joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140121f80
Capabilities:
Parse pe header

Disassembly:
push rbx
sub rsp, 0x30
xor ebx, ebx
test byte [0x14023e3c0], 1
jne 0x1401220b6
lock bts qword [0x14023e3c0], 0x1f
nop
jae 0x140121fc5
test byte [0x14023e3c0], 1
jne 0x1401220b6
xor edx, edx
lea rcx, [0x14023e3c0]
call sym.ProcessHacker.exe_PhfWaitForEvent
nop dword [rax]
jmp 0x1401220b6
lea rcx, [0x1401db740]
call fcn.1400f9d00
mov rcx, rax
test rax, rax
jne 0x140122017
xor edx, edx
lea rcx, [0x1401db740]
mov r8d, 0x800
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
test rax, rax
jne 0x140122017
xor edx, edx
lea rcx, [0x1401db740]
mov r8d, 0xa00
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
test rax, rax
je 0x1401220aa
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x1401220aa
mov edx, dword [rcx + 0x3c]
lea eax, [rdx - 1]
cmp eax, 0x7ffffffd
ja 0x1401220aa
cmp dword [rdx + rcx], 0x4550
jne 0x1401220aa
add rdx, 0x88
add rdx, rcx
mov eax, dword [rdx]
test eax, eax
je 0x1401220aa
cmp dword [rdx + 4], ebx
je 0x1401220aa
lea r8, [rcx + rax]
mov word [rsp + 0x20], bx
lea r9, str.RtlGetAppContainerParent
call fcn.1400fa1a0
mov r9, rax
test rax, rax
je 0x1401220aa
mov rcx, qword [0x7ffe0320]
mov edx, dword [0x7ffe0004]
mov eax, ecx
shr rcx, 0x20
imul rax, rdx
imul rcx, rdx
shr rax, 0x18
shl rcx, 8
add rax, rcx
mov qword [0x140244cf8], rax
xor rax, r9
mov qword [0x140244d58], rax
lea rcx, [0x14023e3c0]
call sym.ProcessHacker.exe_PhfSetEvent
mov rax, qword [0x140244d58]
nop dword [rax]
test rax, rax
je 0x1401220da
mov rcx, qword [0x140244cf8]
test rcx, rcx
je 0x1401220da
xor rax, rcx
add rsp, 0x30
pop rbx
ret
mov rax, rbx
add rsp, 0x30
pop rbx
ret
Function at 0x140122100
Capabilities:
Parse pe header

Disassembly:
push rbx
sub rsp, 0x30
xor ebx, ebx
test byte [0x14023e420], 1
jne 0x140122236
lock bts qword [0x14023e420], 0x1f
nop
jae 0x140122145
test byte [0x14023e420], 1
jne 0x140122236
xor edx, edx
lea rcx, [0x14023e420]
call sym.ProcessHacker.exe_PhfWaitForEvent
nop dword [rax]
jmp 0x140122236
lea rcx, [0x1401db740]
call fcn.1400f9d00
mov rcx, rax
test rax, rax
jne 0x140122197
xor edx, edx
lea rcx, [0x1401db740]
mov r8d, 0x800
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
test rax, rax
jne 0x140122197
xor edx, edx
lea rcx, [0x1401db740]
mov r8d, 0xa00
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
test rax, rax
je 0x14012222a
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x14012222a
mov edx, dword [rcx + 0x3c]
lea eax, [rdx - 1]
cmp eax, 0x7ffffffd
ja 0x14012222a
cmp dword [rdx + rcx], 0x4550
jne 0x14012222a
add rdx, 0x88
add rdx, rcx
mov eax, dword [rdx]
test eax, eax
je 0x14012222a
cmp dword [rdx + 4], ebx
je 0x14012222a
lea r8, [rcx + rax]
mov word [rsp + 0x20], bx
lea r9, str.RtlDeriveCapabilitySidsFromName
call fcn.1400fa1a0
mov r9, rax
test rax, rax
je 0x14012222a
mov rcx, qword [0x7ffe0320]
mov edx, dword [0x7ffe0004]
