joyce8/EMBER2024-capa huggingface dataset:
Function at 0x7ff7bffc6000
Capabilities:
Delete service

Disassembly:
mov qword [rsp + 0x20], rbp
push rsi
sub rsp, 0x30
mov r8, qword [rdx + 0x10]
lea r9, [0x7ff7c0153590]
mov rsi, rdx
mov byte [rsp + 0x20], 1
lea rdx, [0x7ff7c0153638]
mov rbp, rcx
mov r8, qword [r8 + 8]
call sym.ProcessHacker.exe_PhShowConfirmMessage
test al, al
jne 0x7ff7bffc603f
mov rbp, qword [rsp + 0x58]
add rsp, 0x30
pop rsi
ret
mov rax, qword [rsi + 0x10]
xor edx, edx
mov qword [rsp + 0x40], rbx
xor ecx, ecx
mov qword [rsp + 0x50], rdi
mov rdi, qword [rax + 8]
lea r8d, [rdx + 1]
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov rbx, rax
test rax, rax
je 0x7ff7bffc60b1
mov r8d, 0x10000
mov rdx, rdi
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov rcx, rbx
mov rdi, rax
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
test rdi, rdi
je 0x7ff7bffc60b1
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_DeleteService]
mov rcx, rdi
test eax, eax
je 0x7ff7bffc60ab
mov bl, 1
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x7ff7bffc6199
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call qword [sym.imp.kernel32.dll_GetLastError]
mov ebx, eax
test eax, eax
jle 0x7ff7bffc60c6
movzx ebx, ax
or ebx, 0xc0070000
mov rax, qword [rsi + 0x10]
lea rcx, [0x7ff7c0153648]
mov rdx, qword [rax + 8]
call sym.ProcessHacker.exe_PhConcatStrings2
mov rcx, rax
call sym.ProcessHacker.exe_PhAutoDereferenceObject
lea r9, [rsp + 0x48]
mov r8d, ebx
mov rcx, rbp
mov rdx, qword [rax + 8]
call fcn.7ff7bffc1910
test al, al
je 0x7ff7bffc6167
xor bl, bl
cmp byte [rsp + 0x48], bl
je 0x7ff7bffc6199
mov rcx, qword [rsi + 0x10]
mov edx, 5
mov rcx, qword [rcx + 8]
call fcn.7ff7c0052020
mov ebx, eax
test eax, eax
js 0x7ff7bffc612d
mov bl, 1
call sym.ProcessHacker.exe_PhUiDisconnectFromPhSvc
jmp 0x7ff7bffc6199
mov r8, qword [rsi + 0x10]
lea rdx, [0x7ff7c0153638]
lea rcx, [0x7ff7c0153488]
mov r8, qword [r8 + 8]
call fcn.7ff7bffc1770
xor r9d, r9d
mov r8d, ebx
mov rcx, rbp
mov rdx, qword [rax + 8]
call sym.ProcessHacker.exe_PhShowStatus
xor bl, bl
call sym.ProcessHacker.exe_PhUiDisconnectFromPhSvc
jmp 0x7ff7bffc6199
mov r8, qword ds:[rsi + 0x10]
lea rdx, [0x7ff7c0153638]
lea rcx, [0x7ff7c0153488]
mov r8, qword [r8 + 8]
call fcn.7ff7bffc1770
xor r9d, r9d
mov r8d, ebx
mov rcx, rbp
mov rdx, qword [rax + 8]
call sym.ProcessHacker.exe_PhShowStatus
xor bl, bl
mov rdi, qword [rsp + 0x50]
movzx eax, bl
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x58]
add rsp, 0x30
pop rsi
ret
Function at 0x7ff7bffc6810
Capabilities:
Suspend thread

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x10]
sub rsp, 0x110
mov rdi, rdx
xor r15b, r15b
xor edx, edx
mov r12d, r8d
mov r13, rcx
mov sil, 1
mov r14d, edx
test r8d, r8d
je 0x7ff7bffc6a1f
mov qword [rsp + 0x150], rbx
nop dword [rax]
mov rax, qword [rdi]
lea r9, [rsp + 0x20]
mov qword [rsp + 0x20], rdx
lea r8, [rsp + 0x30]
