joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140010220
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0xf0
mov rax, qword [0x140237008]
xor rax, rsp
mov qword [rsp + 0xe0], rax
mov rax, qword [0x140241bd0]
xor ebx, ebx
mov rdi, rcx
test rax, rax
jne 0x1400102ca
lea rcx, [0x1401d9d58]
nop dword [rax]
call fcn.1400f9d00
mov rcx, rax
test rax, rax
je 0x1400102e5
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x1400102e5
mov edx, dword ds:[rcx + 0x3c]
lea eax, [rdx - 1]
cmp eax, 0x7ffffffd
ja 0x1400102e5
cmp dword [rdx + rcx], 0x4550
jne 0x1400102e5
add rdx, 0x88
add rdx, rcx
mov eax, dword [rdx]
test eax, eax
je 0x1400102e5
cmp dword [rdx + 4], ebx
je 0x1400102e5
lea r8, [rcx + rax]
mov word [rsp + 0x20], bx
lea r9, str.GetSendMessageReceiver
call fcn.1400fa1a0
mov qword [0x140241bd0], rax
test rax, rax
je 0x1400102db
mov rcx, rdi
call qword [case.0x1400f654f.0]
mov rsi, rax
test rax, rax
jne 0x1400102f3
xor eax, eax
jmp 0x1400103d5
mov qword [0x140241bd0], rbx
xor eax, eax
jmp 0x1400103d5
lea rdx, [rsp + 0x50]
mov qword [rsp + 0x108], rbp
mov rcx, rsi
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov ecx, dword [rsp + 0x50]
mov eax, eax
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x40], rcx
call sym.ProcessHacker.exe_PhReferenceProcessItem
lea rcx, [rsp + 0x40]
mov rbp, rax
test rax, rax
je 0x140010351
mov rdx, qword [rax + 0x30]
call fcn.1401306a0
mov rdi, rax
lea rcx, [rbp - 0x10]
mov eax, 0xffffffff
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x14001035b
call fcn.1400fbcc0
jmp 0x14001035b
xor edx, edx
call fcn.1401306a0
mov rdi, rax
mov rcx, rdi
call sym.ProcessHacker.exe_PhAutoDereferenceObject
mov r8d, 0x40
lea rdx, [rsp + 0x60]
mov rcx, rsi
mov rdi, rax
call qword [sym.imp.USER32.dll_GetClassNameW]
mov rbp, qword [rsp + 0x108]
test eax, eax
jne 0x14001038d
mov word [rsp + 0x60], bx
lea r8, [rsp + 0x38]
xor edx, edx
mov rcx, rsi
call sym.ProcessHacker.exe_PhGetWindowTextEx
mov rcx, qword [rsp + 0x38]
call sym.ProcessHacker.exe_PhAutoDereferenceObject
test rax, rax
je 0x1400103b1
mov rax, qword [rax + 8]
jmp 0x1400103b8
lea rax, [0x1401b790c]
mov r8, qword [rdi + 8]
lea r9, [rsp + 0x60]
mov rdx, rsi
mov qword [rsp + 0x20], rax
lea rcx, str.Window_0x_Ix___s_:__s___s_
call fcn.140001720
mov rcx, qword [rsp + 0xe0]
xor rcx, rsp
call fcn.1401848a0
lea r11, [rsp + 0xf0]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x1400138a0
Capabilities:
Log keystrokes via polling

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rdx
cmp qword [rcx], rdx
jne 0x1400138e9
cmp dword [rcx + 0x10], 0xffffff65
jne 0x1400138e9
movzx eax, word ds:[rcx + 0x18]
cmp ax, 0x41
je 0x1400138e9
cmp ax, 0x43
jne 0x1400138e9
mov ecx, 0x11
call qword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jns 0x1400138e9
mov rcx, rbx
add rsp, 0x20
pop rbx
jmp sym.ProcessHacker.exe_PhCopyListView
add rsp, 0x20
pop rbx
ret

Function at 0x140013900
Capabilities:
Log keystrokes via polling

