joyce8/EMBER2024-capa huggingface dataset:
Function at 0x7ff6cc7a9500
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x60
xor r14d, r14d
lea r15, [0x7ff6cc85dad8]
test byte [0x7ff6cc855948], 1
lea r12, [0x7ff6cc85daf0]
movzx edi, r8b
mov esi, edx
mov rbp, rcx
jne 0x7ff6cc7a960b
lock bts qword [0x7ff6cc855948], 0x1f
jae 0x7ff6cc7a9569
test byte [0x7ff6cc855948], 1
jne 0x7ff6cc7a960b
xor edx, edx
lea rcx, [0x7ff6cc855948]
call sym.ProcessHacker.exe_PhfWaitForEvent
jmp 0x7ff6cc7a960b
mov r9d, 4
mov r8, r15
mov ecx, 0x400
lea edx, [r9 + 0xa]
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
jne 0x7ff6cc7a958f
mov dword [0x7ff6cc85dad8], 0x2e
mov r9d, 4
mov r8, r12
mov ecx, 0x400
lea edx, [r9 + 0xb]
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
jne 0x7ff6cc7a95b5
mov dword [0x7ff6cc85daf0], 0x2c
lock bts qword [0x7ff6cc855948], 0
jb 0x7ff6cc7a960b
mov rbx, qword [0x7ff6cc855950]
test rbx, rbx
je 0x7ff6cc7a95d8
xor edx, edx
mov rcx, rbx
call qword [sym.imp.ntdll.dll_NtSetEvent]
mov rax, 0xfffffffffffffffe
lock xadd qword [0x7ff6cc855948], rax
shr rax, 1
and eax, 0x7fff
cmp rax, 1
jne 0x7ff6cc7a960b
test rbx, rbx
je 0x7ff6cc7a960b
mov rcx, rbx
call qword [sym.imp.ntdll.dll_NtClose]
mov qword [0x7ff6cc855950], r14
neg dil
mov dword [rsp + 0x28], r14d
lea r9, [rsp + 0x30]
mov dword [rsp + 0x30], esi
sbb eax, eax
mov dword [rsp + 0x34], r14d
and eax, 3
mov qword [rsp + 0x40], r15
mov r8, rbp
mov dword [rsp + 0x38], eax
xor edx, edx
mov qword [rsp + 0x48], r12
mov ecx, 0x400
mov dword [rsp + 0x50], 1
mov qword [rsp + 0x20], r14
call qword [sym.imp.KERNEL32.dll_GetNumberFormatW]
mov rbx, qword [0x7ff6cc85e0c8]
mov esi, eax
lea ecx, [rax + rax]
mov edi, ecx
lea rdx, [rcx + 0x12]
mov rcx, rbx
call fcn.7ff6cc7ae820
lock inc dword [rbx + 4]
mov dword [rax + 8], 1
lea r9, [rsp + 0x30]
movzx edx, byte [rbx + 2]
mov r8, rbp
mov word [rax], dx
lea rbx, [rax + 0x10]
lea rax, [rbx + 0x10]
mov qword [rbx], rdi
mov qword [rbx + 8], rax
xor edx, edx
mov word [rax + rdi], r14w
mov ecx, 0x400
mov rax, qword [rbx + 8]
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_GetNumberFormatW]
test eax, eax
jne 0x7ff6cc7a96d1
lea rcx, [rbx - 0x10]
or eax, 0xffffffff
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x7ff6cc7a96cd
call fcn.7ff6cc7ae900
xor eax, eax
jmp 0x7ff6cc7a96e3
mov rcx, qword [rbx + 8]
call sym.ProcessHacker.exe_PhCountStringZ
add rax, rax
mov qword [rbx], rax
mov rax, rbx
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
Function at 0x7ff6cc7a9790
Capabilities:
Get file version info

