joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140024490
Capabilities:
Create process on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xf0
xor ebx, ebx
or rbp, 0xffffffffffffffff
mov r13, r9
mov r14, r8
mov r10, rdx
mov r15, rcx
mov rsi, rbx
test rdx, rdx
je 0x1400244e7
mov rdi, rdx
xor eax, eax
mov rcx, rbp
repne scasw ax, word [rdi]
not rcx
lea rdx, [rcx + rcx - 2]
mov rcx, r10
call sym.ProcessHacker.exe_PhCreateStringEx
mov rsi, rax
mov r12d, dword [rsp + 0x148]
mov edi, ebx
lea rax, [0x1400d1b3c]
mov ecx, 4
nop dword [rax]
test dword [rax - 4], r12d
je 0x140024508
or edi, dword [rax]
add rax, 8
sub rcx, 1
jne 0x140024500
mov rdx, qword [rsp + 0x140]
lea rcx, [rsp + 0x80]
mov r8d, 0x68
test rdx, rdx
je 0x140024534
call fcn.140094930
jmp 0x140024546
xor edx, edx
call fcn.14009e740
mov dword [rsp + 0x80], 0x68
mov rcx, qword [rsp + 0x150]
test rcx, rcx
jne 0x14002459e
lea rdx, [rsi + 0x10]
test rsi, rsi
jne 0x14002455f
mov rdx, rbx
lea rax, [rsp + 0x60]
and r12d, 1
xor r9d, r9d
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x80]
xor r8d, r8d
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], r13
mov qword [rsp + 0x30], r14
mov rcx, r15
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], r12d
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
jmp 0x1400245e9
lea r8, [rsi + 0x10]
test rsi, rsi
jne 0x1400245aa
mov r8, rbx
lea rax, [rsp + 0x60]
and r12d, 1
xor r9d, r9d
mov qword [rsp + 0x50], rax
lea rax, [rsp + 0x80]
mov rdx, r15
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x40], r13
mov qword [rsp + 0x38], r14
mov dword [rsp + 0x30], edi
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
test eax, eax
jne 0x140024610
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jg 0x140024601
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
jmp 0x140024610
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ebx, ax
or ebx, 0xc0070000
test rsi, rsi
je 0x140024627
lea rcx, [rsi - 0x20]
lock xadd dword [rcx], ebp
add ebp, 0xffffffff
jne 0x140024627
call fcn.14001fcd0
test ebx, ebx
js 0x14002468b
mov rcx, qword [rsp + 0x158]
test rcx, rcx
je 0x140024647
mov eax, dword [rsp + 0x70]
mov qword [rcx], rax
mov eax, dword [rsp + 0x74]
mov qword [rcx + 8], rax
mov rcx, qword [rsp + 0x160]
test rcx, rcx
je 0x14002465e
mov rax, qword [rsp + 0x60]
mov qword [rcx], rax
jmp 0x140024669
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ntdll.dll_NtClose]
mov rcx, qword [rsp + 0x168]
test rcx, rcx
je 0x140024680
mov rax, qword [rsp + 0x68]
mov qword [rcx], rax
jmp 0x14002468b
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ntdll.dll_NtClose]
lea r11, [rsp + 0xf0]
mov eax, ebx
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x1400246b0
Capabilities:
Create process on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x90
mov rbx, rdx
xor edx, edx
mov rdi, r8
mov rsi, rcx
lea r8d, [rdx + 0x6c]
lea rcx, [rsp + 0x24]
mov dword [rsp + 0x20], 0x70
call fcn.14009e740
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x40], rdi
mov dword [rsp + 0x50], 5
mov qword [rsp + 0x28], rsi
call qword [sym.imp.SHELL32.dll_ShellExecuteExW]
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret

Function at 0x140024720
Capabilities:
Create process on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x90
mov rbx, rdx
xor edx, edx
mov rdi, r8
mov rsi, rcx
lea r8d, [rdx + 0x6c]
lea rcx, [rsp + 0x24]
mov ebp, r9d
mov dword [rsp + 0x20], 0x70
call fcn.14009e740
mov qword [rsp + 0x38], rbx
mov ebx, dword [rsp + 0xc0]
mov qword [rsp + 0x40], rdi
mov dword [rsp + 0x24], 0x40
mov dword [rsp + 0x50], ebp
mov qword [rsp + 0x28], rsi
test bl, 1
je 0x14002479b
cmp dword [0x1400d8fc0], 0x3c
lea rax, str.runas
cmovb rax, qword [rsp + 0x30]
mov qword [rsp + 0x30], rax
lea rcx, [rsp + 0x20]
call qword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
je 0x140024849
mov r9d, dword [rsp + 0xc8]
test r9d, r9d
je 0x14002481b
test bl, 2
jne 0x140024807
cmp r9d, 0xffffffff
jne 0x1400247db
mov rcx, qword [rsp + 0x88]
xor r8d, r8d
xor edx, edx
call qword [sym.imp.ntdll.dll_NtWaitForSingleObject]
jmp 0x14002481b
mov rcx, qword [rsp + 0x88]
mov rax, r9
lea r8, [rsp + 0xa0]
imul rax, rax, 0xffffffffffffd8f0
xor edx, edx
mov qword [rsp + 0xa0], rax
call qword [sym.imp.ntdll.dll_NtWaitForSingleObject]
jmp 0x14002481b
lea r8, [rsp + 0x88]
mov edx, 1
xor ecx, ecx
call sym.ProcessHacker.exe_PhWaitForMultipleObjectsAndPump
mov rcx, qword [rsp + 0xd0]
test rcx, rcx
je 0x140024837
mov rax, qword [rsp + 0x88]
mov qword [rcx], rax
mov al, 1
jmp 0x14002484b
mov rcx, qword [rsp + 0x88]
call qword [sym.imp.ntdll.dll_NtClose]
mov al, 1
jmp 0x14002484b
xor al, al
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x140024870
Capabilities:
Create process on windows

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
push rdi
sub rsp, 0xa0
cmp qword [0x1400d8f78], 0
mov rbx, rdx
mov rdi, rcx
je 0x140024905
mov rax, qword [0x1400d8f38]
test rax, rax
je 0x140024905
lea rcx, [r11 + 0x18]
lea r8, [r11 + 0x20]
xor r9d, r9d
mov qword [rsp + 0x20], rcx
mov rcx, rbx
xor edx, edx
call rax
test eax, eax
js 0x1400248dd
mov rcx, qword [rsp + 0xc8]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
call qword [0x1400d8f78]
mov rbx, qword [rsp + 0xb0]
add rsp, 0xa0
pop rdi
ret
lea r8, str.The_location___s__could_not_be_found.
mov r9, rbx
mov edx, 0x10
mov rcx, rdi
call sym.ProcessHacker.exe_PhShowMessage
mov rbx, qword [rsp + 0xb0]
add rsp, 0xa0
pop rdi
ret
lea rcx, str._select_
call sym.ProcessHacker.exe_PhConcatStrings2
xor edx, edx
lea rcx, [rsp + 0x34]
lea r8d, [rdx + 0x6c]
mov rbx, rax
mov dword [rsp + 0x30], 0x70
call fcn.14009e740
lea rcx, [rbx + 0x10]
lea r11, str.explorer.exe
mov qword [rsp + 0x50], rcx
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x48], r11
mov dword [rsp + 0x60], 5
mov qword [rsp + 0x38], rdi
call qword [sym.imp.SHELL32.dll_ShellExecuteExW]
lea rcx, [rbx - 0x20]
or eax, 0xffffffff
lock xadd dword [rcx], eax
add eax, 0xffffffff
jne 0x14002496e
call fcn.14001fcd0
mov rbx, qword [rsp + 0xb0]
add rsp, 0xa0
pop rdi
ret