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rdx
cmp qword [rcx], rdx
jne 0x140013985
cmp dword [rcx + 0x10], 0xffffff65
jne 0x140013985
movzx eax, word ds:[rcx + 0x18]
cmp ax, 0x41
je 0x140013952
cmp ax, 0x43
jne 0x140013985
test r8b, 1
je 0x140013985
mov ecx, 0x11
call qword [sym.imp.USER32.dll_GetKeyState]
nop dword [rax]
test ax, ax
jns 0x140013985
mov rcx, rbx
add rsp, 0x20
pop rbx
jmp sym.ProcessHacker.exe_PhCopyListView
test r8b, 2
je 0x140013985
mov ecx, 0x11
call qword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jns 0x140013985
mov edx, 2
mov rcx, rbx
mov r8d, edx
add rsp, 0x20
pop rbx
jmp sym.ProcessHacker.exe_PhSetStateAllListViewItems
add rsp, 0x20
pop rbx
ret
Function at 0x14001daa0
Capabilities:
Get graphical window text

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x510
mov rax, qword [0x140237008]
xor rax, rsp
mov qword [rsp + 0x500], rax
mov rbx, rcx
mov dword [rsp + 0x24], edx
xor ecx, ecx
mov dword [rsp + 0x84], r8d
lea rax, [rsp + 0xe0]
mov dword [rsp + 0x28], ecx
mov qword [rsp + 0x38], rax
lea r9, [rsp + 0x20]
mov dword [rsp + 0x88], ecx
lea rax, [rsp + 0x2f0]
mov esi, r8d
mov qword [rsp + 0x98], rax
mov edi, edx
mov dword [rsp + 0x20], 0xd
mov rcx, rbx
mov dword [rsp + 0x30], 0xffffffff
xor r8d, r8d
mov dword [rsp + 0x40], 0x208
mov edx, 0x104b
mov dword [rsp + 0x80], 0xd
mov dword [rsp + 0x90], 0xffffffff
mov dword [rsp + 0xa0], 0x208
call qword [sym.imp.USER32.dll_SendMessageW]
test eax, eax
je 0x14001dba6
lea r9, [rsp + 0x80]
xor r8d, r8d
mov edx, 0x104b
mov rcx, rbx
call qword [sym.imp.USER32.dll_SendMessageW]
test eax, eax
je 0x14001dba6
lea r9, [rsp + 0x20]
mov dword [rsp + 0x24], esi
xor r8d, r8d
mov dword [rsp + 0x84], edi
mov edx, 0x104c
mov rcx, rbx
call qword [sym.imp.USER32.dll_SendMessageW]
lea r9, ds:[rsp + 0x80]
xor r8d, r8d
mov edx, 0x104c
mov rcx, rbx
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, qword [rsp + 0x500]
xor rcx, rsp
call fcn.1401848a0
add rsp, 0x510
pop rdi
pop rsi
pop rbx
ret
Function at 0x140040f00
Capabilities:
Allocate or change rwx memory
Parse pe header

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x60
mov rax, qword [0x140237008]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov r8, qword [0x140241948]
xor r13b, r13b
mov r12d, dword [rcx + 8]
mov rbx, 0xffffffffffffffff
mov eax, dword [rcx + 4]
add r12, r8
mov ebp, dword [rcx + 0xc]
add rax, r8
mov r15d, dword [rcx + 0x10]
add rbp, r8
add r15, r8
mov qword [rsp + 0x38], rdx
mov rdi, qword [r12]
test rdi, rdi
jne 0x140040fcf
mov rdx, rbx
nop
inc rdx
cmp byte [rax + rdx], r13b
jne 0x140040f60
mov rcx, rax
call sym.ProcessHacker.exe_PhZeroExtendToUtf16Ex
xor edx, edx
mov r8d, 0x800
mov rsi, rax
mov r14, qword [rax + 8]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rdi, rax
test rax, rax
jne 0x140040fae
xor edx, edx
mov r8d, 0xa00
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rdi, rax
test rax, rax
je 0x140040ff5
lea rcx, [rsi - 0x10]
mov eax, ebx