Disassembly:
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
lea rdx, [rsp + 0x38]
mov rsi, rcx
call qword [sym.imp.VERSION.dll_GetFileVersionInfoSizeW]
mov edi, eax
test eax, eax
je 0x7ff6cc7a9817
mov rcx, qword [sym.ProcessHacker.exe_PhHeapHandle]
mov r8d, edi
mov edx, 4
mov qword [rsp + 0x30], rbx
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov r8d, edi
xor edx, edx
mov r9, rax
mov rcx, rsi
mov rbx, rax
call qword [sym.imp.VERSION.dll_GetFileVersionInfoW]
test eax, eax
jne 0x7ff6cc7a9804
mov rcx, qword [sym.ProcessHacker.exe_PhHeapHandle]
mov r8, rbx
xor edx, edx
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
mov rbx, qword [rsp + 0x30]
xor eax, eax
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
mov rax, rbx
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
xor eax, eax
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret

Function at 0x7ff6cc7aa470
Capabilities:
Get common file path

Disassembly:
sub rsp, 0x38
mov rax, qword [0x7ff6cc85b1b0]
test rax, rax
je 0x7ff6cc7aa489
lock inc dword [rax - 8]
add rsp, 0x38
ret
mov qword [rsp + 0x48], rbx
mov edx, 0x92
mov rbx, qword [0x7ff6cc85e0c8]
mov qword [rsp + 0x50], rbp
mov rcx, rbx
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x20], r14
call fcn.7ff6cc7ae820
lock inc dword [rbx + 4]
mov dword [rax + 8], 1
xor ebp, ebp
movzx ecx, byte [rbx + 2]
lea rbx, [rax + 0x10]
mov word [rax], cx
lea rax, [rbx + 0x10]
mov qword [rbx + 8], rax
mov qword [rbx], 0x80
lea edx, [rbp + 0x40]
mov word [rax + 0x80], bp
mov rcx, qword [rbx + 8]
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
or esi, 0xffffffff
mov r14d, eax
cmp eax, 0x40
jbe 0x7ff6cc7aa564
mov qword [rsp + 0x28], rdi
lea rcx, [rbx - 0x10]
mov edx, esi
lock xadd dword [rcx + 8], edx
cmp edx, 1
jne 0x7ff6cc7aa511
call fcn.7ff6cc7ae900
mov rbx, qword [0x7ff6cc85e0c8]
lea eax, [r14 + r14]
lea rdx, [rax + 0x12]
mov edi, eax
mov rcx, rbx
call fcn.7ff6cc7ae820
lock inc dword [rbx + 4]
mov dword [rax + 8], 1
mov edx, r14d
movzx ecx, byte [rbx + 2]
lea rbx, [rax + 0x10]
mov word [rax], cx
lea rax, [rbx + 0x10]
mov qword [rbx + 8], rax
mov qword [rbx], rdi
mov word [rax + rdi], bp
mov rcx, qword [rbx + 8]
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov rdi, qword [rsp + 0x28]
mov r14d, eax
mov rbp, qword [rsp + 0x50]
test r14d, r14d
mov r14, qword [rsp + 0x20]
jne 0x7ff6cc7aa597
lea rcx, [rbx - 0x10]
lock xadd dword [rcx + 8], esi
cmp esi, 1
jne 0x7ff6cc7aa586
call fcn.7ff6cc7ae900
mov rbx, qword [rsp + 0x48]
xor eax, eax
mov rsi, qword [rsp + 0x30]
add rsp, 0x38
ret
mov rcx, qword [rbx + 8]
call sym.ProcessHacker.exe_PhCountStringZ
add rax, rax
mov qword [rbx], rax
xor eax, eax
lock cmpxchg qword [0x7ff6cc85b1b0], rbx
jne 0x7ff6cc7aa5b7
lock inc dword [rbx - 8]
mov rsi, qword [rsp + 0x30]
mov rax, rbx
mov rbx, qword [rsp + 0x48]
add rsp, 0x38
ret
Function at 0x7ff6cc7aa5d0
Capabilities:
Get windows directory from kuser_shared_data

