joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400f7040
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
sub rsp, 0x28
mov r9d, dword [rcx]
mov r10, rdx
mov r11, rcx
test r9d, r9d
je 0x1400f70d5
sub r9d, 1
je 0x1400f70c8
nop dword [rax]
sub r9d, 1
je 0x1400f7085
cmp r9d, 1
je 0x1400f7078
mov ecx, 0xc000000d
call qword [sym.imp.ntdll.dll_RtlRaiseStatus]
int3
add rcx, 4
add rsp, 0x28
jmp fcn.140170560
mov edx, dword [rcx + 4]
mov r8d, r8d
not edx
test r8, r8
je 0x1400f70bd
lea r9, [0x1401f2820]
nop dword [rax]
movsx ecx, byte [r10]
lea r10, [r10 + 1]
mov eax, edx
shr edx, 8
xor rcx, rax
movzx eax, cl
xor edx, dword [r9 + rax*4]
sub r8, 1
jne 0x1400f70a0
not edx
mov dword [r11 + 4], edx
add rsp, 0x28
ret
add rcx, 4
add rsp, 0x28
jmp fcn.1401736e0
add rcx, 4
add rsp, 0x28
jmp fcn.1401708c0
Function at 0x1400f8f00
Capabilities:
Create directory

Disassembly:
sub rsp, 0x78
mov rax, qword [0x140237008]
xor rax, rsp
mov qword [rsp + 0x60], rax
test byte [0x14023df38], 1
jne 0x1400f90ff
lock bts qword [0x14023df38], 0x1f
jae 0x1400f8f52
test byte [0x14023df38], 1
jne 0x1400f90ff
xor edx, edx
lea rcx, [0x14023df38]
call sym.ProcessHacker.exe_PhfWaitForEvent
jmp 0x1400f90ff
mov qword [rsp + 0x80], rbx
lea rdx, [0x14023df58]
mov qword [rsp + 0x88], rsi
lea rcx, [rsp + 0x50]
mov r8b, 2
mov qword [rsp + 0x70], rdi
call qword [sym.imp.ntdll.dll_RtlInitializeSid]
xor edx, edx
lea rcx, [rsp + 0x50]
call qword [sym.imp.ntdll.dll_RtlSubAuthoritySid]
mov edx, 1
lea rcx, [rsp + 0x50]
mov dword [rax], 0x20
call qword [sym.imp.ntdll.dll_RtlSubAuthoritySid]
lea rcx, [rsp + 0x50]
mov dword [rax], 0x220
call qword [sym.imp.ntdll.dll_RtlLengthSid]
lea rcx, [0x140238008]
mov ebx, eax
call qword [sym.imp.ntdll.dll_RtlLengthSid]
lea rcx, [0x140237ff8]
add ebx, eax
call qword [sym.imp.ntdll.dll_RtlLengthSid]
mov rcx, qword [0x140241998]
mov edx, 4
add eax, 0x54
add ebx, eax
mov r8d, ebx
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov rcx, rax
mov edx, 1
mov rsi, rax
call qword [sym.imp.ntdll.dll_RtlCreateSecurityDescriptor]
lea edx, [rbx - 0x28]
mov r8d, 2
lea rcx, [rsi + 0x28]
call qword [sym.imp.ntdll.dll_RtlCreateAcl]
lea r9, [0x140237ff8]
mov edx, 2
mov r8d, 0xf000f
lea rcx, [rsi + 0x28]
call qword [sym.imp.ntdll.dll_RtlAddAccessAllowedAce]
lea r9, ds:[rsp + 0x50]
mov edx, 2
mov r8d, 0xf000f
lea rcx, [rsi + 0x28]
call qword [sym.imp.ntdll.dll_RtlAddAccessAllowedAce]
mov edx, 2
lea r9, [0x140238008]
lea rcx, [rsi + 0x28]
lea r8d, [rdx + 5]
call qword [sym.imp.ntdll.dll_RtlAddAccessAllowedAce]
xor r9d, r9d
lea r8, [rsi + 0x28]
mov dl, 1
mov rcx, rsi
call qword [sym.imp.ntdll.dll_RtlSetDaclSecurityDescriptor]
xor edx, edx
mov dword [rsp + 0x20], 0x30
cmp dword [0x140237d34], 0x64
lea r8, [rsp + 0x20]
mov eax, 0x1080
mov qword [rsp + 0x28], rdx
