joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140021330
Capabilities:
Get system information on windows

Disassembly:
push rsi
push r14
sub rsp, 0x28
mov r8d, edx
mov esi, edx
mov r14, rcx
sub r8d, 5
je 0x14002136d
sub r8d, 0x34
je 0x140021366
cmp r8d, 0x5b
je 0x14002135f
mov eax, 0xc0000003
add rsp, 0x28
pop r14
pop rsi
ret
mov eax, 2
jmp 0x14002136f
mov eax, 1
jmp 0x14002136f
xor eax, eax
mov qword [rsp + 0x40], rbx
lea rcx, [0x140152ea0]
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x20], r15
lea r15, [rcx + rax*4]
mov eax, dword [rcx + rax*4]
mov dword [rsp + 0x48], eax
mov r8d, eax
mov rcx, qword [sym.ProcessHacker.exe_PhHeapHandle]
mov edx, 4
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov r8d, dword [rsp + 0x48]
lea r9, [rsp + 0x48]
mov rdx, rax
mov ecx, esi
mov rdi, rax
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
mov ebx, eax
cmp eax, 0xc0000023
je 0x1400213cd
cmp eax, 0xc0000004
jne 0x1400213e6
mov rcx, qword [sym.ProcessHacker.exe_PhHeapHandle]
mov r8, rdi
xor edx, edx
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
mov r8d, dword [rsp + 0x48]
jmp 0x140021393
test eax, eax
jns 0x1400213fe
mov rcx, qword [sym.ProcessHacker.exe_PhHeapHandle]
mov r8, rdi
xor edx, edx
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
jmp 0x14002140f
mov eax, dword [rsp + 0x48]
cmp eax, 0x100000
ja 0x14002140c
mov dword [r15], eax
mov qword [r14], rdi
mov rdi, qword [rsp + 0x50]
mov eax, ebx
mov rbx, qword [rsp + 0x40]
mov r15, qword [rsp + 0x20]
add rsp, 0x28
pop r14
pop rsi
ret

Function at 0x140021430
Capabilities:
Get system information on windows
Make suspicious ntquerysysteminformation call

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
mov eax, dword [0x140152d58]
mov ebx, edx
mov rsi, rcx
mov dword [rsp + 0x48], eax
mov rcx, qword [sym.ProcessHacker.exe_PhHeapHandle]
mov r8d, eax
mov edx, 4
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov dword [rsp + 0x20], ebx
mov ecx, dword [rsp + 0x48]
lea r9, [rsp + 0x48]
mov r8d, 0x10
mov dword [rsp + 0x24], ecx
lea rdx, [rsp + 0x20]
mov qword [rsp + 0x28], rax
mov rdi, rax
lea ecx, [r8 + 0x25]
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
mov ebx, eax
cmp eax, 0xc0000023
je 0x1400214a1
cmp eax, 0xc0000004
jne 0x1400214cc
mov rcx, qword [sym.ProcessHacker.exe_PhHeapHandle]
mov r8, rdi
xor edx, edx
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
mov r8d, dword [rsp + 0x48]
mov edx, 4
mov rcx, qword [sym.ProcessHacker.exe_PhHeapHandle]
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
jmp 0x140021467
test eax, eax
jns 0x1400214f4
mov rcx, qword [sym.ProcessHacker.exe_PhHeapHandle]
mov r8, rdi
xor edx, edx
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
mov eax, ebx
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
mov ecx, dword [0x140152d58]
cmp dword [rsp + 0x48], 0x100000
mov rbx, qword [rsp + 0x40]
cmovbe ecx, dword [rsp + 0x48]
mov qword [rsi], rdi
mov rsi, qword [rsp + 0x50]
mov dword [0x140152d58], ecx
add rsp, 0x30
pop rdi
ret
Function at 0x1400216a0
Capabilities:
Get system information on windows
Make suspicious ntquerysysteminformation call

