joyce8/EMBER2024-capa huggingface dataset:
Function at 0x403aa0
Capabilities:
Start service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
xor bl, bl
push 1
push 0
push 0
mov eax, dword [edi + 8]
mov eax, dword [eax + 4]
mov dword [ebp - 8], eax
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov esi, eax
test esi, esi
je 0x403b0d
push 0x10
push dword [ebp - 8]
push esi
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
push esi
mov dword [ebp - 8], eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov esi, dword [ebp - 8]
test esi, esi
je 0x403b0d
push 0
push 0
push esi
call dword [sym.imp.ADVAPI32.dll_StartServiceW]
test eax, eax
movzx ebx, bl
mov eax, 1
push esi
cmovne ebx, eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
test bl, bl
jne 0x403bdc
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x403b22
movzx esi, si
or esi, 0xc0070000
mov eax, dword [edi + 8]
push dword [eax + 4]
push str.Unable_to_start
call sym.ProcessHacker.exe_PhConcatStrings2
push eax
call sym.ProcessHacker.exe_PhAutoDereferenceObject
lea ecx, [ebp - 1]
push ecx
mov ecx, dword [ebp + 8]
mov edx, dword [eax + 4]
push esi
call fcn.00401580
test al, al
je 0x403bb4
cmp byte [ebp - 1], 0
je 0x403bdc
mov ecx, dword [edi + 8]
mov edx, 1
mov ecx, dword [ecx + 4]
call fcn.00458250
test eax, eax
js 0x403b7c
mov bl, 1
call sym.ProcessHacker.exe__PhUiDisconnectFromPhSvc_0
mov al, bl
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
push 0
push eax
mov eax, dword [edi + 8]
push dword [eax + 4]
push str.start
push str.Unable_to__s__s.
call fcn.00401400
add esp, 0xc
mov eax, dword [eax + 4]
push eax
mov eax, dword [ebp + 8]
push eax
call sym.ProcessHacker.exe_PhShowStatus
call sym.ProcessHacker.exe__PhUiDisconnectFromPhSvc_0
mov al, bl
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov eax, dword [edi + 8]
push 0
push esi
push dword [eax + 4]
push str.start
push str.Unable_to__s__s.
call fcn.00401400
add esp, 0xc
mov eax, dword [eax + 4]
push eax
mov eax, dword [ebp + 8]
push eax
call sym.ProcessHacker.exe_PhShowStatus
pop edi
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x403bf0
Capabilities:
Continue service
Stop service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
xor bl, bl
push 1
push 0
push 0
mov eax, dword [edi + 8]
mov eax, dword [eax + 4]
mov dword [ebp - 8], eax
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov esi, eax
test esi, esi
je 0x403c5f
push 0x40
push dword [ebp - 8]
push esi
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
push esi
mov dword [ebp - 8], eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov esi, dword [ebp - 8]
test esi, esi
je 0x403c5f
lea eax, [ebp - 0x24]
push eax
push 3
push esi
call dword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
movzx ebx, bl
mov ecx, 1
push esi
cmovne ebx, ecx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
test bl, bl
jne 0x403d2e
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x403c74
movzx esi, si
or esi, 0xc0070000
mov eax, dword [edi + 8]
push dword [eax + 4]
push str.Unable_to_continue
call sym.ProcessHacker.exe_PhConcatStrings2
push eax
call sym.ProcessHacker.exe_PhAutoDereferenceObject
lea ecx, [ebp - 1]
push ecx
mov ecx, dword [ebp + 8]
mov edx, dword [eax + 4]
push esi
call fcn.00401580
test al, al
je 0x403d06
cmp byte [ebp - 1], 0
je 0x403d2e
mov ecx, dword [edi + 8]
mov edx, 2
mov ecx, dword [ecx + 4]
call fcn.00458250
test eax, eax
js 0x403cce
mov bl, 1
call sym.ProcessHacker.exe__PhUiDisconnectFromPhSvc_0
mov al, bl
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
push 0
push eax
mov eax, dword [edi + 8]
push dword [eax + 4]
push 0x508878
push str.Unable_to__s__s.
