joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140135a20
Capabilities:
Parse pe header

Disassembly:
push rbx
sub rsp, 0x30
xor ebx, ebx
test byte [0x140210e20], 1
jne 0x140135b1f
lock bts qword [0x140210e20], 0x1f
nop
jae 0x140135a65
test byte [0x140210e20], 1
jne 0x140135b1f
xor edx, edx
lea rcx, [0x140210e20]
call sym.ProcessHacker.exe_PhfWaitForEvent
nop dword [rax]
jmp 0x140135b1f
lea rcx, [0x1401b59e0]
call fcn.1401047c0
mov rcx, rax
test rax, rax
jne 0x140135a92
lea rcx, [0x1401b59e0]
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rcx, rax
test rax, rax
je 0x140135b13
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x140135b13
mov edx, dword [rcx + 0x3c]
lea eax, [rdx - 1]
cmp eax, 0xffffffe
ja 0x140135b13
cmp dword [rdx + rcx], 0x4550
jne 0x140135b13
lea r8, ds:[rcx + 0x88]
add r8, rdx
mov eax, dword [r8]
test eax, eax
je 0x140135b13
cmp dword [r8 + 4], ebx
je 0x140135b13
lea r9, ds:[rcx + rax]
mov word [rsp + 0x28], bx
lea rax, str.NtQueryInformationEnlistment
mov qword [rsp + 0x20], rax
call fcn.140104bd0
test rax, rax
je 0x140135b13
mov ecx, dword [0x7ffe0004]
mov rdx, qword [0x7ffe0320]
imul rcx, rdx
shr rcx, 0x18
mov ecx, ecx
mov dword [0x1402176b0], ecx
xor rcx, rax
mov qword [0x1402176a0], rcx
lea rcx, [0x140210e20]
call sym.ProcessHacker.exe_PhfSetEvent
mov rcx, qword [0x1402176a0]
test rcx, rcx
je 0x140135b3e
mov eax, dword [0x1402176b0]
test eax, eax
je 0x140135b3e
xor rax, rcx
add rsp, 0x30
pop rbx
ret
mov rax, rbx
add rsp, 0x30
pop rbx
ret

Function at 0x140135b50
Capabilities:
Parse pe header

Disassembly:
push rbx
sub rsp, 0x30
xor ebx, ebx
test byte [0x140210e90], 1
jne 0x140135c4f
lock bts qword [0x140210e90], 0x1f
nop
jae 0x140135b95
test byte [0x140210e90], 1
jne 0x140135c4f
xor edx, edx
lea rcx, [0x140210e90]
call sym.ProcessHacker.exe_PhfWaitForEvent
nop dword [rax]
jmp 0x140135c4f
lea rcx, [0x1401b59e0]
call fcn.1401047c0
mov rcx, rax
test rax, rax
jne 0x140135bc2
lea rcx, [0x1401b59e0]
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rcx, rax
test rax, rax
je 0x140135c43
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x140135c43
mov edx, dword [rcx + 0x3c]
lea eax, [rdx - 1]
cmp eax, 0xffffffe
ja 0x140135c43
cmp dword [rdx + rcx], 0x4550
jne 0x140135c43
lea r8, ds:[rcx + 0x88]
add r8, rdx
mov eax, dword [r8]
test eax, eax
je 0x140135c43
cmp dword [r8 + 4], ebx
je 0x140135c43
lea r9, ds:[rcx + rax]
mov word [rsp + 0x28], bx
lea rax, str.NtQueryInformationResourceManager
mov qword [rsp + 0x20], rax
call fcn.140104bd0
test rax, rax
je 0x140135c43
mov ecx, dword [0x7ffe0004]
mov rdx, qword [0x7ffe0320]
imul rcx, rdx
shr rcx, 0x18
mov ecx, ecx
mov dword [0x140217738], ecx
xor rcx, rax
mov qword [0x140217790], rcx
lea rcx, [0x140210e90]
call sym.ProcessHacker.exe_PhfSetEvent
mov rcx, qword [0x140217790]
test rcx, rcx
je 0x140135c6e
mov eax, dword [0x140217738]
test eax, eax
je 0x140135c6e
xor rax, rcx
add rsp, 0x30
pop rbx
ret
mov rax, rbx
add rsp, 0x30
pop rbx
ret
Function at 0x140135c80
Capabilities:
Parse pe header