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push r14
sub rsp, 0x20
mov ebx, dword [0x140152c2c]
mov r14, rcx
mov rcx, qword [sym.ProcessHacker.exe_PhHeapHandle]
mov r8d, ebx
mov edx, 4
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
xor r9d, r9d
mov r8d, ebx
mov rdx, rax
mov rdi, rax
lea ecx, [r9 + 0x10]
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
mov esi, eax
cmp eax, 0xc0000004
jne 0x140021742
mov rcx, qword [sym.ProcessHacker.exe_PhHeapHandle]
mov r8, rdi
xor edx, edx
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
add ebx, ebx
cmp ebx, 0x10000000
ja 0x14002175a
mov rcx, qword [sym.ProcessHacker.exe_PhHeapHandle]
mov edx, 4
mov r8d, ebx
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
xor r9d, r9d
mov r8d, ebx
mov rdx, rax
mov rdi, rax
lea ecx, [r9 + 0x10]
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
mov esi, eax
cmp eax, 0xc0000004
je 0x1400216f2
test esi, esi
jns 0x140021761
mov rcx, qword [sym.ProcessHacker.exe_PhHeapHandle]
mov r8, rdi
xor edx, edx
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
jmp 0x140021779
mov eax, 0xc000009a
jmp 0x14002177b
mov eax, dword [0x140152c2c]
cmp ebx, 0x100000
mov qword [r14], rdi
cmovbe eax, ebx
mov dword [0x140152c2c], eax
mov eax, esi
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x40]
add rsp, 0x20
pop r14
ret

Function at 0x1400217a0
Capabilities:
Get system information on windows
Make suspicious ntquerysysteminformation call

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push r14
sub rsp, 0x20
mov ebx, dword [0x140152d5c]
mov r14, rcx
mov rcx, qword [sym.ProcessHacker.exe_PhHeapHandle]
mov r8d, ebx
mov edx, 4
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
xor r9d, r9d
mov r8d, ebx
mov rdx, rax
mov rdi, rax
lea ecx, [r9 + 0x40]
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
mov esi, eax
cmp eax, 0xc0000004
jne 0x140021842
mov rcx, qword [sym.ProcessHacker.exe_PhHeapHandle]
mov r8, rdi
xor edx, edx
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
add ebx, ebx
cmp ebx, 0x10000000
ja 0x14002185a
mov rcx, qword [sym.ProcessHacker.exe_PhHeapHandle]
mov edx, 4
mov r8d, ebx
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
xor r9d, r9d
mov r8d, ebx
mov rdx, rax
mov rdi, rax
lea ecx, [r9 + 0x40]
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
mov esi, eax
cmp eax, 0xc0000004
je 0x1400217f2
test esi, esi
jns 0x140021861
mov rcx, qword [sym.ProcessHacker.exe_PhHeapHandle]
mov r8, rdi
xor edx, edx
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
jmp 0x140021879
mov eax, 0xc000009a
jmp 0x14002187b
mov eax, dword [0x140152d5c]
cmp ebx, 0x200000
mov qword [r14], rdi
cmovbe eax, ebx
mov dword [0x140152d5c], eax
mov eax, esi
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x40]
add rsp, 0x20
pop r14
ret
Function at 0x1400218a0
Capabilities:
Get system information on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push r14
sub rsp, 0x20
mov r14, rcx
mov ebx, 0x200
mov rcx, qword [sym.ProcessHacker.exe_PhHeapHandle]
mov r8d, ebx
mov edx, 4
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
xor r9d, r9d
mov r8d, ebx
mov rdx, rax
mov rdi, rax
lea ecx, [r9 + 0x12]
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
mov esi, eax
cmp eax, 0xc0000004
jne 0x140021943
mov rcx, qword [sym.ProcessHacker.exe_PhHeapHandle]
mov r8, rdi
xor edx, edx
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
lea eax, [rbx + rbx]
mov ebx, eax
cmp eax, 0x10000000
ja 0x14002195b
mov rcx, qword [sym.ProcessHacker.exe_PhHeapHandle]
mov r8d, ebx
mov edx, 4
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
xor r9d, r9d
mov r8d, ebx
mov rdx, rax
mov rdi, rax
lea ecx, [r9 + 0x12]
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
mov esi, eax
cmp eax, 0xc0000004
je 0x1400218f1
test esi, esi
jns 0x140021962
mov rcx, qword [sym.ProcessHacker.exe_PhHeapHandle]
mov r8, rdi
xor edx, edx
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
jmp 0x140021965
mov eax, 0xc000009a
jmp 0x140021967
mov qword [r14], rdi
mov eax, esi
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x40]
add rsp, 0x20
pop r14
ret

Function at 0x140021980
Capabilities:
Get system information on windows
Make suspicious ntquerysysteminformation call