call fcn.00401400
add esp, 0xc
mov eax, dword [eax + 4]
push eax
mov eax, dword [ebp + 8]
push eax
call sym.ProcessHacker.exe_PhShowStatus
call sym.ProcessHacker.exe__PhUiDisconnectFromPhSvc_0
mov al, bl
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov eax, dword [edi + 8]
push 0
push esi
push dword [eax + 4]
push 0x508878
push str.Unable_to__s__s.
call fcn.00401400
add esp, 0xc
mov eax, dword [eax + 4]
push eax
mov eax, dword [ebp + 8]
push eax
call sym.ProcessHacker.exe_PhShowStatus
pop edi
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x403d40
Capabilities:
Pause service
Stop service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
xor bl, bl
push 1
push 0
push 0
mov eax, dword [edi + 8]
mov eax, dword [eax + 4]
mov dword [ebp - 8], eax
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov esi, eax
test esi, esi
je 0x403daf
push 0x40
push dword [ebp - 8]
push esi
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
push esi
mov dword [ebp - 8], eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov esi, dword [ebp - 8]
test esi, esi
je 0x403daf
lea eax, [ebp - 0x24]
push eax
push 2
push esi
call dword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
movzx ebx, bl
mov ecx, 1
push esi
cmovne ebx, ecx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
test bl, bl
jne 0x403e7e
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x403dc4
movzx esi, si
or esi, 0xc0070000
mov eax, dword [edi + 8]
push dword [eax + 4]
push str.Unable_to_pause
call sym.ProcessHacker.exe_PhConcatStrings2
push eax
call sym.ProcessHacker.exe_PhAutoDereferenceObject
lea ecx, [ebp - 1]
push ecx
mov ecx, dword [ebp + 8]
mov edx, dword [eax + 4]
push esi
call fcn.00401580
test al, al
je 0x403e56
cmp byte [ebp - 1], 0
je 0x403e7e
mov ecx, dword [edi + 8]
mov edx, 3
mov ecx, dword [ecx + 4]
call fcn.00458250
test eax, eax
js 0x403e1e
mov bl, 1
call sym.ProcessHacker.exe__PhUiDisconnectFromPhSvc_0
mov al, bl
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
push 0
push eax
mov eax, dword [edi + 8]
push dword [eax + 4]
push str.pause
push str.Unable_to__s__s.
call fcn.00401400
add esp, 0xc
mov eax, dword [eax + 4]
push eax
mov eax, dword [ebp + 8]
push eax
call sym.ProcessHacker.exe_PhShowStatus
call sym.ProcessHacker.exe__PhUiDisconnectFromPhSvc_0
mov al, bl
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov eax, dword [edi + 8]
push 0
push esi
push dword [eax + 4]
push str.pause
push str.Unable_to__s__s.
call fcn.00401400
add esp, 0xc
mov eax, dword [eax + 4]
push eax
mov eax, dword [ebp + 8]
push eax
call sym.ProcessHacker.exe_PhShowStatus
pop edi
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x403e90
Capabilities:
Stop service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
xor bl, bl
push 1
push 0
push 0
mov eax, dword [edi + 8]
mov eax, dword [eax + 4]
mov dword [ebp - 8], eax
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov esi, eax
test esi, esi
je 0x403eff
push 0x20
push dword [ebp - 8]
push esi
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
push esi
mov dword [ebp - 8], eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov esi, dword [ebp - 8]
test esi, esi
je 0x403eff
lea eax, [ebp - 0x24]
push eax
push 1
push esi
call dword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
movzx ebx, bl
mov ecx, 1
push esi
cmovne ebx, ecx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
test bl, bl
jne 0x403fce
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x403f14
movzx esi, si
or esi, 0xc0070000
mov eax, dword [edi + 8]
push dword [eax + 4]
push str.Unable_to_stop
call sym.ProcessHacker.exe_PhConcatStrings2
push eax
call sym.ProcessHacker.exe_PhAutoDereferenceObject
lea ecx, [ebp - 1]
push ecx
mov ecx, dword [ebp + 8]
mov edx, dword [eax + 4]
push esi
call fcn.00401580
test al, al
je 0x403fa6
cmp byte [ebp - 1], 0
je 0x403fce
mov ecx, dword [edi + 8]
mov edx, 4
mov ecx, dword [ecx + 4]
call fcn.00458250
test eax, eax
js 0x403f6e
mov bl, 1
call sym.ProcessHacker.exe__PhUiDisconnectFromPhSvc_0
mov al, bl
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
push 0
push eax
mov eax, dword [edi + 8]
push dword [eax + 4]
push str.stop
push str.Unable_to__s__s.