Disassembly:
push rbx
sub rsp, 0x30
xor ebx, ebx
test byte [0x140210e70], 1
jne 0x140135d7f
lock bts qword [0x140210e70], 0x1f
nop
jae 0x140135cc5
test byte [0x140210e70], 1
jne 0x140135d7f
xor edx, edx
lea rcx, [0x140210e70]
call sym.ProcessHacker.exe_PhfWaitForEvent
nop dword [rax]
jmp 0x140135d7f
lea rcx, [0x1401b59e0]
call fcn.1401047c0
mov rcx, rax
test rax, rax
jne 0x140135cf2
lea rcx, [0x1401b59e0]
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rcx, rax
test rax, rax
je 0x140135d73
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x140135d73
mov edx, dword [rcx + 0x3c]
lea eax, [rdx - 1]
cmp eax, 0xffffffe
ja 0x140135d73
cmp dword [rdx + rcx], 0x4550
jne 0x140135d73
lea r8, ds:[rcx + 0x88]
add r8, rdx
mov eax, dword [r8]
test eax, eax
je 0x140135d73
cmp dword [r8 + 4], ebx
je 0x140135d73
lea r9, ds:[rcx + rax]
mov word [rsp + 0x28], bx
lea rax, str.NtQueryInformationTransaction
mov qword [rsp + 0x20], rax
call fcn.140104bd0
test rax, rax
je 0x140135d73
mov ecx, dword [0x7ffe0004]
mov rdx, qword [0x7ffe0320]
imul rcx, rdx
shr rcx, 0x18
mov ecx, ecx
mov dword [0x140217750], ecx
xor rcx, rax
mov qword [0x1402176d0], rcx
lea rcx, [0x140210e70]
call sym.ProcessHacker.exe_PhfSetEvent
mov rcx, qword [0x1402176d0]
test rcx, rcx
je 0x140135d9e
mov eax, dword [0x140217750]
test eax, eax
je 0x140135d9e
xor rax, rcx
add rsp, 0x30
pop rbx
ret
mov rax, rbx
add rsp, 0x30
pop rbx
ret

Function at 0x140135db0
Capabilities:
Parse pe header

Disassembly:
push rbx
sub rsp, 0x30
xor ebx, ebx
test byte [0x140210ee0], 1
jne 0x140135eaf
lock bts qword [0x140210ee0], 0x1f
nop
jae 0x140135df5
test byte [0x140210ee0], 1
jne 0x140135eaf
xor edx, edx
lea rcx, [0x140210ee0]
call sym.ProcessHacker.exe_PhfWaitForEvent
nop dword [rax]
jmp 0x140135eaf
lea rcx, [0x1401b59e0]
call fcn.1401047c0
mov rcx, rax
test rax, rax
jne 0x140135e22
lea rcx, [0x1401b59e0]
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rcx, rax
test rax, rax
je 0x140135ea3
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x140135ea3
mov edx, dword [rcx + 0x3c]
lea eax, [rdx - 1]
cmp eax, 0xffffffe
ja 0x140135ea3
cmp dword [rdx + rcx], 0x4550
jne 0x140135ea3
lea r8, ds:[rcx + 0x88]
add r8, rdx
mov eax, dword [r8]
test eax, eax
je 0x140135ea3
cmp dword [r8 + 4], ebx
je 0x140135ea3
lea r9, ds:[rcx + rax]
mov word [rsp + 0x28], bx
lea rax, str.NtQueryInformationTransactionManager
mov qword [rsp + 0x20], rax
call fcn.140104bd0
test rax, rax
je 0x140135ea3
mov ecx, dword [0x7ffe0004]
mov rdx, qword [0x7ffe0320]
imul rcx, rdx
shr rcx, 0x18
mov ecx, ecx
mov dword [0x140216a8c], ecx
xor rcx, rax
mov qword [0x1402177b8], rcx
lea rcx, [0x140210ee0]
call sym.ProcessHacker.exe_PhfSetEvent
mov rcx, qword [0x1402177b8]
test rcx, rcx
je 0x140135ece
mov eax, dword [0x140216a8c]
test eax, eax
je 0x140135ece
xor rax, rcx
add rsp, 0x30
pop rbx
ret
mov rax, rbx
add rsp, 0x30
pop rbx
ret
Function at 0x140135ee0
Capabilities:
Parse pe header

