joyce8/EMBER2024-capa huggingface dataset:
Function at 0x7ff7c00bf660
Capabilities:
Get windows directory from kuser_shared_data

Disassembly:
push rbx
sub rsp, 0x30
cmp qword [0x7ff7c01d69b8], 0
mov rbx, rcx
je 0x7ff7c00bf683
movups xmm0, xmmword [0x7ff7c01d69b0]
movups xmmword [rcx], xmm0
add rsp, 0x30
pop rbx
ret
mov ecx, 0x7ffe0030
mov qword [rsp + 0x28], 0x7ffe0030
call sym.ProcessHacker.exe_PhCountStringZ
add rax, rax
mov qword [rsp + 0x20], rax
cmp word [rax + 0x7ffe002e], 0x5c
jne 0x7ff7c00bf6b1
add rax, 0xfffffffffffffffe
mov qword [rsp + 0x20], rax
movups xmm0, xmmword [rsp + 0x20]
mov qword [0x7ff7c01d69b0], rax
movups xmmword [rbx], xmm0
lock or dword [rsp], 0
mov qword [0x7ff7c01d69b8], 0x7ffe0030
add rsp, 0x30
pop rbx
ret
Function at 0x7ff7c00c0710
Capabilities:
Create process on windows

Disassembly:
mov r11, rsp
push rdi
sub rsp, 0xa0
xorps xmm0, xmm0
mov dword [rsp + 0x30], 0x70
movups xmmword [rsp + 0x34], xmm0
xor eax, eax
mov rdi, rcx
movups xmmword [rsp + 0x54], xmm0
movups xmmword [rsp + 0x44], xmm0
movups xmmword [rsp + 0x64], xmm0
movups xmmword [rsp + 0x74], xmm0
mov qword [r11 - 0x14], rax
movups xmmword [r11 - 0x24], xmm0
mov dword [r11 - 0xc], eax
mov qword [r11 - 0x60], rdx
mov qword [r11 - 0x58], r8
mov dword [rsp + 0x34], 0x400
mov dword [rsp + 0x60], 5
mov qword [r11 - 0x70], rcx
lea rcx, [r11 - 0x78]
call qword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
jne 0x7ff7c00c081f
mov qword [rsp + 0xb8], rbx
call qword [sym.imp.kernel32.dll_GetLastError]
nop dword [rax]
test eax, eax
jne 0x7ff7c00c079d
xor ecx, ecx
call sym.ProcessHacker.exe_PhGetNtMessage
jmp 0x7ff7c00c07a4
mov ecx, eax
call sym.ProcessHacker.exe_PhGetWin32Message
lea r9, [0x7ff7c01883c0]
mov rbx, rax
mov rcx, rdi
test rax, rax
je 0x7ff7c00c0806
mov rax, qword [rax + 8]
mov edx, 0x20
mov qword [rsp + 0x28], rax
mov r8d, 0xfffe
lea rax, [0x7ff7c017439c]
mov qword [rsp + 0x20], rax
call sym.ProcessHacker.exe_PhShowMessage2
lea rcx, [rbx - 0x10]
mov eax, 0xffffffff
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x7ff7c00c0817
nop
call fcn.7ff7c00c6290
mov rbx, qword [rsp + 0xb8]
add rsp, 0xa0
pop rdi
ret
lea r8, [0x7ff7c0187ff8]
mov edx, 0x10
call sym.ProcessHacker.exe_PhShowMessage
mov rbx, qword [rsp + 0xb8]
add rsp, 0xa0
pop rdi
ret
Function at 0x7ff7c00c0830
Capabilities:
Create process on windows

Disassembly:
push rbp
push rbx
lea rbp, [rsp - 0x37]
sub rsp, 0xe8
mov ebx, dword ds:[rbp + 0x6f]
mov rax, rcx
xor ecx, ecx
mov dword [rsp + 0x30], 0x70
xorps xmm0, xmm0
mov qword [rbp - 0x1d], rcx
movups xmmword [rbp - 0x7d], xmm0
mov qword [rbp - 0x79], rax
test bl, 1
movups xmmword [rbp - 0x6d], xmm0
mov dword [rbp - 0x15], ecx
lea rax, [0x7ff7c0185228]
cmove rax, qword [rbp - 0x71]
mov ecx, 0x440
movups xmmword [rbp - 0x5d], xmm0
mov qword [rbp - 0x71], rax
test bl, 4
mov eax, 0x800440
mov qword [rbp - 0x69], rdx
cmovne ecx, eax
mov qword [rbp - 0x61], r8
