joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140006810
Capabilities:
Suspend thread

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x10]
sub rsp, 0x110
mov rdi, rdx
xor r15b, r15b
xor edx, edx
mov r12d, r8d
mov r13, rcx
mov sil, 1
mov r14d, edx
test r8d, r8d
je 0x140006a1f
mov qword [rsp + 0x150], rbx
nop dword [rax]
mov rax, qword [rdi]
lea r9, [rsp + 0x20]
mov qword [rsp + 0x20], rdx
lea r8, [rsp + 0x30]
mov qword [rsp + 0x38], rdx
xorps xmm0, xmm0
mov dword [rsp + 0x48], edx
mov rcx, qword [rax]
mov qword [rsp + 0x28], rcx
lea rcx, [rbp + 0x68]
mov qword [rsp + 0x40], rdx
mov edx, 2
mov dword [rsp + 0x30], 0x30
movdqu xmmword [rsp + 0x50], xmm0
call qword [sym.imp.ntdll.dll_NtOpenThread]
mov ebx, eax
cmp eax, 0xc0000022
jne 0x1400068bf
cmp byte [0x1402130ef], 0
je 0x1400068bf
lea r8, [rsp + 0x20]
mov edx, 2
lea rcx, [rbp + 0x68]
call fcn.140123820
mov ebx, eax
test ebx, ebx
js 0x1400068e3
mov rcx, qword [rbp + 0x68]
xor edx, edx
call qword [sym.imp.ntdll.dll_NtSuspendThread]
mov rcx, qword [rbp + 0x68]
mov ebx, eax
call qword [sym.imp.ntdll.dll_NtClose]
test ebx, ebx
jns 0x1400069eb
xor sil, sil
test r15b, r15b
jne 0x1400069bc
mov rax, qword [rdi]
lea rcx, str.Unable_to_suspend_thread__lu
mov edx, dword [rax]
call fcn.140001770
lea r9, ds:[rbp + 0x60]
mov r8d, ebx
mov rcx, r13
mov rdx, qword [rax + 8]
call fcn.140001910
test al, al
je 0x1400069bc
cmp byte [rbp + 0x60], sil
je 0x1400069b7
mov rcx, qword [0x1402185c0]
nop
test rcx, rcx
jne 0x14000696e
mov ebx, 0xc0000037
mov rax, qword ds:[rdi]
lea rdx, str.suspend
lea rcx, str.Unable_to__s_thread__lu
mov r8d, dword [rax]
call fcn.140001770
xor r9d, r9d
mov r8d, ebx
mov rcx, r13
mov rdx, qword [rax + 8]
call sym.ProcessHacker.exe_PhShowContinueStatus
call sym.ProcessHacker.exe_PhUiDisconnectFromPhSvc
jmp 0x1400069eb
mov rax, qword [rdi]
lea r8, [rsp + 0x60]
mov dword [rbp - 0x78], 0xa
mov qword [rbp - 0x68], 2
mov qword [rsp + 0x60], 0xb00088
mov rdx, qword [rax]
mov qword [rbp - 0x70], rdx
lea rdx, [rsp + 0x60]
call qword [sym.imp.ntdll.dll_NtRequestWaitReplyPort]
mov ebx, eax
test eax, eax
js 0x14000693a
mov ebx, dword [rbp - 0x74]
test ebx, ebx
js 0x14000693a
mov sil, 1
call sym.ProcessHacker.exe_PhUiDisconnectFromPhSvc
jmp 0x1400069eb
mov r15b, 1
jmp 0x1400069eb
mov rax, qword [rdi]
lea rdx, str.suspend
lea rcx, str.Unable_to__s_thread__lu
mov r8d, dword [rax]
call fcn.140001770
xor r9d, r9d
mov r8d, ebx
mov rcx, r13
mov rdx, qword [rax + 8]
call sym.ProcessHacker.exe_PhShowContinueStatus
test al, al
je 0x140006a00
inc r14d
add rdi, 8
mov edx, 0
cmp r14d, r12d
jb 0x140006850
mov rbx, qword [rsp + 0x150]
movzx eax, sil
add rsp, 0x110
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
movzx eax, sil
jmp 0x140006a0c
Function at 0x140006a30
Capabilities:
Resume thread

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x10]
sub rsp, 0x110
mov rdi, rdx
xor r15b, r15b
xor edx, edx
mov r12d, r8d
