], 0xffffffff
xor r8d, r8d
mov dword [rsp + 0x40], 0x208
mov edx, 0x104b
mov dword [rsp + 0x80], 0xd
mov dword [rsp + 0x90], 0xffffffff
mov dword [rsp + 0xa0], 0x208
call qword [sym.imp.USER32.dll_SendMessageW]
test eax, eax
je 0x140012c5a
lea r9, [rsp + 0x80]
xor r8d, r8d
mov edx, 0x104b
mov rcx, rbx
call qword [sym.imp.USER32.dll_SendMessageW]
test eax, eax
je 0x140012c5a
lea r9, [rsp + 0x20]
mov dword [rsp + 0x24], edi
xor r8d, r8d
mov dword [rsp + 0x84], esi
mov edx, 0x104c
mov rcx, rbx
call qword [sym.imp.USER32.dll_SendMessageW]
lea r9, [rsp + 0x80]
xor r8d, r8d
mov edx, 0x104c
mov rcx, rbx
call qword [sym.imp.USER32.dll_SendMessageW]
lea r11, [rsp + 0x500]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret
Function at 0x14002e110
Capabilities:
Lock the desktop

Disassembly:
sub rsp, 0x38
add ecx, 0xffff6320
cmp ecx, 0x78
ja case.0x14002e13c.40166
lea rdx, [0x140000000]
movzx eax, byte [rdx + rcx + 0x2e2a8]
mov ecx, dword [rdx + rax*4 + 0x2e284]
add rcx, rdx
jmp rcx
mov qword [rsp + 0x30], rdi
mov rdi, qword [sym.ProcessHacker.exe_PhMainWndHandle]
call qword [sym.imp.USER32.dll_LockWorkStation]
test eax, eax
jne 0x14002e1dd
mov qword [rsp + 0x48], rbx
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x14002e170
xor ecx, ecx
call sym.ProcessHacker.exe_PhGetNtMessage
jmp 0x14002e177
mov ecx, eax
call sym.ProcessHacker.exe_PhGetWin32Message
lea r9, str.Unable_to_lock_the_computer
mov rbx, rax
mov rcx, rdi
test rax, rax
jne 0x14002e1a9
lea r8, [0x1401689f8]
lea edx, [rax + 0x10]
call sym.ProcessHacker.exe_PhShowMessage
mov rbx, qword [rsp + 0x48]
mov al, 1
mov rdi, qword [rsp + 0x30]
add rsp, 0x38
ret
mov rax, qword [rbx + 8]
mov edx, 0x20
mov r8d, 0xfffe
mov qword [rsp + 0x20], rax
call sym.ProcessHacker.exe_PhShowMessage2
lea rcx, [rbx - 0x10]
or eax, 0xffffffff
lock xadd dword [rcx + 8], eax
sub eax, 1
jne 0x14002e1d8
call fcn.1400c8bc0
mov rbx, qword [rsp + 0x48]
mov al, 1
mov rdi, qword [rsp + 0x30]
add rsp, 0x38
ret
mov rcx, qword [sym.ProcessHacker.exe_PhMainWndHandle]
call sym.ProcessHacker.exe_PhUiLogoffComputer
mov al, 1
add rsp, 0x38
ret
mov rcx, qword [sym.ProcessHacker.exe_PhMainWndHandle]
call sym.ProcessHacker.exe_PhUiSleepComputer
mov al, 1
add rsp, 0x38
ret
mov rcx, qword [sym.ProcessHacker.exe_PhMainWndHandle]
call sym.ProcessHacker.exe_PhUiHibernateComputer
mov al, 1
add rsp, 0x38
ret
mov rcx, qword [sym.ProcessHacker.exe_PhMainWndHandle]
xor edx, edx
call sym.ProcessHacker.exe_PhUiRestartComputer
mov al, 1
add rsp, 0x38
ret
mov rcx, qword [sym.ProcessHacker.exe_PhMainWndHandle]
mov edx, 0x1000000
call sym.ProcessHacker.exe_PhUiRestartComputer
mov al, 1
add rsp, 0x38
ret
mov rcx, qword [sym.ProcessHacker.exe_PhMainWndHandle]
xor edx, edx
call sym.ProcessHacker.exe_PhUiShutdownComputer
mov al, 1
add rsp, 0x38
ret
mov rcx, qword [sym.ProcessHacker.exe_PhMainWndHandle]
mov edx, 0x400000
call sym.ProcessHacker.exe_PhUiShutdownComputer
mov al, 1
add rsp, 0x38
ret
xor al, al
add rsp, 0x38
ret
Function at 0x14004e900
Capabilities:
Map section object

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x90