mov eax, ecx
shr rcx, 0x20
imul rax, rdx
imul rcx, rdx
shr rax, 0x18
shl rcx, 8
add rax, rcx
mov qword [0x140244d70], rax
xor rax, r9
mov qword [0x140244d20], rax
lea rcx, [0x14023e420]
call sym.ProcessHacker.exe_PhfSetEvent
mov rax, qword [0x140244d20]
nop dword [rax]
test rax, rax
je 0x14012225a
mov rcx, qword [0x140244d70]
test rcx, rcx
je 0x14012225a
xor rax, rcx
add rsp, 0x30
pop rbx
ret
mov rax, rbx
add rsp, 0x30
pop rbx
ret
Function at 0x140122280
Capabilities:
Parse pe header

Disassembly:
push rbx
sub rsp, 0x30
xor ebx, ebx
test byte [0x14023e360], 1
jne 0x1401223b6
lock bts qword [0x14023e360], 0x1f
nop
jae 0x1401222c5
test byte [0x14023e360], 1
jne 0x1401223b6
xor edx, edx
lea rcx, [0x14023e360]
call sym.ProcessHacker.exe_PhfWaitForEvent
nop dword [rax]
jmp 0x1401223b6
lea rcx, str.advapi32.dll
call fcn.1400f9d00
mov rcx, rax
test rax, rax
jne 0x140122317
xor edx, edx
lea rcx, str.advapi32.dll
mov r8d, 0x800
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
test rax, rax
jne 0x140122317
xor edx, edx
lea rcx, str.advapi32.dll
mov r8d, 0xa00
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
test rax, rax
je 0x1401223aa
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x1401223aa
mov edx, dword [rcx + 0x3c]
lea eax, [rdx - 1]
cmp eax, 0x7ffffffd
ja 0x1401223aa
cmp dword [rdx + rcx], 0x4550
jne 0x1401223aa
add rdx, 0x88
add rdx, rcx
mov eax, dword [rdx]
test eax, eax
je 0x1401223aa
cmp dword [rdx + 4], ebx
je 0x1401223aa
lea r8, [rcx + rax]
mov word [rsp + 0x20], bx
lea r9, str.ConvertSecurityDescriptorToStringSecurityDescriptorW
call fcn.1400fa1a0
mov r9, rax
test rax, rax
je 0x1401223aa
mov rcx, qword [0x7ffe0320]
mov edx, dword [0x7ffe0004]
mov eax, ecx
shr rcx, 0x20
imul rax, rdx
imul rcx, rdx
shr rax, 0x18
shl rcx, 8
add rax, rcx
mov qword [0x140244c88], rax
xor rax, r9
mov qword [0x140244be0], rax
lea rcx, [0x14023e360]
call sym.ProcessHacker.exe_PhfSetEvent
mov rax, qword [0x140244be0]
nop dword [rax]
test rax, rax
je 0x1401223da
mov rcx, qword [0x140244c88]
test rcx, rcx
je 0x1401223da
xor rax, rcx
add rsp, 0x30
pop rbx
ret
mov rax, rbx
add rsp, 0x30
pop rbx
ret
Function at 0x140122400
Capabilities:
Parse pe header

Disassembly:
push rbx
sub rsp, 0x30
xor ebx, ebx
test byte [0x14023e500], 1
jne 0x140122536
lock bts qword [0x14023e500], 0x1f
nop
jae 0x140122445
test byte [0x14023e500], 1
jne 0x140122536
xor edx, edx
lea rcx, [0x14023e500]
call sym.ProcessHacker.exe_PhfWaitForEvent
nop dword [rax]
jmp 0x140122536
lea rcx, str.advapi32.dll
call fcn.1400f9d00
mov rcx, rax
test rax, rax
jne 0x140122497
xor edx, edx
lea rcx, str.advapi32.dll
mov r8d, 0x800
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
test rax, rax
jne 0x140122497
xor edx, edx
lea rcx, str.advapi32.dll
mov r8d, 0xa00
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
test rax, rax
je 0x14012252a
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x14012252a