mov r13, rcx
mov sil, 1
mov r14d, edx
test r8d, r8d
je 0x140006c3f
mov qword [rsp + 0x150], rbx
nop dword [rax]
mov rax, qword [rdi]
lea r9, [rsp + 0x20]
mov qword [rsp + 0x20], rdx
lea r8, [rsp + 0x30]
mov qword [rsp + 0x38], rdx
xorps xmm0, xmm0
mov dword [rsp + 0x48], edx
mov rcx, qword [rax]
mov qword [rsp + 0x28], rcx
lea rcx, [rbp + 0x68]
mov qword [rsp + 0x40], rdx
mov edx, 2
mov dword [rsp + 0x30], 0x30
movdqu xmmword [rsp + 0x50], xmm0
call qword [sym.imp.ntdll.dll_NtOpenThread]
mov ebx, eax
cmp eax, 0xc0000022
jne 0x140006adf
cmp byte [0x1402130ef], 0
je 0x140006adf
lea r8, [rsp + 0x20]
mov edx, 2
lea rcx, [rbp + 0x68]
call fcn.140123820
mov ebx, eax
test ebx, ebx
js 0x140006b03
mov rcx, qword [rbp + 0x68]
xor edx, edx
call qword [sym.imp.ntdll.dll_NtResumeThread]
mov rcx, qword [rbp + 0x68]
mov ebx, eax
call qword [sym.imp.ntdll.dll_NtClose]
test ebx, ebx
jns 0x140006c0b
xor sil, sil
test r15b, r15b
jne 0x140006bdc
mov rax, qword [rdi]
lea rcx, str.Unable_to_resume_thread__lu
mov edx, dword [rax]
call fcn.140001770
lea r9, ds:[rbp + 0x60]
mov r8d, ebx
mov rcx, r13
mov rdx, qword [rax + 8]
call fcn.140001910
test al, al
je 0x140006bdc
cmp byte [rbp + 0x60], sil
je 0x140006bd7
mov rcx, qword [0x1402185c0]
nop
test rcx, rcx
jne 0x140006b8e
mov ebx, 0xc0000037
mov rax, qword ds:[rdi]
lea rdx, str.resume
lea rcx, str.Unable_to__s_thread__lu
mov r8d, dword [rax]
call fcn.140001770
xor r9d, r9d
mov r8d, ebx
mov rcx, r13
mov rdx, qword [rax + 8]
call sym.ProcessHacker.exe_PhShowContinueStatus
call sym.ProcessHacker.exe_PhUiDisconnectFromPhSvc
jmp 0x140006c0b
mov rax, qword [rdi]
lea r8, [rsp + 0x60]
mov dword [rbp - 0x78], 0xa
mov qword [rbp - 0x68], 3
mov qword [rsp + 0x60], 0xb00088
mov rdx, qword [rax]
mov qword [rbp - 0x70], rdx
lea rdx, [rsp + 0x60]
call qword [sym.imp.ntdll.dll_NtRequestWaitReplyPort]
mov ebx, eax
test eax, eax
js 0x140006b5a
mov ebx, dword [rbp - 0x74]
test ebx, ebx
js 0x140006b5a
mov sil, 1
call sym.ProcessHacker.exe_PhUiDisconnectFromPhSvc
jmp 0x140006c0b
mov r15b, 1
jmp 0x140006c0b
mov rax, qword [rdi]
lea rdx, str.resume
lea rcx, str.Unable_to__s_thread__lu
mov r8d, dword [rax]
call fcn.140001770
xor r9d, r9d
mov r8d, ebx
mov rcx, r13
mov rdx, qword [rax + 8]
call sym.ProcessHacker.exe_PhShowContinueStatus
test al, al
je 0x140006c20
inc r14d
add rdi, 8
mov edx, 0
cmp r14d, r12d
jb 0x140006a70
mov rbx, qword [rsp + 0x150]
movzx eax, sil
add rsp, 0x110
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
movzx eax, sil
jmp 0x140006c2c
Function at 0x14000d3c0
Capabilities:
Log keystrokes via polling

Disassembly:
push rdi
sub rsp, 0x20
mov rdi, rdx
cmp qword [rcx], rdx
jne 0x14000d439
cmp dword [rcx + 0x10], 0xffffff65
jne 0x14000d439
movzx eax, word ds:[rcx + 0x18]
cmp ax, 0x41
je 0x14000d439
cmp ax, 0x43
jne 0x14000d439
mov ecx, 0x11
call qword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jns 0x14000d439
mov rcx, rdi