mov dword [rbp - 0x7d], ecx
lea rcx, [rsp + 0x30]
movups xmmword [rbp - 0x4d], xmm0
mov dword [rbp - 0x51], r9d
movups xmmword [rbp - 0x3d], xmm0
movups xmmword [rbp - 0x2d], xmm0
call qword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
je 0x7ff7c00c0a91
mov qword ss:[rsp + 0x110], rdi
mov edi, dword [rbp + 0x77]
test edi, edi
je 0x7ff7c00c0a56
test bl, 2
jne 0x7ff7c00c091b
mov rcx, qword [rbp - 0x19]
test rcx, rcx
je 0x7ff7c00c0a5a
cmp edi, 0xffffffff
jne 0x7ff7c00c08ff
xor r8d, r8d
xor edx, edx
call qword [sym.imp.ntdll.dll_NtWaitForSingleObject]
jmp 0x7ff7c00c0a56
imul rdx, rdi, 0xffffffffffffd8f0
lea r8, [rbp + 0x4f]
mov qword [rbp + 0x4f], rdx
xor edx, edx
call qword [sym.imp.ntdll.dll_NtWaitForSingleObject]
jmp 0x7ff7c00c0a56
mov rax, qword [0x7ffe0320]
mov rbx, rdi
mov ecx, dword [0x7ffe0004]
mov qword [rsp + 0x108], rsi
mov esi, eax
shr rax, 0x20
mov qword [rsp + 0xe0], r12
mov r12d, 0x7ffe0004
imul rax, rcx
imul rsi, rcx
shl rax, 8
mov qword [rsp + 0xd8], r14
mov qword [rsp + 0xd0], r15
mov r15d, 0x7ffe0320
shr rsi, 0x18
add rsi, rax
xor r8d, r8d
mov dword [rsp + 0x20], 0x1cbf
mov r9d, ebx
lea rdx, [rbp - 0x19]
lea ecx, [r8 + 1]
call qword [sym.imp.USER32.dll_MsgWaitForMultipleObjects]
nop
test eax, 0xffffff7f
je 0x7ff7c00c0a36
cmp eax, 1
jne 0x7ff7c00c0a36
xor r9d, r9d
mov dword [rsp + 0x20], eax
xor r8d, r8d
lea rcx, [rbp - 0x11]
xor edx, edx
call qword [sym.imp.USER32.dll_PeekMessageW]
test eax, eax
je 0x7ff7c00c09fa
nop
lea rcx, [rbp - 0x11]
call qword [sym.imp.USER32.dll_TranslateMessage]
lea rcx, ds:[rbp - 0x11]
call qword [sym.imp.USER32.dll_DispatchMessageW]
xor r9d, r9d
mov dword [rsp + 0x20], 1
xor r8d, r8d
lea rcx, [rbp - 0x11]
xor edx, edx
call qword [sym.imp.USER32.dll_PeekMessageW]
test eax, eax
jne 0x7ff7c00c09c0
cmp edi, 0xffffffff
je 0x7ff7c00c0972
mov rax, qword ds:[r15]
mov rbx, rdi
mov edx, dword [r12]
mov ecx, eax
shr rax, 0x20
imul rcx, rdx
imul rax, rdx
shr rcx, 0x18
sub rbx, rcx
shl rax, 8
sub rbx, rax
add rbx, rsi
jns 0x7ff7c00c0972
mov r14, qword [rsp + 0xd8]
mov r12, qword [rsp + 0xe0]
mov rsi, qword [rsp + 0x108]
mov r15, qword [rsp + 0xd0]
mov rcx, qword [rbp - 0x19]
mov rax, qword [rbp + 0x7f]
mov rdi, qword [rsp + 0x110]
test rax, rax
je 0x7ff7c00c0a7a
mov qword [rax], rcx
mov al, 1
add rsp, 0xe8
pop rbx
pop rbp
ret
test rcx, rcx
je 0x7ff7c00c0a85
call qword [sym.imp.ntdll.dll_NtClose]
mov al, 1
add rsp, 0xe8
pop rbx
pop rbp
ret
xor al, al
add rsp, 0xe8
pop rbx
pop rbp
ret
Function at 0x7ff7c00c0c20
Capabilities:
Create process on windows

Disassembly:
mov r11, rsp
push rdi
sub rsp, 0xa0
xorps xmm0, xmm0
mov dword [rsp + 0x30], 0x70
movups xmmword [rsp + 0x34], xmm0
xor eax, eax
mov rdi, rcx
movups xmmword [rsp + 0x54], xmm0
movups xmmword [rsp + 0x44], xmm0
movups xmmword [rsp + 0x64], xmm0
movups xmmword [rsp + 0x74], xmm0
mov qword [r11 - 0x14], rax
mov dword [r11 - 0xc], eax
lea rax, [0x7ff7c0188480]
movups xmmword [r11 - 0x24], xmm0