call fcn.00401400
add esp, 0xc
mov eax, dword [eax + 4]
push eax
mov eax, dword [ebp + 8]
push eax
call sym.ProcessHacker.exe_PhShowStatus
call sym.ProcessHacker.exe__PhUiDisconnectFromPhSvc_0
mov al, bl
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov eax, dword [edi + 8]
push 0
push esi
push dword [eax + 4]
push str.stop
push str.Unable_to__s__s.
call fcn.00401400
add esp, 0xc
mov eax, dword [eax + 4]
push eax
mov eax, dword [ebp + 8]
push eax
call sym.ProcessHacker.exe_PhShowStatus
pop edi
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x403ff0
Capabilities:
Delete service

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
xor bl, bl
push 1
push str.Deleting_a_service_can_prevent_the_system_from_starting_or_functioning_properly.
mov eax, dword [edi + 8]
push dword [eax + 4]
push 0x50898c
push dword [ebp + 8]
call sym.ProcessHacker.exe_PhShowConfirmMessage
test al, al
jne 0x404028
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov eax, dword [edi + 8]
push 1
push 0
push 0
mov eax, dword [eax + 4]
mov dword [esp + 0x20], eax
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov esi, eax
test esi, esi
je 0x40408a
push 0x10000
push dword [esp + 0x18]
push esi
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
push esi
mov dword [esp + 0x18], eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov esi, dword [esp + 0x14]
test esi, esi
je 0x40408a
push esi
call dword [sym.imp.ADVAPI32.dll_DeleteService]
test eax, eax
movzx ebx, bl
mov ecx, 1
push esi
cmovne ebx, ecx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
test bl, bl
jne 0x404159
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x40409f
movzx esi, si
or esi, 0xc0070000
mov eax, dword [edi + 8]
push dword [eax + 4]
push str.Unable_to_delete
call sym.ProcessHacker.exe_PhConcatStrings2
push eax
call sym.ProcessHacker.exe_PhAutoDereferenceObject
lea ecx, [esp + 0x13]
push ecx
mov ecx, dword [ebp + 8]
mov edx, dword [eax + 4]
push esi
call fcn.00401580
test al, al
je 0x404132
cmp byte [esp + 0x13], 0
je 0x404159
mov ecx, dword [edi + 8]
mov edx, 5
mov ecx, dword [ecx + 4]
call fcn.00458250
test eax, eax
js 0x4040fb
mov bl, 1
call sym.ProcessHacker.exe__PhUiDisconnectFromPhSvc_0
mov al, bl
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
push 0
push eax
mov eax, dword [edi + 8]
push dword [eax + 4]
push 0x50898c
push str.Unable_to__s__s.
call fcn.00401400
add esp, 0xc
mov eax, dword [eax + 4]
push eax
push dword [ebp + 8]
call sym.ProcessHacker.exe_PhShowStatus
call sym.ProcessHacker.exe__PhUiDisconnectFromPhSvc_0
mov al, bl
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov eax, dword [edi + 8]
push 0
push esi
push dword [eax + 4]
push 0x50898c
push str.Unable_to__s__s.