mov qword [rsp + 0x38], rbx
call fcn.14012f280
mov rdx, rax
mov rcx, rdi
mov rbx, rax
call sym.ProcessHacker.exe_PhSetClipboardString
lea rcx, [rbx - 0x10]
mov eax, 0xffffffff
lock xadd dword [rcx + 8], eax
mov rbx, qword [rsp + 0x38]
cmp eax, 1
jne 0x14000d439
add rsp, 0x20
pop rdi
jmp fcn.140106290
add rsp, 0x20
pop rdi
ret

Function at 0x14000d440
Capabilities:
Log keystrokes via polling

Disassembly:
push rdi
sub rsp, 0x20
mov rdi, rdx
cmp qword [rcx], rdx
jne 0x14000d4f3
cmp dword [rcx + 0x10], 0xffffff65
jne 0x14000d4f3
movzx eax, word [rcx + 0x18]
cmp ax, 0x41
je 0x14000d4c8
cmp ax, 0x43
jne 0x14000d4f3
test r8b, 1
je 0x14000d4f3
mov ecx, 0x11
call qword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jns 0x14000d4f3
mov rcx, rdi
mov qword [rsp + 0x38], rbx
call fcn.14012f280
mov rdx, rax
mov rcx, rdi
mov rbx, rax
call sym.ProcessHacker.exe_PhSetClipboardString
lea rcx, [rbx - 0x10]
mov eax, 0xffffffff
lock xadd dword [rcx + 8], eax
mov rbx, qword [rsp + 0x38]
cmp eax, 1
jne 0x14000d4f3
add rsp, 0x20
pop rdi
jmp fcn.140106290
test r8b, 2
je 0x14000d4f3
mov ecx, 0x11
call qword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jns 0x14000d4f3
mov edx, 2
mov rcx, rdi
mov r8d, edx
add rsp, 0x20
pop rdi
jmp sym.ProcessHacker.exe_PhSetStateAllListViewItems
add rsp, 0x20
pop rdi
ret
Function at 0x1400156a0
Capabilities:
Get graphical window text

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x510
mov rax, qword [0x14020a008]
xor rax, rsp
mov qword [rsp + 0x500], rax
mov rbx, rcx
mov dword [rsp + 0x24], edx
xor ecx, ecx
mov dword [rsp + 0x84], r8d
lea rax, [rsp + 0xe0]
mov dword [rsp + 0x28], ecx
mov qword [rsp + 0x38], rax
lea r9, [rsp + 0x20]
mov dword [rsp + 0x88], ecx
lea rax, [rsp + 0x2f0]
mov esi, r8d
mov qword [rsp + 0x98], rax
mov edi, edx
mov dword [rsp + 0x20], 0xd
mov rcx, rbx
mov dword [rsp + 0x30], 0xffffffff
xor r8d, r8d
mov dword [rsp + 0x40], 0x208
mov edx, 0x104b
mov dword [rsp + 0x80], 0xd
mov dword [rsp + 0x90], 0xffffffff
mov dword [rsp + 0xa0], 0x208
call qword [sym.imp.USER32.dll_SendMessageW]
test eax, eax
je 0x1400157a6
lea r9, [rsp + 0x80]
xor r8d, r8d
mov edx, 0x104b
mov rcx, rbx
call qword [sym.imp.USER32.dll_SendMessageW]
test eax, eax
je 0x1400157a6
lea r9, [rsp + 0x20]
mov dword [rsp + 0x24], esi
xor r8d, r8d
mov dword [rsp + 0x84], edi
mov edx, 0x104c
mov rcx, rbx
call qword [sym.imp.USER32.dll_SendMessageW]
lea r9, ds:[rsp + 0x80]
xor r8d, r8d
mov edx, 0x104c
mov rcx, rbx
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, qword [rsp + 0x500]
xor rcx, rsp
call fcn.140161390
add rsp, 0x510
pop rdi
pop rsi
pop rbx
ret
Function at 0x140069b90
Capabilities:
Delete registry value
Persist via run registry key
Set registry value

Disassembly:
mov r11, rsp
push rbx
push rsi
sub rsp, 0x88
cmp byte [0x14021467c], cl
movzx esi, dl
movzx ebx, cl
je 0x140069da6
mov r8, qword [0x14020e018]
mov word ds:[r11 - 0x68], r8w
lea eax, [r8 + 2]