Function at 0x140024980
Capabilities:
Create process on windows

Disassembly:
push rbx
sub rsp, 0x90
mov rbx, rdx
xor edx, edx
lea rcx, [rsp + 0x24]
lea r8d, [rdx + 0x6c]
mov dword [rsp + 0x20], 0x70
call fcn.14009e740
lea rax, str.properties
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], rbx
mov dword [rsp + 0x50], 5
mov dword [rsp + 0x24], 0xc
call qword [sym.imp.SHELL32.dll_ShellExecuteExW]
add rsp, 0x90
pop rbx
ret
Function at 0x140024d10
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push r12
sub rsp, 0x30
mov r12, rcx
mov rcx, qword [0x1400d8fb0]
mov rbp, rdx
xor edx, edx
mov r8d, 0x80
xor esi, esi
mov dword [rsp + 0x60], 0x80
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov rbx, rax
test rax, rax
jne 0x140024d56
mov ecx, 0xc000009a
call qword [sym.imp.ntdll.dll_RtlRaiseStatus]
int3
lea rax, [rsp + 0x60]
lea r9, [rsp + 0x68]
xor r8d, r8d
mov qword [rsp + 0x28], rax
mov rdx, rbp
mov rcx, r12
mov qword [rsp + 0x20], rbx
mov qword [rsp + 0x50], rdi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edi, eax
cmp eax, 0xea
jne 0x140024de6
mov rcx, qword [0x1400d8fb0]
mov r8, rbx
xor edx, edx
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
mov r8d, dword [rsp + 0x60]
mov rcx, qword [0x1400d8fb0]
xor edx, edx
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov rbx, rax
test rax, rax
jne 0x140024dc1
mov ecx, 0xc000009a
call qword [sym.imp.ntdll.dll_RtlRaiseStatus]
int3
lea rax, [rsp + 0x60]
lea r9, [rsp + 0x68]
xor r8d, r8d
mov qword [rsp + 0x28], rax
mov rdx, rbp
mov rcx, r12
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edi, eax
test edi, edi
jne 0x140024e2d
mov eax, dword [rsp + 0x68]
cmp eax, 1
je 0x140024dfd
cmp eax, 7
je 0x140024dfd
cmp eax, 2
jne 0x140024e2d
mov eax, dword [rsp + 0x60]
cmp eax, 2
jbe 0x140024e16
add eax, 0xfffffffe
mov rcx, rbx
mov edx, eax
call sym.ProcessHacker.exe_PhCreateStringEx
mov rsi, rax
mov rcx, qword [0x1400d8fb0]
mov r8, rbx
xor edx, edx
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
mov rax, rsi
jmp 0x140024e49
mov rcx, qword [0x1400d8fb0]
mov r8, rbx
xor edx, edx
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
mov rdi, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x58]
add rsp, 0x30
pop r12
pop rsi
pop rbp
ret
Function at 0x1400267a0
Capabilities:
Enumerate services

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
sub rsp, 0x50
mov edi, dword [0x1400d1ae0]
test edx, edx
mov esi, edx
mov eax, 0x3b
mov ebp, r8d
mov r13, rcx
mov rcx, qword [0x1400d8fb0]
cmove esi, eax
test r8d, r8d
mov eax, 3
mov r8, rdi
mov r12, r9
cmove ebp, eax
xor edx, edx
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov rbx, rax
test rax, rax
jne 0x1400267fc
mov ecx, 0xc000009a
call qword [sym.imp.ntdll.dll_RtlRaiseStatus]
int3
lea rax, [rsp + 0x90]
mov qword [rsp + 0x80], r14
xor r14d, r14d
mov qword [rsp + 0x48], r14
mov qword [rsp + 0x40], r14
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x88]
mov r9d, ebp
mov r8d, esi
mov qword [rsp + 0x30], rax
xor edx, edx
mov rcx, r13
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_EnumServicesStatusExW]
test eax, eax
jne 0x1400268f5
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xea
jne 0x1400268f5
mov rcx, qword [0x1400d8fb0]
mov r8, rbx
xor edx, edx
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
add edi, dword [rsp + 0x88]
mov rcx, qword [0x1400d8fb0]
mov r8d, edi
xor edx, edx
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov rbx, rax
test rax, rax
jne 0x14002689d
mov ecx, 0xc000009a
call qword [sym.imp.ntdll.dll_RtlRaiseStatus]
int3
mov qword [rsp + 0x48], r14
mov qword [rsp + 0x40], r14
lea rax, [rsp + 0x90]
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x88]
mov r9d, ebp
mov qword [rsp + 0x30], rax
mov r8d, esi
xor edx, edx
mov rcx, r13
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_EnumServicesStatusExW]
test eax, eax
jne 0x1400268f5
mov rcx, qword [0x1400d8fb0]
mov r8, rbx
xor edx, edx
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
xor eax, eax
jmp 0x140026918
mov ecx, dword [0x1400d1ae0]
cmp edi, 0x10000
mov rax, rbx
cmovbe ecx, edi
mov dword [0x1400d1ae0], ecx
mov ecx, dword [rsp + 0x90]
mov dword [r12], ecx
mov r14, qword [rsp + 0x80]
mov rbx, qword [rsp + 0x98]
add rsp, 0x50
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret

Function at 0x140026bb0
Capabilities:
Modify service

Disassembly:
sub rsp, 0x28
movzx eax, dl
lea r8, [rsp + 0x38]
mov edx, 3
mov dword [rsp + 0x38], eax
call qword [sym.imp.ADVAPI32.dll_ChangeServiceConfig2W]
test eax, eax
setne al
add rsp, 0x28
ret
Function at 0x14002d4b0
Capabilities:
Lock the desktop

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
call qword [sym.imp.USER32.dll_LockWorkStation]
test eax, eax
je 0x14002d4cb
mov al, 1
add rsp, 0x20
pop rbx
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, str.Unable_to_lock_the_computer
xor r8d, r8d
mov r9d, eax
mov rcx, rbx
call sym.ProcessHacker.exe_PhShowStatus
xor al, al
add rsp, 0x20
pop rbx
ret

Function at 0x14002d4f0
Capabilities:
Shutdown system

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_ExitWindowsEx]
test eax, eax
je 0x14002d50f
mov al, 1
add rsp, 0x20
pop rbx
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, str.Unable_to_logoff_the_computer
xor r8d, r8d
mov r9d, eax
mov rcx, rbx
call sym.ProcessHacker.exe_PhShowStatus
xor al, al
add rsp, 0x20
pop rbx
ret

Function at 0x14002d5e0
Capabilities:
Shutdown system

Disassembly:
push rbx
sub rsp, 0x30
mov rbx, rcx
lea rcx, str.EnableWarnings
call sym.ProcessHacker.exe_PhGetIntegerSetting
test eax, eax
je 0x14002d61b
lea r8, str.the_computer
lea rdx, str.restart
xor r9d, r9d
mov rcx, rbx
mov byte [rsp + 0x20], 0
call sym.ProcessHacker.exe_PhShowConfirmMessage
test al, al
je 0x14002d64d
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.USER32.dll_ExitWindowsEx]
test eax, eax
je 0x14002d632
mov al, 1
add rsp, 0x30
pop rbx
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, str.Unable_to_restart_the_computer
xor r8d, r8d
mov r9d, eax
mov rcx, rbx
call sym.ProcessHacker.exe_PhShowStatus
xor al, al
add rsp, 0x30
pop rbx
ret

Function at 0x14002d660
Capabilities:
Shutdown system

Disassembly:
push rbx
sub rsp, 0x30
mov rbx, rcx
lea rcx, str.EnableWarnings
call sym.ProcessHacker.exe_PhGetIntegerSetting
test eax, eax
je 0x14002d69b
lea r8, str.the_computer
lea rdx, str.shutdown
xor r9d, r9d
mov rcx, rbx
mov byte [rsp + 0x20], 0
call sym.ProcessHacker.exe_PhShowConfirmMessage
test al, al
je 0x14002d6cd
xor edx, edx
lea ecx, [rdx + 1]
call qword [sym.imp.USER32.dll_ExitWindowsEx]
test eax, eax
je 0x14002d6b2
mov al, 1
add rsp, 0x30
pop rbx
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, str.Unable_to_shutdown_the_computer
xor r8d, r8d
mov r9d, eax
mov rcx, rbx
call sym.ProcessHacker.exe_PhShowStatus
xor al, al
add rsp, 0x30
pop rbx
ret