call fcn.00401400
add esp, 0xc
mov ecx, dword [eax + 4]
push ecx
push dword [ebp + 8]
call sym.ProcessHacker.exe_PhShowStatus
pop edi
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x404540
Capabilities:
Suspend thread

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x2c
push ebx
push esi
push edi
xor edi, edi
xor bh, bh
mov bl, 1
cmp dword [ebp + 0x10], edi
jbe 0x4046cc
mov esi, dword [ebp + 0xc]
mov edi, edi
mov eax, dword [esi + edi*4]
mov dword [esp + 0x18], 0
mov dword [esp + 0x20], 0x18
mov dword [esp + 0x24], 0
mov eax, dword [eax]
mov dword [esp + 0x1c], eax
lea eax, [esp + 0x18]
push eax
lea eax, [esp + 0x24]
mov dword [esp + 0x30], 0
push eax
push 2
lea eax, [esp + 0x20]
mov dword [esp + 0x34], 0
push eax
mov dword [esp + 0x40], 0
mov dword [esp + 0x44], 0
call dword [sym.imp.ntdll.dll_NtOpenThread]
mov esi, eax
cmp esi, 0xc0000022
jne 0x4045e0
cmp byte [0x5496b4], 0
je 0x4045e0
lea eax, [esp + 0x18]
mov edx, 2
push eax
lea ecx, [esp + 0x18]
call fcn.004b3f00
mov esi, eax
test esi, esi
js 0x404604
push 0
push dword [esp + 0x18]
call dword [sym.imp.ntdll.dll_NtSuspendThread]
push dword [esp + 0x14]
mov esi, eax
call dword [sym.imp.ntdll.dll_NtClose]
test esi, esi
jns 0x4046bf
xor bl, bl
test bh, bh
jne 0x404692
lea eax, [esp + 0x13]
push eax
mov eax, dword [ebp + 0xc]
push esi
mov eax, dword [eax + edi*4]
push dword [eax]
push str.Unable_to_suspend_thread__u
call fcn.00401400
mov ecx, dword [ebp + 8]
add esp, 8
mov edx, dword [eax + 4]
call fcn.00401580
test al, al
je 0x404692
mov esi, dword [ebp + 0xc]
cmp byte [esp + 0x13], bh
je 0x40468e
mov ecx, dword [esi + edi*4]
mov edx, 2
push 0
mov ecx, dword [ecx]
call fcn.00458d90
mov ecx, eax
test ecx, ecx
js 0x404661
mov bl, 1
call sym.ProcessHacker.exe__PhUiDisconnectFromPhSvc_0
jmp 0x4046c2
mov eax, dword [esi + edi*4]
push 0
push ecx
push dword [eax]
push str.suspend
push str.Unable_to__s_thread__u
call fcn.00401400
add esp, 0xc
mov eax, dword [eax + 4]
push eax
push dword [ebp + 8]
call sym.ProcessHacker.exe_PhShowContinueStatus
call sym.ProcessHacker.exe__PhUiDisconnectFromPhSvc_0
jmp 0x4046c2
mov bh, 1
jmp 0x4046c2
mov eax, dword [ebp + 0xc]
push 0
push esi
mov eax, dword [eax + edi*4]
push dword [eax]
push str.suspend
push str.Unable_to__s_thread__u
call fcn.00401400
add esp, 0xc
mov eax, dword [eax + 4]
push eax
push dword [ebp + 8]
call sym.ProcessHacker.exe_PhShowContinueStatus
test al, al
je 0x4046cc
mov esi, dword [ebp + 0xc]
inc edi
cmp edi, dword [ebp + 0x10]
jb 0x404560
pop edi
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4046e0
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x2c
push ebx
push esi
push edi
xor edi, edi
xor bh, bh
mov bl, 1
cmp dword [ebp + 0x10], edi
jbe 0x40486c
mov esi, dword [ebp + 0xc]
mov edi, edi
mov eax, dword [esi + edi*4]
mov dword [esp + 0x18], 0
mov dword [esp + 0x20], 0x18
mov dword [esp + 0x24], 0
mov eax, dword [eax]
mov dword [esp + 0x1c], eax
lea eax, [esp + 0x18]
push eax
lea eax, [esp + 0x24]
mov dword [esp + 0x30], 0
push eax
push 2
lea eax, [esp + 0x20]
mov dword [esp + 0x34], 0
push eax
mov dword [esp + 0x40], 0
mov dword [esp + 0x44], 0
call dword [sym.imp.ntdll.dll_NtOpenThread]
mov esi, eax
cmp esi, 0xc0000022
jne 0x404780