Disassembly:
push rbx
sub rsp, 0x30
xor ebx, ebx
test byte [0x140210df0], 1
jne 0x140135fdf
lock bts qword [0x140210df0], 0x1f
nop
jae 0x140135f25
test byte [0x140210df0], 1
jne 0x140135fdf
xor edx, edx
lea rcx, [0x140210df0]
call sym.ProcessHacker.exe_PhfWaitForEvent
nop dword [rax]
jmp 0x140135fdf
lea rcx, [0x1401b59e0]
call fcn.1401047c0
mov rcx, rax
test rax, rax
jne 0x140135f52
lea rcx, [0x1401b59e0]
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rcx, rax
test rax, rax
je 0x140135fd3
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x140135fd3
mov edx, dword [rcx + 0x3c]
lea eax, [rdx - 1]
cmp eax, 0xffffffe
ja 0x140135fd3
cmp dword [rdx + rcx], 0x4550
jne 0x140135fd3
lea r8, ds:[rcx + 0x88]
add r8, rdx
mov eax, dword [r8]
test eax, eax
je 0x140135fd3
cmp dword [r8 + 4], ebx
je 0x140135fd3
lea r9, ds:[rcx + rax]
mov word [rsp + 0x28], bx
lea rax, str.NtQueryDefaultLocale
mov qword [rsp + 0x20], rax
call fcn.140104bd0
test rax, rax
je 0x140135fd3
mov ecx, dword [0x7ffe0004]
mov rdx, qword [0x7ffe0320]
imul rcx, rdx
shr rcx, 0x18
mov ecx, ecx
mov dword [0x140217760], ecx
xor rcx, rax
mov qword [0x140217708], rcx
lea rcx, [0x140210df0]
call sym.ProcessHacker.exe_PhfSetEvent
mov rcx, qword [0x140217708]
test rcx, rcx
je 0x140135ffe
mov eax, dword [0x140217760]
test eax, eax
je 0x140135ffe
xor rax, rcx
add rsp, 0x30
pop rbx
ret
mov rax, rbx
add rsp, 0x30
pop rbx
ret

Function at 0x140136010
Capabilities:
Parse pe header

Disassembly:
push rbx
sub rsp, 0x30
xor ebx, ebx
test byte [0x140210e40], 1
jne 0x14013610f
lock bts qword [0x140210e40], 0x1f
nop
jae 0x140136055
test byte [0x140210e40], 1
jne 0x14013610f
xor edx, edx
lea rcx, [0x140210e40]
call sym.ProcessHacker.exe_PhfWaitForEvent
nop dword [rax]
jmp 0x14013610f
lea rcx, [0x1401b59e0]
call fcn.1401047c0
mov rcx, rax
test rax, rax
jne 0x140136082
lea rcx, [0x1401b59e0]
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rcx, rax
test rax, rax
je 0x140136103
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x140136103
mov edx, dword [rcx + 0x3c]
lea eax, [rdx - 1]
cmp eax, 0xffffffe
ja 0x140136103
cmp dword [rdx + rcx], 0x4550
jne 0x140136103
lea r8, ds:[rcx + 0x88]
add r8, rdx
mov eax, dword [r8]
test eax, eax
je 0x140136103
cmp dword [r8 + 4], ebx
je 0x140136103
lea r9, ds:[rcx + rax]
mov word [rsp + 0x28], bx
lea rax, str.NtTraceControl
mov qword [rsp + 0x20], rax
call fcn.140104bd0
test rax, rax
je 0x140136103
mov ecx, dword [0x7ffe0004]
mov rdx, qword [0x7ffe0320]
imul rcx, rdx
shr rcx, 0x18
mov ecx, ecx
mov dword [0x140217770], ecx
xor rcx, rax
mov qword [0x140217758], rcx
lea rcx, [0x140210e40]
call sym.ProcessHacker.exe_PhfSetEvent
mov rcx, qword [0x140217758]
test rcx, rcx
je 0x14013612e
mov eax, dword [0x140217770]
test eax, eax
je 0x14013612e
xor rax, rcx
add rsp, 0x30
pop rbx
ret
mov rax, rbx
add rsp, 0x30
pop rbx
ret
Function at 0x140136140
Capabilities:
Parse pe header