mov word [rsp + 0x32], ax
mov rax, qword [str.SoftwareMicrosoftWindowsCurrentVersionRun]
mov qword [r11 - 0x60], rax
cmp r8, 0xfffe
ja 0x140069da6
xor r8d, r8d
lea rax, [r11 + 0x20]
lea r9, [r11 - 0x48]
mov qword [r11 - 0x78], rax
lea rdx, [r11 - 0x68]
lea rcx, [r8 - 9]
call fcn.140120390
test eax, eax
js 0x140069da6
lea r8, [rsp + 0x50]
mov qword [rsp + 0x80], rdi
mov edx, 0x20006
lea rcx, [rsp + 0xb0]
call qword [sym.imp.ntdll.dll_NtOpenKey]
mov rcx, qword ds:[rsp + 0xb8]
mov edi, eax
test rcx, rcx
je 0x140069c3b
call qword [sym.imp.ntdll.dll_NtClose]
test edi, edi
mov rdi, qword [rsp + 0x80]
js 0x140069da6
nop dword [rax + rax]
test bl, bl
je 0x140069d5c
xor ecx, ecx
xor eax, eax
lock cmpxchg qword [0x1402169a0], rcx
mov rbx, rax
je 0x140069c72
lock inc dword ds:[rax - 8]
jmp 0x140069c9f
mov rcx, qword [sym.ProcessHacker.exe_PhInstanceHandle]
xor edx, edx
call sym.ProcessHacker.exe_PhGetDllFileName
mov rbx, rax
xor eax, eax
lock cmpxchg qword [0x1402169a0], rbx
jne 0x140069c96
lock inc dword [rbx - 8]
test rbx, rbx
je 0x140069d98
mov r8, qword [rbx + 8]
lea r9, [0x1401b4408]
lea rdx, [0x1401b4408]
mov ecx, 3
call sym.ProcessHacker.exe_PhConcatStrings
mov rcx, rax
call sym.ProcessHacker.exe_PhAutoDereferenceObject
test sil, sil
je 0x140069ce0
mov rcx, qword [rax + 8]
lea rdx, str.__hide
call sym.ProcessHacker.exe_PhConcatStrings2
mov rcx, rax
call sym.ProcessHacker.exe_PhAutoDereferenceObject
mov rcx, qword [0x14020e028]
mov edx, dword ds:[rax]
mov r8, qword [rax + 8]
add edx, 2
mov word [rsp + 0x40], cx
lea eax, [rcx + 2]
mov word [rsp + 0x42], ax
mov rax, qword [str.Process_Hacker]
mov qword [rsp + 0x48], rax
cmp rcx, 0xfffe
ja 0x140069d3e
mov rcx, qword [rsp + 0xb0]
mov r9d, 1
mov dword [rsp + 0x28], edx
lea rdx, [rsp + 0x40]
mov qword [rsp + 0x20], r8
xor r8d, r8d
call qword [sym.imp.ntdll.dll_NtSetValueKey]
lea rcx, ds:[rbx - 0x10]
mov eax, 0xffffffff
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x140069d98
call fcn.140106290
jmp 0x140069d98
mov rcx, qword [0x14020e028]
mov word [rsp + 0x30], cx
lea eax, [rcx + 2]
mov word [rsp + 0x32], ax
mov rax, qword [str.Process_Hacker]
mov qword [rsp + 0x38], rax
cmp rcx, 0xfffe
ja 0x140069d98
mov rcx, qword [rsp + 0xb0]
lea rdx, [rsp + 0x30]
call qword [sym.imp.ntdll.dll_NtDeleteValueKey]
mov rcx, qword [rsp + 0xb0]
call qword [sym.imp.ntdll.dll_NtClose]
add rsp, 0x88
pop rsi
pop rbx
nop
ret
Function at 0x1400938a0
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push r14
sub rsp, 0x20
cmp dword ds:[rcx + 4], 0
mov r14, r8
mov rsi, rcx
je 0x140093927
mov ecx, dword [0x1402185b0]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, dword [rsi + 4]
mov r8d, dword [rsi]
mov rcx, qword [rax]
mov rdx, qword [rcx + 0x38]
add rdi, rdx
lea rax, [r8 + rdi]
cmp rax, rdi
jb 0x14009392b
cmp rdi, rdx
jb 0x14009392b
cmp rax, qword [rcx + 0x40]
ja 0x14009392b
test rdi, rdi
je 0x14009392b
mov rcx, qword [0x140213cd0]
xor edx, edx