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x40
mov rsi, rdx
mov rbx, rcx
mov rcx, qword [sym.ProcessHacker.exe_PhHeapHandle]
mov ebp, 0x100
mov r8d, ebp
mov edx, 4
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
xor r9d, r9d
mov qword [rsp + 0x20], rbx
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x28], 0x1000000
mov rdi, rax
mov qword [rsp + 0x30], rax
lea r8d, [r9 + 0x18]
lea ecx, [r9 + 0x58]
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
mov ebx, eax
cmp eax, 0xc0000004
jne 0x140021a32
mov rcx, qword [sym.ProcessHacker.exe_PhHeapHandle]
mov r8, rdi
xor edx, edx
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
movzx r8d, word [rsp + 0x2a]
mov edx, 4
mov rcx, qword [sym.ProcessHacker.exe_PhHeapHandle]
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
xor r9d, r9d
lea rdx, [rsp + 0x20]
mov rdi, rax
mov qword [rsp + 0x30], rax
lea r8d, [r9 + 0x18]
lea ecx, [r9 + 0x58]
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
mov ebx, eax
test ebx, ebx
js 0x140021a48
movzx edx, word [rsp + 0x28]
mov rcx, qword [rsp + 0x30]
call sym.ProcessHacker.exe_PhCreateStringEx
mov qword [rsi], rax
mov rcx, qword [sym.ProcessHacker.exe_PhHeapHandle]
mov r8, rdi
xor edx, edx
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
mov rbp, qword [rsp + 0x58]
mov eax, ebx
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret
Function at 0x140022170
Capabilities:
Get file attributes

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x70
mov r14d, 0x400
mov r12, r9
mov r8d, r14d
mov r13, rdx
mov r15, rcx
mov dil, 1
mov rcx, qword [sym.ProcessHacker.exe_PhHeapHandle]
mov edx, 4
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov rbp, rax
nop dword [rax + rax]
mov byte [rsp + 0x50], dil
lea rax, [rsp + 0x60]
mov qword [rsp + 0x48], r13
xor r9d, r9d
mov byte [rsp + 0x40], 0
xor r8d, r8d
mov dword [rsp + 0x38], 1
xor edx, edx
mov dword [rsp + 0x30], r14d
mov rcx, r15
mov qword [rsp + 0x28], rbp
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntdll.dll_NtQueryDirectoryFile]
mov ebx, eax
cmp eax, 0x103
jne 0x14002221c
xor r8d, r8d
xor edx, edx
mov rcx, r15
call qword [sym.imp.ntdll.dll_NtWaitForSingleObject]
test eax, eax
mov ebx, eax
cmovns ebx, dword [rsp + 0x60]
cmp ebx, 0x80000005
je 0x14002222c
cmp ebx, 0xc0000004
jne 0x14002224d
mov rcx, qword [sym.ProcessHacker.exe_PhHeapHandle]
mov r8, rbp
xor edx, edx
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
lea eax, [r14 + r14]
mov r14d, eax
mov r8d, eax
jmp 0x1400221a3
mov r13, qword [rsp + 0xc0]
cmp ebx, 0x80000006
je 0x14002229f
test ebx, ebx
js 0x1400222a1
mov rdx, r12
mov rcx, rbp
xor esi, esi
mov rdi, rbp
call r13
test al, al
je 0x1400222a1
mov eax, dword [rdi]
test eax, eax
je 0x14002228f
add esi, eax
mov rdx, r12
mov edi, esi
add rdi, rbp
mov rcx, rdi
call r13
test al, al
jne 0x140022273
jmp 0x1400222a1
mov r13, qword [rsp + 0xb8]
xor dil, dil
jmp 0x1400221c0
xor ebx, ebx
mov rcx, qword [sym.ProcessHacker.exe_PhHeapHandle]
mov r8, rbp
xor edx, edx
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
mov eax, ebx
mov rbx, qword [rsp + 0xb0]
add rsp, 0x70
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret

Function at 0x1400222d0
Capabilities:
Get file attributes

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x40
mov esi, 0x200
mov r14, r8
mov r8d, esi
mov rbp, rcx
mov rcx, qword [sym.ProcessHacker.exe_PhHeapHandle]
mov edx, 4
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov r9d, esi
mov dword [rsp + 0x20], 0x16
mov r8, rax
lea rdx, [rsp + 0x30]
mov rcx, rbp
mov rdi, rax
call qword [sym.imp.ntdll.dll_NtQueryInformationFile]
mov ebx, eax
cmp eax, 0x80000005
je 0x14001f1a0
cmp eax, 0xc0000023
je 0x14001f1a0
cmp eax, 0xc0000004
jne 0x14001f1bc
mov rcx, qword [sym.ProcessHacker.exe_PhHeapHandle]
mov r8, rdi
xor edx, edx
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
lea eax, [rsi + rsi]
mov esi, eax
mov r8d, eax
jmp 0x14001f158
test eax, eax
js 0x14001f1c5
mov qword [r14], rdi
jmp 0x14001f1d9
mov rcx, qword [sym.ProcessHacker.exe_PhHeapHandle]
mov r8, rdi
xor edx, edx
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
mov eax, ebx
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
ret
mov r8, rdx
jmp 0x14001f130
Function at 0x140025330
Capabilities:
Allocate thread local storage

Disassembly:
push rbx
sub rsp, 0x60
lea rcx, [0x14015a380]
call qword [sym.imp.ntdll.dll_RtlInitializeSListHead]
lea rcx, [0x14015a3a0]
call qword [sym.imp.ntdll.dll_RtlInitializeSListHead]
xor eax, eax
mov dword [0x14015a3b4], 0x200
mov qword [rsp + 0x20], rax
lea rcx, str.Type
mov qword [rsp + 0x28], rax
xor ebx, ebx
mov qword [rsp + 0x30], rax
xor r8d, r8d
mov qword [rsp + 0x38], rax
xor edx, edx
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rax
lea rax, [rsp + 0x20]
mov qword [0x14015a390], rax
lea rax, [rsp + 0x20]
mov qword [0x14015e9c0], rax
mov dword [0x14015a3b0], ebx
mov qword [0x14015a3b8], 0x40
call sym.ProcessHacker.exe_PhCreateObjectType
xor r8d, r8d
mov qword [0x14015a390], rax
xor edx, edx
movzx ecx, byte [rax + 2]
mov word [rax - 0x10], cx
lea rcx, str.Alloc
mov dword [rax + 4], 1
call sym.ProcessHacker.exe_PhCreateObjectType
mov qword [0x14015a378], rax
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
cmp eax, 0xffffffff
mov dword [0x14015bdc8], eax
mov ecx, 0xc000009a
cmove ebx, ecx
mov eax, ebx
add rsp, 0x60
pop rbx
ret

Function at 0x140025a00
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rbx
sub rsp, 0x20
xor eax, eax
mov rbx, rcx
mov dword [rcx], eax
mov qword [rcx + 0x208], rax
mov qword [rcx + 0x210], rax
mov ecx, dword [0x14015bdc8]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ecx, dword [0x14015bdc8]
mov rdx, rbx
mov qword [rbx + 0x218], rax
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
jne 0x140025a4d
mov ecx, 0xc0000001
call qword [sym.imp.ntdll.dll_RtlRaiseStatus]
int3
add rsp, 0x20
pop rbx
ret

Function at 0x140025a60
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
call sym.ProcessHacker.exe_PhDrainAutoPool
mov ecx, dword [0x14015bdc8]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp rax, rbx
je 0x140025a8b
mov ecx, 0xc0000001
call qword [sym.imp.ntdll.dll_RtlRaiseStatus]
int3
mov rdx, qword [rbx + 0x218]
mov ecx, dword [0x14015bdc8]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
jne 0x140025aae
mov ecx, 0xc0000001
call qword [sym.imp.ntdll.dll_RtlRaiseStatus]
int3
mov r8, qword [rbx + 0x210]
test r8, r8
je 0x140025acf
mov rcx, qword [sym.ProcessHacker.exe_PhHeapHandle]
xor edx, edx
add rsp, 0x20
pop rbx
jmp qword [sym.imp.ntdll.dll_RtlFreeHeap]
add rsp, 0x20
pop rbx
ret
Function at 0x140025bc0
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
mov ecx, dword [0x14015bdc8]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, rax
test rdi, rdi
jne 0x140025bee
xor eax, eax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
mov eax, dword [rax]
cmp eax, 0x40
jae 0x140025c0a
mov qword [rbx + rax*8 + 8], rdi
mov rax, rdi
inc dword [rbx]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
cmp qword [rbx + 0x210], 0
jne 0x140025c3d
mov dword [rbx + 0x20c], 0x40
mov edx, 4
mov rcx, qword [sym.ProcessHacker.exe_PhHeapHandle]
mov r8d, 0x200
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov qword [rbx + 0x210], rax
mov eax, dword [rbx + 0x20c]
cmp dword [rbx + 0x208], eax
jne 0x140025c7a
mov r8, qword [rbx + 0x210]
add eax, eax
mov r9d, eax
mov edx, 4
mov dword [rbx + 0x20c], eax
mov rcx, qword [sym.ProcessHacker.exe_PhHeapHandle]
shl r9, 3
call qword [sym.imp.ntdll.dll_RtlReAllocateHeap]
mov qword [rbx + 0x210], rax
mov ecx, dword [rbx + 0x208]
mov rax, qword [rbx + 0x210]
mov qword [rax + rcx*8], rdi
mov rax, rdi
inc dword [rbx + 0x208]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x140025ca0
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x28
test rcx, rcx
jne 0x140025cb5
mov ecx, 0xc000000d
call qword [sym.imp.ntdll.dll_RtlRaiseStatus]
int3
add rsp, 0x28
jmp sym.ProcessHacker.exe_PhAutoDereferenceObject
Function at 0x1400282f0
Capabilities:
Hash data using sha1