mov ecx, 0x80
mov qword [rsp + 0x48], rdx
cmovb eax, ecx
mov qword [rsp + 0x40], rsi
mov dword [rsp + 0x38], eax
lea rcx, [0x1402447c0]
lea rax, [0x14023df60]
mov edx, 0x2000000
mov qword [rsp + 0x30], rax
call qword [sym.imp.ntdll.dll_NtCreateDirectoryObject]
mov rcx, qword [0x140241998]
mov r8, rsi
xor edx, edx
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
lea rcx, [0x14023df38]
call sym.ProcessHacker.exe_PhfSetEvent
mov rdi, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x88]
mov rbx, qword [rsp + 0x80]
mov rax, qword [0x1402447c0]
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.1401848a0
add rsp, 0x78
ret
Function at 0x1400f9120
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x60
mov rax, qword [0x140237008]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov rbx, qword [rsp + 0xa0]
mov rdi, r9
mov qword [rsp + 0x38], r8
lea r9, [rsp + 0x28]
mov qword [rsp + 0x40], rdx
mov r8d, 3
lea rdx, [rsp + 0x38]
mov qword [rsp + 0x48], 0
mov rsi, rcx
call qword [sym.imp.ntdll.dll_LdrFindResource_U]
test eax, eax
js 0x1400f91b1
lfence
mov rdx, qword [rsp + 0x28]
lea r9, [rsp + 0x20]
lea r8, [rsp + 0x30]
mov rcx, rsi
call qword [sym.imp.ntdll.dll_LdrAccessResource]
test eax, eax
js 0x1400f91b1
test rdi, rdi
je 0x1400f919c
mov eax, dword [rsp + 0x20]
mov dword [rdi], eax
nop dword [rax]
test rbx, rbx
je 0x1400f91ad
mov rax, qword [rsp + 0x30]
mov qword [rbx], rax
mov al, 1
jmp 0x1400f91b3
xor al, al
mov rcx, qword ds:[rsp + 0x50]
xor rcx, rsp
call fcn.1401848a0
add rsp, 0x60
pop rdi
pop rsi
pop rbx
ret

Function at 0x1400f91e0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push rbx
push rsi
sub rsp, 0x68
mov rax, qword [0x140237008]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov rsi, qword [rsp + 0xa0]
lea r9, [rsp + 0x28]
mov qword [rsp + 0x38], r8
mov rbx, rcx
mov qword [rsp + 0x40], rdx
mov r8d, 3
lea rdx, [rsp + 0x38]
mov qword [rsp + 0x48], 0
call qword [sym.imp.ntdll.dll_LdrFindResource_U]
test eax, eax
js 0x1400f92a2
lfence
mov rdx, qword [rsp + 0x28]
lea r9, [rsp + 0x20]
lea r8, [rsp + 0x30]
mov rcx, rbx
call qword [sym.imp.ntdll.dll_LdrAccessResource]
test eax, eax
js 0x1400f92a2
mov qword [rsp + 0x98], rbp
mov rbp, qword [rsp + 0x30]
test rsi, rsi
je 0x1400f9296
mov rcx, qword [0x140241998]
mov edx, 4
mov qword [rsp + 0x60], rdi
mov edi, dword [rsp + 0x20]
mov r8d, edi
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov r8d, edi
mov rdx, rbp
mov rcx, rax
mov rbx, rax
call fcn.140188690
mov rdi, qword [rsp + 0x60]
mov qword [rsi], rbx
mov rbp, qword [rsp + 0x98]
mov al, 1
jmp 0x1400f92a4
xor al, al
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.1401848a0
add rsp, 0x68
pop rsi
pop rbx
ret
Function at 0x1400f9760
Capabilities:
Parse pe header

Disassembly:
push rbx
sub rsp, 0x30