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov rbx, rax
test rax, rax
jne 0x140093915
mov eax, 0xc0000017
jmp 0x140093939
mov r8d, dword ds:[rsi]
mov rdx, rdi
mov rcx, rax
call fcn.140165120
jmp 0x140093934
test dl, dl
jne 0x140093932
mov eax, 0xc0000005
jmp 0x140093939
xor ebx, ebx
mov qword [r14], rbx
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x40]
add rsp, 0x20
pop r14
ret

Function at 0x140093950
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 0x18], rdi
push r14
sub rsp, 0x20
mov eax, dword [rcx]
mov r14, r8
mov rdi, rcx
test al, 1
jne 0x140093a41
nop dword [rax + rax]
cmp eax, 0xfffe
ja 0x140093a41
cmp dword [rcx + 4], 0
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x38], rsi
je 0x140093a17
mov ecx, dword [0x1402185b0]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebx, dword ds:[rdi + 4]
mov esi, dword [rdi]
mov rcx, qword [rax]
mov rdx, qword [rcx + 0x38]
add rbx, rdx
lea rax, [rsi + rbx]
cmp rax, rbx
jb 0x140093a1b
cmp rbx, rdx
jb 0x140093a1b
cmp rax, qword [rcx + 0x40]
ja 0x140093a1b
test bl, 1
jne 0x140093a1b
test rbx, rbx
je 0x140093a1b
test esi, esi
je 0x140093a08
mov rdx, qword [0x140213b58]
lea rcx, [rsi + 0x12]
call sym.ProcessHacker.exe_PhCreateObject
mov rdi, rax
xor ecx, ecx
mov r8d, esi
mov rdx, rbx
mov qword [rax], rsi
add rax, 0x10
mov qword [rdi + 8], rax
mov word [rax + rsi], cx
mov rcx, qword [rdi + 8]
call fcn.140165120
xor eax, eax
mov qword [r14], rdi
jmp 0x140093a20
call sym.ProcessHacker.exe_PhReferenceEmptyString
mov rdi, rax
mov qword [r14], rax
xor eax, eax
jmp 0x140093a20
test dl, dl
jne 0x140093a36
mov eax, 0xc0000005
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x40]
add rsp, 0x20
pop r14
ret
xor ecx, ecx
mov edi, ecx
mov qword [r14], rcx
xor eax, eax
jmp 0x140093a20
mov rdi, qword [rsp + 0x40]
mov eax, 0xc0000206
add rsp, 0x20
pop r14
ret
Function at 0x1400a1c10
Capabilities:
Get system information on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x20
movsx r8d, byte [0x140213ba8]
xor r9d, r9d
mov rdx, qword [0x140213a90]
mov r14, rcx
shl r8d, 3
lea ecx, [r9 + 0x53]
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
movsx ebp, byte [0x140213ba8]
xor ebx, ebx
mov rdx, qword [0x140213a90]
mov edi, ebx
mov r10d, ebx
lea esi, [rbx + 2]
cmp ebp, 4
jb 0x1400a1cd5
mov r9d, ebp
xorps xmm2, xmm2
and r9d, 0xfffffffc
xorps xmm1, xmm1
mov r8d, esi
nop word [rax + rax]
mov eax, r10d
add r10d, 4
movq xmm0, qword [rdx + rax*8]
lea eax, [r8 - 1]
movhpd xmm0, qword [rdx + rax*8]
mov eax, r8d
paddq xmm0, xmm2
movdqa xmm2, xmm0
movq xmm0, qword [rdx + rax*8]
lea eax, [r8 + 1]
movhpd xmm0, qword [rdx + rax*8]
add r8d, 4
paddq xmm0, xmm1
movdqa xmm1, xmm0
cmp r10d, r9d
jb 0x1400a1c80
paddq xmm1, xmm2
movdqa xmm0, xmm1
psrldq xmm0, 8
paddq xmm1, xmm0
movq rdi, xmm1
mov r8, rbx
mov r9, rbx
cmp r10d, ebp
jae 0x1400a1d25
mov eax, ebp
mov ecx, r10d
sub eax, r10d
cmp eax, esi
jb 0x1400a1d1a
mov eax, ebp