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x70
mov edi, dword [rcx + 0x30]
mov r14, rdx
mov eax, edi
mov rbp, rcx
and eax, 0x3f
mov esi, 0x78
cmp eax, 0x38
jae 0x140028327
mov esi, 0x38
sub esi, eax
mov ebx, edi
mov eax, dword [rcx + 0x2c]
lea edi, [rdi*8]
shl eax, 3
lea rcx, [rsp + 0x21]
shr ebx, 0x1d
xor edx, edx
or ebx, eax
lea eax, [rsi - 1]
movsxd r8, eax
call fcn.1400e2690
movsxd rax, esi
lea rdx, [rsp + 0x20]
add rdx, rax
mov byte [rsp + 0x20], 0x80
mov eax, ebx
lea r8d, [rsi + 8]
shr eax, 0x10
mov ecx, ebx
and ecx, 0xff0000
or ecx, eax
mov eax, ebx
and eax, 0xff00
shr ecx, 8
shl ebx, 0x10
or eax, ebx
shl eax, 8
or ecx, eax
mov eax, edi
mov dword [rdx], ecx
mov ecx, edi
shr eax, 0x10
and ecx, 0xff0000
or ecx, eax
mov eax, edi
and eax, 0xff00
shr ecx, 8
shl edi, 0x10
or eax, edi
shl eax, 8
or ecx, eax
mov dword [rdx + 4], ecx
lea rdx, [rsp + 0x20]
mov rcx, rbp
call fcn.140028210
mov ecx, dword [rbp + 0x18]
mov edx, ecx
shl edx, 0x10
mov eax, ecx
and eax, 0xff00
shr ecx, 8
or edx, eax
and ecx, 0xff00
movzx eax, byte [rbp + 0x1b]
shl edx, 8
or edx, ecx
or edx, eax
mov dword [r14], edx
mov ecx, dword [rbp + 0x1c]
mov edx, ecx
shl edx, 0x10
mov eax, ecx
and eax, 0xff00
shr ecx, 8
or edx, eax
and ecx, 0xff00
movzx eax, byte [rbp + 0x1f]
shl edx, 8
or edx, ecx
or edx, eax
mov dword [r14 + 4], edx
mov ecx, dword [rbp + 0x20]
mov edx, ecx
mov eax, ecx
shl edx, 0x10
and eax, 0xff00
shr ecx, 8
or edx, eax
shl edx, 8
and ecx, 0xff00
movzx eax, byte [rbp + 0x23]
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x10]
or edx, ecx
mov rsi, qword [r11 + 0x20]
or edx, eax
mov rdi, qword [r11 + 0x28]
mov dword [r14 + 8], edx
mov ecx, dword [rbp + 0x24]
mov eax, ecx
and eax, 0xff00
mov edx, ecx
shl edx, 0x10
or edx, eax
shr ecx, 8
movzx eax, byte [rbp + 0x27]
and ecx, 0xff00
shl edx, 8
or edx, ecx
or edx, eax
mov dword [r14 + 0xc], edx
mov ecx, dword [rbp + 0x28]
mov eax, ecx
and eax, 0xff00
mov edx, ecx
shl edx, 0x10
or edx, eax
shr ecx, 8
movzx eax, byte [rbp + 0x2b]
and ecx, 0xff00
shl edx, 8
or edx, ecx
or edx, eax
mov dword [r14 + 0x10], edx
xor eax, eax
mov qword [rbp + 0x2c], rax
mov dword [rbp + 0x18], 0x67452301
mov dword [rbp + 0x1c], 0xefcdab89
mov dword [rbp + 0x20], 0x98badcfe
mov dword [rbp + 0x24], 0x10325476
mov dword [rbp + 0x28], 0xc3d2e1f0
mov rbp, qword [r11 + 0x18]
mov rsp, r11
pop r14
ret
Function at 0x140028950
Capabilities:
Identify system language via api