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x140040fc5
nop
call fcn.1400fbcc0
mov r8, qword [0x140241948]
mov r13b, 1
mov rax, qword ds:[rsp + 0x38]
sub rax, rbp
mov rcx, qword [rax + r15]
test rcx, rcx
jns 0x140041031
movzx r8d, cx
xor edx, edx
mov rcx, rdi
call fcn.1400fa100
jmp 0x140041045
lea rcx, ds:[rsi - 0x10]
lock xadd dword [rcx + 8], ebx
cmp ebx, 1
jne 0x14004100a
call fcn.1400fbcc0
xor eax, eax
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1401848a0
mov rbx, qword [rsp + 0xb0]
add rsp, 0x60
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
lea rdx, [rcx + 2]
add rdx, r8
movzx r8d, word [rcx + r8]
mov rcx, rdi
call fcn.1400fa480
mov rsi, rax
test rax, rax
je 0x14004100a
mov r9, qword [0x140241948]
mov eax, 0x5a4d
cmp word [r9], ax
jne 0x14004100a
mov ecx, dword [r9 + 0x3c]
lea eax, [rcx - 1]
cmp eax, 0x7ffffffd
ja 0x14004100a
cmp dword [r9 + rcx], 0x4550
lea r10, [r9 + rcx]
jne 0x14004100a
movzx r11d, word [r10 + 6]
xor edx, edx
test r11d, r11d
je 0x14004100a
movzx r14d, word [r10 + 0x14]
nop dword [rax]
lea rcx, [rdx + rdx*4]
lea r8, [r14 + rcx*8]
mov ecx, dword [r8 + r10 + 0x24]
lea rax, [rcx + r9]
cmp rbp, rax
jb 0x1400410b6
mov eax, dword [r8 + r10 + 0x28]
add rax, rcx
add rax, r9
cmp rbp, rax
jb 0x1400410c5
inc edx
cmp edx, r11d
jb 0x140041090
nop dword [rax]
jmp 0x14004100a
mov edx, dword [r8 + r10 + 0x20]
mov rax, rcx
add rax, r9
je 0x14004100a
test rdx, rdx
je 0x14004100a
mov qword [rsp + 0x40], rax
lea r8, [rsp + 0x50]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x50], rdx
mov r9d, 4
mov qword [rsp + 0x20], rax
lea rdx, [rsp + 0x40]
mov rcx, rbx
call qword [sym.imp.ntdll.dll_NtProtectVirtualMemory]
test eax, eax
js 0x14004100a
mov rcx, qword ds:[rsp + 0x38]
lea r8, [rsp + 0x50]
mov rax, rsi
lea rdx, [rsp + 0x40]
xchg qword [rcx], rax
mov r9d, dword [rsp + 0x48]
lea rcx, [rsp + 0x48]
mov qword [rsp + 0x20], rcx
mov rcx, rbx
call qword [sym.imp.ntdll.dll_NtProtectVirtualMemory]
test eax, eax
js 0x14004100a
mov rax, rdi
xchg qword [r12], rax
cmp rax, rdi
jne 0x140041168
test r13b, r13b
je 0x140041168
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rax, rsi
jmp 0x14004100c
Function at 0x140058800
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
mov rbx, rdx
mov rsi, rcx
mov rcx, qword [0x140241998]
mov edx, 4
mov r8d, 0x88
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov rdi, rax
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rdi], xmm0
movups xmmword [rdi + 0x10], xmm0
movups xmmword [rdi + 0x20], xmm0
movups xmmword [rdi + 0x30], xmm0
movups xmmword [rdi + 0x40], xmm0
movups xmmword [rdi + 0x50], xmm0
movups xmmword [rdi + 0x60], xmm0
movups xmmword [rdi + 0x70], xmm0
mov qword [rdi + 0x80], rax
mov dword [rdi], 5
mov qword [rdi + 0x60], rbx
mov rax, qword [rbx]
mov rcx, qword [rax + 0x20]
mov qword [rdi + 0x68], rcx
mov rax, qword [rbx]
mov rcx, qword [rax + 0x40]
mov qword [rdi + 0x70], rcx
mov rcx, qword [rbx + 0x10]
test rcx, rcx
je 0x140058976
call qword [sym.imp.USER32.dll_IsHungAppWindow]