sub eax, r10d
sub eax, esi
shr eax, 1
inc eax
mov r11d, eax
lea eax, [r10 + rax*2]
nop
add r8, qword ds:[rdx + rcx*8]
add r9, qword [rdx + rcx*8 + 8]
add rcx, rsi
sub r11, 1
jne 0x1400a1d00
cmp eax, ebp
jae 0x1400a1d1e
add rdi, qword [rdx + rcx*8]
lea rax, [r9 + r8]
add rdi, rax
mov rdx, qword [0x140213aa0]
lea r8d, [rbp*8]
xor r9d, r9d
mov rax, rdi
sub rax, qword [0x140218250]
mov qword [0x140218258], rax
mov qword [0x140218250], rdi
lea ecx, [r9 + 0x6c]
mov qword [r14], rax
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
movsx edi, byte [0x140213ba8]
mov r11, rbx
mov rdx, qword [0x140213aa0]
mov r8d, ebx
cmp edi, 4
jb 0x1400a1de1
mov r9d, edi
xorps xmm2, xmm2
and r9d, 0xfffffffc
xorps xmm1, xmm1
nop dword [rax]
nop word [rax + rax]
mov eax, r8d
add r8d, 4
movq xmm0, qword [rdx + rax*8]
lea eax, [rsi - 1]
movhpd xmm0, qword [rdx + rax*8]
mov eax, esi
paddq xmm0, xmm2
movdqa xmm2, xmm0
movq xmm0, qword [rdx + rax*8]
lea eax, [rsi + 1]
movhpd xmm0, qword [rdx + rax*8]
add esi, 4
paddq xmm0, xmm1
movdqa xmm1, xmm0
cmp r8d, r9d
jb 0x1400a1d90
paddq xmm1, xmm2
movdqa xmm0, xmm1
psrldq xmm0, 8
paddq xmm1, xmm0
movq r11, xmm1
mov r9, rbx
cmp r8d, edi
jae 0x1400a1e32
mov eax, edi
mov ecx, r8d
sub eax, r8d
cmp eax, 2
jb 0x1400a1e27
mov eax, edi
sub eax, r8d
sub eax, 2
shr eax, 1
inc eax
mov r10d, eax
lea eax, [r8 + rax*2]
nop dword [rax]
add rbx, qword [rdx + rcx*8]
add r9, qword [rdx + rcx*8 + 8]
add rcx, 2
sub r10, 1
jne 0x1400a1e10
cmp eax, edi
jae 0x1400a1e2b
add r11, qword [rdx + rcx*8]
lea rax, [r9 + rbx]
add r11, rax
mov rbx, qword [rsp + 0x30]
mov rax, r11
sub rax, qword [0x140218260]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
mov qword [0x140218268], rax
mov qword [0x140218260], r11
add rsp, 0x20
pop r14
ret
Function at 0x1400c7840
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x38
test byte [0x14020e318], 1
jne 0x1400c79bf
lock bts qword [0x14020e318], 0x1f
jae 0x1400c7888
test byte [0x14020e318], 1
jne 0x1400c79bf
xor edx, edx
lea rcx, [0x14020e318]
call sym.ProcessHacker.exe_PhfWaitForEvent
cmp qword [0x140215a90], 0
setne al
add rsp, 0x38
ret
lea rcx, str.netapi32.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov qword [0x140215a90], rax
mov rdx, rax
test rax, rax
je 0x1400c79b3
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x30], rdi
mov edi, 0x5a4d
cmp word [rax], di
jne 0x1400c7917
mov eax, dword [rax + 0x3c]
lea ecx, [rax - 1]
cmp ecx, 0xffffffe
ja 0x1400c7917
cmp dword [rax + rdx], 0x4550
jne 0x1400c7917
lea r8, [rax + 0x88]
add r8, rdx
mov eax, dword [r8]
test eax, eax
je 0x1400c7917
cmp dword [r8 + 4], 0
je 0x1400c7917
lea r9, [rdx + rax]
xor ebx, ebx
lea rax, str.NetUserEnum
mov word [rsp + 0x28], bx
mov rcx, rdx
mov qword [rsp + 0x20], rax
call fcn.140104bd0
mov rdx, qword [0x140215a90]
mov rcx, rax
jmp 0x1400c791b
xor ebx, ebx
mov ecx, ebx
cmp word [rdx], di
mov rdi, qword [rsp + 0x30]
mov qword [0x140215b08], rcx