mov edx, dword [rcx + 0x3c]
lea eax, [rdx - 1]
cmp eax, 0x7ffffffd
ja 0x14012252a
cmp dword [rdx + rcx], 0x4550
jne 0x14012252a
add rdx, 0x88
add rdx, rcx
mov eax, dword [rdx]
test eax, eax
je 0x14012252a
cmp dword [rdx + 4], ebx
je 0x14012252a
lea r8, [rcx + rax]
mov word [rsp + 0x20], bx
lea r9, str.ConvertStringSecurityDescriptorToSecurityDescriptorW
call fcn.1400fa1a0
mov r9, rax
test rax, rax
je 0x14012252a
mov rcx, qword [0x7ffe0320]
mov edx, dword [0x7ffe0004]
mov eax, ecx
shr rcx, 0x20
imul rax, rdx
imul rcx, rdx
shr rax, 0x18
shl rcx, 8
add rax, rcx
mov qword [0x140244cf0], rax
xor rax, r9
mov qword [0x140244ca0], rax
lea rcx, [0x14023e500]
call sym.ProcessHacker.exe_PhfSetEvent
mov rax, qword [0x140244ca0]
nop dword [rax]
test rax, rax
je 0x14012255a
mov rcx, qword [0x140244cf0]
test rcx, rcx
je 0x14012255a
xor rax, rcx
add rsp, 0x30
pop rbx
ret
mov rax, rbx
add rsp, 0x30
pop rbx
ret
Function at 0x140122580
Capabilities:
Parse pe header

Disassembly:
push rbx
sub rsp, 0x30
xor ebx, ebx
test byte [0x14023e410], 1
jne 0x1401226b6
lock bts qword [0x14023e410], 0x1f
nop
jae 0x1401225c5
test byte [0x14023e410], 1
jne 0x1401226b6
xor edx, edx
lea rcx, [0x14023e410]
call sym.ProcessHacker.exe_PhfWaitForEvent
nop dword [rax]
jmp 0x1401226b6
lea rcx, str.dnsapi.dll
call fcn.1400f9d00
mov rcx, rax
test rax, rax
jne 0x140122617
xor edx, edx
lea rcx, str.dnsapi.dll
mov r8d, 0x800
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
test rax, rax
jne 0x140122617
xor edx, edx
lea rcx, str.dnsapi.dll
mov r8d, 0xa00
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
test rax, rax
je 0x1401226aa
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x1401226aa
mov edx, dword [rcx + 0x3c]
lea eax, [rdx - 1]
cmp eax, 0x7ffffffd
ja 0x1401226aa
cmp dword [rdx + rcx], 0x4550
jne 0x1401226aa
add rdx, 0x88
add rdx, rcx
mov eax, dword [rdx]
test eax, eax
je 0x1401226aa
cmp dword [rdx + 4], ebx
je 0x1401226aa
lea r8, [rcx + rax]
mov word [rsp + 0x20], bx
lea r9, str.DnsQuery_W
call fcn.1400fa1a0
mov r9, rax
test rax, rax
je 0x1401226aa
mov rcx, qword [0x7ffe0320]
mov edx, dword [0x7ffe0004]
mov eax, ecx
shr rcx, 0x20
imul rax, rdx
imul rcx, rdx
shr rax, 0x18
shl rcx, 8
add rax, rcx
mov qword [0x140244d50], rax
xor rax, r9
mov qword [0x140244b90], rax
lea rcx, [0x14023e410]
call sym.ProcessHacker.exe_PhfSetEvent
mov rax, qword [0x140244b90]
nop dword [rax]
test rax, rax
je 0x1401226da
mov rcx, qword [0x140244d50]
test rcx, rcx
je 0x1401226da
xor rax, rcx
add rsp, 0x30
pop rbx
ret
mov rax, rbx
add rsp, 0x30
pop rbx
ret
Function at 0x140122700
Capabilities:
Parse pe header

Disassembly:
push rbx
sub rsp, 0x30
xor ebx, ebx
test byte [0x14023e490], 1
jne 0x140122836
lock bts qword [0x14023e490], 0x1f
nop
jae 0x140122745
test byte [0x14023e490], 1
jne 0x140122836
xor edx, edx
lea rcx, [0x14023e490]
call sym.ProcessHacker.exe_PhfWaitForEvent
nop dword [rax]