mov qword [r11 - 0x60], rdx
mov dword [rsp + 0x60], 5
mov dword [rsp + 0x34], 0x40c
mov qword [r11 - 0x70], rcx
lea rcx, [r11 - 0x78]
mov qword [r11 - 0x68], rax
call qword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
jne 0x7ff7c00c0d34
mov qword ss:[rsp + 0xb8], rbx
call qword [sym.imp.kernel32.dll_GetLastError]
test eax, eax
jne 0x7ff7c00c0cb3
xor ecx, ecx
call sym.ProcessHacker.exe_PhGetNtMessage
jmp 0x7ff7c00c0cba
mov ecx, eax
call sym.ProcessHacker.exe_PhGetWin32Message
lea r9, [0x7ff7c01883c0]
mov rbx, rax
mov rcx, rdi
test rax, rax
je 0x7ff7c00c0d1b
mov rax, qword [rax + 8]
mov edx, 0x20
mov qword [rsp + 0x28], rax
mov r8d, 0xfffe
lea rax, [0x7ff7c017439c]
mov qword [rsp + 0x20], rax
call sym.ProcessHacker.exe_PhShowMessage2
lea rcx, ds:[rbx - 0x10]
mov eax, 0xffffffff
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x7ff7c00c0d2c
call fcn.7ff7c00c6290
mov rbx, qword [rsp + 0xb8]
add rsp, 0xa0
pop rdi
ret
lea r8, [0x7ff7c0187ff8]
mov edx, 0x10
call sym.ProcessHacker.exe_PhShowMessage
mov rbx, qword [rsp + 0xb8]
add rsp, 0xa0
pop rdi
ret
Function at 0x7ff7c00c1330
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
push r14
push r15
sub rsp, 0x40
xor ebx, ebx
mov r14, rcx
lea r15d, [rbx + 2]
test rdx, rdx
je 0x7ff7c00c1387
mov r8, 0xffffffffffffffff
nop
inc r8
cmp word [rdx + r8*2], bx
jne 0x7ff7c00c1350
add r8, r8
mov qword [rsp + 0x38], rdx
mov word [rsp + 0x30], r8w
lea ecx, [r8 + 2]
mov word [rsp + 0x32], cx
cmp r8, 0xfffe
jbe 0x7ff7c00c1394
mov rax, rbx
add rsp, 0x40
pop r15
pop r14
pop rbx
ret
mov dword [rsp + 0x30], 0x20000
mov qword [rsp + 0x38], rbx
mov rcx, qword [0x7ff7c01d3cd0]
mov edx, 4
mov qword [rsp + 0x60], rbp
mov r8d, 0x100
mov qword [rsp + 0x70], rsi
mov qword [rsp + 0x78], rdi
mov dword [rsp + 0x68], 0x100
call qword [sym.imp.kernel32.dll_HeapAlloc_1]
mov rdi, rax
mov ebp, 0x10
nop dword [rax + rax]
mov ecx, dword [rsp + 0x68]
lea rax, [rsp + 0x68]
mov qword [rsp + 0x28], rax
lea rdx, [rsp + 0x30]
mov dword [rsp + 0x20], ecx
mov r9, rdi
mov rcx, r14
mov r8d, r15d
call qword [sym.imp.ntdll.dll_NtQueryValueKey]
mov esi, eax
test eax, eax
jns 0x7ff7c00c143e
mov rcx, qword [0x7ff7c01d3cd0]
mov r8, rdi
xor edx, edx
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
nop
cmp esi, 0x80000005
jne 0x7ff7c00c14ba
mov r8d, dword ds:[rsp + 0x68]
mov edx, 4
mov rcx, qword [0x7ff7c01d3cd0]
call qword [sym.imp.kernel32.dll_HeapAlloc_1]
mov rdi, rax
add ebp, 0xffffffff
jne 0x7ff7c00c13d0
test esi, esi
js 0x7ff7c00c14ba
mov ecx, dword [rdi + 4]
lea eax, [rcx - 1]
cmp eax, 1
jbe 0x7ff7c00c1455
nop dword [rax]
cmp ecx, 7
jne 0x7ff7c00c14a8
mov eax, dword [rdi + 8]
cmp eax, r15d
jb 0x7ff7c00c14a0
mov rdx, qword [0x7ff7c01d3b58]
lea rsi, [rax - 2]
lea rcx, [rsi + 0x12]
lea rbp, [rdi + 0xc]
call sym.ProcessHacker.exe_PhCreateObject
mov r14, rax
mov qword [rax], rsi
lea rcx, [rax + 0x10]
mov qword [rax + 8], rcx
mov word [rcx + rsi], bx
test rbp, rbp