test byte [0x14023e020], 1
mov rbx, rcx
jne 0x1400f981c
lock bts qword [0x14023e020], 0x1f
jae 0x1400f979f
test byte [0x14023e020], 1
jne 0x1400f981c
xor edx, edx
lea rcx, [0x14023e020]
call sym.ProcessHacker.exe_PhfWaitForEvent
jmp 0x1400f981c
lea rcx, [0x1401d9d58]
call fcn.1400f9d00
mov rcx, rax
test rax, rax
je 0x1400f9807
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x1400f9807
mov edx, dword [rcx + 0x3c]
lea eax, [rdx - 1]
cmp eax, 0x7ffffffd
ja 0x1400f9807
cmp dword [rdx + rcx], 0x4550
jne 0x1400f9807
add rdx, 0x88
add rdx, rcx
mov eax, dword [rdx]
test eax, eax
je 0x1400f9807
cmp dword [rdx + 4], 0
je 0x1400f9807
lea r8, ds:[rcx + rax]
xor eax, eax
lea r9, str.HungWindowFromGhostWindow
mov word [rsp + 0x20], ax
call fcn.1400fa1a0
jmp 0x1400f9809
xor eax, eax
lea rcx, [0x14023e020]
mov qword [0x140244810], rax
call sym.ProcessHacker.exe_PhfSetEvent
mov rax, qword [0x140244810]
test rax, rax
jne 0x1400f982e
add rsp, 0x30
pop rbx
ret
mov rcx, rbx
add rsp, 0x30
pop rbx
jmp qword [case.0x1400f654f.0]
Function at 0x1400f9b40
Capabilities:
Access peb ldr_data

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rdi
push r14
sub rsp, 0x20
mov rax, qword gs:[0x30]
mov rbx, rcx
mov r14, rdx
mov rcx, qword [rax + 0x60]
mov rcx, qword [rcx + 0x110]
call qword [sym.imp.ntdll.dll_RtlEnterCriticalSection]
mov rax, qword gs:[0x30]
mov r8, qword [rax + 0x60]
mov rcx, qword [r8 + 0x18]
add rcx, 0x10
mov rax, qword [rcx]
cmp rax, rcx
je 0x1400f9ba5
nop word [rax + rax]
test rbx, rbx
je 0x1400f9bcf
cmp qword [rax + 0x30], rbx
je 0x1400f9bcf
mov rax, qword ds:[rax]
cmp rax, rcx
jne 0x1400f9b90
mov rax, qword gs:[0x30]
mov rcx, qword [rax + 0x60]
mov rcx, qword [rcx + 0x110]
call qword [sym.imp.ntdll.dll_RtlLeaveCriticalSection]
xor eax, eax
mov rbx, qword [rsp + 0x48]
add rsp, 0x20
pop r14
pop rdi
pop rbp
ret
test rax, rax
je 0x1400f9ba5
movzx ecx, word [rax + 0x48]
xor ebp, ebp
test cx, cx
jne 0x1400f9bea
nop
call sym.ProcessHacker.exe_PhReferenceEmptyString
mov rbx, rax
jmp 0x1400f9c31
mov rdx, qword [0x1402418e8]
mov rdi, rcx
add rcx, 0x12
mov qword [rsp + 0x40], rsi
mov rsi, qword [rax + 0x50]
call sym.ProcessHacker.exe_PhCreateObject
mov rbx, rax
mov qword [rax], rdi
add rax, 0x10
mov qword [rbx + 8], rax
mov word [rax + rdi], bp
test rsi, rsi
je 0x1400f9c2c
mov rcx, qword [rbx + 8]
mov r8, rdi
mov rdx, rsi
call fcn.140188690
mov rsi, qword [rsp + 0x40]
mov rax, qword gs:[0x30]
mov rcx, qword [rax + 0x60]
mov rcx, qword [rcx + 0x110]
call qword [sym.imp.ntdll.dll_RtlLeaveCriticalSection]
test rbx, rbx
je 0x1400f9bbf
mov rcx, rbx
call sym.ProcessHacker.exe_PhGetFileName
lea rcx, [rbx - 0x10]
mov rdi, rax
mov ebx, 0xffffffff
mov eax, ebx
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x1400f9c79
call fcn.1400fbcc0