jmp 0x140122836
lea rcx, str.dnsapi.dll
call fcn.1400f9d00
mov rcx, rax
test rax, rax
jne 0x140122797
xor edx, edx
lea rcx, str.dnsapi.dll
mov r8d, 0x800
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
test rax, rax
jne 0x140122797
xor edx, edx
lea rcx, str.dnsapi.dll
mov r8d, 0xa00
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
test rax, rax
je 0x14012282a
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x14012282a
mov edx, dword [rcx + 0x3c]
lea eax, [rdx - 1]
cmp eax, 0x7ffffffd
ja 0x14012282a
cmp dword [rdx + rcx], 0x4550
jne 0x14012282a
add rdx, 0x88
add rdx, rcx
mov eax, dword [rdx]
test eax, eax
je 0x14012282a
cmp dword [rdx + 4], ebx
je 0x14012282a
lea r8, [rcx + rax]
mov word [rsp + 0x20], bx
lea r9, str.DnsExtractRecordsFromMessage_W
call fcn.1400fa1a0
mov r9, rax
test rax, rax
je 0x14012282a
mov rcx, qword [0x7ffe0320]
mov edx, dword [0x7ffe0004]
mov eax, ecx
shr rcx, 0x20
imul rax, rdx
imul rcx, rdx
shr rax, 0x18
shl rcx, 8
add rax, rcx
mov qword [0x140244d98], rax
xor rax, r9
mov qword [0x140244d78], rax
lea rcx, [0x14023e490]
call sym.ProcessHacker.exe_PhfSetEvent
mov rax, qword [0x140244d78]
nop dword [rax]
test rax, rax
je 0x14012285a
mov rcx, qword [0x140244d98]
test rcx, rcx
je 0x14012285a
xor rax, rcx
add rsp, 0x30
pop rbx
ret
mov rax, rbx
add rsp, 0x30
pop rbx
ret
Function at 0x140122880
Capabilities:
Parse pe header

Disassembly:
push rbx
sub rsp, 0x30
xor ebx, ebx
test byte [0x14023e3d0], 1
jne 0x1401229b6
lock bts qword [0x14023e3d0], 0x1f
nop
jae 0x1401228c5
test byte [0x14023e3d0], 1
jne 0x1401229b6
xor edx, edx
lea rcx, [0x14023e3d0]
call sym.ProcessHacker.exe_PhfWaitForEvent
nop dword [rax]
jmp 0x1401229b6
lea rcx, str.dnsapi.dll
call fcn.1400f9d00
mov rcx, rax
test rax, rax
jne 0x140122917
xor edx, edx
lea rcx, str.dnsapi.dll
mov r8d, 0x800
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
test rax, rax
jne 0x140122917
xor edx, edx
lea rcx, str.dnsapi.dll
mov r8d, 0xa00
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
test rax, rax
je 0x1401229aa
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x1401229aa
mov edx, dword [rcx + 0x3c]
lea eax, [rdx - 1]
cmp eax, 0x7ffffffd
ja 0x1401229aa
cmp dword [rdx + rcx], 0x4550
jne 0x1401229aa
add rdx, 0x88
add rdx, rcx
mov eax, dword [rdx]
test eax, eax
je 0x1401229aa
cmp dword [rdx + 4], ebx
je 0x1401229aa
lea r8, [rcx + rax]
mov word [rsp + 0x20], bx
lea r9, str.DnsWriteQuestionToBuffer_W
call fcn.1400fa1a0
mov r9, rax
test rax, rax
je 0x1401229aa
mov rcx, qword [0x7ffe0320]
mov edx, dword [0x7ffe0004]
mov eax, ecx
shr rcx, 0x20
imul rax, rdx
imul rcx, rdx
shr rax, 0x18
shl rcx, 8
add rax, rcx
mov qword [0x140244da8], rax
xor rax, r9
mov qword [0x140244ce0], rax
lea rcx, [0x14023e3d0]
call sym.ProcessHacker.exe_PhfSetEvent
mov rax, qword [0x140244ce0]
nop dword [rax]
test rax, rax
je 0x1401229da
mov rcx, qword [0x140244da8]
test rcx, rcx
je 0x1401229da