je 0x7ff7c00c149b
mov rcx, qword [rax + 8]
mov r8, rsi
mov rdx, rbp
call fcn.7ff7c0125120
mov rbx, r14
jmp 0x7ff7c00c14a8
call sym.ProcessHacker.exe_PhReferenceEmptyString
mov rbx, rax
mov rcx, qword [0x7ff7c01d3cd0]
mov r8, rdi
xor edx, edx
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
mov rsi, qword [rsp + 0x70]
mov rax, rbx
mov rbp, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x78]
add rsp, 0x40
pop r15
pop r14
pop rbx
ret
Function at 0x7ff7c00c14e0
Capabilities:
Query or enumerate registry value

Disassembly:
push rsi
push r14
push r15
sub rsp, 0x40
mov r14, rcx
mov esi, 0xffffffff
mov r15d, 2
test rdx, rdx
je 0x7ff7c00c153b
mov r8, 0xffffffffffffffff
inc r8
cmp word [rdx + r8*2], 0
jne 0x7ff7c00c1504
add r8, r8
mov qword [rsp + 0x38], rdx
mov word [rsp + 0x30], r8w
lea ecx, [r8 + 2]
mov word [rsp + 0x32], cx
cmp r8, 0xfffe
jbe 0x7ff7c00c154a
mov eax, esi
add rsp, 0x40
pop r15
pop r14
pop rsi
ret
xor eax, eax
mov dword [rsp + 0x30], 0x20000
mov qword [rsp + 0x38], rax
mov rcx, qword [0x7ff7c01d3cd0]
mov edx, 4
mov qword [rsp + 0x60], rbx
mov r8d, 0x100
mov qword [rsp + 0x70], rbp
mov qword [rsp + 0x78], rdi
mov dword [rsp + 0x68], 0x100
call qword [sym.imp.kernel32.dll_HeapAlloc_1]
mov rbx, rax
mov ebp, 0x10
mov ecx, dword [rsp + 0x68]
lea rax, [rsp + 0x68]
mov qword [rsp + 0x28], rax
lea rdx, [rsp + 0x30]
mov dword [rsp + 0x20], ecx
mov r9, rbx
mov rcx, r14
mov r8d, r15d
call qword [sym.imp.ntdll.dll_NtQueryValueKey]
mov edi, eax
test eax, eax
jns 0x7ff7c00c15e6
mov rcx, qword [0x7ff7c01d3cd0]
mov r8, rbx
xor edx, edx
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
nop
cmp edi, 0x80000005
jne 0x7ff7c00c160b
mov r8d, dword [rsp + 0x68]
mov edx, 4
mov rcx, qword [0x7ff7c01d3cd0]
call qword [sym.imp.kernel32.dll_HeapAlloc_1]
mov rbx, rax
add ebp, esi
jne 0x7ff7c00c1581
test edi, edi
js 0x7ff7c00c160b
cmp dword [rbx + 4], 4
jne 0x7ff7c00c15f9
cmp dword [rbx + 8], 4
jne 0x7ff7c00c15f9
mov esi, dword [rbx + 0xc]
mov rcx, qword [0x7ff7c01d3cd0]
mov r8, rbx
xor edx, edx
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
mov rbp, qword [rsp + 0x70]
mov eax, esi
mov rbx, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x78]
add rsp, 0x40
pop r15
pop r14
pop rsi
ret
Function at 0x7ff7c00c1630
Capabilities:
Query or enumerate registry value

Disassembly:
push rdi
push r14
push r15
sub rsp, 0x40
mov rdi, 0xffffffffffffffff
mov r14, rcx
lea r15d, [rdi + 3]
test rdx, rdx
je 0x7ff7c00c1688
mov r8, rdi
inc r8
cmp word [rdx + r8*2], 0
jne 0x7ff7c00c1650
add r8, r8
mov qword [rsp + 0x38], rdx
mov word [rsp + 0x30], r8w
lea ecx, [r8 + 2]
mov word [rsp + 0x32], cx
cmp r8, 0xfffe
jbe 0x7ff7c00c1697
mov rax, rdi
add rsp, 0x40
pop r15
pop r14
pop rdi
ret
xor eax, eax
mov dword [rsp + 0x30], 0x20000
mov qword [rsp + 0x38], rax
mov rcx, qword [0x7ff7c01d3cd0]
mov edx, 4
mov qword [rsp + 0x60], rbx
mov r8d, 0x100
mov qword [rsp + 0x70], rbp
mov qword [rsp + 0x78], rsi