Disassembly:
push rbx
sub rsp, 0x30
cmp qword [0x7ff6cc85dae8], 0
mov rbx, rcx
je 0x7ff6cc7aa5f3
movups xmm0, xmmword [0x7ff6cc85dae0]
movups xmmword [rcx], xmm0
add rsp, 0x30
pop rbx
ret
mov ecx, 0x7ffe0030
mov qword [rsp + 0x28], 0x7ffe0030
call sym.ProcessHacker.exe_PhCountStringZ
add rax, rax
mov qword [rsp + 0x20], rax
cmp word [rax + 0x7ffe002e], 0x5c
jne 0x7ff6cc7aa621
sub rax, 2
mov qword [rsp + 0x20], rax
movups xmm0, xmmword [rsp + 0x20]
mov qword [0x7ff6cc85dae0], rax
movups xmmword [rbx], xmm0
lock or dword [rsp], 0
mov qword [0x7ff6cc85dae8], 0x7ffe0030
add rsp, 0x30
pop rbx
ret
Function at 0x7ff6cc7aa910
Capabilities:
Access peb ldr_data

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x20], rsi
push r14
sub rsp, 0x20
mov rax, qword gs:[0x30]
mov rbx, rcx
mov r14, rdx
mov rcx, qword [rax + 0x60]
mov rcx, qword [rcx + 0x110]
call qword [sym.imp.ntdll.dll_RtlEnterCriticalSection]
mov rax, qword gs:[0x30]
xor esi, esi
mov r8, qword [rax + 0x60]
mov rax, qword [r8 + 0x18]
add rax, 0x10
mov rcx, qword [rax]
cmp rcx, rax
je 0x7ff6cc7aa973
nop
test rbx, rbx
je 0x7ff6cc7aa9a8
cmp qword [rcx + 0x30], rbx
je 0x7ff6cc7aa9a8
mov rcx, qword [rcx]
cmp rcx, rax
jne 0x7ff6cc7aa960
mov rbx, rsi
mov rax, qword gs:[0x30]
mov rcx, qword [rax + 0x60]
mov rcx, qword [rcx + 0x110]
call qword [sym.imp.ntdll.dll_RtlLeaveCriticalSection]
test rbx, rbx
jne 0x7ff6cc7aa9bf
xor eax, eax
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
test rcx, rcx
je 0x7ff6cc7aa973
movzx edx, word [rcx + 0x48]
mov rcx, qword [rcx + 0x50]
call sym.ProcessHacker.exe_PhCreateStringEx
mov rbx, rax
jmp 0x7ff6cc7aa976
mov rcx, rbx
mov qword [rsp + 0x30], rdi
call sym.ProcessHacker.exe_PhGetFileName
mov rdi, rax
lea rcx, [rbx - 0x10]
or edx, 0xffffffff
lock xadd dword [rcx + 8], edx
cmp edx, 1
jne 0x7ff6cc7aa9e5
call fcn.7ff6cc7ae900
test r14, r14
je 0x7ff6cc7aaa09
mov edx, 0x5c
xor r8d, r8d
mov rcx, rdi
call sym.ProcessHacker.exe_PhFindLastCharInStringRef
cmp rax, 0xffffffffffffffff
lea rcx, [rax + 1]
cmovne rsi, rcx
mov dword [r14], esi
mov rbx, qword [rsp + 0x38]
mov rax, rdi
mov rdi, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret

Function at 0x7ff6cc7aaac0
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r14
push r15
sub rsp, 0x30
xor r15d, r15d
mov rbp, rdx
mov r14d, ecx
test rdx, rdx
je 0x7ff6cc7aaaf6
mov rcx, rdx
call sym.ProcessHacker.exe_PhCountStringZ
mov rsi, rax
add rsi, rsi
jmp 0x7ff6cc7aaaf9
mov rsi, r15
mov rbx, qword [0x7ff6cc85e0c8]
lea rdi, [rsi + 0x208]
lea rdx, [rdi + 0x12]
mov rcx, rbx
call fcn.7ff6cc7ae820
lock inc dword [rbx + 4]
mov dword [rax + 8], 1
xor r9d, r9d
movzx ecx, byte [rbx + 2]
xor r8d, r8d
mov word [rax], cx
lea rbx, [rax + 0x10]
lea rax, [rbx + 0x10]
mov qword [rbx], rdi
mov qword [rbx + 8], rax
mov edx, r14d
mov word [rax + rdi], r15w
xor ecx, ecx
mov rax, qword [rbx + 8]
mov qword [rsp + 0x20], rax
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
js 0x7ff6cc7aab8a
mov rcx, qword [rbx + 8]
call sym.ProcessHacker.exe_PhCountStringZ
add rax, rax
mov qword [rbx], rax
test rbp, rbp
je 0x7ff6cc7aab85
mov rcx, qword [rbx + 8]
lea r8, [rsi + 2]
shr rax, 1
mov rdx, rbp
lea rcx, [rcx + rax*2]
call fcn.7ff6cc7e3970
add qword [rbx], rsi
mov rax, rbx
jmp 0x7ff6cc7aaba2
lea rcx, [rbx - 0x10]
or eax, 0xffffffff
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x7ff6cc7aaba0
call fcn.7ff6cc7ae900
xor eax, eax
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x30
pop r15
pop r14
pop rdi
ret
Function at 0x7ff6cc7abf90
Capabilities:
Create process on windows