mov rcx, qword ds:[rdi + 8]
xor edx, edx
call sym.ProcessHacker.exe_PhGetFullPath
test rax, rax
je 0x1400f9caa
mov rcx, rdi
mov rdi, rax
test rcx, rcx
je 0x1400f9caa
add rcx, 0xfffffffffffffff0
lock xadd dword [rcx + 8], ebx
cmp ebx, 1
jne 0x1400f9caa
call fcn.1400fbcc0
test r14, r14
je 0x1400f9ce3
mov edx, 0x5c
xor r8d, r8d
mov rcx, rdi
call sym.ProcessHacker.exe_PhFindLastCharInStringRef
nop
cmp rax, 0xffffffffffffffff
je 0x1400f9cdd
inc rax
mov dword [r14], eax
mov rax, rdi
mov rbx, qword [rsp + 0x48]
add rsp, 0x20
pop r14
pop rdi
pop rbp
ret
mov rax, rbp
mov dword [r14], eax
mov rbx, qword [rsp + 0x48]
mov rax, rdi
add rsp, 0x20
pop r14
pop rdi
pop rbp
ret
Function at 0x1400f9d00
Capabilities:
Access peb ldr_data

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
mov qword [rsp + 8], rcx
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
mov rdi, rcx
call sym.ProcessHacker.exe_PhCountStringZ
mov rdx, qword gs:[0x30]
mov r15, rax
add r15, r15
mov rcx, qword [rdx + 0x60]
mov rcx, qword [rcx + 0x110]
call qword [sym.imp.ntdll.dll_RtlEnterCriticalSection]
mov rdx, qword gs:[0x30]
xor ebx, ebx
mov r8, qword [rdx + 0x60]
mov r13, qword [r8 + 0x18]
add r13, 0x10
mov r12, qword [r13]
cmp r12, r13
je 0x1400f9e72
nop dword [rax]
mov rbx, qword [r12 + 0x60]
movzx eax, word ds:[r12 + 0x58]
cmp rax, r15
jb 0x1400f9eab
cmp byte [0x140244611], 1
mov r14, rdi
jb 0x1400f9df4
mov rsi, r15
shr rsi, 4
test rsi, rsi
je 0x1400f9dd6
nop word [rax + rax]
movdqu xmm1, xmmword [r14]
movdqu xmm0, xmmword [rbx]
pcmpeqd xmm1, xmm0
pmovmskb eax, xmm1
cmp eax, 0xffff
jne 0x1400f9de2
add rbx, 0x10
add r14, 0x10
sub rsi, 1
jne 0x1400f9db0
mov rsi, r15
shr rsi, 1
and esi, 7
jmp 0x1400f9e33
mov rax, r15
shl rsi, 4
and eax, 0xf
add rsi, rax
shr rsi, 1
jmp 0x1400f9e33
mov rcx, r15
shr rcx, 3
test rcx, rcx
je 0x1400f9e2a
nop word [rax + rax]
mov rax, qword [r14]
cmp qword [rbx], rax
jne 0x1400f9e97
add rbx, 8
add r14, 8
sub rcx, 1
jne 0x1400f9e10
mov rsi, r15
shr rsi, 1
and esi, 3
test rsi, rsi
je 0x1400f9e6f
sub r14, rbx
nop dword [rax + rax]
movzx ecx, word [rbx]
movzx ebp, word [r14 + rbx]
cmp cx, bp
je 0x1400f9e65
call qword [sym.imp.ntdll.dll_RtlUpcaseUnicodeChar]
movzx ecx, bp
movzx edi, ax
call qword [sym.imp.ntdll.dll_RtlUpcaseUnicodeChar]
nop
cmp di, ax
jne 0x1400f9ea6
add rbx, 2
sub rsi, 1
jne 0x1400f9e40
mov rbx, r12
mov rcx, qword gs:[0x30]
mov rcx, qword [rcx + 0x60]
mov rcx, qword [rcx + 0x110]
call qword [sym.imp.ntdll.dll_RtlLeaveCriticalSection]
test rbx, rbx
je 0x1400f9ed2
mov rax, qword [rbx + 0x30]
jmp 0x1400f9ed4
mov rax, r15
and eax, 7
lea rsi, [rax + rcx*8]
shr rsi, 1
jmp 0x1400f9e33
mov rdi, qword [rsp + 0x50]
mov r12, qword [r12]
cmp r12, r13
jne 0x1400f9d70
mov rax, qword gs:[0x30]
mov rcx, qword [rax + 0x60]
mov rcx, qword [rcx + 0x110]