mov qword [rsp + 0x38], rdx
xorps xmm0, xmm0
mov dword [rsp + 0x48], edx
mov rcx, qword [rax]
mov qword [rsp + 0x28], rcx
lea rcx, [rbp + 0x68]
mov qword [rsp + 0x40], rdx
mov edx, 2
mov dword [rsp + 0x30], 0x30
movdqu xmmword [rsp + 0x50], xmm0
call qword [sym.imp.ntdll.dll_NtOpenThread]
mov ebx, eax
cmp eax, 0xc0000022
jne 0x7ff7bffc68bf
cmp byte [0x7ff7c01d30ef], 0
je 0x7ff7bffc68bf
lea r8, [rsp + 0x20]
mov edx, 2
lea rcx, [rbp + 0x68]
call fcn.7ff7c00e3820
mov ebx, eax
test ebx, ebx
js 0x7ff7bffc68e3
mov rcx, qword [rbp + 0x68]
xor edx, edx
call qword [sym.imp.ntdll.dll_NtSuspendThread]
mov rcx, qword [rbp + 0x68]
mov ebx, eax
call qword [sym.imp.ntdll.dll_NtClose]
test ebx, ebx
jns 0x7ff7bffc69eb
xor sil, sil
test r15b, r15b
jne 0x7ff7bffc69bc
mov rax, qword [rdi]
lea rcx, [0x7ff7c01538d8]
mov edx, dword [rax]
call fcn.7ff7bffc1770
lea r9, ds:[rbp + 0x60]
mov r8d, ebx
mov rcx, r13
mov rdx, qword [rax + 8]
call fcn.7ff7bffc1910
test al, al
je 0x7ff7bffc69bc
cmp byte [rbp + 0x60], sil
je 0x7ff7bffc69b7
mov rcx, qword [0x7ff7c01d85c0]
nop
test rcx, rcx
jne 0x7ff7bffc696e
mov ebx, 0xc0000037
mov rax, qword ds:[rdi]
lea rdx, [0x7ff7c0152c10]
lea rcx, [0x7ff7c01537f0]
mov r8d, dword [rax]
call fcn.7ff7bffc1770
xor r9d, r9d
mov r8d, ebx
mov rcx, r13
mov rdx, qword [rax + 8]
call sym.ProcessHacker.exe_PhShowContinueStatus
call sym.ProcessHacker.exe_PhUiDisconnectFromPhSvc
jmp 0x7ff7bffc69eb
mov rax, qword [rdi]
lea r8, [rsp + 0x60]
mov dword [rbp - 0x78], 0xa
mov qword [rbp - 0x68], 2
mov qword [rsp + 0x60], 0xb00088
mov rdx, qword [rax]
mov qword [rbp - 0x70], rdx
lea rdx, [rsp + 0x60]
call qword [sym.imp.ntdll.dll_NtRequestWaitReplyPort]
mov ebx, eax
test eax, eax
js 0x7ff7bffc693a
mov ebx, dword [rbp - 0x74]
test ebx, ebx
js 0x7ff7bffc693a
mov sil, 1
call sym.ProcessHacker.exe_PhUiDisconnectFromPhSvc
jmp 0x7ff7bffc69eb
mov r15b, 1
jmp 0x7ff7bffc69eb
mov rax, qword [rdi]
lea rdx, [0x7ff7c0152c10]
lea rcx, [0x7ff7c01537f0]
mov r8d, dword [rax]
call fcn.7ff7bffc1770
xor r9d, r9d
mov r8d, ebx
mov rcx, r13
mov rdx, qword [rax + 8]
call sym.ProcessHacker.exe_PhShowContinueStatus
test al, al
je 0x7ff7bffc6a00
inc r14d
add rdi, 8
mov edx, 0
cmp r14d, r12d
jb 0x7ff7bffc6850
mov rbx, qword [rsp + 0x150]
movzx eax, sil
add rsp, 0x110
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
movzx eax, sil
jmp 0x7ff7bffc6a0c
Function at 0x7ff7bffc6a30
Capabilities:
Resume thread

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x10]
sub rsp, 0x110
mov rdi, rdx
xor r15b, r15b
xor edx, edx
mov r12d, r8d
mov r13, rcx
mov sil, 1
mov r14d, edx
test r8d, r8d
je 0x7ff7bffc6c3f
mov qword [rsp + 0x150], rbx
nop dword [rax]
mov rax, qword [rdi]
lea r9, [rsp + 0x20]
mov qword [rsp + 0x20], rdx
lea r8, [rsp + 0x30]
mov qword [rsp + 0x38], rdx
xorps xmm0, xmm0
mov dword [rsp + 0x48], edx
mov rcx, qword [rax]
mov qword [rsp + 0x28], rcx
lea rcx, [rbp + 0x68]
mov qword [rsp + 0x40], rdx