Disassembly:
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
mov rax, qword [0x7ff6cc85b318]
jmp 0x7ff6cc7ac042
test rax, rax
je 0x7ff6cc7ac0d1
call fcn.7ff6cc7c2190
lea rcx, [rsp + 0xc0]
xor r9d, r9d
mov qword [rsp + 0x20], rcx
lea r8, [rsp + 0xc8]
mov rcx, rbx
xor edx, edx
call rax
test eax, eax
js 0x7ff6cc7ac0a9
call fcn.7ff6cc7c2130
mov rcx, qword [rsp + 0xc8]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
call rax
mov rcx, qword [rsp + 0xc8]
call qword [sym.imp.ole32.dll_CoTaskMemFree]
mov rbx, qword [rsp + 0xb8]
add rsp, 0xa0
pop rsi
ret
mov r9, rbx
lea r8, str.The_location___s__could_not_be_found.
mov edx, 0x10
mov rcx, rsi
call sym.ProcessHacker.exe_PhShowMessage
mov rbx, qword [rsp + 0xb8]
add rsp, 0xa0
pop rsi
ret
mov rdx, rbx
mov qword [rsp + 0xb0], rdi
lea rcx, str._select_
call sym.ProcessHacker.exe_PhConcatStrings2
xor edx, edx
mov dword [rsp + 0x30], 0x70
lea rcx, [rsp + 0x34]
mov rdi, rax
mov rbx, qword [rax + 8]
lea r8d, [rdx + 0x6c]
call fcn.7ff6cc7e43c0
lea rax, str.explorer.exe
mov qword [rsp + 0x50], rbx
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x48], rax
mov dword [rsp + 0x60], 5
mov qword [rsp + 0x38], rsi
call qword [sym.imp.SHELL32.dll_ShellExecuteExW]
lea rcx, [rdi - 0x10]
or eax, 0xffffffff
lock xadd dword [rcx + 8], eax
mov rdi, qword [rsp + 0xb0]
cmp eax, 1
jne 0x7ff6cc7ac14e
call fcn.7ff6cc7ae900
mov rbx, qword [rsp + 0xb8]
add rsp, 0xa0
pop rsi
ret

Function at 0x7ff6cc7ac160
Capabilities:
Create process on windows

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x90
mov rbx, rdx
mov dword [rsp + 0x20], 0x70
xor edx, edx
mov rdi, rcx
lea rcx, [rsp + 0x24]
lea r8d, [rdx + 0x6c]
call fcn.7ff6cc7e43c0
lea rax, str.properties
mov qword [rsp + 0x38], rbx
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x50], 5
mov dword [rsp + 0x24], 0xc
mov qword [rsp + 0x28], rdi
call qword [sym.imp.SHELL32.dll_ShellExecuteExW]
mov rbx, qword [rsp + 0xa0]
add rsp, 0x90
pop rdi
ret
Function at 0x7ff6cc7ac3b0
Capabilities:
Create process on windows
Set registry value