mov rbx, qword [rdx]
lea r12, [0x14015b828]
mov r14, rcx
xor edi, edi
mov rcx, rbx
mov qword [rsp + 0xe8], rdi
mov r15, rdx
mov rsi, r12
mov ebp, edi
call qword [sym.ProcessHacker.exe_PhDeleteCallback]
mov r8, qword [r15 + 8]
lea edx, [rdi + 5]
lea rcx, [rsp + 0xd8]
call rbx
test eax, eax
jns 0x14004e974
mov rbx, qword [r15]
mov rcx, rbx
call qword [sym.ProcessHacker.exe_PhDeleteCallback]
mov r8, qword [r15 + 8]
lea edx, [rdi + 5]
lea rcx, [rsp + 0xd8]
call rbx
test eax, eax
js 0x14004eb20
mov rcx, qword [rsp + 0xd8]
lea r8, [rsp + 0x58]
mov r9d, 0x18
mov qword [rsp + 0x20], rdi
xor edx, edx
call qword [sym.imp.ntdll.dll_NtQuerySection]
test eax, eax
js 0x14004ea14
mov eax, dword [rsp + 0x60]
bt eax, 0x1b
jae 0x14004e9ab
lea rsi, [0x14015fac8]
jmp 0x14004e9d8
bt eax, 0x17
jae 0x14004e9ba
lea rsi, [0x14015abe8]
jmp 0x14004e9d8
bt eax, 0x18
jae 0x14004e9c9
lea rsi, [0x14015fb00]
jmp 0x14004e9d8
bt eax, 0x1a
lea rsi, str.Reserve
cmovae rsi, r12
movzx eax, byte [0x140190e48]
lea rcx, [rsp + 0x70]
xor r8d, r8d
mov byte [rsp + 0x7a], al
mov rax, qword [rsp + 0x68]
mov dword [rsp + 0x70], 0x10c
mov qword [rsp + 0x80], rax
lea edx, [r8 + 1]
call sym.ProcessHacker.exe_PhFormat
mov rcx, rax
call sym.ProcessHacker.exe_PhAutoDereferenceObject
mov rbp, rax
mov rcx, qword [rsp + 0xd8]
lea rax, [rsp + 0x50]
mov dword [rsp + 0x48], 2
lea r8, [rsp + 0xe0]
mov dword [rsp + 0x40], edi
xor r9d, r9d
mov dword [rsp + 0x38], 1
or rdx, 0xffffffffffffffff
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x50], 1
mov qword [rsp + 0xe0], rdi
call qword [sym.imp.ntdll.dll_NtMapViewOfSection]
test eax, eax
js 0x14004eac7
mov rdx, qword [rsp + 0xe0]
lea r8, [rsp + 0xe8]
or rcx, 0xffffffffffffffff
call sym.ProcessHacker.exe_PhGetProcessMappedFileName
mov rdx, qword [rsp + 0xe0]
or rcx, 0xffffffffffffffff
mov ebx, eax
call qword [sym.imp.ntdll.dll_NtUnmapViewOfSection]
mov rdi, qword [rsp + 0xe8]
test ebx, ebx
js 0x14004eac7
mov rcx, rdi
call sym.ProcessHacker.exe_PhAutoDereferenceObject
mov rcx, rdi
call sym.ProcessHacker.exe_PhResolveDevicePrefix
test rax, rax
je 0x14004eac7
mov rcx, rax
call sym.ProcessHacker.exe_PhAutoDereferenceObject
mov rdi, rax
mov r8, rsi
mov edx, 0x408
mov rcx, r14
call qword [sym.imp.USER32.dll_SetDlgItemTextW]
test rbp, rbp
je 0x14004eae1
mov r12, qword [rbp + 8]
mov r8, r12
mov edx, 0x44a
mov rcx, r14
call qword [sym.imp.USER32.dll_SetDlgItemTextW]
test rdi, rdi
je 0x14004eafd
mov r8, qword [rdi + 8]
jmp 0x14004eb04
lea r8, [0x14015f648]
mov edx, 0x3ee
mov rcx, r14
call qword [sym.imp.USER32.dll_SetDlgItemTextW]
mov rcx, qword [rsp + 0xd8]
call qword [sym.imp.ntdll.dll_NtClose]
add rsp, 0x90
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x140072ea0
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, rcx
mov edi, edx
mov ecx, dword [0x140197610]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov r8d, dword [rbx + 4]
mov r9d, dword [rbx]
mov rcx, qword [rax]
mov r10, qword [rcx + 0x38]
add r8, r10
add r9, r8
cmp r9, r8
jb 0x140072efc
cmp r8, r10
jb 0x140072efc
cmp r9, qword [rcx + 0x40]
ja 0x140072efc