mov edx, 2
mov dword [rsp + 0x30], 0x30
movdqu xmmword [rsp + 0x50], xmm0
call qword [sym.imp.ntdll.dll_NtOpenThread]
mov ebx, eax
cmp eax, 0xc0000022
jne 0x7ff7bffc6adf
cmp byte [0x7ff7c01d30ef], 0
je 0x7ff7bffc6adf
lea r8, [rsp + 0x20]
mov edx, 2
lea rcx, [rbp + 0x68]
call fcn.7ff7c00e3820
mov ebx, eax
test ebx, ebx
js 0x7ff7bffc6b03
mov rcx, qword [rbp + 0x68]
xor edx, edx
call qword [sym.imp.ntdll.dll_NtResumeThread]
mov rcx, qword [rbp + 0x68]
mov ebx, eax
call qword [sym.imp.ntdll.dll_NtClose]
test ebx, ebx
jns 0x7ff7bffc6c0b
xor sil, sil
test r15b, r15b
jne 0x7ff7bffc6bdc
mov rax, qword [rdi]
lea rcx, [0x7ff7c0153918]
mov edx, dword [rax]
call fcn.7ff7bffc1770
lea r9, ds:[rbp + 0x60]
mov r8d, ebx
mov rcx, r13
mov rdx, qword [rax + 8]
call fcn.7ff7bffc1910
test al, al
je 0x7ff7bffc6bdc
cmp byte [rbp + 0x60], sil
je 0x7ff7bffc6bd7
mov rcx, qword [0x7ff7c01d85c0]
nop
test rcx, rcx
jne 0x7ff7bffc6b8e
mov ebx, 0xc0000037
mov rax, qword ds:[rdi]
lea rdx, [0x7ff7c0152c48]
lea rcx, [0x7ff7c01537f0]
mov r8d, dword [rax]
call fcn.7ff7bffc1770
xor r9d, r9d
mov r8d, ebx
mov rcx, r13
mov rdx, qword [rax + 8]
call sym.ProcessHacker.exe_PhShowContinueStatus
call sym.ProcessHacker.exe_PhUiDisconnectFromPhSvc
jmp 0x7ff7bffc6c0b
mov rax, qword [rdi]
lea r8, [rsp + 0x60]
mov dword [rbp - 0x78], 0xa
mov qword [rbp - 0x68], 3
mov qword [rsp + 0x60], 0xb00088
mov rdx, qword [rax]
mov qword [rbp - 0x70], rdx
lea rdx, [rsp + 0x60]
call qword [sym.imp.ntdll.dll_NtRequestWaitReplyPort]
mov ebx, eax
test eax, eax
js 0x7ff7bffc6b5a
mov ebx, dword [rbp - 0x74]
test ebx, ebx
js 0x7ff7bffc6b5a
mov sil, 1
call sym.ProcessHacker.exe_PhUiDisconnectFromPhSvc
jmp 0x7ff7bffc6c0b
mov r15b, 1
jmp 0x7ff7bffc6c0b
mov rax, qword [rdi]
lea rdx, [0x7ff7c0152c48]
lea rcx, [0x7ff7c01537f0]
mov r8d, dword [rax]
call fcn.7ff7bffc1770
xor r9d, r9d
mov r8d, ebx
mov rcx, r13
mov rdx, qword [rax + 8]
call sym.ProcessHacker.exe_PhShowContinueStatus
test al, al
je 0x7ff7bffc6c20
inc r14d
add rdi, 8
mov edx, 0
cmp r14d, r12d
jb 0x7ff7bffc6a70
mov rbx, qword [rsp + 0x150]
movzx eax, sil
add rsp, 0x110
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
movzx eax, sil
jmp 0x7ff7bffc6c2c
Function at 0x7ff7bffcd3c0
Capabilities:
Log keystrokes via polling

Disassembly:
push rdi
sub rsp, 0x20
mov rdi, rdx
cmp qword [rcx], rdx
jne 0x7ff7bffcd439
cmp dword [rcx + 0x10], 0xffffff65
jne 0x7ff7bffcd439
movzx eax, word ds:[rcx + 0x18]
cmp ax, 0x41
je 0x7ff7bffcd439
cmp ax, 0x43
jne 0x7ff7bffcd439
mov ecx, 0x11
call qword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jns 0x7ff7bffcd439
mov rcx, rdi
mov qword [rsp + 0x38], rbx
call fcn.7ff7c00ef280
mov rdx, rax
mov rcx, rdi
mov rbx, rax
call sym.ProcessHacker.exe_PhSetClipboardString
lea rcx, [rbx - 0x10]
mov eax, 0xffffffff
lock xadd dword [rcx + 8], eax
mov rbx, qword [rsp + 0x38]
cmp eax, 1
jne 0x7ff7bffcd439
add rsp, 0x20
pop rdi
jmp fcn.7ff7c00c6290