call qword [sym.imp.ntdll.dll_RtlLeaveCriticalSection]
xor eax, eax
mov rbx, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x1400f9f00
Capabilities:
Access peb ldr_data

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
mov qword [rsp + 8], rcx
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
mov rdi, rcx
call sym.ProcessHacker.exe_PhCountStringZ
mov rdx, qword gs:[0x30]
mov r15, rax
add r15, r15
mov rcx, qword [rdx + 0x60]
mov rcx, qword [rcx + 0x110]
call qword [sym.imp.ntdll.dll_RtlEnterCriticalSection]
mov rdx, qword gs:[0x30]
xor ebx, ebx
mov r8, qword [rdx + 0x60]
mov r13, qword [r8 + 0x18]
add r13, 0x10
mov r12, qword [r13]
cmp r12, r13
je 0x1400fa069
nop dword [rax]
movzx eax, word ds:[r12 + 0x48]
mov rbx, qword [r12 + 0x50]
cmp rax, r15
jb 0x1400fa0aa
cmp byte [0x140244611], 1
mov rsi, rdi
mov rcx, r15
jb 0x1400f9ff4
shr rcx, 4
test rcx, rcx
je 0x1400f9fd5
nop word [rax + rax]
movdqu xmm1, xmmword [rsi]
movdqu xmm0, xmmword [rbx]
pcmpeqd xmm1, xmm0
pmovmskb eax, xmm1
cmp eax, 0xffff
jne 0x1400f9fe2
add rbx, 0x10
add rsi, 0x10
sub rcx, 1
jne 0x1400f9fb0
mov rbp, r15
shr rbp, 1
and ebp, 7
jmp 0x1400fa023
mov rbp, r15
shl rcx, 4
and ebp, 0xf
add rbp, rcx
shr rbp, 1
jmp 0x1400fa023
shr rcx, 3
test rcx, rcx
je 0x1400fa01a
nop dword [rax]
mov rax, qword [rsi]
cmp qword [rbx], rax
jne 0x1400fa091
add rbx, 8
add rsi, 8
sub rcx, 1
jne 0x1400fa000
mov rbp, r15
shr rbp, 1
and ebp, 3
test rbp, rbp
je 0x1400fa066
sub rsi, rbx
nop dword [rax + rax]
movzx ecx, word [rbx]
movzx r14d, word [rsi + rbx]
cmp cx, r14w
je 0x1400fa058
nop
call qword [sym.imp.ntdll.dll_RtlUpcaseUnicodeChar]
movzx ecx, r14w
movzx edi, ax
call qword [sym.imp.ntdll.dll_RtlUpcaseUnicodeChar]
cmp di, ax
jne 0x1400fa0a5
add rbx, 2
sub rbp, 1
jne 0x1400fa030
mov rbx, r12
mov rcx, qword gs:[0x30]
mov rcx, qword [rcx + 0x60]
mov rcx, qword [rcx + 0x110]
call qword [sym.imp.ntdll.dll_RtlLeaveCriticalSection]
test rbx, rbx
je 0x1400fa0d1
mov rax, qword [rbx + 0x30]
jmp 0x1400fa0d3
mov rax, r15
and eax, 7
lea rbp, [rax + rcx*8]
shr rbp, 1
jmp 0x1400fa023
mov rdi, qword [rsp + 0x50]
mov r12, qword [r12]
cmp r12, r13
jne 0x1400f9f70
mov rax, qword gs:[0x30]
mov rcx, qword [rax + 0x60]
mov rcx, qword [rcx + 0x110]
call qword [sym.imp.ntdll.dll_RtlLeaveCriticalSection]
xor eax, eax
mov rbx, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
ret

Function at 0x1400fa100
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x38
mov eax, 0x5a4d
movzx r10d, r8w
mov r11, rdx
cmp word [rcx], ax
jne 0x1400fa161
mov r9d, dword ds:[rcx + 0x3c]
lea eax, [r9 - 1]
cmp eax, 0x7ffffffd
ja 0x1400fa161
cmp dword [r9 + rcx], 0x4550
jne 0x1400fa161
lea rdx, ds:[rcx + 0x88]
add rdx, r9
mov eax, dword [rdx]
test eax, eax
je 0x1400fa161
cmp dword [rdx + 4], 0
je 0x1400fa161
lea r8, [rcx + rax]