Disassembly:
push rbp
push rdi
push r14
lea rbp, [rsp - 0x90]
sub rsp, 0x190
mov r8, qword [0x7ff6cc855998]
mov rdi, rdx
mov rax, qword [0x7ff6cc8559a0]
mov r14, rcx
mov word [rsp + 0x48], r8w
mov word [rsp + 0x4a], r8w
mov qword [rsp + 0x50], rax
cmp r8, 0xfffe
ja 0x7ff6cc7ac5e3
xor r8d, r8d
lea rax, [rsp + 0x40]
lea r9, [rbp + 0x60]
mov qword [rsp + 0x20], rax
lea rdx, [rsp + 0x48]
lea rcx, [r8 - 9]
call fcn.7ff6cc7beed0
test eax, eax
js 0x7ff6cc7ac5e3
xor eax, eax
mov qword [rsp + 0x1b0], rbx
mov qword [rsp + 0x30], rax
lea r8, [rbp + 0x60]
mov dword [rsp + 0x28], eax
lea rcx, [rbp + 0xc8]
xor r9d, r9d
mov qword [rsp + 0x20], rax
mov edx, 0x20006
call qword [sym.imp.ntdll.dll_NtCreateKey]
mov rcx, qword [rsp + 0x40]
mov ebx, eax
test rcx, rcx
je 0x7ff6cc7ac460
call qword [sym.imp.ntdll.dll_NtClose]
test ebx, ebx
js 0x7ff6cc7ac5db
lea rax, str.LastKey
mov qword [rsp + 0x1b8], rsi
mov rcx, rdi
mov qword [rsp + 0x60], rax
mov dword [rsp + 0x58], 0x10000e
call fcn.7ff6cc7ac1d0
mov r9d, 1
lea rdx, [rsp + 0x58]
xor r8d, r8d
mov rbx, rax
mov ecx, dword [rax]
add ecx, 2
mov dword [rsp + 0x28], ecx
mov rcx, qword [rax + 8]
mov qword [rsp + 0x20], rcx
mov rcx, qword [rbp + 0xc8]
call qword [sym.imp.ntdll.dll_NtSetValueKey]
or edi, 0xffffffff
lea rcx, [rbx - 0x10]
mov eax, edi
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x7ff6cc7ac4d4
call fcn.7ff6cc7ae900
mov rcx, qword [rbp + 0xc8]
call qword [sym.imp.ntdll.dll_NtClose]
lea rdx, str._regedit.exe
mov ecx, 0x24
call sym.ProcessHacker.exe_PhGetKnownLocation
mov rsi, rax
test rax, rax
jne 0x7ff6cc7ac50c
lea edx, [rax + 0x16]
lea rcx, str.regedit.exe
call sym.ProcessHacker.exe_PhCreateStringEx
mov rsi, rax
lea rcx, [rbp - 0x20]
call sym.ProcessHacker.exe_PhGetOwnTokenAttributes
mov rbx, qword [rsi + 8]
xor edx, edx
test byte [rax + 8], 1
lea r8d, [rdx + 0x6c]
jne 0x7ff6cc7ac58c
lea rcx, [rsp + 0x74]
mov dword [rsp + 0x70], 0x70
call fcn.7ff6cc7e43c0
cmp dword [sym.ProcessHacker.exe_WindowsVersion], 0x3c
lea rax, [0x7ff6cc80bbf8]
mov qword [rbp - 0x70], rax
lea rcx, [rsp + 0x70]
lea rax, str.runas
mov qword [rbp - 0x78], rbx
cmovb rax, qword [rbp - 0x80]
mov qword [rbp - 0x80], rax
mov dword [rsp + 0x74], 0x40
mov dword [rbp - 0x60], 1
mov qword [rsp + 0x78], r14
call qword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
je 0x7ff6cc7ac5c0
mov rcx, qword [rbp - 0x28]
call qword [sym.imp.ntdll.dll_NtClose]
jmp 0x7ff6cc7ac5c0
lea rcx, [rbp - 0xc]
mov dword [rbp - 0x10], 0x70
call fcn.7ff6cc7e43c0
lea rax, [0x7ff6cc80bbf8]
mov qword [rbp + 8], rbx
lea rcx, [rbp - 0x10]
mov qword [rbp + 0x10], rax
mov dword [rbp + 0x20], 5
mov qword [rbp - 8], r14
call qword [sym.imp.SHELL32.dll_ShellExecuteExW]
lea rcx, [rsi - 0x10]
lock xadd dword [rcx + 8], edi
mov rsi, qword [rsp + 0x1b8]
cmp edi, 1
jne 0x7ff6cc7ac5db
call fcn.7ff6cc7ae900
mov rbx, qword [rsp + 0x1b0]
add rsp, 0x190
pop r14
pop rdi
pop rbp
ret
Function at 0x7ff6cc7ad620
Capabilities:
Hash data using sha1