mov dword [rsp + 0x68], 0x100
call qword [sym.imp.kernel32.dll_HeapAlloc_1]
mov rbx, rax
mov ebp, 0x10
nop
mov ecx, dword [rsp + 0x68]
lea rax, [rsp + 0x68]
mov qword [rsp + 0x28], rax
lea rdx, [rsp + 0x30]
mov dword [rsp + 0x20], ecx
mov r9, rbx
mov rcx, r14
mov r8d, r15d
call qword [sym.imp.ntdll.dll_NtQueryValueKey]
mov esi, eax
test eax, eax
jns 0x7ff7c00c1737
mov rcx, qword [0x7ff7c01d3cd0]
mov r8, rbx
xor edx, edx
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
nop
cmp esi, 0x80000005
jne 0x7ff7c00c1776
mov r8d, dword [rsp + 0x68]
mov edx, 4
mov rcx, qword [0x7ff7c01d3cd0]
call qword [sym.imp.kernel32.dll_HeapAlloc_1]
mov rbx, rax
add ebp, 0xffffffff
jne 0x7ff7c00c16d0
test esi, esi
js 0x7ff7c00c1776
mov eax, dword [rbx + 4]
cmp eax, 4
jne 0x7ff7c00c174d
cmp dword [rbx + 8], eax
jne 0x7ff7c00c175f
mov edi, dword [rbx + 0xc]
jmp 0x7ff7c00c175f
nop dword [rax]
cmp eax, 0xb
jne 0x7ff7c00c175f
cmp dword [rbx + 8], 8
jne 0x7ff7c00c175f
mov rdi, qword [rbx + 0xc]
mov rcx, qword [0x7ff7c01d3cd0]
mov r8, rbx
xor edx, edx
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
mov rbp, qword [rsp + 0x70]
mov rax, rdi
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x78]
add rsp, 0x40
pop r15
pop r14
pop rdi
ret

Function at 0x7ff7c00c2740
Capabilities:
Hash data using sha1
Hash data using sha256

Disassembly:
sub rsp, 0x28
mov dword [rcx], edx
test edx, edx
je 0x7ff7c00c27e4
sub edx, 1
je 0x7ff7c00c27b6
sub edx, 1
je 0x7ff7c00c27ac
cmp edx, 1
je 0x7ff7c00c2769
mov ecx, 0xc00000f0
call qword [sym.imp.ntdll.dll_RtlRaiseStatus]
int3
xor eax, eax
mov dword [rcx + 0xc], 0x6a09e667
mov dword [rcx + 0x10], 0xbb67ae85
mov dword [rcx + 0x14], 0x3c6ef372
mov dword [rcx + 0x18], 0xa54ff53a
mov dword [rcx + 0x1c], 0x510e527f
mov dword [rcx + 0x20], 0x9b05688c
mov dword [rcx + 0x24], 0x1f83d9ab
mov dword [rcx + 0x28], 0x5be0cd19
mov qword [rcx + 4], rax
add rsp, 0x28
ret
xor eax, eax
mov dword [rcx + 4], eax
add rsp, 0x28
ret
xor eax, eax
mov dword [rcx + 0x1c], 0x67452301
mov qword [rcx + 0x30], rax
mov dword [rcx + 0x20], 0xefcdab89
mov dword [rcx + 0x24], 0x98badcfe
mov dword [rcx + 0x28], 0x10325476
mov dword [rcx + 0x2c], 0xc3d2e1f0
add rsp, 0x28
ret
xor eax, eax
mov dword [rcx + 0xc], 0x67452301
mov dword [rcx + 0x10], 0xefcdab89
mov dword [rcx + 0x14], 0x98badcfe
mov dword [rcx + 0x18], 0x10325476
mov qword [rcx + 4], rax
add rsp, 0x28
ret
Function at 0x7ff7c00c2810
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push rbx
sub rsp, 0x20
mov r9d, dword [rcx]
mov r10, rdx
mov ebx, r8d
mov r11, rcx
test r9d, r9d
je 0x7ff7c00c28bf
nop dword [rax + rax]
sub r9d, 1
je 0x7ff7c00c28ae
sub r9d, 1
je 0x7ff7c00c285f
cmp r9d, 1
je 0x7ff7c00c284e
mov ecx, 0xc000000d
call qword [sym.imp.ntdll.dll_RtlRaiseStatus]
int3
add rcx, 4
mov r8d, ebx
add rsp, 0x20
pop rbx
jmp fcn.7ff7c01119d0
mov r8d, dword [rcx + 4]
mov r9, rbx
not r8d
test ebx, ebx
je 0x7ff7c00c28a1
lea rbx, [0x7ff7c018a3b0]
nop dword [rax]