add rsp, 0x20
pop rdi
ret

Function at 0x7ff7bffcd440
Capabilities:
Log keystrokes via polling

Disassembly:
push rdi
sub rsp, 0x20
mov rdi, rdx
cmp qword [rcx], rdx
jne 0x7ff7bffcd4f3
cmp dword [rcx + 0x10], 0xffffff65
jne 0x7ff7bffcd4f3
movzx eax, word [rcx + 0x18]
cmp ax, 0x41
je 0x7ff7bffcd4c8
cmp ax, 0x43
jne 0x7ff7bffcd4f3
test r8b, 1
je 0x7ff7bffcd4f3
mov ecx, 0x11
call qword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jns 0x7ff7bffcd4f3
mov rcx, rdi
mov qword [rsp + 0x38], rbx
call fcn.7ff7c00ef280
mov rdx, rax
mov rcx, rdi
mov rbx, rax
call sym.ProcessHacker.exe_PhSetClipboardString
lea rcx, [rbx - 0x10]
mov eax, 0xffffffff
lock xadd dword [rcx + 8], eax
mov rbx, qword [rsp + 0x38]
cmp eax, 1
jne 0x7ff7bffcd4f3
add rsp, 0x20
pop rdi
jmp fcn.7ff7c00c6290
test r8b, 2
je 0x7ff7bffcd4f3
mov ecx, 0x11
call qword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jns 0x7ff7bffcd4f3
mov edx, 2
mov rcx, rdi
mov r8d, edx
add rsp, 0x20
pop rdi
jmp sym.ProcessHacker.exe_PhSetStateAllListViewItems
add rsp, 0x20
pop rdi
ret
Function at 0x7ff7bffd56a0
Capabilities:
Get graphical window text

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x510
mov rax, qword [0x7ff7c01ca008]
xor rax, rsp
mov qword [rsp + 0x500], rax
mov rbx, rcx
mov dword [rsp + 0x24], edx
xor ecx, ecx
mov dword [rsp + 0x84], r8d
lea rax, [rsp + 0xe0]
mov dword [rsp + 0x28], ecx
mov qword [rsp + 0x38], rax
lea r9, [rsp + 0x20]
mov dword [rsp + 0x88], ecx
lea rax, [rsp + 0x2f0]
mov esi, r8d
mov qword [rsp + 0x98], rax
mov edi, edx
mov dword [rsp + 0x20], 0xd
mov rcx, rbx
mov dword [rsp + 0x30], 0xffffffff
xor r8d, r8d
mov dword [rsp + 0x40], 0x208
mov edx, 0x104b
mov dword [rsp + 0x80], 0xd
mov dword [rsp + 0x90], 0xffffffff
mov dword [rsp + 0xa0], 0x208
call qword [sym.imp.USER32.dll_SendMessageW]
test eax, eax
je 0x7ff7bffd57a6
lea r9, [rsp + 0x80]
xor r8d, r8d
mov edx, 0x104b
mov rcx, rbx
call qword [sym.imp.USER32.dll_SendMessageW]
test eax, eax
je 0x7ff7bffd57a6
lea r9, [rsp + 0x20]
mov dword [rsp + 0x24], esi
xor r8d, r8d
mov dword [rsp + 0x84], edi
mov edx, 0x104c
mov rcx, rbx
call qword [sym.imp.USER32.dll_SendMessageW]
lea r9, ds:[rsp + 0x80]
xor r8d, r8d
mov edx, 0x104c
mov rcx, rbx
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, qword [rsp + 0x500]
xor rcx, rsp
call fcn.7ff7c0121390
add rsp, 0x510
pop rdi
pop rsi
pop rbx
ret
Function at 0x7ff7c0029b90
Capabilities:
Delete registry value
Persist via run registry key
Set registry value

Disassembly:
mov r11, rsp
push rbx
push rsi
sub rsp, 0x88
cmp byte [0x7ff7c01d467c], cl
movzx esi, dl
movzx ebx, cl
je 0x7ff7c0029da6
mov r8, qword [0x7ff7c01ce018]
mov word ds:[r11 - 0x68], r8w
lea eax, [r8 + 2]
mov word [rsp + 0x32], ax
mov rax, qword [0x7ff7c01ce020]
mov qword [r11 - 0x60], rax
cmp r8, 0xfffe
ja 0x7ff7c0029da6
xor r8d, r8d
lea rax, [r11 + 0x20]
lea r9, [r11 - 0x48]
mov qword [r11 - 0x78], rax
lea rdx, [r11 - 0x68]