jne 0x1400c798a
mov r8d, dword [rdx + 0x3c]
lea eax, [r8 - 1]
cmp eax, 0xffffffe
ja 0x1400c798a
cmp dword [r8 + rdx], 0x4550
jne 0x1400c798a
add r8, 0x88
add r8, rdx
mov eax, dword [r8]
test eax, eax
je 0x1400c798a
cmp dword [r8 + 4], 0
je 0x1400c798a
lea r9, [rdx + rax]
mov word [rsp + 0x28], bx
lea rax, str.NetApiBufferFree
mov rcx, rdx
mov qword [rsp + 0x20], rax
call fcn.140104bd0
mov rdx, qword [0x140215a90]
mov rcx, qword [0x140215b08]
jmp 0x1400c798d
mov rax, rbx
mov qword [0x140215a78], rax
test rcx, rcx
je 0x1400c799e
test rax, rax
jne 0x1400c79ae
mov rcx, rdx
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov qword [0x140215a90], rbx
mov rbx, qword [rsp + 0x40]
lea rcx, [0x14020e318]
call sym.ProcessHacker.exe_PhfSetEvent
cmp qword [0x140215a90], 0
setne al
add rsp, 0x38
ret
Function at 0x1400c79d0
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x38
test byte [0x14020e3e0], 1
jne 0x1400c7c36
lock bts qword [0x14020e3e0], 0x1f
jae 0x1400c7a18
test byte [0x14020e3e0], 1
jne 0x1400c7c36
xor edx, edx
lea rcx, [0x14020e3e0]
call sym.ProcessHacker.exe_PhfWaitForEvent
cmp qword [0x140215af8], 0
setne al
add rsp, 0x38
ret
lea rcx, str.comctl32.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov qword [0x140215af8], rax
mov rdx, rax
test rax, rax
je 0x1400c7c2a
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x30], rdi
mov edi, 0x5a4d
cmp word [rax], di
jne 0x1400c7aa4
mov eax, dword [rax + 0x3c]
lea ecx, [rax - 1]
cmp ecx, 0xffffffe
ja 0x1400c7aa4
cmp dword [rax + rdx], 0x4550
jne 0x1400c7aa4
lea r8, [rax + 0x88]
add r8, rdx
mov eax, dword [r8]
test eax, eax
je 0x1400c7aa4
cmp dword [r8 + 4], 0
je 0x1400c7aa4
lea r9, [rdx + rax]
xor ebx, ebx
lea rax, str.CreateMRUListW
mov word [rsp + 0x28], bx
mov rcx, rdx
mov qword [rsp + 0x20], rax
call fcn.140104bd0
mov rdx, qword [0x140215af8]
jmp 0x1400c7aa8
xor ebx, ebx
mov eax, ebx
mov qword [0x140215b00], rax
nop
cmp word [rdx], di
jne 0x1400c7b09
mov ecx, dword [rdx + 0x3c]
lea eax, [rcx - 1]
cmp eax, 0xffffffe
ja 0x1400c7b09
cmp dword [rcx + rdx], 0x4550
jne 0x1400c7b09
lea r8, [rdx + 0x88]
add r8, rcx
mov eax, dword [r8]
test eax, eax
je 0x1400c7b09
cmp dword [r8 + 4], 0
je 0x1400c7b09
lea r9, [rdx + rax]
mov word [rsp + 0x28], bx
lea rax, str.AddMRUStringW
mov rcx, rdx
mov qword [rsp + 0x20], rax
call fcn.140104bd0
mov rdx, qword [0x140215af8]
jmp 0x1400c7b0c
mov rax, rbx
mov qword [0x140215b10], rax
cmp word [rdx], di
jne 0x1400c7b6f
mov ecx, dword [rdx + 0x3c]
lea eax, [rcx - 1]
cmp eax, 0xffffffe
ja 0x1400c7b6f
cmp dword [rcx + rdx], 0x4550
jne 0x1400c7b6f
lea r8, [rdx + 0x88]
add r8, rcx
mov eax, dword [r8]
test eax, eax
je 0x1400c7b6f
cmp dword [r8 + 4], 0
je 0x1400c7b6f
lea r9, [rdx + rax]
mov word [rsp + 0x28], bx
lea rax, str.EnumMRUListW
mov rcx, rdx
mov qword [rsp + 0x20], rax
call fcn.140104bd0
mov rdx, qword [0x140215af8]
mov rcx, rax
jmp 0x1400c7b72
mov rcx, rbx
cmp word [rdx], di