cmp byte [0x5496b4], 0
je 0x404780
lea eax, [esp + 0x18]
mov edx, 2
push eax
lea ecx, [esp + 0x18]
call fcn.004b3f00
mov esi, eax
test esi, esi
js 0x4047a4
push 0
push dword [esp + 0x18]
call dword [sym.imp.ntdll.dll_NtResumeThread]
push dword [esp + 0x14]
mov esi, eax
call dword [sym.imp.ntdll.dll_NtClose]
test esi, esi
jns 0x40485f
xor bl, bl
test bh, bh
jne 0x404832
lea eax, [esp + 0x13]
push eax
mov eax, dword [ebp + 0xc]
push esi
mov eax, dword [eax + edi*4]
push dword [eax]
push str.Unable_to_resume_thread__u
call fcn.00401400
mov ecx, dword [ebp + 8]
add esp, 8
mov edx, dword [eax + 4]
call fcn.00401580
test al, al
je 0x404832
mov esi, dword [ebp + 0xc]
cmp byte [esp + 0x13], bh
je 0x40482e
mov ecx, dword [esi + edi*4]
mov edx, 3
push 0
mov ecx, dword [ecx]
call fcn.00458d90
mov ecx, eax
test ecx, ecx
js 0x404801
mov bl, 1
call sym.ProcessHacker.exe__PhUiDisconnectFromPhSvc_0
jmp 0x404862
mov eax, dword [esi + edi*4]
push 0
push ecx
push dword [eax]
push str.resume
push str.Unable_to__s_thread__u
call fcn.00401400
add esp, 0xc
mov eax, dword [eax + 4]
push eax
push dword [ebp + 8]
call sym.ProcessHacker.exe_PhShowContinueStatus
call sym.ProcessHacker.exe__PhUiDisconnectFromPhSvc_0
jmp 0x404862
mov bh, 1
jmp 0x404862
mov eax, dword [ebp + 0xc]
push 0
push esi
mov eax, dword [eax + edi*4]
push dword [eax]
push str.resume
push str.Unable_to__s_thread__u
call fcn.00401400
add esp, 0xc
mov eax, dword [eax + 4]
push eax
push dword [ebp + 8]
call sym.ProcessHacker.exe_PhShowContinueStatus
test al, al
je 0x40486c
mov esi, dword [ebp + 0xc]
inc edi
cmp edi, dword [ebp + 0x10]
jb 0x404700
pop edi
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x407050
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x94
push ebx
push esi
mov esi, dword [0x5496d4]
push edi
mov edi, ecx
test esi, esi
jne 0x40709c
mov ecx, 0x522c80
call fcn.004a2030
test eax, eax
jne 0x407082
mov dword [0x5496d4], eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0
mov edx, str.GetSendMessageReceiver
mov ecx, eax
call fcn.004a20e0
mov esi, eax
mov dword [0x5496d4], esi
test esi, esi
je 0x4070ad
push edi
mov ecx, esi
call dword [0x4fe8dc]
call esi
mov edi, eax
test edi, edi
jne 0x4070b6
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 8]
push eax
push edi
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov ecx, dword [ebp - 8]
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x10]
push eax
mov dword [ebp - 0x10], ecx
call sym.ProcessHacker.exe__PhGetClientIdName_4
push eax
call sym.ProcessHacker.exe_PhAutoDereferenceObject
mov ebx, eax
lea eax, [ebp - 0x90]
push 0x40
push eax
push edi
mov dword [ebp - 4], ebx
call dword [sym.imp.USER32.dll_GetClassNameW]
test eax, eax
jne 0x4070f9
mov word [ebp - 0x90], ax
push edi
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
test eax, eax
je 0x40716a
push dword [0x54b7b4]
lea esi, [eax + eax]
lea eax, [esi + 0xa]
push eax
call sym.ProcessHacker.exe_PhCreateObject
mov ebx, eax
xor eax, eax
lea ecx, [ebx + 8]
mov dword [ebx + 4], ecx
mov dword [ebx], esi
mov word [ecx + esi], ax
mov ecx, dword [ebx]
shr ecx, 1
inc ecx
push ecx
push dword [ebx + 4]
push edi
call dword [sym.imp.USER32.dll_GetWindowTextW]
test eax, eax
je 0x40714e