Disassembly:
push rbx
sub rsp, 0x30
xor ebx, ebx
test byte [0x140210ea0], 1
jne 0x14013623f
lock bts qword [0x140210ea0], 0x1f
nop
jae 0x140136185
test byte [0x140210ea0], 1
jne 0x14013623f
xor edx, edx
lea rcx, [0x140210ea0]
call sym.ProcessHacker.exe_PhfWaitForEvent
nop dword [rax]
jmp 0x14013623f
lea rcx, [0x1401b59e0]
call fcn.1401047c0
mov rcx, rax
test rax, rax
jne 0x1401361b2
lea rcx, [0x1401b59e0]
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rcx, rax
test rax, rax
je 0x140136233
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x140136233
mov edx, dword [rcx + 0x3c]
lea eax, [rdx - 1]
cmp eax, 0xffffffe
ja 0x140136233
cmp dword [rdx + rcx], 0x4550
jne 0x140136233
lea r8, ds:[rcx + 0x88]
add r8, rdx
mov eax, dword [r8]
test eax, eax
je 0x140136233
cmp dword [r8 + 4], ebx
je 0x140136233
lea r9, ds:[rcx + rax]
mov word [rsp + 0x28], bx
lea rax, str.NtQueryOpenSubKeysEx
mov qword [rsp + 0x20], rax
call fcn.140104bd0
test rax, rax
je 0x140136233
mov ecx, dword [0x7ffe0004]
mov rdx, qword [0x7ffe0320]
imul rcx, rdx
shr rcx, 0x18
mov ecx, ecx
mov dword [0x1402177dc], ecx
xor rcx, rax
mov qword [0x1402176a8], rcx
lea rcx, [0x140210ea0]
call sym.ProcessHacker.exe_PhfSetEvent
mov rcx, qword [0x1402176a8]
test rcx, rcx
je 0x14013625e
mov eax, dword [0x1402177dc]
test eax, eax
je 0x14013625e
xor rax, rcx
add rsp, 0x30
pop rbx
ret
mov rax, rbx
add rsp, 0x30
pop rbx
ret

Function at 0x140136270
Capabilities:
Parse pe header

Disassembly:
push rbx
sub rsp, 0x30
xor ebx, ebx
test byte [0x140210de0], 1
jne 0x14013636f
lock bts qword [0x140210de0], 0x1f
nop
jae 0x1401362b5
test byte [0x140210de0], 1
jne 0x14013636f
xor edx, edx
lea rcx, [0x140210de0]
call sym.ProcessHacker.exe_PhfWaitForEvent
nop dword [rax]
jmp 0x14013636f
lea rcx, [0x1401b59e0]
call fcn.1401047c0
mov rcx, rax
test rax, rax
jne 0x1401362e2
lea rcx, [0x1401b59e0]
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rcx, rax
test rax, rax
je 0x140136363
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x140136363
mov edx, dword [rcx + 0x3c]
lea eax, [rdx - 1]
cmp eax, 0xffffffe
ja 0x140136363
cmp dword [rdx + rcx], 0x4550
jne 0x140136363
lea r8, ds:[rcx + 0x88]
add r8, rdx
mov eax, dword [r8]
test eax, eax
je 0x140136363
cmp dword [r8 + 4], ebx
je 0x140136363
lea r9, ds:[rcx + rax]
mov word [rsp + 0x28], bx
lea rax, str.RtlDefaultNpAcl
mov qword [rsp + 0x20], rax
call fcn.140104bd0
test rax, rax
je 0x140136363
mov ecx, dword [0x7ffe0004]
mov rdx, qword [0x7ffe0320]
imul rcx, rdx
shr rcx, 0x18
mov ecx, ecx
mov dword [0x1402177c8], ecx
xor rcx, rax
mov qword [0x140217718], rcx
lea rcx, [0x140210de0]
call sym.ProcessHacker.exe_PhfSetEvent
mov rcx, qword [0x140217718]
test rcx, rcx
je 0x14013638e
mov eax, dword [0x1402177c8]
test eax, eax
je 0x14013638e
xor rax, rcx
add rsp, 0x30
pop rbx
ret
mov rax, rbx
add rsp, 0x30
pop rbx
ret
Function at 0x1401363a0
Capabilities:
Parse pe header