Function at 0x14002d6e0
Capabilities:
Shutdown system

Disassembly:
push rbx
sub rsp, 0x30
mov rbx, rcx
lea rcx, str.EnableWarnings
call sym.ProcessHacker.exe_PhGetIntegerSetting
test eax, eax
je 0x14002d71b
lea r8, str.the_computer
lea rdx, str.poweroff
xor r9d, r9d
mov rcx, rbx
mov byte [rsp + 0x20], 0
call sym.ProcessHacker.exe_PhShowConfirmMessage
test al, al
je 0x14002d74d
xor edx, edx
lea ecx, [rdx + 8]
call qword [sym.imp.USER32.dll_ExitWindowsEx]
test eax, eax
je 0x14002d732
mov al, 1
add rsp, 0x30
pop rbx
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, str.Unable_to_poweroff_the_computer
xor r8d, r8d
mov r9d, eax
mov rcx, rbx
call sym.ProcessHacker.exe_PhShowStatus
xor al, al
add rsp, 0x30
pop rbx
ret
Function at 0x14002ddb0
Capabilities:
Terminate process

Disassembly:
push rbp
push rdi
push r12
push r13
sub rsp, 0xe8
mov dword [rsp + 0x28], r8d
mov ebp, r8d
mov rdi, rdx
mov qword [rsp + 0x20], rdx
lea r8, str.Terminating_a_process_will_cause_unsaved_data_to_be_lost.
lea rdx, str.terminate
xor r9d, r9d
mov r13, rcx
mov r12b, 1
call fcn.14002db60
test al, al
jne 0x14002ddfc
add rsp, 0xe8
pop r13
pop r12
pop rdi
pop rbp
ret
mov qword [rsp + 0x110], rbx
mov qword [rsp + 0x118], rsi
mov qword [rsp + 0xe0], r14
xor r14d, r14d
mov esi, r14d
test ebp, ebp
je 0x14002e01a
mov rax, qword [rdi]
mov rcx, qword [0x1400d62b8]
mov dword [rsp + 0x88], r14d
mov rdx, qword [rax + 0x10]
xor eax, eax
mov qword [rsp + 0x90], rax
mov qword [rsp + 0x98], rax
mov qword [rsp + 0xa0], rax
mov qword [rsp + 0xa8], rax
mov qword [rsp + 0xb0], rax
test rcx, rcx
je 0x14002ded7
mov dword [rsp + 0x48], 8
lea rax, [rsp + 0x50]
mov qword [rsp + 0x68], rdx
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x38], 0x10
lea rax, [rsp + 0x68]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0xb8]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov dword [rsp + 0x28], 0x999920c8
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x70], 1
call qword [sym.imp.ntdll.dll_NtDeviceIoControlFile]
mov ebx, eax
mov rax, qword [rsp + 0x128]
test ebx, ebx
cmovns rax, qword [rsp + 0x50]
mov qword [rsp + 0x128], rax
jmp 0x14002df0e
mov qword [rsp + 0x78], rdx
lea r9, [rsp + 0x78]
lea r8, [rsp + 0x88]
lea rcx, [rsp + 0x128]
mov edx, 1
mov qword [rsp + 0x80], r14
call qword [sym.imp.ntdll.dll_NtOpenProcess]
mov ebx, eax
mov rax, qword [rsp + 0x128]
test ebx, ebx
js 0x14002df9c
mov rcx, qword [0x1400d62b8]
test rcx, rcx
je 0x14002df7d
mov dword [rsp + 0x48], r14d
mov qword [rsp + 0x40], r14
mov qword [rsp + 0x58], rax
mov dword [rsp + 0x38], 0x10
lea rax, [rsp + 0x58]
xor r9d, r9d
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0xc8]
xor r8d, r8d
xor edx, edx
mov dword [rsp + 0x28], 0x999920dc
mov dword [rsp + 0x60], r14d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntdll.dll_NtDeviceIoControlFile]
mov ebx, eax
cmp eax, 0xc00000db
jne 0x14002df8a
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
xor edx, edx
mov rcx, rax
call qword [sym.imp.ntdll.dll_NtTerminateProcess]
mov ebx, eax
mov rcx, qword [rsp + 0x128]
call qword [sym.imp.ntdll.dll_NtClose]
test ebx, ebx
jns 0x14002e00c
mov rax, qword [rdi]
xor r12b, r12b
cmp qword [rax + 0x10], r14
jl 0x14002dfdb
mov r8, qword [rax + 0x20]
mov r9d, dword [rax + 0x10]
lea rdx, str.terminate
lea rcx, str.Unable_to__s__s__PID__u_
add r8, 0x10
call sym.ProcessHacker.exe_PhaFormatString
xor r9d, r9d
mov r8d, ebx
lea rdx, [rax + 0x10]
mov rcx, r13
call sym.ProcessHacker.exe_PhShowContinueStatus
jmp 0x14002e008
mov r8, qword [rax + 0x20]
lea rdx, str.terminate
lea rcx, str.Unable_to__s__s
add r8, 0x10
call sym.ProcessHacker.exe_PhaFormatString
xor r9d, r9d
mov r8d, ebx
lea rdx, [rax + 0x10]
mov rcx, r13
call sym.ProcessHacker.exe_PhShowContinueStatus
test al, al
je 0x14002e01a
inc esi
add rdi, 8
cmp esi, ebp
jb 0x14002de22
mov rsi, qword [rsp + 0x118]
mov rbx, qword [rsp + 0x110]
mov r14, qword [rsp + 0xe0]
mov al, r12b
add rsp, 0xe8
pop r13
pop r12
pop rdi
pop rbp
ret
Function at 0x140030510
Capabilities:
Start service