Disassembly:
sub rsp, 0x28
mov dword [rcx], edx
test edx, edx
je 0x7ff6cc7ad678
sub edx, 1
je 0x7ff6cc7ad64a
cmp edx, 1
je 0x7ff6cc7ad640
mov ecx, 0xc00000f0
call qword [sym.imp.ntdll.dll_RtlRaiseStatus]
int3
xor eax, eax
mov dword [rcx + 4], eax
add rsp, 0x28
ret
xor eax, eax
mov dword [rcx + 0x1c], 0x67452301
mov qword [rcx + 0x30], rax
mov dword [rcx + 0x20], 0xefcdab89
mov dword [rcx + 0x24], 0x98badcfe
mov dword [rcx + 0x28], 0x10325476
mov dword [rcx + 0x2c], 0xc3d2e1f0
add rsp, 0x28
ret
xor eax, eax
mov dword [rcx + 0xc], 0x67452301
mov qword [rcx + 4], rax
mov dword [rcx + 0x10], 0xefcdab89
mov dword [rcx + 0x14], 0x98badcfe
mov dword [rcx + 0x18], 0x10325476
add rsp, 0x28
ret

Function at 0x7ff6cc7ad6a0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
sub rsp, 0x28
mov r9, rdx
mov r11, rcx
mov edx, dword [rcx]
test edx, edx
je 0x7ff6cc7ad723
sub edx, 1
je 0x7ff6cc7ad713
cmp edx, 1
je 0x7ff6cc7ad6c6
mov ecx, 0xc000000d
call qword [sym.imp.ntdll.dll_RtlRaiseStatus]
int3
mov r10d, r8d
mov r8d, dword [rcx + 4]
not r8d
test r10, r10
je 0x7ff6cc7ad707
mov qword [rsp + 0x20], rbx
lea rbx, [0x7ff6cc835af0]
movsx ecx, byte [r9]
lea r9, [r9 + 1]
mov eax, r8d
xor rcx, rax
shr eax, 8
movzx edx, cl
mov r8d, dword [rbx + rdx*4]
xor r8d, eax
sub r10, 1
jne 0x7ff6cc7ad6e1
mov rbx, qword [rsp + 0x20]
not r8d
mov dword [r11 + 4], r8d
add rsp, 0x28
ret
add rcx, 4
mov rdx, r9
add rsp, 0x28
jmp fcn.7ff6cc7e2780
add rcx, 4
mov rdx, r9
add rsp, 0x28
jmp 0x7ff6cc7e0970
push rsi
push rdi
push r14
sub rsp, 0x20
mov rdi, rdx
mov esi, r8d
mov edx, dword [rcx]
mov r14, rcx
lea eax, [rdx + rsi*8]
mov dword [rcx], eax
cmp eax, edx
jae 0x7ff6cc7e0990
inc dword [rcx + 4]
mov eax, esi
shr edx, 3
shr eax, 0x1d
add dword [rcx + 4], eax
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rbp
and edx, 0x3f
je 0x7ff6cc7e09e5
mov eax, edx
add rcx, 0x18
mov ebp, 0x40
add rcx, rax
sub ebp, edx
mov rdx, rdi
cmp esi, ebp
jae 0x7ff6cc7e09c9
mov r8, rsi
jmp 0x7ff6cc7e0a4c
mov r8d, ebp
mov ebx, ebp
call fcn.7ff6cc7e3970
lea rdx, [r14 + 0x18]
lea rcx, [r14 + 8]
call fcn.7ff6cc7e0b10
add rdi, rbx
sub esi, ebp
cmp esi, 0x40
jb 0x7ff6cc7e0a42
mov ebp, esi
shr rbp, 6
mov qword [rsp + 0x50], r15
nop word [rax + rax]
movups xmm0, xmmword [rdi]
lea rdx, [r14 + 0x18]
lea rcx, [r14 + 8]
movups xmmword [r14 + 0x18], xmm0
movups xmm1, xmmword [rdi + 0x10]
movups xmmword [r14 + 0x28], xmm1
movups xmm0, xmmword [rdi + 0x20]
movups xmmword [r14 + 0x38], xmm0
movups xmm1, xmmword [rdi + 0x30]
movups xmmword [r14 + 0x48], xmm1
call fcn.7ff6cc7e0b10
add rdi, 0x40
add esi, 0xffffffc0
sub rbp, 1
jne 0x7ff6cc7e0a00
mov r15, qword [rsp + 0x50]
mov r8d, esi
lea rcx, [r14 + 0x18]
mov rdx, rdi
mov rbp, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop r14
pop rdi
pop rsi
jmp fcn.7ff6cc7e3970
Function at 0x7ff6cc7ae420
Capabilities:
Allocate thread local storage