mov eax, 0
lea edx, [rdi - 1]
test r8, rdx
cmovne r8, rax
mov rax, r8
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
xor eax, eax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x14007f9d0
Capabilities:
Get system information on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r14
push r15
sub rsp, 0x20
movsx r8d, byte [0x1401967d8]
xor r9d, r9d
mov rdx, qword [0x140197368]
mov r15, rcx
shl r8d, 3
lea ecx, [r9 + 0x53]
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
movsx esi, byte [0x1401967d8]
xor ebx, ebx
mov r14, qword [0x140197368]
mov r11d, ebx
mov edx, ebx
lea edi, [rbx + 2]
cmp esi, 4
jb 0x14007fa97
mov r9d, esi
xorps xmm2, xmm2
and r9d, 0xfffffffc
xorps xmm1, xmm1
mov r8d, edi
nop word [rax + rax]
mov eax, edx
add edx, 4
movq xmm0, qword [r14 + rax*8]
lea eax, [r8 - 1]
movhpd xmm0, qword [r14 + rax*8]
mov eax, r8d
paddq xmm0, xmm2
movdqa xmm2, xmm0
movq xmm0, qword [r14 + rax*8]
lea eax, [r8 + 1]
movhpd xmm0, qword [r14 + rax*8]
add r8d, 4
paddq xmm0, xmm1
movdqa xmm1, xmm0
cmp edx, r9d
jb 0x14007fa40
paddq xmm1, xmm2
movdqa xmm0, xmm1
psrldq xmm0, 8
paddq xmm1, xmm0
movq r11, xmm1
mov r8, rbx
mov r9, rbx
cmp edx, esi
jae 0x14007fae2
mov eax, esi
sub eax, edx
cmp eax, edi
jb 0x14007fad1
mov eax, edx
lea rcx, [r14 + rax*8]
mov eax, esi
sub eax, edx
sub eax, edi
shr eax, 1
inc eax
mov r10d, eax
lea edx, [rdx + rax*2]
nop
add r8, qword [rcx]
add r9, qword [rcx + 8]
lea rcx, [rcx + 0x10]
sub r10, 1
jne 0x14007fac0
cmp edx, esi
jae 0x14007fadb
mov eax, edx
add r11, qword [r14 + rax*8]
lea rax, [r9 + r8]
add r11, rax
mov rdx, qword [0x140197338]
lea r8d, [rsi*8]
xor r9d, r9d
mov rax, r11
sub rax, qword [0x140197310]
mov qword [0x140197318], rax
mov qword [0x140197310], r11
lea ecx, [r9 + 0x6c]
mov qword [r15], rax
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
movsx esi, byte [0x1401967d8]
mov r10, rbx
mov r11, qword [0x140197338]
mov edx, ebx
cmp esi, 4
jb 0x14007fb93
mov r8d, esi
xorps xmm2, xmm2
and r8d, 0xfffffffc
xorps xmm1, xmm1
nop
mov eax, edx
add edx, 4
movq xmm0, qword [r11 + rax*8]
lea eax, [rdi - 1]
movhpd xmm0, qword [r11 + rax*8]
mov eax, edi
paddq xmm0, xmm2
movdqa xmm2, xmm0
movq xmm0, qword [r11 + rax*8]
lea eax, [rdi + 1]
movhpd xmm0, qword [r11 + rax*8]
add edi, 4
paddq xmm0, xmm1
movdqa xmm1, xmm0
cmp edx, r8d
jb 0x14007fb40
paddq xmm1, xmm2
movdqa xmm0, xmm1
psrldq xmm0, 8
paddq xmm1, xmm0
movq r10, xmm1
mov r8, rbx
cmp edx, esi
jae 0x14007fbe2
mov eax, esi
sub eax, edx
cmp eax, 2
jb 0x14007fbd1
mov eax, edx
lea rcx, [r11 + rax*8]
mov eax, esi
sub eax, edx
sub eax, 2
shr eax, 1
inc eax
mov r9d, eax
lea edx, [rdx + rax*2]
nop word [rax + rax]
add rbx, qword [rcx]
add r8, qword [rcx + 8]
lea rcx, [rcx + 0x10]
sub r9, 1
jne 0x14007fbc0
cmp edx, esi
jae 0x14007fbdb
mov eax, edx
add r10, qword [r11 + rax*8]
lea rax, [r8 + rbx]
add r10, rax
mov rbx, qword [rsp + 0x30]
mov rax, r10
sub rax, qword [0x140197320]
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x40]
mov r14, qword [rsp + 0x48]
mov qword [0x140197328], rax
mov qword [0x140197320], r10
add rsp, 0x20
pop r15
ret