lea rcx, [r8 - 9]
call fcn.7ff7c00e0390
test eax, eax
js 0x7ff7c0029da6
lea r8, [rsp + 0x50]
mov qword [rsp + 0x80], rdi
mov edx, 0x20006
lea rcx, [rsp + 0xb0]
call qword [sym.imp.ntdll.dll_NtOpenKey]
mov rcx, qword ds:[rsp + 0xb8]
mov edi, eax
test rcx, rcx
je 0x7ff7c0029c3b
call qword [sym.imp.ntdll.dll_NtClose]
test edi, edi
mov rdi, qword [rsp + 0x80]
js 0x7ff7c0029da6
nop dword [rax + rax]
test bl, bl
je 0x7ff7c0029d5c
xor ecx, ecx
xor eax, eax
lock cmpxchg qword [0x7ff7c01d69a0], rcx
mov rbx, rax
je 0x7ff7c0029c72
lock inc dword ds:[rax - 8]
jmp 0x7ff7c0029c9f
mov rcx, qword [sym.ProcessHacker.exe_PhInstanceHandle]
xor edx, edx
call sym.ProcessHacker.exe_PhGetDllFileName
mov rbx, rax
xor eax, eax
lock cmpxchg qword [0x7ff7c01d69a0], rbx
jne 0x7ff7c0029c96
lock inc dword [rbx - 8]
test rbx, rbx
je 0x7ff7c0029d98
mov r8, qword [rbx + 8]
lea r9, [0x7ff7c0174408]
lea rdx, [0x7ff7c0174408]
mov ecx, 3
call sym.ProcessHacker.exe_PhConcatStrings
mov rcx, rax
call sym.ProcessHacker.exe_PhAutoDereferenceObject
test sil, sil
je 0x7ff7c0029ce0
mov rcx, qword [rax + 8]
lea rdx, [0x7ff7c01746b8]
call sym.ProcessHacker.exe_PhConcatStrings2
mov rcx, rax
call sym.ProcessHacker.exe_PhAutoDereferenceObject
mov rcx, qword [0x7ff7c01ce028]
mov edx, dword ds:[rax]
mov r8, qword [rax + 8]
add edx, 2
mov word [rsp + 0x40], cx
lea eax, [rcx + 2]
mov word [rsp + 0x42], ax
mov rax, qword [0x7ff7c01ce030]
mov qword [rsp + 0x48], rax
cmp rcx, 0xfffe
ja 0x7ff7c0029d3e
mov rcx, qword [rsp + 0xb0]
mov r9d, 1
mov dword [rsp + 0x28], edx
lea rdx, [rsp + 0x40]
mov qword [rsp + 0x20], r8
xor r8d, r8d
call qword [sym.imp.ntdll.dll_NtSetValueKey]
lea rcx, ds:[rbx - 0x10]
mov eax, 0xffffffff
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x7ff7c0029d98
call fcn.7ff7c00c6290
jmp 0x7ff7c0029d98
mov rcx, qword [0x7ff7c01ce028]
mov word [rsp + 0x30], cx
lea eax, [rcx + 2]
mov word [rsp + 0x32], ax
mov rax, qword [0x7ff7c01ce030]
mov qword [rsp + 0x38], rax
cmp rcx, 0xfffe
ja 0x7ff7c0029d98
mov rcx, qword [rsp + 0xb0]
lea rdx, [rsp + 0x30]
call qword [sym.imp.ntdll.dll_NtDeleteValueKey]
mov rcx, qword [rsp + 0xb0]
call qword [sym.imp.ntdll.dll_NtClose]
add rsp, 0x88
pop rsi
pop rbx
nop
ret
Function at 0x7ff7c00538a0
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push r14
sub rsp, 0x20
cmp dword ds:[rcx + 4], 0
mov r14, r8
mov rsi, rcx
je 0x7ff7c0053927
mov ecx, dword [0x7ff7c01d85b0]
call qword [sym.imp.kernel32.dll_TlsGetValue]
mov edi, dword [rsi + 4]
mov r8d, dword [rsi]
mov rcx, qword [rax]
mov rdx, qword [rcx + 0x38]
add rdi, rdx
lea rax, [r8 + rdi]
cmp rax, rdi
jb 0x7ff7c005392b
cmp rdi, rdx
jb 0x7ff7c005392b
cmp rax, qword [rcx + 0x40]
ja 0x7ff7c005392b
test rdi, rdi
je 0x7ff7c005392b
mov rcx, qword [0x7ff7c01d3cd0]
xor edx, edx
call qword [sym.imp.kernel32.dll_HeapAlloc_1]
mov rbx, rax
test rax, rax
jne 0x7ff7c0053915
mov eax, 0xc0000017
jmp 0x7ff7c0053939