Disassembly:
push rbx
sub rsp, 0x30
xor ebx, ebx
test byte [0x140210d60], 1
jne 0x14013649f
lock bts qword [0x140210d60], 0x1f
nop
jae 0x1401363e5
test byte [0x140210d60], 1
jne 0x14013649f
xor edx, edx
lea rcx, [0x140210d60]
call sym.ProcessHacker.exe_PhfWaitForEvent
nop dword [rax]
jmp 0x14013649f
lea rcx, [0x1401b59e0]
call fcn.1401047c0
mov rcx, rax
test rax, rax
jne 0x140136412
lea rcx, [0x1401b59e0]
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rcx, rax
test rax, rax
je 0x140136493
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x140136493
mov edx, dword [rcx + 0x3c]
lea eax, [rdx - 1]
cmp eax, 0xffffffe
ja 0x140136493
cmp dword [rdx + rcx], 0x4550
jne 0x140136493
lea r8, ds:[rcx + 0x88]
add r8, rdx
mov eax, dword [r8]
test eax, eax
je 0x140136493
cmp dword [r8 + 4], ebx
je 0x140136493
lea r9, ds:[rcx + rax]
mov word [rsp + 0x28], bx
lea rax, str.RtlGetTokenNamedObjectPath
mov qword [rsp + 0x20], rax
call fcn.140104bd0
test rax, rax
je 0x140136493
mov ecx, dword [0x7ffe0004]
mov rdx, qword [0x7ffe0320]
imul rcx, rdx
shr rcx, 0x18
mov ecx, ecx
mov dword [0x14021777c], ecx
xor rcx, rax
mov qword [0x140217720], rcx
lea rcx, [0x140210d60]
call sym.ProcessHacker.exe_PhfSetEvent
mov rcx, qword [0x140217720]
test rcx, rcx
je 0x1401364be
mov eax, dword [0x14021777c]
test eax, eax
je 0x1401364be
xor rax, rcx
add rsp, 0x30
pop rbx
ret
mov rax, rbx
add rsp, 0x30
pop rbx
ret

Function at 0x1401364d0
Capabilities:
Parse pe header

Disassembly:
push rbx
sub rsp, 0x30
xor ebx, ebx
test byte [0x140210d80], 1
jne 0x1401365cf
lock bts qword [0x140210d80], 0x1f
nop
jae 0x140136515
test byte [0x140210d80], 1
jne 0x1401365cf
xor edx, edx
lea rcx, [0x140210d80]
call sym.ProcessHacker.exe_PhfWaitForEvent
nop dword [rax]
jmp 0x1401365cf
lea rcx, [0x1401b59e0]
call fcn.1401047c0
mov rcx, rax
test rax, rax
jne 0x140136542
lea rcx, [0x1401b59e0]
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rcx, rax
test rax, rax
je 0x1401365c3
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x1401365c3
mov edx, dword [rcx + 0x3c]
lea eax, [rdx - 1]
cmp eax, 0xffffffe
ja 0x1401365c3
cmp dword [rdx + rcx], 0x4550
jne 0x1401365c3
lea r8, ds:[rcx + 0x88]
add r8, rdx
mov eax, dword [r8]
test eax, eax
je 0x1401365c3
cmp dword [r8 + 4], ebx
je 0x1401365c3
lea r9, ds:[rcx + rax]
mov word [rsp + 0x28], bx
lea rax, str.RtlGetAppContainerNamedObjectPath
mov qword [rsp + 0x20], rax
call fcn.140104bd0
test rax, rax
je 0x1401365c3
mov ecx, dword [0x7ffe0004]
mov rdx, qword [0x7ffe0320]
imul rcx, rdx
shr rcx, 0x18
mov ecx, ecx
mov dword [0x14021773c], ecx
xor rcx, rax
mov qword [0x140217700], rcx
lea rcx, [0x140210d80]
call sym.ProcessHacker.exe_PhfSetEvent
mov rcx, qword [0x140217700]
test rcx, rcx
je 0x1401365ee
mov eax, dword [0x14021773c]
test eax, eax
je 0x1401365ee
xor rax, rcx
add rsp, 0x30
pop rbx
ret
mov rax, rbx
add rsp, 0x30
pop rbx
ret
Function at 0x140136600
Capabilities:
Parse pe header