mov rdi, qword [rsp + 0x30]
mov qword [0x140215a80], rcx
jne 0x1400c7be8
mov r8d, dword ds:[rdx + 0x3c]
lea eax, [r8 - 1]
cmp eax, 0xffffffe
ja 0x1400c7be8
cmp dword [r8 + rdx], 0x4550
jne 0x1400c7be8
add r8, 0x88
add r8, rdx
mov eax, dword [r8]
test eax, eax
je 0x1400c7be8
cmp dword [r8 + 4], 0
je 0x1400c7be8
lea r9, [rdx + rax]
mov word [rsp + 0x28], bx
lea rax, str.FreeMRUList
mov rcx, rdx
mov qword [rsp + 0x20], rax
call fcn.140104bd0
mov rdx, qword [0x140215af8]
mov rcx, qword [0x140215a80]
jmp 0x1400c7beb
mov rax, rbx
cmp qword [0x140215b00], 0
mov qword [0x140215b18], rax
je 0x1400c7c15
cmp qword [0x140215b10], 0
je 0x1400c7c15
test rcx, rcx
je 0x1400c7c15
nop dword [rax + rax]
test rax, rax
jne 0x1400c7c25
mov rcx, rdx
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov qword [0x140215af8], rbx
mov rbx, qword [rsp + 0x40]
lea rcx, [0x14020e3e0]
call sym.ProcessHacker.exe_PhfSetEvent
cmp qword [0x140215af8], 0
setne al
add rsp, 0x38
ret
Function at 0x1400c8800
Capabilities:
Enumerate gui resources

Disassembly:
sub rsp, 0x38
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x50], rbp
mov rbp, rcx
call fcn.1400c8740
mov rdx, qword [0x140213b60]
mov ecx, 0x10
call sym.ProcessHacker.exe_PhCreateObject
mov rcx, qword [0x140213cd0]
mov edx, 4
mov rbx, rax
mov dword [rax], 0
lea r8d, [rdx + 0x4c]
mov dword [rax + 4], 0xa
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov qword [rbx + 8], rax
mov qword [rsp + 0x20], rbx
call fcn.1400c74c0
mov qword [rsp + 0x28], rax
call qword [sym.imp.USER32.dll_GetProcessWindowStation]
mov rcx, rax
lea r8, [rsp + 0x20]
lea rdx, [0x1400c86b0]
call qword [sym.imp.USER32.dll_EnumDesktopsW]
mov rcx, qword [rsp + 0x20]
xor ebx, ebx
cmp dword [rcx], ebx
jbe 0x1400c8926
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x30], rdi
nop dword [rax]
nop dword [rax + rax]
mov rax, qword [rcx + 8]
lea rdi, [rbx*8]
mov rcx, qword [rdi + rax]
test rcx, rcx
je 0x1400c88bb
mov r9, qword [rcx + 8]
jmp 0x1400c88be
xor r9d, r9d
xor r8d, r8d
mov edx, 0x143
mov rcx, rbp
call qword [sym.imp.USER32.dll_SendMessageW]
mov rsi, rax
cmp eax, 0xffffffff
je 0x1400c8911
mov rcx, qword [0x140213cd0]
mov edx, 4
lea r8d, [rdx + 4]
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov rcx, qword [rsp + 0x20]
mov r9, rax
movsxd r8, esi
mov rdx, qword [rcx + 8]
mov rcx, qword [rdi + rdx]
mov edx, 0x151
mov qword [rax], rcx
mov rcx, rbp
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, qword [rsp + 0x20]
inc ebx
cmp ebx, dword [rcx]
jb 0x1400c88a0
mov rdi, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x58]
mov ebx, 0xffffffff
add rcx, 0xfffffffffffffff0
mov eax, ebx
lock xadd dword [rcx + 8], eax
mov rbp, qword [rsp + 0x50]
cmp eax, 1
jne 0x1400c894a
call fcn.140106290
mov rcx, qword [rsp + 0x28]
add rcx, 0xfffffffffffffff0
lock xadd dword [rcx + 8], ebx
cmp ebx, 1
mov rbx, qword [rsp + 0x40]
jne 0x1400c8967
call fcn.140106290
add rsp, 0x38
ret