mov r8d, dword ds:[rsi]
mov rdx, rdi
mov rcx, rax
call fcn.7ff7c0125120
jmp 0x7ff7c0053934
test dl, dl
jne 0x7ff7c0053932
mov eax, 0xc0000005
jmp 0x7ff7c0053939
xor ebx, ebx
mov qword [r14], rbx
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x40]
add rsp, 0x20
pop r14
ret

Function at 0x7ff7c0053950
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 0x18], rdi
push r14
sub rsp, 0x20
mov eax, dword [rcx]
mov r14, r8
mov rdi, rcx
test al, 1
jne 0x7ff7c0053a41
nop dword [rax + rax]
cmp eax, 0xfffe
ja 0x7ff7c0053a41
cmp dword [rcx + 4], 0
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x38], rsi
je 0x7ff7c0053a17
mov ecx, dword [0x7ff7c01d85b0]
call qword [sym.imp.kernel32.dll_TlsGetValue]
mov ebx, dword ds:[rdi + 4]
mov esi, dword [rdi]
mov rcx, qword [rax]
mov rdx, qword [rcx + 0x38]
add rbx, rdx
lea rax, [rsi + rbx]
cmp rax, rbx
jb 0x7ff7c0053a1b
cmp rbx, rdx
jb 0x7ff7c0053a1b
cmp rax, qword [rcx + 0x40]
ja 0x7ff7c0053a1b
test bl, 1
jne 0x7ff7c0053a1b
test rbx, rbx
je 0x7ff7c0053a1b
test esi, esi
je 0x7ff7c0053a08
mov rdx, qword [0x7ff7c01d3b58]
lea rcx, [rsi + 0x12]
call sym.ProcessHacker.exe_PhCreateObject
mov rdi, rax
xor ecx, ecx
mov r8d, esi
mov rdx, rbx
mov qword [rax], rsi
add rax, 0x10
mov qword [rdi + 8], rax
mov word [rax + rsi], cx
mov rcx, qword [rdi + 8]
call fcn.7ff7c0125120
xor eax, eax
mov qword [r14], rdi
jmp 0x7ff7c0053a20
call sym.ProcessHacker.exe_PhReferenceEmptyString
mov rdi, rax
mov qword [r14], rax
xor eax, eax
jmp 0x7ff7c0053a20
test dl, dl
jne 0x7ff7c0053a36
mov eax, 0xc0000005
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x40]
add rsp, 0x20
pop r14
ret
xor ecx, ecx
mov edi, ecx
mov qword [r14], rcx
xor eax, eax
jmp 0x7ff7c0053a20
mov rdi, qword [rsp + 0x40]
mov eax, 0xc0000206
add rsp, 0x20
pop r14
ret
Function at 0x7ff7c0061c10
Capabilities:
Get system information on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x20
movsx r8d, byte [0x7ff7c01d3ba8]
xor r9d, r9d
mov rdx, qword [0x7ff7c01d3a90]
mov r14, rcx
shl r8d, 3
lea ecx, [r9 + 0x53]
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
movsx ebp, byte [0x7ff7c01d3ba8]
xor ebx, ebx
mov rdx, qword [0x7ff7c01d3a90]
mov edi, ebx
mov r10d, ebx
lea esi, [rbx + 2]
cmp ebp, 4
jb 0x7ff7c0061cd5
mov r9d, ebp
xorps xmm2, xmm2
and r9d, 0xfffffffc
xorps xmm1, xmm1
mov r8d, esi
nop word [rax + rax]
mov eax, r10d
add r10d, 4
movq xmm0, qword [rdx + rax*8]
lea eax, [r8 - 1]
movhpd xmm0, qword [rdx + rax*8]
mov eax, r8d
paddq xmm0, xmm2
movdqa xmm2, xmm0
movq xmm0, qword [rdx + rax*8]
lea eax, [r8 + 1]
movhpd xmm0, qword [rdx + rax*8]
add r8d, 4
paddq xmm0, xmm1
movdqa xmm1, xmm0
cmp r10d, r9d
jb 0x7ff7c0061c80
paddq xmm1, xmm2
movdqa xmm0, xmm1
psrldq xmm0, 8
paddq xmm1, xmm0
movq rdi, xmm1
mov r8, rbx
mov r9, rbx
cmp r10d, ebp
jae 0x7ff7c0061d25
mov eax, ebp
mov ecx, r10d
sub eax, r10d
cmp eax, esi
jb 0x7ff7c0061d1a
mov eax, ebp
sub eax, r10d
sub eax, esi
shr eax, 1
inc eax