test eax, eax
je 0x140058976
mov byte [rdi + 0x78], 1
test byte [0x14023e020], 1
mov rbx, qword [rbx + 0x10]
jne 0x14005895c
lock bts qword [0x14023e020], 0x1f
jae 0x1400588d9
test byte [0x14023e020], 1
nop
jne 0x14005895c
xor edx, edx
lea rcx, [0x14023e020]
call sym.ProcessHacker.exe_PhfWaitForEvent
jmp 0x14005895c
lea rcx, [0x1401d9d58]
call fcn.1400f9d00
mov rcx, rax
test rax, rax
je 0x140058947
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x140058947
mov edx, dword ds:[rcx + 0x3c]
lea eax, [rdx - 1]
cmp eax, 0x7ffffffd
ja 0x140058947
cmp dword [rdx + rcx], 0x4550
jne 0x140058947
add rdx, 0x88
add rdx, rcx
mov eax, dword [rdx]
test eax, eax
je 0x140058947
cmp dword [rdx + 4], 0
je 0x140058947
lea r8, ds:[rcx + rax]
xor eax, eax
lea r9, str.HungWindowFromGhostWindow
mov word [rsp + 0x20], ax
call fcn.1400fa1a0
jmp 0x140058949
xor eax, eax
lea rcx, [0x14023e020]
mov qword [0x140244810], rax
call sym.ProcessHacker.exe_PhfSetEvent
mov rax, qword [0x140244810]
test rax, rax
je 0x14005897a
mov rcx, rbx
call qword [case.0x1400f654f.0]
test rax, rax
je 0x14005897a
mov byte [rdi + 0x78], 0
mov rbx, qword [rsi + 0xa8]
mov eax, dword [rbx]
mov ecx, dword [rbx + 4]
cmp eax, ecx
jne 0x1400589b3
mov r8, qword [rbx + 8]
lea eax, [rcx + rcx]
mov rcx, qword [0x140241998]
mov edx, 4
mov r9d, eax
shl r9, 3
mov dword [rbx + 4], eax
call qword [sym.imp.ntdll.dll_RtlReAllocateHeap]
mov qword [rbx + 8], rax
mov eax, dword [rbx]
mov rsi, qword [rsp + 0x48]
mov ecx, eax
mov rax, qword [rbx + 8]
mov qword [rax + rcx*8], rdi
mov rax, rdi
inc dword [rbx]
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
Function at 0x14007cce0
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, rcx
mov edi, edx
mov ecx, dword [0x140246550]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov r8d, dword [rbx + 4]
mov r9d, dword [rbx]
mov rcx, qword [rax]
mov r10, qword [rcx + 0x38]
add r8, r10
add r9, r8
cmp r9, r8
jb 0x14007cd38
cmp r8, r10
jb 0x14007cd38
cmp r9, qword [rcx + 0x40]
ja 0x14007cd38
lea edx, [rdi - 1]
test r8, rdx
jne 0x14007cd38
lfence
mov rax, r8
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
mov rbx, qword [rsp + 0x30]
xor eax, eax
add rsp, 0x20
pop rdi
ret
Function at 0x140081c00
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x38
movzx eax, word [rcx]
lea r9, [rsp + 0x48]
mov word [rsp + 0x20], ax
lea r8, [rsp + 0x20]
add ax, 2
mov dword [rsp + 0x40], 2
mov word [rsp + 0x22], ax
lea rdx, [rsp + 0x40]
mov rax, qword [rcx + 8]
xor ecx, ecx
mov qword [rsp + 0x28], rax
call qword [sym.imp.ntdll.dll_LdrLoadDll]
nop dword [rax]
test eax, eax
js 0x140081d26
mov rcx, qword ds:[rsp + 0x48]
mov eax, 0x5a4d
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x30], rdi
cmp word [rcx], ax
je 0x140081c6f
mov ebx, 0xc000012f
jmp 0x140081d14
mov edx, dword ds:[rcx + 0x3c]
lea eax, [rdx - 1]
cmp eax, 0x7ffffffd
ja 0x140081d0f
cmp dword [rcx + rdx], 0x4550
lea rdi, [rcx + rdx]
jne 0x140081d0f
mov rdx, rdi