xor rax, rcx
add rsp, 0x30
pop rbx
ret
mov rax, rbx
add rsp, 0x30
pop rbx
ret
Function at 0x140122a00
Capabilities:
Parse pe header

Disassembly:
push rbx
sub rsp, 0x30
xor ebx, ebx
test byte [0x14023e450], 1
jne 0x140122b36
lock bts qword [0x14023e450], 0x1f
nop
jae 0x140122a45
test byte [0x14023e450], 1
jne 0x140122b36
xor edx, edx
lea rcx, [0x14023e450]
call sym.ProcessHacker.exe_PhfWaitForEvent
nop dword [rax]
jmp 0x140122b36
lea rcx, str.dnsapi.dll
call fcn.1400f9d00
mov rcx, rax
test rax, rax
jne 0x140122a97
xor edx, edx
lea rcx, str.dnsapi.dll
mov r8d, 0x800
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
test rax, rax
jne 0x140122a97
xor edx, edx
lea rcx, str.dnsapi.dll
mov r8d, 0xa00
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
test rax, rax
je 0x140122b2a
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x140122b2a
mov edx, dword [rcx + 0x3c]
lea eax, [rdx - 1]
cmp eax, 0x7ffffffd
ja 0x140122b2a
cmp dword [rdx + rcx], 0x4550
jne 0x140122b2a
add rdx, 0x88
add rdx, rcx
mov eax, dword [rdx]
test eax, eax
je 0x140122b2a
cmp dword [rdx + 4], ebx
je 0x140122b2a
lea r8, [rcx + rax]
mov word [rsp + 0x20], bx
lea r9, str.DnsFree
call fcn.1400fa1a0
mov r9, rax
test rax, rax
je 0x140122b2a
mov rcx, qword [0x7ffe0320]
mov edx, dword [0x7ffe0004]
mov eax, ecx
shr rcx, 0x20
imul rax, rdx
imul rcx, rdx
shr rax, 0x18
shl rcx, 8
add rax, rcx
mov qword [0x140244c80], rax
xor rax, r9
mov qword [0x140244bc0], rax
lea rcx, [0x14023e450]
call sym.ProcessHacker.exe_PhfSetEvent
mov rax, qword [0x140244bc0]
nop dword [rax]
test rax, rax
je 0x140122b5a
mov rcx, qword [0x140244c80]
test rcx, rcx
je 0x140122b5a
xor rax, rcx
add rsp, 0x30
pop rbx
ret
mov rax, rbx
add rsp, 0x30
pop rbx
ret
Function at 0x140122b80
Capabilities:
Parse pe header

Disassembly:
push rbx
sub rsp, 0x30
xor ebx, ebx
test byte [0x14023e430], 1
jne 0x140122cb6
lock bts qword [0x14023e430], 0x1f
nop
jae 0x140122bc5
test byte [0x14023e430], 1
jne 0x140122cb6
xor edx, edx
lea rcx, [0x14023e430]
call sym.ProcessHacker.exe_PhfWaitForEvent
nop dword [rax]
jmp 0x140122cb6
lea rcx, str.shlwapi.dll
call fcn.1400f9d00
mov rcx, rax
test rax, rax
jne 0x140122c17
xor edx, edx
lea rcx, str.shlwapi.dll
mov r8d, 0x800
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
test rax, rax
jne 0x140122c17
xor edx, edx
lea rcx, str.shlwapi.dll
mov r8d, 0xa00
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
test rax, rax
je 0x140122caa
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x140122caa
mov edx, dword [rcx + 0x3c]
lea eax, [rdx - 1]
cmp eax, 0x7ffffffd
ja 0x140122caa
cmp dword [rdx + rcx], 0x4550
jne 0x140122caa
add rdx, 0x88
add rdx, rcx
mov eax, dword [rdx]
test eax, eax
je 0x140122caa
cmp dword [rdx + 4], ebx
je 0x140122caa
lea r8, [rcx + rax]
mov word [rsp + 0x20], bx
lea r9, str.SHAutoComplete
call fcn.1400fa1a0
mov r9, rax
test rax, rax
je 0x140122caa
mov rcx, qword [0x7ffe0320]