Disassembly:
push rbx
sub rsp, 0x30
xor ebx, ebx
test byte [0x140210db0], 1
jne 0x1401366ff
lock bts qword [0x140210db0], 0x1f
nop
jae 0x140136645
test byte [0x140210db0], 1
jne 0x1401366ff
xor edx, edx
lea rcx, [0x140210db0]
call sym.ProcessHacker.exe_PhfWaitForEvent
nop dword [rax]
jmp 0x1401366ff
lea rcx, [0x1401b59e0]
call fcn.1401047c0
mov rcx, rax
test rax, rax
jne 0x140136672
lea rcx, [0x1401b59e0]
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rcx, rax
test rax, rax
je 0x1401366f3
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x1401366f3
mov edx, dword [rcx + 0x3c]
lea eax, [rdx - 1]
cmp eax, 0xffffffe
ja 0x1401366f3
cmp dword [rdx + rcx], 0x4550
jne 0x1401366f3
lea r8, ds:[rcx + 0x88]
add r8, rdx
mov eax, dword [r8]
test eax, eax
je 0x1401366f3
cmp dword [r8 + 4], ebx
je 0x1401366f3
lea r9, ds:[rcx + rax]
mov word [rsp + 0x28], bx
lea rax, str.RtlGetAppContainerSidType
mov qword [rsp + 0x20], rax
call fcn.140104bd0
test rax, rax
je 0x1401366f3
mov ecx, dword [0x7ffe0004]
mov rdx, qword [0x7ffe0320]
imul rcx, rdx
shr rcx, 0x18
mov ecx, ecx
mov dword [0x1402176e0], ecx
xor rcx, rax
mov qword [0x1402177d0], rcx
lea rcx, [0x140210db0]
call sym.ProcessHacker.exe_PhfSetEvent
mov rcx, qword [0x1402177d0]
test rcx, rcx
je 0x14013671e
mov eax, dword [0x1402176e0]
test eax, eax
je 0x14013671e
xor rax, rcx
add rsp, 0x30
pop rbx
ret
mov rax, rbx
add rsp, 0x30
pop rbx
ret

Function at 0x140136730
Capabilities:
Parse pe header

Disassembly:
push rbx
sub rsp, 0x30
xor ebx, ebx
test byte [0x140210dc0], 1
jne 0x14013682f
lock bts qword [0x140210dc0], 0x1f
nop
jae 0x140136775
test byte [0x140210dc0], 1
jne 0x14013682f
xor edx, edx
lea rcx, [0x140210dc0]
call sym.ProcessHacker.exe_PhfWaitForEvent
nop dword [rax]
jmp 0x14013682f
lea rcx, [0x1401b59e0]
call fcn.1401047c0
mov rcx, rax
test rax, rax
jne 0x1401367a2
lea rcx, [0x1401b59e0]
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rcx, rax
test rax, rax
je 0x140136823
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x140136823
mov edx, dword [rcx + 0x3c]
lea eax, [rdx - 1]
cmp eax, 0xffffffe
ja 0x140136823
cmp dword [rdx + rcx], 0x4550
jne 0x140136823
lea r8, ds:[rcx + 0x88]
add r8, rdx
mov eax, dword [r8]
test eax, eax
je 0x140136823
cmp dword [r8 + 4], ebx
je 0x140136823
lea r9, ds:[rcx + rax]
mov word [rsp + 0x28], bx
lea rax, str.RtlGetAppContainerParent
mov qword [rsp + 0x20], rax
call fcn.140104bd0
test rax, rax
je 0x140136823
mov ecx, dword [0x7ffe0004]
mov rdx, qword [0x7ffe0320]
imul rcx, rdx
shr rcx, 0x18
mov ecx, ecx
mov dword [0x140217764], ecx
xor rcx, rax
mov qword [0x1402177a8], rcx
lea rcx, [0x140210dc0]
call sym.ProcessHacker.exe_PhfSetEvent
mov rcx, qword [0x1402177a8]
test rcx, rcx
je 0x14013684e
mov eax, dword [0x140217764]
test eax, eax
je 0x14013684e
xor rax, rcx
add rsp, 0x30
pop rbx
ret
mov rax, rbx
add rsp, 0x30
pop rbx
ret
Function at 0x140136860
Capabilities:
Parse pe header