call fcn.1400fa7a0
mov ebx, eax
test eax, eax
js 0x140081cf7
lfence
mov rcx, qword [rsp + 0x48]
lea r8, [0x1401f02b0]
mov rdx, rdi
call fcn.1400fab00
mov ebx, eax
test eax, eax
js 0x140081cf7
mov eax, dword [rdi + 0x28]
mov rcx, qword [rsp + 0x48]
test eax, eax
jne 0x140081cde
mov ebx, 0xc0000139
jmp 0x140081d14
xor r8d, r8d
add rax, rcx
lea edx, [r8 + 1]
call qword [case.0x1400f654f.0]
test al, al
jne 0x140081cfe
mov ebx, 0xc0000142
mov rcx, qword [rsp + 0x48]
jmp 0x140081d14
mov rbx, qword [rsp + 0x50]
xor eax, eax
mov rdi, qword [rsp + 0x30]
add rsp, 0x38
ret
mov ebx, 0xc000007b
call qword [sym.imp.ntdll.dll_LdrUnloadDll]
mov rdi, qword [rsp + 0x30]
mov eax, ebx
mov rbx, qword [rsp + 0x50]
add rsp, 0x38
ret
Function at 0x140089e80
Capabilities:
Get graphical window text

Disassembly:
sub rsp, 0x28
call qword [sym.imp.USER32.dll_GetParent]
mov rcx, rax
mov edx, 0xffff
call sym.ProcessHacker.exe_PhGetWindowContext
lea rcx, ds:[rax + 8]
add rsp, 0x28
jmp sym.ProcessHacker.exe_PhLayoutManagerLayout
Function at 0x14008cea0
Capabilities:
Get system information on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x20
movsx r8d, byte [0x140241988]
xor r9d, r9d
mov rdx, qword [0x140241800]
mov r14, rcx
shl r8d, 3
lea ecx, [r9 + 0x53]
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
movsx ebp, byte [0x140241988]
xor ebx, ebx
mov rdx, qword [0x140241800]
mov edi, ebx
mov r10d, ebx
lea esi, [rbx + 2]
cmp ebp, 4
jb 0x14008cf5d
mov r9d, ebp
xorps xmm2, xmm2
and r9d, 0xfffffffc
xorps xmm1, xmm1
mov r8d, esi
nop word [rax + rax]
mov eax, r10d
add r10d, 4
movq xmm0, qword [rdx + rax*8]
lea eax, [r8 - 1]
movhpd xmm0, qword [rdx + rax*8]
mov eax, r8d
paddq xmm2, xmm0
movq xmm0, qword [rdx + rax*8]
lea eax, [r8 + 1]
movhpd xmm0, qword [rdx + rax*8]
add r8d, 4
paddq xmm1, xmm0
cmp r10d, r9d
jb 0x14008cf10
paddq xmm1, xmm2
movdqa xmm0, xmm1
psrldq xmm0, 8
paddq xmm1, xmm0
movq rdi, xmm1
mov r8, rbx
mov r9, rbx
cmp r10d, ebp
jae 0x14008cfb5
mov eax, ebp
mov ecx, r10d
sub eax, r10d
cmp eax, esi
jb 0x14008cfaa
mov eax, ebp
sub eax, r10d
sub eax, esi
shr eax, 1
inc eax
mov r11d, eax
lea eax, [r10 + rax*2]
nop word [rax + rax]
add r8, qword ds:[rdx + rcx*8]
add r9, qword [rdx + rcx*8 + 8]
add rcx, rsi
sub r11, 1
jne 0x14008cf90
cmp eax, ebp
jae 0x14008cfae
add rdi, qword [rdx + rcx*8]
lea rax, [r9 + r8]
add rdi, rax
mov rdx, qword [0x140241818]
lea r8d, [rbp*8]
xor r9d, r9d
mov rax, rdi
sub rax, qword [0x140246310]
mov qword [0x140246318], rax
mov qword [0x140246310], rdi
lea ecx, [r9 + 0x6c]
mov qword [r14], rax
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
movsx edi, byte [0x140241988]
mov r11, rbx
mov rdx, qword [0x140241818]
mov r8d, ebx
cmp edi, 4
jb 0x14008d069
mov r9d, edi
xorps xmm2, xmm2
and r9d, 0xfffffffc
xorps xmm1, xmm1
nop dword [rax]
nop word [rax + rax]
mov eax, r8d
add r8d, 4
movq xmm0, qword [rdx + rax*8]
lea eax, [rsi - 1]
movhpd xmm0, qword [rdx + rax*8]
mov eax, esi
paddq xmm2, xmm0
movq xmm0, qword [rdx + rax*8]