mov edx, dword [0x7ffe0004]
mov eax, ecx
shr rcx, 0x20
imul rax, rdx
imul rcx, rdx
shr rax, 0x18
shl rcx, 8
add rax, rcx
mov qword [0x140244c18], rax
xor rax, r9
mov qword [0x140244ce8], rax
lea rcx, [0x14023e430]
call sym.ProcessHacker.exe_PhfSetEvent
mov rax, qword [0x140244ce8]
nop dword [rax]
test rax, rax
je 0x140122cda
mov rcx, qword [0x140244c18]
test rcx, rcx
je 0x140122cda
xor rax, rcx
add rsp, 0x30
pop rbx
ret
mov rax, rbx
add rsp, 0x30
pop rbx
ret
Function at 0x140122d00
Capabilities:
Parse pe header

Disassembly:
push rbx
sub rsp, 0x30
xor ebx, ebx
test byte [0x14023e540], 1
jne 0x140122e36
lock bts qword [0x14023e540], 0x1f
nop
jae 0x140122d45
test byte [0x14023e540], 1
jne 0x140122e36
xor edx, edx
lea rcx, [0x14023e540]
call sym.ProcessHacker.exe_PhfWaitForEvent
nop dword [rax]
jmp 0x140122e36
lea rcx, str.shell32.dll
call fcn.1400f9d00
mov rcx, rax
test rax, rax
jne 0x140122d97
xor edx, edx
lea rcx, str.shell32.dll
mov r8d, 0x800
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
test rax, rax
jne 0x140122d97
xor edx, edx
lea rcx, str.shell32.dll
mov r8d, 0xa00
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
test rax, rax
je 0x140122e2a
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x140122e2a
mov edx, dword [rcx + 0x3c]
lea eax, [rdx - 1]
cmp eax, 0x7ffffffd
ja 0x140122e2a
cmp dword [rdx + rcx], 0x4550
jne 0x140122e2a
add rdx, 0x88
add rdx, rcx
mov eax, dword [rdx]
test eax, eax
je 0x140122e2a
cmp dword [rdx + 4], ebx
je 0x140122e2a
lea r8, [rcx + rax]
mov word [rsp + 0x20], bx
lea r9, str.SHGetFolderPathW
call fcn.1400fa1a0
mov r9, rax
test rax, rax
je 0x140122e2a
mov rcx, qword [0x7ffe0320]
mov edx, dword [0x7ffe0004]
mov eax, ecx
shr rcx, 0x20
imul rax, rdx
imul rcx, rdx
shr rax, 0x18
shl rcx, 8
add rax, rcx
mov qword [0x140244bc8], rax
xor rax, r9
mov qword [0x140244c50], rax
lea rcx, [0x14023e540]
call sym.ProcessHacker.exe_PhfSetEvent
mov rax, qword [0x140244c50]
nop dword [rax]
test rax, rax
je 0x140122e5a
mov rcx, qword [0x140244bc8]
test rcx, rcx
je 0x140122e5a
xor rax, rcx
add rsp, 0x30
pop rbx
ret
mov rax, rbx
add rsp, 0x30
pop rbx
ret
Function at 0x140122e80
Capabilities:
Parse pe header

Disassembly:
push rbx
sub rsp, 0x30
xor ebx, ebx
test byte [0x14023e390], 1
jne 0x140122fb6
lock bts qword [0x14023e390], 0x1f
nop
jae 0x140122ec5
test byte [0x14023e390], 1
jne 0x140122fb6
xor edx, edx
lea rcx, [0x14023e390]
call sym.ProcessHacker.exe_PhfWaitForEvent
nop dword [rax]
jmp 0x140122fb6
lea rcx, str.shell32.dll
call fcn.1400f9d00
mov rcx, rax
test rax, rax
jne 0x140122f17
xor edx, edx
lea rcx, str.shell32.dll
mov r8d, 0x800
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
test rax, rax
jne 0x140122f17
xor edx, edx
lea rcx, str.shell32.dll
mov r8d, 0xa00
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
test rax, rax
je 0x140122faa
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x140122faa
mov edx, dword [rcx + 0x3c]