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x30
mov eax, ecx
mov edi, ecx
and eax, 0xfff0000
cmp eax, 0x70000
je 0x140028995
call qword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
lea rcx, [0x14010a240]
movzx ebx, ax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov r9d, edi
mov r8d, ebx
mov rcx, rax
mov edx, 0xb
call sym.ProcessHacker.exe_PhGetMessage
jmp 0x14002899d
movzx ecx, cx
call sym.ProcessHacker.exe_PhGetWin32Message
mov rbx, rax
test rax, rax
je 0x140028a76
cmp qword [rax], 0
je 0x140028a76
mov rcx, qword [rax + 8]
call sym.ProcessHacker.exe_PhCountStringZ
or edi, 0xffffffff
lea rdx, [rax + rax]
mov qword [rbx], rdx
cmp rdx, 4
jb 0x140028a0f
mov rcx, qword [rbx + 8]
mov rax, rdx
shr rax, 1
cmp word [rcx + rax*2 - 4], 0xd
jne 0x140028a0f
cmp word [rcx + rax*2 - 2], 0xa
jne 0x140028a0f
add rdx, 0xfffffffffffffffc
call sym.ProcessHacker.exe_PhCreateStringEx
mov rcx, rbx
mov rbx, rax
test rcx, rcx
je 0x140028a0f
add rcx, 0xfffffffffffffff0
mov eax, edi
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x140028a0f
call fcn.1400258b0
mov rax, qword [rbx + 8]
cmp word [rax], 0x7b
jne 0x140028a76
movups xmm0, xmmword [rbx]
mov edx, 0xa
xor r8d, r8d
mov rcx, rbx
movups xmmword [rsp + 0x20], xmm0
call sym.ProcessHacker.exe_PhFindCharInStringRef
cmp rax, 0xffffffffffffffff
je 0x140028a76
mov rcx, qword [rsp + 0x28]
lea r8, [rax + rax]
mov rdx, qword [rsp + 0x20]
add rcx, 2
sub rdx, r8
add rcx, r8
sub rdx, 2
call sym.ProcessHacker.exe_PhCreateStringEx
mov rcx, rbx
mov rbx, rax
test rcx, rcx
je 0x140028a76
add rcx, 0xfffffffffffffff0
lock xadd dword [rcx + 8], edi
cmp edi, 1
jne 0x140028a76
call fcn.1400258b0
mov rax, rbx
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret

Function at 0x140028a90
Capabilities:
Identify system language via api

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov edi, ecx
call qword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
lea rcx, str.kernel32.dll
movzx ebx, ax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov r9d, edi
mov r8d, ebx
mov rcx, rax
mov edx, 0xb
call sym.ProcessHacker.exe_PhGetMessage
mov rbx, rax
test rax, rax
je 0x140028b35
mov rcx, qword [rax + 8]
call sym.ProcessHacker.exe_PhCountStringZ
lea rdx, [rax + rax]
mov qword [rbx], rdx
cmp rdx, 4
jb 0x140028b32
mov rcx, qword [rbx + 8]
mov rax, rdx
shr rax, 1
cmp word [rcx + rax*2 - 4], 0xd
jne 0x140028b32
cmp word [rcx + rax*2 - 2], 0xa
jne 0x140028b32
add rdx, 0xfffffffffffffffc
call sym.ProcessHacker.exe_PhCreateStringEx
mov rdi, rax
test rbx, rbx
je 0x140028b35
lea rcx, [rbx - 0x10]
or edx, 0xffffffff
lock xadd dword [rcx + 8], edx
cmp edx, 1
jne 0x140028b35
call fcn.1400258b0
mov rax, rdi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
mov rax, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x1400291b0
Capabilities:
Hash data using sha1