mov word [rsp + 0x20], r10w
mov r9, r11
call fcn.1400fa1a0
add rsp, 0x38
ret
xor eax, eax
add rsp, 0x38
ret
Function at 0x1400fae80
Capabilities:
Read file on windows

Disassembly:
push rbx
push rdi
push r13
push r14
mov eax, 0x1078
call fcn.1401a8120
sub rsp, rax
mov rax, qword [0x140237008]
xor rax, rsp
mov qword [rsp + 0x1060], rax
mov qword [rsp + 0x10b0], rsi
movzx r13d, dl
mov qword [rsp + 0x10b8], r12
xor r14d, r14d
mov r12, rcx
mov qword [rsp + 0x1070], r15
mov rcx, qword [0x140241998]
mov esi, 0x1000
mov r8d, esi
lea edx, [r14 + 4]
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov qword [rsp + 0x40], r14
xor r9d, r9d
mov rbx, rax
mov qword [rsp + 0x38], r14
lea rax, [rsp + 0x60]
mov dword [rsp + 0x30], esi
mov qword [rsp + 0x28], rax
xor r8d, r8d
lea rax, [rsp + 0x50]
xor edx, edx
mov rcx, r12
mov qword [rsp + 0x20], rax
mov r15d, r14d
call qword [sym.imp.ntdll.dll_NtReadFile]
nop
test eax, eax
js 0x1400fafba
lfence
mov qword [rsp + 0x10a8], rbp
mov edi, dword [rsp + 0x58]
test edi, edi
je 0x1400fafb2
lea ebp, ds:[rdi + r15]
cmp esi, ebp
jae 0x1400faf61
mov rcx, qword [0x140241998]
add esi, esi
mov r9d, esi
mov r8, rbx
mov edx, 4
call qword [sym.imp.ntdll.dll_RtlReAllocateHeap]
mov rbx, rax
mov ecx, r15d
lea rdx, [rsp + 0x60]
add rcx, rbx
mov r8, rdi
call fcn.140188690
mov qword [rsp + 0x40], r14
lea rax, [rsp + 0x60]
mov qword [rsp + 0x38], r14
xor r9d, r9d
mov dword [rsp + 0x30], 0x1000
xor r8d, r8d
mov qword [rsp + 0x28], rax
xor edx, edx
lea rax, [rsp + 0x50]
mov rcx, r12
mov qword [rsp + 0x20], rax
mov r15d, ebp
call qword [sym.imp.ntdll.dll_NtReadFile]
test eax, eax
jns 0x1400faf33
mov rbp, qword [rsp + 0x10a8]
mov r12, qword [rsp + 0x10b8]
mov edi, r15d
mov eax, esi
lea rcx, [rdi + 1]
cmp rax, rcx
jae 0x1400fafef
lfence
mov rcx, qword [0x140241998]
lea r9d, [rsi + 1]
mov r8, rbx
mov edx, 4
call qword [sym.imp.ntdll.dll_RtlReAllocateHeap]
mov rbx, rax
mov rsi, qword [rsp + 0x10b0]
test r15d, r15d
mov r15, qword [rsp + 0x1070]
je 0x1400fb058
mov byte [rdi + rbx], r14b
lfence
test r13b, r13b
je 0x1400fb022
mov rdx, rdi
mov rcx, rbx
call sym.ProcessHacker.exe_PhConvertUtf8ToUtf16Ex
mov r14, rax
jmp 0x1400fb058
mov rdx, qword [0x1402418d8]
lea rcx, [rdi + 0x11]
call sym.ProcessHacker.exe_PhCreateObject
mov r14, rax
mov qword [rax], rdi
add rax, 0x10
mov qword [r14 + 8], rax
mov byte [rax + rdi], 0
test rbx, rbx
je 0x1400fb058
mov rcx, qword [r14 + 8]
mov r8, rdi
mov rdx, rbx
call fcn.140188690
mov rcx, qword [0x140241998]
mov r8, rbx
xor edx, edx
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
mov rax, r14
mov rcx, qword [rsp + 0x1060]
xor rcx, rsp
call fcn.1401848a0
add rsp, 0x1078
pop r14
pop r13
pop rdi
pop rbx
ret
Function at 0x1400fb1e0
Capabilities:
Parse pe header

Disassembly:
mov qword ss:[rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
mov eax, 0x5a4d
mov rdi, r9
mov rsi, r8
mov rbx, rdx
cmp word [rcx], ax
jne 0x1400fb2b9
mov r10d, dword [rcx + 0x3c]
lea eax, [r10 - 1]
cmp eax, 0x7ffffffd
ja 0x1400fb2b9
cmp dword [r10 + rcx], 0x4550
jne 0x1400fb2b9
lea rdx, [rcx + 0x88]
add rdx, r10
mov eax, dword [rdx]
test eax, eax
je 0x1400fb2b9
cmp dword ds:[rdx + 4], 0
je 0x1400fb2b9
lea r8, [rcx + rax]
xor eax, eax
lea r9, str.DllGetClassObject
mov word [rsp + 0x20], ax
call fcn.1400fa1a0
test rax, rax
je 0x1400fb2b9
lea r8, [rsp + 0x40]
mov rcx, rbx
lea rdx, [0x1401ad590]
call qword [case.0x1400f654f.0]
mov ebx, eax
test eax, eax
js 0x1400fb2a7
mov rcx, qword [rsp + 0x40]
mov r9, rdi
mov r8, rsi
xor edx, edx
mov rax, qword [rcx]
mov rax, qword [rax + 0x18]
call qword [case.0x1400f654f.0]
mov rcx, qword [rsp + 0x40]
mov ebx, eax
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [case.0x1400f654f.0]
mov eax, ebx
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
mov rbx, qword [rsp + 0x48]
mov eax, 0x8007007f
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
Function at 0x1400fb3c0
Capabilities:
Map section object

Disassembly:
push rbp
push rdi
sub rsp, 0xc8
movzx eax, word [rcx]
mov rdi, rdx
mov word [rsp + 0x68], ax
add ax, 2
cmp qword [rcx], 0xfffe
mov word [rsp + 0x6a], ax
mov rax, qword [rcx + 8]
mov qword [rsp + 0x70], rax
jbe 0x1400fb402
mov eax, 0xc0000106
lfence
add rsp, 0xc8
pop rdi
pop rbp
ret
xor ebp, ebp
mov dword [rsp + 0x88], 0x30
mov dword [rsp + 0x50], ebp
lea rax, [rsp + 0x68]
mov qword [rsp + 0x48], rbp
lea r9, [rsp + 0x78]
mov dword [rsp + 0x40], 0x60
lea r8, [rsp + 0x88]
mov dword [rsp + 0x38], 1
lea rcx, [rsp + 0xf8]
mov dword [rsp + 0x30], 5
xorps xmm0, xmm0
mov dword [rsp + 0x28], 0x80
mov edx, 0x100081
mov qword [rsp + 0x20], rbp
mov qword [rsp + 0x90], rbp
mov dword [rsp + 0xa0], 0x40
mov qword [rsp + 0x98], rax
movdqu xmmword [rsp + 0xa8], xmm0
call qword [sym.imp.ntdll.dll_NtCreateFile]
test eax, eax
js 0x1400fb3f5
cmp dword [0x140237d34], 0x3e
lea edx, ss:[rbp + 5]
mov qword [rsp + 0xe8], rbx
mov eax, 0x11000000
mov rbx, qword [rsp + 0xf8]
mov ecx, 0x1000000
cmovb eax, ecx
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], eax
lea rcx, [rsp + 0xe0]
xor r9d, r9d
mov dword [rsp + 0x20], 2
xor r8d, r8d
mov qword [rsp + 0xc0], rsi
call qword [sym.imp.ntdll.dll_NtCreateSection]
mov rcx, rbx
mov esi, eax
call qword [sym.imp.ntdll.dll_NtClose]
test esi, esi
jns 0x1400fb514
lfence
mov eax, esi
mov rbx, qword [rsp + 0xe8]
mov rsi, qword [rsp + 0xc0]
add rsp, 0xc8
pop rdi
pop rbp
ret
cmp dword [0x140237d34], 0x67
lea r8, [rsp + 0xf0]
mov rcx, qword [rsp + 0xe0]
mov eax, 0x40000
mov dword [rsp + 0x48], 2
cmovb eax, ebp
mov dword [rsp + 0x40], eax
xor r9d, r9d
mov dword [rsp + 0x38], 1