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
sub rsp, 0x30
mov rdi, qword [rdx + 0x10]
mov rsi, rdx
mov rbp, rcx
mov r13d, 1
xor r12b, r12b
xor edx, edx
mov r8d, r13d
xor ecx, ecx
mov byte [rsp + 0x58], r12b
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov rbx, rax
test rax, rax
je 0x1400305a7
lea r8d, [r13 + 0xf]
lea rdx, [rdi + 0x10]
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov rcx, rbx
mov rdi, rax
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
test rdi, rdi
je 0x1400305a7
xor r8d, r8d
xor edx, edx
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_StartServiceW]
movzx ebx, r12b
mov rcx, rdi
test eax, eax
cmovne ebx, r13d
mov byte [rsp + 0x58], bl
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
test bl, bl
je 0x1400305a7
mov al, bl
jmp 0x140030663
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jg 0x1400305bb
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
jmp 0x1400305ca
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ebx, ax
or ebx, 0xc0070000
mov rdx, qword [rsi + 0x10]
lea rcx, str.Unable_to_start
add rdx, 0x10
call sym.ProcessHacker.exe_PhConcatStrings2
mov rdi, rax
test rax, rax
je 0x1400305ee
mov rcx, rax
call sym.ProcessHacker.exe_PhaDereferenceObject
mov r8, qword [rsi + 0x10]
lea r9, [0x1400afe14]
lea rdx, str._e__c__ctype_service__caction_start__cobject__
add r8, 0x10
mov ecx, 3
call sym.ProcessHacker.exe_PhaConcatStrings
lea rcx, [rsp + 0x58]
lea rdx, [rdi + 0x10]
mov qword [rsp + 0x20], rcx
lea r9, [rax + 0x10]
mov r8d, ebx
mov rcx, rbp
call fcn.14002d1d0
test al, al
jne 0x14003065f
mov r8, qword [rsi + 0x10]
lea rdx, str.start
lea rcx, str.Unable_to__s__s
add r8, 0x10
call sym.ProcessHacker.exe_PhaFormatString
xor r9d, r9d
mov r8d, ebx
add rax, 0x10
mov rcx, rbp
mov rdx, rax
call sym.ProcessHacker.exe_PhShowStatus
mov al, byte [rsp + 0x58]
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x30
pop r13
pop r12
pop rdi
ret
Function at 0x140030680
Capabilities:
Pause service