Disassembly:
push rbx
sub rsp, 0x30
xor ebx, ebx
test byte [0x140210e10], 1
jne 0x14013695f
lock bts qword [0x140210e10], 0x1f
nop
jae 0x1401368a5
test byte [0x140210e10], 1
jne 0x14013695f
xor edx, edx
lea rcx, [0x140210e10]
call sym.ProcessHacker.exe_PhfWaitForEvent
nop dword [rax]
jmp 0x14013695f
lea rcx, [0x1401b59e0]
call fcn.1401047c0
mov rcx, rax
test rax, rax
jne 0x1401368d2
lea rcx, [0x1401b59e0]
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rcx, rax
test rax, rax
je 0x140136953
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x140136953
mov edx, dword [rcx + 0x3c]
lea eax, [rdx - 1]
cmp eax, 0xffffffe
ja 0x140136953
cmp dword [rdx + rcx], 0x4550
jne 0x140136953
lea r8, ds:[rcx + 0x88]
add r8, rdx
mov eax, dword [r8]
test eax, eax
je 0x140136953
cmp dword [r8 + 4], ebx
je 0x140136953
lea r9, ds:[rcx + rax]
mov word [rsp + 0x28], bx
lea rax, str.RtlDeriveCapabilitySidsFromName
mov qword [rsp + 0x20], rax
call fcn.140104bd0
test rax, rax
je 0x140136953
mov ecx, dword [0x7ffe0004]
mov rdx, qword [0x7ffe0320]
imul rcx, rdx
shr rcx, 0x18
mov ecx, ecx
mov dword [0x1402177a4], ecx
xor rcx, rax
mov qword [0x140217780], rcx
lea rcx, [0x140210e10]
call sym.ProcessHacker.exe_PhfSetEvent
mov rcx, qword [0x140217780]
test rcx, rcx
je 0x14013697e
mov eax, dword [0x1402177a4]
test eax, eax
je 0x14013697e
xor rax, rcx
add rsp, 0x30
pop rbx
ret
mov rax, rbx
add rsp, 0x30
pop rbx
ret

Function at 0x140136990
Capabilities:
Parse pe header

Disassembly:
push rbx
sub rsp, 0x30
xor ebx, ebx
test byte [0x140210d70], 1
jne 0x140136a8f
lock bts qword [0x140210d70], 0x1f
nop
jae 0x1401369d5
test byte [0x140210d70], 1
jne 0x140136a8f
xor edx, edx
lea rcx, [0x140210d70]
call sym.ProcessHacker.exe_PhfWaitForEvent
nop dword [rax]
jmp 0x140136a8f
lea rcx, str.advapi32.dll
call fcn.1401047c0
mov rcx, rax
test rax, rax
jne 0x140136a02
lea rcx, str.advapi32.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rcx, rax
test rax, rax
je 0x140136a83
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x140136a83
mov edx, dword [rcx + 0x3c]
lea eax, [rdx - 1]
cmp eax, 0xffffffe
ja 0x140136a83
cmp dword [rdx + rcx], 0x4550
jne 0x140136a83
lea r8, ds:[rcx + 0x88]
add r8, rdx
mov eax, dword [r8]
test eax, eax
je 0x140136a83
cmp dword [r8 + 4], ebx
je 0x140136a83
lea r9, ds:[rcx + rax]
mov word [rsp + 0x28], bx
lea rax, str.ConvertSecurityDescriptorToStringSecurityDescriptorW
mov qword [rsp + 0x20], rax
call fcn.140104bd0
test rax, rax
je 0x140136a83
mov ecx, dword [0x7ffe0004]
mov rdx, qword [0x7ffe0320]
imul rcx, rdx
shr rcx, 0x18
mov ecx, ecx
mov dword [0x140217734], ecx
xor rcx, rax
mov qword [0x1402176c8], rcx
lea rcx, [0x140210d70]
call sym.ProcessHacker.exe_PhfSetEvent
mov rcx, qword [0x1402176c8]
test rcx, rcx
je 0x140136aae
mov eax, dword [0x140217734]
test eax, eax
je 0x140136aae
xor rax, rcx
add rsp, 0x30
pop rbx
ret
mov rax, rbx
add rsp, 0x30
pop rbx
ret
Function at 0x140136ac0
Capabilities:
Parse pe header