lea eax, [rdx - 1]
cmp eax, 0x7ffffffd
ja 0x140122faa
cmp dword [rdx + rcx], 0x4550
jne 0x140122faa
add rdx, 0x88
add rdx, rcx
mov eax, dword [rdx]
test eax, eax
je 0x140122faa
cmp dword [rdx + 4], ebx
je 0x140122faa
lea r8, [rcx + rax]
mov word [rsp + 0x20], bx
lea r9, str.SHGetFileInfoW
call fcn.1400fa1a0
mov r9, rax
test rax, rax
je 0x140122faa
mov rcx, qword [0x7ffe0320]
mov edx, dword [0x7ffe0004]
mov eax, ecx
shr rcx, 0x20
imul rax, rdx
imul rcx, rdx
shr rax, 0x18
shl rcx, 8
add rax, rcx
mov qword [0x140244c20], rax
xor rax, r9
mov qword [0x140244c28], rax
lea rcx, [0x14023e390]
call sym.ProcessHacker.exe_PhfSetEvent
mov rax, qword [0x140244c28]
nop dword [rax]
test rax, rax
je 0x140122fda
mov rcx, qword [0x140244c20]
test rcx, rcx
je 0x140122fda
xor rax, rcx
add rsp, 0x30
pop rbx
ret
mov rax, rbx
add rsp, 0x30
pop rbx
ret
Function at 0x140123000
Capabilities:
Parse pe header

Disassembly:
push rbx
sub rsp, 0x30
xor ebx, ebx
test byte [0x14023e470], 1
jne 0x140123136
lock bts qword [0x14023e470], 0x1f
nop
jae 0x140123045
test byte [0x14023e470], 1
jne 0x140123136
xor edx, edx
lea rcx, [0x14023e470]
call sym.ProcessHacker.exe_PhfWaitForEvent
nop dword [rax]
jmp 0x140123136
lea rcx, str.kernel32.dll
call fcn.1400f9d00
mov rcx, rax
test rax, rax
jne 0x140123097
xor edx, edx
lea rcx, str.kernel32.dll
mov r8d, 0x800
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
test rax, rax
jne 0x140123097
xor edx, edx
lea rcx, str.kernel32.dll
mov r8d, 0xa00
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
test rax, rax
je 0x14012312a
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x14012312a
mov edx, dword [rcx + 0x3c]
lea eax, [rdx - 1]
cmp eax, 0x7ffffffd
ja 0x14012312a
cmp dword [rdx + rcx], 0x4550
jne 0x14012312a
add rdx, 0x88
add rdx, rcx
mov eax, dword [rdx]
test eax, eax
je 0x14012312a
cmp dword [rdx + 4], ebx
je 0x14012312a
lea r8, [rcx + rax]
mov word [rsp + 0x20], bx
lea r9, str.PssCaptureSnapshot
call fcn.1400fa1a0
mov r9, rax
test rax, rax
je 0x14012312a
mov rcx, qword [0x7ffe0320]
mov edx, dword [0x7ffe0004]
mov eax, ecx
shr rcx, 0x20
imul rax, rdx
imul rcx, rdx
shr rax, 0x18
shl rcx, 8
add rax, rcx
mov qword [0x140244d90], rax
xor rax, r9
mov qword [0x140244bf8], rax
lea rcx, [0x14023e470]
call sym.ProcessHacker.exe_PhfSetEvent
mov rax, qword [0x140244bf8]
nop dword [rax]
test rax, rax
je 0x14012315a
mov rcx, qword [0x140244d90]
test rcx, rcx
je 0x14012315a
xor rax, rcx
add rsp, 0x30
pop rbx
ret
mov rax, rbx
add rsp, 0x30
pop rbx
ret
Function at 0x140123180
Capabilities:
Parse pe header

Disassembly:
push rbx
sub rsp, 0x30
xor ebx, ebx
test byte [0x14023e520], 1
jne 0x1401232b6
lock bts qword [0x14023e520], 0x1f
nop
jae 0x1401231c5
test byte [0x14023e520], 1
jne 0x1401232b6
xor edx, edx
lea rcx, [0x14023e520]
call sym.ProcessHacker.exe_PhfWaitForEvent
nop dword [rax]
jmp 0x1401232b6
lea rcx, str.kernel32.dll
call fcn.1400f9d00