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r14
push r15
lea rbp, [rsp - 0x3f]
sub rsp, 0xc0
movups xmm0, xmmword [rdx]
mov ebx, r9d
mov rdi, r8
mov rsi, rcx
mov edx, 4
mov rcx, qword [sym.ProcessHacker.exe_PhHeapHandle]
movups xmmword [rbp - 0x61], xmm0
ror word [rbp - 0x5d], 8
lea r15d, [rbx + 0x10]
ror word [rbp - 0x5b], 8
movd eax, xmm0
mov r8d, r15d
bswap eax
mov dword [rbp - 0x61], eax
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
movups xmm0, xmmword [rbp - 0x61]
mov r8d, ebx
mov rdx, rdi
mov r14, rax
lea rcx, [rax + 0x10]
movups xmmword [rax], xmm0
call fcn.1400e19b0
movzx ebx, byte [rbp + 0x7f]
xor eax, eax
mov r8d, r15d
mov rdx, r14
cmp bl, 3
jne 0x1400292e8
lea rcx, [rbp - 0x41]
mov dword [rbp - 0x39], 0x67452301
mov dword [rbp - 0x35], 0xefcdab89
mov dword [rbp - 0x31], 0x98badcfe
mov dword [rbp - 0x2d], 0x10325476
mov qword [rbp - 0x41], rax
call fcn.14001c040
mov edx, dword [rbp - 0x41]
lea rcx, [rbp - 0x29]
shr edx, 3
and edx, 0x3f
mov eax, edx
add rcx, rax
mov eax, 0x3f
sub eax, edx
xor edx, edx
mov byte [rcx], 0x80
inc rcx
cmp eax, 8
jae 0x1400292be
mov r8d, eax
call fcn.1400e2690
lea rdx, [rbp - 0x29]
lea rcx, [rbp - 0x39]
call fcn.14001c1e0
xor eax, eax
mov qword [rbp - 0x29], rax
mov qword [rbp - 0x21], rax
mov qword [rbp - 0x19], rax
mov qword [rbp - 0x11], rax
mov qword [rbp - 9], rax
mov qword [rbp - 1], rax
mov qword [rbp + 7], rax
jmp 0x1400292c9
add eax, 0xfffffff8
mov r8d, eax
call fcn.1400e2690
mov eax, dword [rbp - 0x41]
lea rdx, [rbp - 0x29]
mov dword [rbp + 0xf], eax
lea rcx, [rbp - 0x39]
mov eax, dword [rbp - 0x3d]
mov dword [rbp + 0x13], eax
call fcn.14001c1e0
movups xmm0, xmmword [rbp - 0x39]
jmp 0x14002932b
lea rcx, [rbp - 0x41]
mov dword [rbp - 0x29], 0x67452301
mov dword [rbp - 0x25], 0xefcdab89
mov dword [rbp - 0x21], 0x98badcfe
mov dword [rbp - 0x1d], 0x10325476
mov dword [rbp - 0x19], 0xc3d2e1f0
mov qword [rbp - 0x15], rax
call fcn.140028210
lea rdx, [rbp - 0x61]
lea rcx, [rbp - 0x41]
call fcn.1400282f0
movups xmm0, xmmword [rbp - 0x61]
mov bl, 5
mov rcx, qword [sym.ProcessHacker.exe_PhHeapHandle]
mov r8, r14
xor edx, edx
movups xmmword [rbp - 0x61], xmm0
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
movups xmm0, xmmword [rbp - 0x61]
shl bl, 4
lea r11, [rsp + 0xc0]
mov rdi, qword [r11 + 0x30]
movups xmmword [rsi], xmm0
mov eax, dword [rsi]
bswap eax
mov dword [rsi], eax
movzx eax, word [rsi + 4]
ror ax, 8
mov word [rsi + 4], ax
movzx eax, word [rsi + 6]
ror ax, 8
mov word [rsi + 6], ax
and byte [rsi + 7], 0xf
or byte [rsi + 7], bl
and byte [rsi + 8], 0x3f
or byte [rsi + 8], 0x80
mov rsi, qword [r11 + 0x28]
mov rbx, qword [r11 + 0x20]
mov rsp, r11
pop r15
pop r14
pop rbp
ret