mov r11d, eax
lea eax, [r10 + rax*2]
nop
add r8, qword ds:[rdx + rcx*8]
add r9, qword [rdx + rcx*8 + 8]
add rcx, rsi
sub r11, 1
jne 0x7ff7c0061d00
cmp eax, ebp
jae 0x7ff7c0061d1e
add rdi, qword [rdx + rcx*8]
lea rax, [r9 + r8]
add rdi, rax
mov rdx, qword [0x7ff7c01d3aa0]
lea r8d, [rbp*8]
xor r9d, r9d
mov rax, rdi
sub rax, qword [0x7ff7c01d8250]
mov qword [0x7ff7c01d8258], rax
mov qword [0x7ff7c01d8250], rdi
lea ecx, [r9 + 0x6c]
mov qword [r14], rax
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
movsx edi, byte [0x7ff7c01d3ba8]
mov r11, rbx
mov rdx, qword [0x7ff7c01d3aa0]
mov r8d, ebx
cmp edi, 4
jb 0x7ff7c0061de1
mov r9d, edi
xorps xmm2, xmm2
and r9d, 0xfffffffc
xorps xmm1, xmm1
nop dword [rax]
nop word [rax + rax]
mov eax, r8d
add r8d, 4
movq xmm0, qword [rdx + rax*8]
lea eax, [rsi - 1]
movhpd xmm0, qword [rdx + rax*8]
mov eax, esi
paddq xmm0, xmm2
movdqa xmm2, xmm0
movq xmm0, qword [rdx + rax*8]
lea eax, [rsi + 1]
movhpd xmm0, qword [rdx + rax*8]
add esi, 4
paddq xmm0, xmm1
movdqa xmm1, xmm0
cmp r8d, r9d
jb 0x7ff7c0061d90
paddq xmm1, xmm2
movdqa xmm0, xmm1
psrldq xmm0, 8
paddq xmm1, xmm0
movq r11, xmm1
mov r9, rbx
cmp r8d, edi
jae 0x7ff7c0061e32
mov eax, edi
mov ecx, r8d
sub eax, r8d
cmp eax, 2
jb 0x7ff7c0061e27
mov eax, edi
sub eax, r8d
sub eax, 2
shr eax, 1
inc eax
mov r10d, eax
lea eax, [r8 + rax*2]
nop dword [rax]
add rbx, qword [rdx + rcx*8]
add r9, qword [rdx + rcx*8 + 8]
add rcx, 2
sub r10, 1
jne 0x7ff7c0061e10
cmp eax, edi
jae 0x7ff7c0061e2b
add r11, qword [rdx + rcx*8]
lea rax, [r9 + rbx]
add r11, rax
mov rbx, qword [rsp + 0x30]
mov rax, r11
sub rax, qword [0x7ff7c01d8260]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
mov qword [0x7ff7c01d8268], rax
mov qword [0x7ff7c01d8260], r11
add rsp, 0x20
pop r14
ret
Function at 0x7ff7c0087840
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x38
test byte [0x7ff7c01ce318], 1
jne 0x7ff7c00879bf
lock bts qword [0x7ff7c01ce318], 0x1f
jae 0x7ff7c0087888
test byte [0x7ff7c01ce318], 1
jne 0x7ff7c00879bf
xor edx, edx
lea rcx, [0x7ff7c01ce318]
call sym.ProcessHacker.exe_PhfWaitForEvent
cmp qword [0x7ff7c01d5a90], 0
setne al
add rsp, 0x38
ret
lea rcx, [0x7ff7c0184f00]
call qword [sym.imp.kernel32.dll_LoadLibraryW]
mov qword [0x7ff7c01d5a90], rax
mov rdx, rax
test rax, rax
je 0x7ff7c00879b3
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x30], rdi
mov edi, 0x5a4d
cmp word [rax], di
jne 0x7ff7c0087917
mov eax, dword [rax + 0x3c]
lea ecx, [rax - 1]
cmp ecx, 0xffffffe
ja 0x7ff7c0087917
cmp dword [rax + rdx], 0x4550
jne 0x7ff7c0087917
lea r8, [rax + 0x88]
add r8, rdx
mov eax, dword [r8]
test eax, eax
je 0x7ff7c0087917
cmp dword [r8 + 4], 0
je 0x7ff7c0087917
lea r9, [rdx + rax]
xor ebx, ebx
lea rax, [0x7ff7c0184f20]
mov word [rsp + 0x28], bx
mov rcx, rdx
mov qword [rsp + 0x20], rax
call fcn.7ff7c00c4bd0
mov rdx, qword [0x7ff7c01d5a90]
mov rcx, rax
jmp 0x7ff7c008791b
xor ebx, ebx
mov ecx, ebx