Disassembly:
push rbx
sub rsp, 0x60
lea rcx, [0x7ff6cc85b1e0]
call qword [sym.imp.ntdll.dll_RtlInitializeSListHead]
lea rcx, [0x7ff6cc85b1f0]
call qword [sym.imp.ntdll.dll_RtlInitializeSListHead]
xor eax, eax
mov dword [0x7ff6cc85b204], 0x200
mov qword [rsp + 0x20], rax
lea rcx, str.Type
mov qword [rsp + 0x28], rax
xor ebx, ebx
mov qword [rsp + 0x30], rax
xor r8d, r8d
mov qword [rsp + 0x38], rax
xor edx, edx
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rax
lea rax, [rsp + 0x20]
mov qword [0x7ff6cc85b1c8], rax
lea rax, [rsp + 0x20]
mov qword [0x7ff6cc85e100], rax
mov dword [0x7ff6cc85b200], ebx
mov qword [0x7ff6cc85b208], 0x40
call sym.ProcessHacker.exe_PhCreateObjectType
xor r8d, r8d
mov qword [0x7ff6cc85b1c8], rax
xor edx, edx
movzx ecx, byte [rax + 2]
mov word [rax - 0x10], cx
lea rcx, str.Alloc
mov dword [rax + 4], 1
call sym.ProcessHacker.exe_PhCreateObjectType
mov qword [0x7ff6cc85b1d0], rax
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
cmp eax, 0xffffffff
mov dword [0x7ff6cc85dac4], eax
mov ecx, 0xc000009a
cmove ebx, ecx
mov eax, ebx
add rsp, 0x60
pop rbx
ret

Function at 0x7ff6cc7aead0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rbx
sub rsp, 0x20
xor eax, eax
mov rbx, rcx
mov dword [rcx], eax
mov qword [rcx + 0x208], rax
mov qword [rcx + 0x210], rax
mov ecx, dword [0x7ff6cc85dac4]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ecx, dword [0x7ff6cc85dac4]
mov rdx, rbx
mov qword [rbx + 0x218], rax
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
jne 0x7ff6cc7aeb1d
mov ecx, 0xc0000001
call qword [sym.imp.ntdll.dll_RtlRaiseStatus]
int3
add rsp, 0x20
pop rbx
ret