nop dword [rax + rax]
movsx ecx, byte [r10]
lea r10, [r10 + 1]
mov eax, r8d
xor rcx, rax
shr eax, 8
movzx edx, cl
mov r8d, dword [rbx + rdx*4]
xor r8d, eax
sub r9, 1
jne 0x7ff7c00c2880
not r8d
mov dword [r11 + 4], r8d
add rsp, 0x20
pop rbx
ret
add rcx, 4
mov r8d, ebx
add rsp, 0x20
pop rbx
jmp fcn.7ff7c0114af0
add rcx, 4
mov r8d, ebx
add rsp, 0x20
pop rbx
jmp fcn.7ff7c0111d30
Function at 0x7ff7c00c3a40
Capabilities:
Create directory

Disassembly:
sub rsp, 0x78
mov rax, qword [0x7ff7c01ca008]
xor rax, rsp
mov qword [rsp + 0x60], rax
test byte [0x7ff7c01d0598], 1
nop word [rax + rax]
jne 0x7ff7c00c3c2f
lock bts qword [0x7ff7c01d0598], 0x1f
jae 0x7ff7c00c3a92
test byte [0x7ff7c01d0598], 1
jne 0x7ff7c00c3c2f
xor edx, edx
lea rcx, [0x7ff7c01d0598]
call sym.ProcessHacker.exe_PhfWaitForEvent
jmp 0x7ff7c00c3c2f
mov qword [rsp + 0x80], rbx
lea rdx, [0x7ff7c01d05b8]
mov qword [rsp + 0x88], rsi
lea rcx, [rsp + 0x50]
mov r8b, 2
mov qword [rsp + 0x70], rdi
call qword [sym.imp.ntdll.dll_RtlInitializeSid]
xor edx, edx
lea rcx, [rsp + 0x50]
call qword [sym.imp.ntdll.dll_RtlSubAuthoritySid]
mov edx, 1
lea rcx, [rsp + 0x50]
mov dword [rax], 0x20
call qword [sym.imp.ntdll.dll_RtlSubAuthoritySid]
lea rcx, [rsp + 0x50]
mov dword [rax], 0x220
call qword [sym.imp.ntdll.dll_RtlLengthSid]
lea rcx, [0x7ff7c01cae48]
mov ebx, eax
call qword [sym.imp.ntdll.dll_RtlLengthSid]
lea rcx, [0x7ff7c01cae38]
add ebx, eax
call qword [sym.imp.ntdll.dll_RtlLengthSid]
mov rcx, qword [0x7ff7c01d3cd0]
mov edx, 4
add eax, 0x54
add ebx, eax
mov r8d, ebx
call qword [sym.imp.kernel32.dll_HeapAlloc_1]
mov rcx, rax
mov edx, 1
mov rsi, rax
call qword [sym.imp.ntdll.dll_RtlCreateSecurityDescriptor]
lea edx, [rbx - 0x28]
mov r8d, 2
lea rcx, [rsi + 0x28]
call qword [sym.imp.ntdll.dll_RtlCreateAcl]
lea r9, [0x7ff7c01cae38]
mov edx, 2
mov r8d, 0xf000f
lea rcx, [rsi + 0x28]
call qword [sym.imp.ntdll.dll_RtlAddAccessAllowedAce]
lea r9, ds:[rsp + 0x50]
mov edx, 2
mov r8d, 0xf000f
lea rcx, [rsi + 0x28]
call qword [sym.imp.ntdll.dll_RtlAddAccessAllowedAce]
mov edx, 2
lea r9, [0x7ff7c01cae48]
lea rcx, [rsi + 0x28]
lea r8d, [rdx + 5]
call qword [sym.imp.ntdll.dll_RtlAddAccessAllowedAce]
xor r9d, r9d
lea r8, [rsi + 0x28]
mov dl, 1
mov rcx, rsi
call qword [sym.imp.ntdll.dll_RtlSetDaclSecurityDescriptor]
xor ecx, ecx
mov dword [rsp + 0x20], 0x30
mov qword [rsp + 0x28], rcx
lea rax, [0x7ff7c01d05d0]
mov qword [rsp + 0x48], rcx
lea r8, [rsp + 0x20]
lea rcx, [0x7ff7c01d6998]
mov dword [rsp + 0x38], 0x80
mov edx, 0x2000000
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x40], rsi
call qword [sym.imp.ntdll.dll_NtCreateDirectoryObject]
mov rcx, qword [0x7ff7c01d3cd0]
mov r8, rsi
xor edx, edx
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
lea rcx, [0x7ff7c01d0598]
call sym.ProcessHacker.exe_PhfSetEvent
mov rdi, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x88]
mov rbx, qword [rsp + 0x80]
mov rax, qword [0x7ff7c01d6998]