cmp word [rdx], di
mov rdi, qword [rsp + 0x30]
mov qword [0x7ff7c01d5b08], rcx
jne 0x7ff7c008798a
mov r8d, dword [rdx + 0x3c]
lea eax, [r8 - 1]
cmp eax, 0xffffffe
ja 0x7ff7c008798a
cmp dword [r8 + rdx], 0x4550
jne 0x7ff7c008798a
add r8, 0x88
add r8, rdx
mov eax, dword [r8]
test eax, eax
je 0x7ff7c008798a
cmp dword [r8 + 4], 0
je 0x7ff7c008798a
lea r9, [rdx + rax]
mov word [rsp + 0x28], bx
lea rax, [0x7ff7c0184f30]
mov rcx, rdx
mov qword [rsp + 0x20], rax
call fcn.7ff7c00c4bd0
mov rdx, qword [0x7ff7c01d5a90]
mov rcx, qword [0x7ff7c01d5b08]
jmp 0x7ff7c008798d
mov rax, rbx
mov qword [0x7ff7c01d5a78], rax
test rcx, rcx
je 0x7ff7c008799e
test rax, rax
jne 0x7ff7c00879ae
mov rcx, rdx
call qword [sym.imp.kernel32.dll_FreeLibrary]
mov qword [0x7ff7c01d5a90], rbx
mov rbx, qword [rsp + 0x40]
lea rcx, [0x7ff7c01ce318]
call sym.ProcessHacker.exe_PhfSetEvent
cmp qword [0x7ff7c01d5a90], 0
setne al
add rsp, 0x38
ret
Function at 0x7ff7c0088800
Capabilities:
Enumerate gui resources

Disassembly:
sub rsp, 0x38
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x50], rbp
mov rbp, rcx
call fcn.7ff7c0088740
mov rdx, qword [0x7ff7c01d3b60]
mov ecx, 0x10
call sym.ProcessHacker.exe_PhCreateObject
mov rcx, qword [0x7ff7c01d3cd0]
mov edx, 4
mov rbx, rax
mov dword [rax], 0
lea r8d, [rdx + 0x4c]
mov dword [rax + 4], 0xa
call qword [sym.imp.kernel32.dll_HeapAlloc_1]
mov qword [rbx + 8], rax
mov qword [rsp + 0x20], rbx
call fcn.7ff7c00874c0
mov qword [rsp + 0x28], rax
call qword [sym.imp.USER32.dll_GetProcessWindowStation]
mov rcx, rax
lea r8, [rsp + 0x20]
lea rdx, [0x7ff7c00886b0]
call qword [sym.imp.USER32.dll_EnumDesktopsW]
mov rcx, qword [rsp + 0x20]
xor ebx, ebx
cmp dword [rcx], ebx
jbe 0x7ff7c0088926
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x30], rdi
nop dword [rax]
nop dword [rax + rax]
mov rax, qword [rcx + 8]
lea rdi, [rbx*8]
mov rcx, qword [rdi + rax]
test rcx, rcx
je 0x7ff7c00888bb
mov r9, qword [rcx + 8]
jmp 0x7ff7c00888be
xor r9d, r9d
xor r8d, r8d
mov edx, 0x143
mov rcx, rbp
call qword [sym.imp.USER32.dll_SendMessageW]
mov rsi, rax
cmp eax, 0xffffffff
je 0x7ff7c0088911
mov rcx, qword [0x7ff7c01d3cd0]
mov edx, 4
lea r8d, [rdx + 4]
call qword [sym.imp.kernel32.dll_HeapAlloc_1]
mov rcx, qword [rsp + 0x20]
mov r9, rax
movsxd r8, esi
mov rdx, qword [rcx + 8]
mov rcx, qword [rdi + rdx]
mov edx, 0x151
mov qword [rax], rcx
mov rcx, rbp
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, qword [rsp + 0x20]
inc ebx
cmp ebx, dword [rcx]
jb 0x7ff7c00888a0
mov rdi, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x58]
mov ebx, 0xffffffff
add rcx, 0xfffffffffffffff0
mov eax, ebx
lock xadd dword [rcx + 8], eax
mov rbp, qword [rsp + 0x50]
cmp eax, 1
jne 0x7ff7c008894a
call fcn.7ff7c00c6290
mov rcx, qword [rsp + 0x28]
add rcx, 0xfffffffffffffff0
lock xadd dword [rcx + 8], ebx
cmp ebx, 1
mov rbx, qword [rsp + 0x40]
jne 0x7ff7c0088967
call fcn.7ff7c00c6290
add rsp, 0x38
ret