Function at 0x7ff6cc7aeb30
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
call sym.ProcessHacker.exe_PhDrainAutoPool
mov ecx, dword [0x7ff6cc85dac4]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp rax, rbx
je 0x7ff6cc7aeb5b
mov ecx, 0xc0000001
call qword [sym.imp.ntdll.dll_RtlRaiseStatus]
int3
mov rdx, qword [rbx + 0x218]
mov ecx, dword [0x7ff6cc85dac4]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
jne 0x7ff6cc7aeb7e
mov ecx, 0xc0000001
call qword [sym.imp.ntdll.dll_RtlRaiseStatus]
int3
mov r8, qword [rbx + 0x210]
test r8, r8
je 0x7ff6cc7aeb9f
mov rcx, qword [sym.ProcessHacker.exe_PhHeapHandle]
xor edx, edx
add rsp, 0x20
pop rbx
jmp qword [sym.imp.ntdll.dll_RtlFreeHeap]
add rsp, 0x20
pop rbx
ret
Function at 0x7ff6cc7aec90
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
mov ecx, dword [0x7ff6cc85dac4]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, rax
test rdi, rdi
jne 0x7ff6cc7aecbe
xor eax, eax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
mov eax, dword [rax]
cmp eax, 0x40
jae 0x7ff6cc7aecda
mov qword [rbx + rax*8 + 8], rdi
mov rax, rdi
inc dword [rbx]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
cmp qword [rbx + 0x210], 0
jne 0x7ff6cc7aed0d
mov dword [rbx + 0x20c], 0x40
mov edx, 4
mov rcx, qword [sym.ProcessHacker.exe_PhHeapHandle]
mov r8d, 0x200
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov qword [rbx + 0x210], rax
mov eax, dword [rbx + 0x20c]
cmp dword [rbx + 0x208], eax
jne 0x7ff6cc7aed4a
mov r8, qword [rbx + 0x210]
add eax, eax
mov r9d, eax
mov edx, 4
mov dword [rbx + 0x20c], eax
mov rcx, qword [sym.ProcessHacker.exe_PhHeapHandle]
shl r9, 3
call qword [sym.imp.ntdll.dll_RtlReAllocateHeap]
mov qword [rbx + 0x210], rax
mov ecx, dword [rbx + 0x208]
mov rax, qword [rbx + 0x210]
mov qword [rax + rcx*8], rdi
mov rax, rdi
inc dword [rbx + 0x208]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x7ff6cc7af090
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
mov rbp, rcx
mov rdi, r8
lea rcx, [0x7ff6cc85db00]
mov rsi, rdx
call qword [sym.imp.ntdll.dll_RtlInterlockedPopEntrySList]
test rax, rax
je 0x7ff6cc7af0c8
lock dec dword [0x7ff6cc85db10]
jmp 0x7ff6cc7af0e5
mov r8, qword [0x7ff6cc85db18]
mov edx, 4
mov rcx, qword [sym.ProcessHacker.exe_PhHeapHandle]
add r8, 0x10
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
lea rbx, [rax + 0x10]
xor eax, eax
lea r8, [0x7ff6cc7af010]
mov qword [rbx], rsi
mov qword [rsp + 0x28], rax
mov r9, rbx
mov rdx, rbp
mov dword [rsp + 0x20], eax
xor ecx, ecx
mov qword [rbx + 8], rdi
call qword [sym.imp.KERNEL32.dll_CreateThread]
test rax, rax
jne 0x7ff6cc7af151
mov eax, dword [0x7ff6cc85db14]
lea r8, [rbx - 0x10]
cmp dword [0x7ff6cc85db10], eax
jae 0x7ff6cc7af140
mov rdx, r8
lea rcx, [0x7ff6cc85db00]
call qword [sym.imp.ntdll.dll_RtlInterlockedPushEntrySList]
lock inc dword [0x7ff6cc85db10]
jmp 0x7ff6cc7af14f
mov rcx, qword [sym.ProcessHacker.exe_PhHeapHandle]
xor edx, edx
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
xor eax, eax
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret

Function at 0x7ff6cc7af2d0
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 8], rcx
push rbx
sub rsp, 0x30
mov rbx, rdx
mov dword [rsp + 0x28], 4
lea rdx, [rsp + 0x50]
mov qword [rsp + 0x50], 0
lea r9, [rsp + 0x40]
mov dword [rsp + 0x20], 0x1000
xor r8d, r8d
or rcx, 0xffffffffffffffff
call qword [sym.imp.ntdll.dll_NtAllocateVirtualMemory]
test eax, eax
js 0x7ff6cc7af329
test rbx, rbx
je 0x7ff6cc7af31e
mov rax, qword [rsp + 0x40]
mov qword [rbx], rax
mov rax, qword [rsp + 0x50]
add rsp, 0x30
pop rbx
ret
xor eax, eax
add rsp, 0x30
pop rbx
ret