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
nop
call fcn.7ff7c0121390
add rsp, 0x78
ret
Function at 0x7ff7c00c3c50
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push rbx
push rdi
push r14
sub rsp, 0x70
mov rax, qword [0x7ff7c01ca008]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov r14, qword [rsp + 0xb0]
mov rbx, r9
mov qword [rsp + 0x38], r8
lea r9, [rsp + 0x28]
mov qword [rsp + 0x40], rdx
mov r8d, 3
lea rdx, [rsp + 0x38]
mov qword [rsp + 0x48], 0
mov rdi, rcx
call qword [sym.imp.ntdll.dll_LdrFindResource_U]
test eax, eax
js 0x7ff7c00c3d09
mov rdx, qword [rsp + 0x28]
lea r9, [rsp + 0x20]
lea r8, [rsp + 0x30]
mov rcx, rdi
call qword [sym.imp.ntdll.dll_LdrAccessResource]
test eax, eax
js 0x7ff7c00c3d09
mov eax, dword [rsp + 0x20]
mov qword [rsp + 0x68], rsi
test rbx, rbx
je 0x7ff7c00c3ccf
mov dword [rbx], eax
mov rcx, qword [0x7ff7c01d3cd0]
mov r8, rax
mov rsi, qword [rsp + 0x30]
mov edx, 4
mov rdi, rax
call qword [sym.imp.kernel32.dll_HeapAlloc_1]
mov r8, rdi
mov rdx, rsi
mov rcx, rax
mov rbx, rax
call fcn.7ff7c0125120
mov rsi, qword [rsp + 0x68]
mov al, 1
mov qword [r14], rbx
jmp 0x7ff7c00c3d0b
xor al, al
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.7ff7c0121390
add rsp, 0x70
pop r14
pop rdi
pop rbx
ret
Function at 0x7ff7c00c4610
Capabilities:
Access peb ldr_data

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
push rsi
push rdi
push r14
sub rsp, 0x20
mov rax, qword gs:[0x30]
mov rbx, rcx
mov r14, rdx
mov rcx, qword [rax + 0x60]
mov rcx, qword [rcx + 0x110]
call qword [sym.imp.kernel32.dll_EnterCriticalSection_1]
mov rax, qword gs:[0x30]
mov r8, qword [rax + 0x60]
mov rcx, qword [r8 + 0x18]
add rcx, 0x10
mov rax, qword [rcx]
cmp rax, rcx
je 0x7ff7c00c4675
nop
test rbx, rbx
je 0x7ff7c00c46a4
cmp qword [rax + 0x30], rbx
je 0x7ff7c00c46a4
mov rax, qword ds:[rax]
cmp rax, rcx
jne 0x7ff7c00c4660
mov rax, qword gs:[0x30]
mov rcx, qword [rax + 0x60]
mov rcx, qword [rcx + 0x110]
call qword [sym.imp.kernel32.dll_LeaveCriticalSection_1]
xor eax, eax
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
add rsp, 0x20
pop r14
pop rdi
pop rsi
ret
test rax, rax
je 0x7ff7c00c4675
movzx ecx, word ds:[rax + 0x48]
xor ebp, ebp
test cx, cx
jne 0x7ff7c00c46bf
call sym.ProcessHacker.exe_PhReferenceEmptyString
mov rbx, rax
jmp 0x7ff7c00c46fc
mov rdx, qword [0x7ff7c01d3b58]
mov rdi, rcx
mov rsi, qword [rax + 0x50]
add rcx, 0x12
call sym.ProcessHacker.exe_PhCreateObject
mov rbx, rax
mov qword [rax], rdi
add rax, 0x10
mov qword [rbx + 8], rax
mov word [rax + rdi], bp
test rsi, rsi
je 0x7ff7c00c46fc
mov rcx, qword [rbx + 8]
mov r8, rdi
mov rdx, rsi
call fcn.7ff7c0125120
mov rax, qword gs:[0x30]
mov rcx, qword [rax + 0x60]
mov rcx, qword [rcx + 0x110]
call qword [sym.imp.kernel32.dll_LeaveCriticalSection_1]
test rbx, rbx
je 0x7ff7c00c468f
mov rcx, rbx
call sym.ProcessHacker.exe_PhGetFileName
lea rcx, [rbx - 0x10]
mov rsi, rax
mov ebx, 0xffffffff
mov rdi, rax