lea eax, [rsi + 1]
movhpd xmm0, qword [rdx + rax*8]
add esi, 4
paddq xmm1, xmm0
cmp r8d, r9d
jb 0x14008d020
paddq xmm1, xmm2
movdqa xmm0, xmm1
psrldq xmm0, 8
paddq xmm1, xmm0
movq r11, xmm1
mov r9, rbx
cmp r8d, edi
jae 0x14008d0b5
mov eax, edi
mov ecx, r8d
sub eax, r8d
cmp eax, 2
jb 0x14008d0aa
mov eax, edi
sub eax, r8d
sub eax, 2
shr eax, 1
inc eax
mov r10d, eax
lea eax, [r8 + rax*2]
add rbx, qword ds:[rdx + rcx*8]
add r9, qword [rdx + rcx*8 + 8]
add rcx, 2
sub r10, 1
jne 0x14008d091
cmp eax, edi
jae 0x14008d0ae
add r11, qword [rdx + rcx*8]
lea rax, [r9 + rbx]
add r11, rax
mov rbx, qword [rsp + 0x30]
mov rax, r11
sub rax, qword [0x140246320]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
mov qword [0x140246328], rax
mov qword [0x140246320], r11
add rsp, 0x20
pop r14
ret
Function at 0x1400953c0
Capabilities:
Enumerate gui resources

Disassembly:
push rbx
sub rsp, 0x40
test byte [rcx + 0x668], 8
mov rbx, rcx
jne 0x1400954d1
mov rcx, qword [rcx + 0x6a8]
mov qword [rsp + 0x58], rdi
mov qword [rbx + 0x6a8], 0
test rcx, rcx
je 0x14009540a
add rcx, 0xfffffffffffffff0
mov eax, 0xffffffff
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x14009540a
call fcn.1400fbcc0
mov rax, qword [rbx + 0x70]
mov rcx, qword [rax + 0x48]
test rcx, rcx
je 0x1400954c5
test dword [rax + 0xd0], 0x10000
jne 0x1400954c5
cmp dword [0x140237d34], 0x3e
xorps xmm0, xmm0
mov rax, qword [rbx + 0x68]
movups xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x30], rax
mov byte [rsp + 0x39], 1
movups xmmword [rsp + 0x20], xmm0
jb 0x14009546d
mov rax, qword [0x140241ac0]
test rax, rax
je 0x14009546d
nop dword [rax + rax]
call qword [case.0x1400f654f.0]
test eax, eax
setne byte [rsp + 0x38]
lea rdx, [rsp + 0x20]
lea rcx, [0x140109fc0]
call qword [sym.imp.USER32.dll_EnumWindows]
mov rax, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x20]
test rax, rax
cmovne rcx, rax
mov qword [rbx + 0x6a0], rcx
test rcx, rcx
je 0x1400954c5
lea r8, [rbx + 0x6a8]
mov edx, 1
call sym.ProcessHacker.exe_PhGetWindowTextEx
mov rcx, qword [rbx + 0x6a0]
call qword [sym.imp.USER32.dll_IsHungAppWindow]
test eax, eax
setne al
mov byte [rbx + 0x6b0], al
or dword [rbx + 0x668], 8
mov rdi, qword [rsp + 0x58]
add rsp, 0x40
pop rbx
ret

Function at 0x140095f40
Capabilities:
Parse pe header

Disassembly:
push rbx
sub rsp, 0x40
mov rax, qword [0x140237008]
xor rax, rsp
mov qword [rsp + 0x38], rax
test byte [0x14023b710], 1
mov rbx, rcx
jne 0x140096009
lock bts qword [0x14023b710], 0x1f
jae 0x140095f8f
test byte [0x14023b710], 1
jne 0x140096009
xor edx, edx
lea rcx, [0x14023b710]
call sym.ProcessHacker.exe_PhfWaitForEvent
jmp 0x140096009
lea rcx, [0x1401d9d58]
call fcn.1400f9d00
mov rcx, rax
test rax, rax
je 0x140095ff4
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x140095ff4
mov edx, dword [rcx + 0x3c]
lea eax, [rdx - 1]
cmp eax, 0x7ffffffd
ja 0x140095ff4
cmp dword [rdx + rcx], 0x4550
jne 0x140095ff4
add rdx, 0x88
add rdx, rcx
mov eax, dword [rdx]
test eax, eax