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
sub rsp, 0x50
mov rdi, qword [rdx + 0x10]
mov rsi, rdx
mov rbp, rcx
mov r13d, 1
xor r12b, r12b
xor edx, edx
mov r8d, r13d
xor ecx, ecx
mov byte [rsp + 0x78], r12b
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov rbx, rax
test rax, rax
je 0x14003071b
lea r8d, [r13 + 0x3f]
lea rdx, [rdi + 0x10]
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov rcx, rbx
mov rdi, rax
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
test rdi, rdi
je 0x14003071b
lea r8, [rsp + 0x30]
lea edx, [r13 + 2]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_ControlService]
movzx ebx, r12b
mov rcx, rdi
test eax, eax
cmovne ebx, r13d
mov byte [rsp + 0x78], bl
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
test bl, bl
je 0x14003071b
mov al, bl
jmp 0x1400307d7
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jg 0x14003072f
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
jmp 0x14003073e
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ebx, ax
or ebx, 0xc0070000
mov rdx, qword [rsi + 0x10]
lea rcx, str.Unable_to_continue
add rdx, 0x10
call sym.ProcessHacker.exe_PhConcatStrings2
mov rdi, rax
test rax, rax
je 0x140030762
mov rcx, rax
call sym.ProcessHacker.exe_PhaDereferenceObject
mov r8, qword [rsi + 0x10]
lea r9, [0x1400afe14]
lea rdx, str._e__c__ctype_service__caction_continue__cobject__
add r8, 0x10
mov ecx, 3
call sym.ProcessHacker.exe_PhaConcatStrings
lea rcx, [rsp + 0x78]
lea rdx, [rdi + 0x10]
mov qword [rsp + 0x20], rcx
lea r9, [rax + 0x10]
mov r8d, ebx
mov rcx, rbp
call fcn.14002d1d0
test al, al
jne 0x1400307d3
mov r8, qword [rsi + 0x10]
lea rdx, str.continue
lea rcx, str.Unable_to__s__s
add r8, 0x10
call sym.ProcessHacker.exe_PhaFormatString
xor r9d, r9d
mov r8d, ebx
add rax, 0x10
mov rcx, rbp
mov rdx, rax
call sym.ProcessHacker.exe_PhShowStatus
mov al, byte [rsp + 0x78]
lea r11, [rsp + 0x50]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r13
pop r12
pop rdi
ret
Function at 0x140030800
Capabilities:
Stop service

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
sub rsp, 0x50
mov rdi, qword [rdx + 0x10]
mov rsi, rdx
mov rbp, rcx
mov r13d, 1
xor r12b, r12b
xor edx, edx
mov r8d, r13d
xor ecx, ecx
mov byte [rsp + 0x78], r12b
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov rbx, rax
test rax, rax
je 0x14003089b
lea r8d, [r13 + 0x3f]
lea rdx, [rdi + 0x10]
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov rcx, rbx
mov rdi, rax
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
test rdi, rdi
je 0x14003089b
lea r8, [rsp + 0x30]
lea edx, [r13 + 1]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_ControlService]
movzx ebx, r12b
mov rcx, rdi
test eax, eax
cmovne ebx, r13d
mov byte [rsp + 0x78], bl
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
test bl, bl
je 0x14003089b
mov al, bl
jmp 0x140030957
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jg 0x1400308af
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
jmp 0x1400308be
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ebx, ax
or ebx, 0xc0070000
mov rdx, qword [rsi + 0x10]
lea rcx, str.Unable_to_pause
add rdx, 0x10
call sym.ProcessHacker.exe_PhConcatStrings2
mov rdi, rax
test rax, rax
je 0x1400308e2
mov rcx, rax
call sym.ProcessHacker.exe_PhaDereferenceObject
mov r8, qword [rsi + 0x10]
lea r9, [0x1400afe14]
lea rdx, str._e__c__ctype_service__caction_pause__cobject__
add r8, 0x10
mov ecx, 3
call sym.ProcessHacker.exe_PhaConcatStrings
lea rcx, [rsp + 0x78]
lea rdx, [rdi + 0x10]
mov qword [rsp + 0x20], rcx
lea r9, [rax + 0x10]
mov r8d, ebx
mov rcx, rbp
call fcn.14002d1d0
test al, al
jne 0x140030953
mov r8, qword [rsi + 0x10]
lea rdx, str.pause
lea rcx, str.Unable_to__s__s
add r8, 0x10
call sym.ProcessHacker.exe_PhaFormatString
xor r9d, r9d
mov r8d, ebx
add rax, 0x10
mov rcx, rbp
mov rdx, rax
call sym.ProcessHacker.exe_PhShowStatus
mov al, byte [rsp + 0x78]
lea r11, [rsp + 0x50]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r13
pop r12
pop rdi
ret