mov edx, ebx
lock xadd dword [rcx + 8], edx
cmp edx, 1
jne 0x7ff7c00c4747
call fcn.7ff7c00c6290
mov rcx, qword [rsi + 8]
lea r8, [rsp + 0x58]
xor edx, edx
call fcn.7ff7c00bf0f0
test eax, eax
js 0x7ff7c00c477b
mov rax, qword [rsp + 0x58]
test rax, rax
je 0x7ff7c00c477b
mov rdi, rax
lea rcx, [rsi - 0x10]
lock xadd dword [rcx + 8], ebx
cmp ebx, 1
jne 0x7ff7c00c477b
call fcn.7ff7c00c6290
test r14, r14
je 0x7ff7c00c47af
mov edx, 0x5c
xor r8d, r8d
mov rcx, rdi
call sym.ProcessHacker.exe_PhFindLastCharInStringRef
cmp rax, 0xffffffffffffffff
je 0x7ff7c00c47a9
inc rax
mov dword [r14], eax
mov rax, rdi
jmp 0x7ff7c00c4691
mov rax, rbp
mov dword [r14], eax
mov rax, rdi
jmp 0x7ff7c00c4691
Function at 0x7ff7c00c47c0
Capabilities:
Access peb ldr_data

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
mov qword [rsp + 8], rcx
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
mov rdi, rcx
call sym.ProcessHacker.exe_PhCountStringZ
mov rdx, qword gs:[0x30]
mov r13, rax
add r13, r13
mov rcx, qword [rdx + 0x60]
mov rcx, qword [rcx + 0x110]
call qword [sym.imp.kernel32.dll_EnterCriticalSection_1]
mov rdx, qword gs:[0x30]
xor ebx, ebx
mov r8, qword [rdx + 0x60]
mov r12, qword [r8 + 0x18]
add r12, 0x10
mov r15, qword [r12]
cmp r15, r12
je 0x7ff7c00c4912
nop dword [rax]
mov rax, qword [r15 + 0x60]
movzx esi, word ds:[r15 + 0x58]
cmp rsi, r13
jne 0x7ff7c00c4948
cmp byte [0x7ff7c01d65de], 1
mov r14, rdi
mov ecx, esi
mov rbx, rax
jb 0x7ff7c00c48ad
shr rcx, 4
test rcx, rcx
je 0x7ff7c00c4896
nop word [rax + rax]
movdqu xmm1, xmmword [r14]
movdqu xmm0, xmmword [rbx]
pcmpeqd xmm1, xmm0
pmovmskb eax, xmm1
cmp eax, 0xffff
jne 0x7ff7c00c489e
add rbx, 0x10
add r14, 0x10
sub rcx, 1
jne 0x7ff7c00c4870
shr rsi, 1
and esi, 7
jmp 0x7ff7c00c48d2
and esi, 0xf
shl rcx, 4
add rsi, rcx
shr rsi, 1
jmp 0x7ff7c00c48d2
shr rcx, 3
test rcx, rcx
je 0x7ff7c00c48cc
mov rax, qword [r14]
cmp qword [rbx], rax
jne 0x7ff7c00c4937
add rbx, 8
add r14, 8
sub rcx, 1
jne 0x7ff7c00c48b6
shr rsi, 1
and esi, 3
test rsi, rsi
je 0x7ff7c00c490f
sub r14, rbx
nop word [rax + rax]
movzx ecx, word [rbx]
movzx ebp, word [r14 + rbx]
cmp cx, bp
je 0x7ff7c00c4905
call qword [sym.imp.ntdll.dll_RtlUpcaseUnicodeChar]
movzx ecx, bp
movzx edi, ax
call qword [sym.imp.ntdll.dll_RtlUpcaseUnicodeChar]
nop
cmp di, ax
jne 0x7ff7c00c4943
add rbx, 2
sub rsi, 1
jne 0x7ff7c00c48e0
mov rbx, r15
mov rcx, qword gs:[0x30]
mov rcx, qword [rcx + 0x60]
mov rcx, qword [rcx + 0x110]
call qword [sym.imp.kernel32.dll_LeaveCriticalSection_1]
test rbx, rbx
je 0x7ff7c00c496e
mov rax, qword [rbx + 0x30]
jmp 0x7ff7c00c4970
and esi, 7
lea rsi, [rsi + rcx*8]
shr rsi, 1
jmp 0x7ff7c00c48d2
mov rdi, qword [rsp + 0x50]
mov r15, qword [r15]
cmp r15, r12
jne 0x7ff7c00c4830
mov rax, qword gs:[0x30]
mov rcx, qword [rax + 0x60]
mov rcx, qword [rcx + 0x110]
call qword [sym.imp.kernel32.dll_LeaveCriticalSection_1]
xor eax, eax
mov rbx, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
ret