je 0x140095ff4
cmp dword [rdx + 4], 0
je 0x140095ff4
lea r8, [rcx + rax]
xor eax, eax
lea r9, str.GetProcessDpiAwarenessInternal
mov word [rsp + 0x20], ax
call fcn.1400fa1a0
jmp 0x140095ff6
xor eax, eax
lea rcx, [0x14023b710]
mov qword [0x140242fd0], rax
call sym.ProcessHacker.exe_PhfSetEvent
mov rax, qword [0x140242fd0]
test rax, rax
je 0x140096054
test dword ds:[rbx + 0x668], 0x400
jne 0x140096054
mov rcx, qword [rbx + 0x70]
mov rcx, qword [rcx + 0x48]
test rcx, rcx
je 0x14009604a
lea rdx, [rsp + 0x30]
call qword [case.0x1400f654f.0]
test eax, eax
je 0x14009604a
mov eax, dword [rsp + 0x30]
inc eax
mov dword [rbx + 0x6f8], eax
or dword [rbx + 0x668], 0x400
mov rcx, qword ds:[rsp + 0x38]
xor rcx, rsp
call fcn.1401848a0
add rsp, 0x40
pop rbx
ret
Function at 0x1400b7c60
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x38
test byte [0x14023b868], 1
jne 0x1400b7e02
lock bts qword [0x14023b868], 0x1f
jae 0x1400b7ca8
test byte [0x14023b868], 1
jne 0x1400b7e02
xor edx, edx
lea rcx, [0x14023b868]
call sym.ProcessHacker.exe_PhfWaitForEvent
cmp qword [0x140243890], 0
setne al
add rsp, 0x38
ret
xor edx, edx
mov qword [rsp + 0x40], rbx
mov r8d, 0x800
lea rcx, str.netapi32.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
test rax, rax
jne 0x1400b7cf2
xor edx, edx
lea rcx, str.netapi32.dll
mov r8d, 0xa00
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
test rax, rax
je 0x1400b7de8
mov qword [rsp + 0x30], rdi
mov r10, rcx
mov edi, 0x5a4d
mov qword [0x140243890], rcx
cmp word [rcx], di
jne 0x1400b7d5b
mov edx, dword [rcx + 0x3c]
lea eax, [rdx - 1]
cmp eax, 0x7ffffffd
ja 0x1400b7d5b
cmp dword ds:[rdx + rcx], 0x4550
jne 0x1400b7d5b
add rdx, 0x88
add rdx, rcx
mov eax, dword [rdx]
test eax, eax
je 0x1400b7d5b
cmp dword [rdx + 4], 0
je 0x1400b7d5b
xor ebx, ebx
lea r8, [rcx + rax]
lea r9, str.NetUserEnum
mov word [rsp + 0x20], bx
call fcn.1400fa1a0
mov r10, qword [0x140243890]
mov rcx, rax
jmp 0x1400b7d5f
xor ebx, ebx
mov ecx, ebx
cmp word [r10], di
mov rdi, qword [rsp + 0x30]
mov qword [0x140243908], rcx
jne 0x1400b7dc7
mov edx, dword [r10 + 0x3c]
lea eax, [rdx - 1]
cmp eax, 0x7ffffffd
ja 0x1400b7dc7
cmp dword [rdx + r10], 0x4550
jne 0x1400b7dc7
add rdx, 0x88
add rdx, r10
mov eax, dword [rdx]
test eax, eax
je 0x1400b7dc7
cmp dword [rdx + 4], 0
je 0x1400b7dc7
lea r8, [r10 + rax]
mov word [rsp + 0x20], bx
lea r9, str.NetApiBufferFree
mov rcx, r10
call fcn.1400fa1a0
mov r10, qword [0x140243890]
mov rcx, qword [0x140243908]
jmp 0x1400b7dca
mov rax, rbx
mov qword [0x140243878], rax
test rcx, rcx
je 0x1400b7ddb
test rax, rax
jne 0x1400b7df1
mov rcx, r10
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
jmp 0x1400b7dea
xor ebx, ebx
mov qword [0x140243890], rbx
lea rcx, [0x14023b868]
call sym.ProcessHacker.exe_PhfSetEvent
mov rbx, qword [rsp + 0x40]
cmp qword [0x140243890], 0
setne al
add rsp, 0x38
ret
Function at 0x1400b7e20
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x38
test byte [0x14023b930], 1
jne 0x1400b808e