mov rcx, rax
test rax, rax
jne 0x140123217
xor edx, edx
lea rcx, str.kernel32.dll
mov r8d, 0x800
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
test rax, rax
jne 0x140123217
xor edx, edx
lea rcx, str.kernel32.dll
mov r8d, 0xa00
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
test rax, rax
je 0x1401232aa
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x1401232aa
mov edx, dword [rcx + 0x3c]
lea eax, [rdx - 1]
cmp eax, 0x7ffffffd
ja 0x1401232aa
cmp dword [rdx + rcx], 0x4550
jne 0x1401232aa
add rdx, 0x88
add rdx, rcx
mov eax, dword [rdx]
test eax, eax
je 0x1401232aa
cmp dword [rdx + 4], ebx
je 0x1401232aa
lea r8, [rcx + rax]
mov word [rsp + 0x20], bx
lea r9, str.PssQuerySnapshot
call fcn.1400fa1a0
mov r9, rax
test rax, rax
je 0x1401232aa
mov rcx, qword [0x7ffe0320]
mov edx, dword [0x7ffe0004]
mov eax, ecx
shr rcx, 0x20
imul rax, rdx
imul rcx, rdx
shr rax, 0x18
shl rcx, 8
add rax, rcx
mov qword [0x140244c10], rax
xor rax, r9
mov qword [0x140244bd8], rax
lea rcx, [0x14023e520]
call sym.ProcessHacker.exe_PhfSetEvent
mov rax, qword [0x140244bd8]
nop dword [rax]
test rax, rax
je 0x1401232da
mov rcx, qword [0x140244c10]
test rcx, rcx
je 0x1401232da
xor rax, rcx
add rsp, 0x30
pop rbx
ret
mov rax, rbx
add rsp, 0x30
pop rbx
ret
Function at 0x140123300
Capabilities:
Parse pe header

Disassembly:
push rbx
sub rsp, 0x30
xor ebx, ebx
test byte [0x14023e550], 1
jne 0x140123436
lock bts qword [0x14023e550], 0x1f
nop
jae 0x140123345
test byte [0x14023e550], 1
jne 0x140123436
xor edx, edx
lea rcx, [0x14023e550]
call sym.ProcessHacker.exe_PhfWaitForEvent
nop dword [rax]
jmp 0x140123436
lea rcx, str.kernel32.dll
call fcn.1400f9d00
mov rcx, rax
test rax, rax
jne 0x140123397
xor edx, edx
lea rcx, str.kernel32.dll
mov r8d, 0x800
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
test rax, rax
jne 0x140123397
xor edx, edx
lea rcx, str.kernel32.dll
mov r8d, 0xa00
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
test rax, rax
je 0x14012342a
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x14012342a
mov edx, dword [rcx + 0x3c]
lea eax, [rdx - 1]
cmp eax, 0x7ffffffd
ja 0x14012342a
cmp dword [rdx + rcx], 0x4550
jne 0x14012342a
add rdx, 0x88
add rdx, rcx
mov eax, dword [rdx]
test eax, eax
je 0x14012342a
cmp dword [rdx + 4], ebx
je 0x14012342a
lea r8, [rcx + rax]
mov word [rsp + 0x20], bx
lea r9, str.PssFreeSnapshot
call fcn.1400fa1a0
mov r9, rax
test rax, rax
je 0x14012342a
mov rcx, qword [0x7ffe0320]
mov edx, dword [0x7ffe0004]
mov eax, ecx
shr rcx, 0x20
imul rax, rdx
imul rcx, rdx
shr rax, 0x18
shl rcx, 8
add rax, rcx
mov qword [0x140244d18], rax
xor rax, r9
mov qword [0x140244c38], rax
lea rcx, [0x14023e550]
call sym.ProcessHacker.exe_PhfSetEvent
mov rax, qword [0x140244c38]
nop dword [rax]
test rax, rax
je 0x14012345a
mov rcx, qword [0x140244d18]
test rcx, rcx
je 0x14012345a
xor rax, rcx
add rsp, 0x30
pop rbx
ret
mov rax, rbx
add rsp, 0x30
pop rbx
ret