lea rax, [rsp + 0x60]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rbp
lea rdx, [r9 - 1]
mov qword [rsp + 0x20], rbp
mov qword [rsp + 0xf0], rbp
mov qword [rsp + 0x60], rbp
call qword [sym.imp.ntdll.dll_NtMapViewOfSection]
mov rcx, qword ds:[rsp + 0xe0]
mov ebx, eax
call qword [sym.imp.ntdll.dll_NtClose]
test ebx, ebx
js 0x1400fb59e
test rdi, rdi
je 0x1400fb59e
mov rax, qword [rsp + 0xf0]
or rax, 2
mov qword [rdi], rax
mov eax, ebx
jmp 0x1400fb4fa
Function at 0x1400fb5e0
Capabilities:
Parse pe header

Disassembly:
push rbx
sub rsp, 0x30
test byte [0x14023dfd0], 1
mov rbx, rdx
jne 0x1400fb69e
lock bts qword [0x14023dfd0], 0x1f
jae 0x1400fb61f
test byte [0x14023dfd0], 1
jne 0x1400fb69e
xor edx, edx
lea rcx, [0x14023dfd0]
call sym.ProcessHacker.exe_PhfWaitForEvent
jmp 0x1400fb69e
lea rcx, [0x1401db740]
call fcn.1400f9d00
mov r10, rax
test rax, rax
je 0x1400fb692
mov eax, 0x5a4d
cmp word [r10], ax
jne 0x1400fb689
mov eax, dword [r10 + 0x3c]
lea ecx, [rax - 1]
cmp ecx, 0x7ffffffd
ja 0x1400fb689
cmp dword [rax + r10], 0x4550
jne 0x1400fb689
lea rdx, [r10 + 0x88]
add rdx, rax
mov eax, dword [rdx]
test eax, eax
je 0x1400fb689
cmp dword [rdx + 4], 0
je 0x1400fb689
lea r8, [r10 + rax]
mov rcx, r10
xor eax, eax
lea r9, str.RtlDelayExecution
mov word [rsp + 0x20], ax
call fcn.1400fa1a0
jmp 0x1400fb68b
xor eax, eax
mov qword [0x140244808], rax
lea rcx, [0x14023dfd0]
call sym.ProcessHacker.exe_PhfSetEvent
mov rax, qword [0x140244808]
xor ecx, ecx
mov rdx, rbx
test rax, rax
je 0x1400fb6bb
add rsp, 0x30
pop rbx
jmp qword [case.0x1400f654f.0]
add rsp, 0x30
pop rbx
jmp qword [sym.imp.ntdll.dll_NtDelayExecution]

Function at 0x1400fbea0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rbx
sub rsp, 0x20
xor eax, eax
mov rbx, rcx
mov dword [rcx], eax
mov qword [rcx + 0x208], rax
mov qword [rcx + 0x210], rax
mov ecx, dword [0x140244804]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ecx, dword [0x140244804]
mov rdx, rbx
mov qword [rbx + 0x218], rax
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
nop dword [rax]
test eax, eax
jne 0x1400fbef0
mov ecx, 0xc0000001
call qword [sym.imp.ntdll.dll_RtlRaiseStatus]
int3
add rsp, 0x20
pop rbx
ret

Function at 0x1400fbf00
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
call sym.ProcessHacker.exe_PhDrainAutoPool
mov ecx, dword [0x140244804]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp rax, rbx
jne 0x1400fbf61
mov rdx, qword [rbx + 0x218]
mov ecx, dword [0x140244804]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
je 0x1400fbf61
mov r8, qword ds:[rbx + 0x210]
test r8, r8
je 0x1400fbf5a
mov rcx, qword [0x140241998]
xor edx, edx
add rsp, 0x20
pop rbx
jmp qword [sym.imp.ntdll.dll_RtlFreeHeap]
add rsp, 0x20
pop rbx
ret
mov ecx, 0xc0000001
call qword [sym.imp.ntdll.dll_RtlRaiseStatus]
int3