lock bts qword [0x14023b930], 0x1f
jae 0x1400b7e68
test byte [0x14023b930], 1
jne 0x1400b808e
xor edx, edx
lea rcx, [0x14023b930]
call sym.ProcessHacker.exe_PhfWaitForEvent
cmp qword [0x1402438f8], 0
setne al
add rsp, 0x38
ret
xor edx, edx
mov qword [rsp + 0x40], rbx
mov r8d, 0x800
lea rcx, str.comctl32.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov r10, rax
test rax, rax
jne 0x1400b7eb2
xor edx, edx
lea rcx, str.comctl32.dll
mov r8d, 0xa00
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov r10, rax
test rax, rax
je 0x1400b8074
mov qword [rsp + 0x30], rdi
mov rcx, r10
mov edi, 0x5a4d
mov qword [0x1402438f8], rcx
cmp word [r10], di
jne 0x1400b7f1a
mov edx, dword [r10 + 0x3c]
lea eax, [rdx - 1]
cmp eax, 0x7ffffffd
ja 0x1400b7f1a
cmp dword [rdx + r10], 0x4550
jne 0x1400b7f1a
add rdx, 0x88
add rdx, r10
mov eax, dword [rdx]
test eax, eax
je 0x1400b7f1a
cmp dword [rdx + 4], 0
je 0x1400b7f1a
xor ebx, ebx
lea r8, [r10 + rax]
lea r9, str.CreateMRUListW
mov word [rsp + 0x20], bx
call fcn.1400fa1a0
mov rcx, qword [0x1402438f8]
jmp 0x1400b7f1e
xor ebx, ebx
mov eax, ebx
mov qword [0x140243900], rax
cmp word [rcx], di
jne 0x1400b7f76
mov edx, dword [rcx + 0x3c]
lea eax, [rdx - 1]
cmp eax, 0x7ffffffd
ja 0x1400b7f76
cmp dword ds:[rdx + rcx], 0x4550
jne 0x1400b7f76
add rdx, 0x88
add rdx, rcx
mov eax, dword [rdx]
test eax, eax
je 0x1400b7f76
cmp dword [rdx + 4], 0
je 0x1400b7f76
lea r8, [rcx + rax]
mov word [rsp + 0x20], bx
lea r9, str.AddMRUStringW
call fcn.1400fa1a0
mov rcx, qword [0x1402438f8]
jmp 0x1400b7f79
mov rax, rbx
mov qword [0x140243910], rax
cmp word [rcx], di
jne 0x1400b7fd2
mov edx, dword [rcx + 0x3c]
lea eax, [rdx - 1]
cmp eax, 0x7ffffffd
ja 0x1400b7fd2
cmp dword [rdx + rcx], 0x4550
jne 0x1400b7fd2
add rdx, 0x88
add rdx, rcx
mov eax, dword [rdx]
test eax, eax
je 0x1400b7fd2
cmp dword [rdx + 4], 0
je 0x1400b7fd2
lea r8, [rcx + rax]
mov word [rsp + 0x20], bx
lea r9, str.EnumMRUListW
call fcn.1400fa1a0
mov rcx, qword [0x1402438f8]
mov rdx, rax
jmp 0x1400b7fd5
mov rdx, rbx
cmp word [rcx], di
mov rdi, qword [rsp + 0x30]
mov qword [0x140243880], rdx
jne 0x1400b8043
mov r8d, dword [rcx + 0x3c]
lea eax, [r8 - 1]
cmp eax, 0x7ffffffd
ja 0x1400b8043
cmp dword [rcx + r8], 0x4550
lea rax, [rcx + r8]
jne 0x1400b8043
mov r8d, dword [rax + 0x88]
test r8d, r8d
je 0x1400b8043
cmp dword [rax + 0x8c], 0
je 0x1400b8043
add r8, rcx
mov word [rsp + 0x20], bx
lea r9, str.FreeMRUList
lea rdx, [rax + 0x88]
call fcn.1400fa1a0
mov rcx, qword [0x1402438f8]
mov rdx, qword [0x140243880]
jmp 0x1400b8046
mov rax, rbx
cmp qword [0x140243900], 0
mov qword [0x140243918], rax
je 0x1400b806c
cmp qword [0x140243910], 0
nop
je 0x1400b806c
test rdx, rdx
je 0x1400b806c
test rax, rax
jne 0x1400b807d
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
jmp 0x1400b8076
xor ebx, ebx
mov qword [0x1402438f8], rbx
lea rcx, [0x14023b930]
call sym.ProcessHacker.exe_PhfSetEvent
mov rbx, qword [rsp + 0x40]
cmp qword [0x1402438f8], 0
setne al
add rsp, 0x38
ret