Disassembly:
push rbx
sub rsp, 0x30
xor ebx, ebx
test byte [0x140210e00], 1
jne 0x140136bbf
lock bts qword [0x140210e00], 0x1f
nop
jae 0x140136b05
test byte [0x140210e00], 1
jne 0x140136bbf
xor edx, edx
lea rcx, [0x140210e00]
call sym.ProcessHacker.exe_PhfWaitForEvent
nop dword [rax]
jmp 0x140136bbf
lea rcx, str.dnsapi.dll
call fcn.1401047c0
mov rcx, rax
test rax, rax
jne 0x140136b32
lea rcx, str.dnsapi.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rcx, rax
test rax, rax
je 0x140136bb3
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x140136bb3
mov edx, dword [rcx + 0x3c]
lea eax, [rdx - 1]
cmp eax, 0xffffffe
ja 0x140136bb3
cmp dword [rdx + rcx], 0x4550
jne 0x140136bb3
lea r8, ds:[rcx + 0x88]
add r8, rdx
mov eax, dword [r8]
test eax, eax
je 0x140136bb3
cmp dword [r8 + 4], ebx
je 0x140136bb3
lea r9, ds:[rcx + rax]
mov word [rsp + 0x28], bx
lea rax, str.DnsQuery_W
mov qword [rsp + 0x20], rax
call fcn.140104bd0
test rax, rax
je 0x140136bb3
mov ecx, dword [0x7ffe0004]
mov rdx, qword [0x7ffe0320]
imul rcx, rdx
shr rcx, 0x18
mov ecx, ecx
mov dword [0x1402177a0], ecx
xor rcx, rax
mov qword [0x140217698], rcx
lea rcx, [0x140210e00]
call sym.ProcessHacker.exe_PhfSetEvent
mov rcx, qword [0x140217698]
test rcx, rcx
je 0x140136bde
mov eax, dword [0x1402177a0]
test eax, eax
je 0x140136bde
xor rax, rcx
add rsp, 0x30
pop rbx
ret
mov rax, rbx
add rsp, 0x30
pop rbx
ret

Function at 0x140136bf0
Capabilities:
Parse pe header

Disassembly:
push rbx
sub rsp, 0x30
xor ebx, ebx
test byte [0x140210e60], 1
jne 0x140136cef
lock bts qword [0x140210e60], 0x1f
nop
jae 0x140136c35
test byte [0x140210e60], 1
jne 0x140136cef
xor edx, edx
lea rcx, [0x140210e60]
call sym.ProcessHacker.exe_PhfWaitForEvent
nop dword [rax]
jmp 0x140136cef
lea rcx, str.dnsapi.dll
call fcn.1401047c0
mov rcx, rax
test rax, rax
jne 0x140136c62
lea rcx, str.dnsapi.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rcx, rax
test rax, rax
je 0x140136ce3
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x140136ce3
mov edx, dword [rcx + 0x3c]
lea eax, [rdx - 1]
cmp eax, 0xffffffe
ja 0x140136ce3
cmp dword [rdx + rcx], 0x4550
jne 0x140136ce3
lea r8, ds:[rcx + 0x88]
add r8, rdx
mov eax, dword [r8]
test eax, eax
je 0x140136ce3
cmp dword [r8 + 4], ebx
je 0x140136ce3
lea r9, ds:[rcx + rax]
mov word [rsp + 0x28], bx
lea rax, str.DnsExtractRecordsFromMessage_W
mov qword [rsp + 0x20], rax
call fcn.140104bd0
test rax, rax
je 0x140136ce3
mov ecx, dword [0x7ffe0004]
mov rdx, qword [0x7ffe0320]
imul rcx, rdx
shr rcx, 0x18
mov ecx, ecx
mov dword [0x1402177d8], ecx
xor rcx, rax
mov qword [0x1402177c0], rcx
lea rcx, [0x140210e60]
call sym.ProcessHacker.exe_PhfSetEvent
mov rcx, qword [0x1402177c0]
test rcx, rcx
je 0x140136d0e
mov eax, dword [0x1402177d8]
test eax, eax
je 0x140136d0e
xor rax, rcx
add rsp, 0x30
pop rbx
ret
mov rax, rbx
add rsp, 0x30
pop rbx
ret