mov esi, ebx
mov ebx, dword [ebp - 4]
push esi
call sym.ProcessHacker.exe_PhAutoDereferenceObject
test eax, eax
je 0x407173
mov eax, dword [eax + 4]
jmp 0x407178
call sym.ProcessHacker.exe_PhReferenceEmptyString
mov esi, eax
lea ecx, [ebx - 8]
or edx, 0xffffffff
lock xadd dword [ecx + 4], edx
dec edx
jne 0x40713c
call fcn.004a2a20
jmp 0x40713c
call sym.ProcessHacker.exe_PhReferenceEmptyString
mov esi, eax
jmp 0x40713f
mov eax, 0x5077f0
push eax
lea eax, [ebp - 0x90]
push eax
push dword [ebx + 4]
push edi
push str.Window_0x_Ix___s_:__s___s_
call fcn.00401400
add esp, 0x14
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x408650
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0xc]
cmp dword [eax], esi
jne 0x408689
cmp dword [eax + 8], 0xffffff65
jne 0x408689
movzx eax, word [eax + 0xc]
sub eax, 0x41
je 0x408689
sub eax, 2
jne 0x408689
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jns 0x408689
push esi
call sym.ProcessHacker.exe__PhCopyListView_4
pop esi
pop ecx
pop ebp
ret 8

Function at 0x409180
Capabilities:
Create process on windows
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x5c
push ebx
push esi
mov dword [esp + 8], ecx
mov ecx, str.kernel32.dll
push edi
call fcn.004a2030
test eax, eax
je 0x4092ed
push 0
mov edx, str.DebugSetProcessKillOnExit
mov ecx, eax
call fcn.004a20e0
mov edi, eax
test edi, edi
je 0x4092ed
mov ecx, str.kernel32.dll
call fcn.004a2030
test eax, eax
je 0x4092ed
push 0
mov edx, str.DebugActiveProcessStop
mov ecx, eax
call fcn.004a20e0
mov esi, eax
test esi, esi
je 0x4092ed
mov ecx, dword fs:[0x18]
xor bh, bh
mov ecx, dword [ecx + 0x30]
push dword [ecx + 0x1c]
call dword [sym.imp.ntdll.dll_RtlEnterCriticalSection]
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov bl, byte [eax + 1]
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov byte [eax + 1], bh
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
push dword [eax + 0x1c]
call dword [sym.imp.ntdll.dll_RtlLeaveCriticalSection]
push 0x44
lea eax, [esp + 0x24]
push 0
push eax
call fcn.004dce30
add esp, 0xc
mov dword [esp + 0x20], 0x44
xor eax, eax
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x24]
push eax
push 0
push 0
push 3
push 0
push 0
push 0
push 0
push dword [esp + 0x30]
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x409290
push 0
mov ecx, edi
call dword [0x4fe8dc]
call edi
push dword [esp + 0x18]
mov ecx, esi
call dword [0x4fe8dc]
call esi
mov bh, 1
mov eax, dword [esp + 0x10]
test eax, eax
je 0x40929f
push eax
call dword [sym.imp.ntdll.dll_NtClose]
mov eax, dword [esp + 0x14]
test eax, eax
je 0x4092ae
push eax
call dword [sym.imp.ntdll.dll_NtClose]
test bl, bl
je 0x4092e4
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
push dword [eax + 0x1c]
call dword [sym.imp.ntdll.dll_RtlEnterCriticalSection]
mov ecx, dword fs:[0x18]
mov ecx, dword [ecx + 0x30]
mov byte [ecx + 1], bl
mov ecx, dword fs:[0x18]
mov ecx, dword [ecx + 0x30]
push dword [ecx + 0x1c]
call dword [sym.imp.ntdll.dll_RtlLeaveCriticalSection]
mov al, bh
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x409fd0
Capabilities:
Delete registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x7c
push ebx
push esi
push edi
push 0
mov edi, edx
mov esi, ecx
push str.RegEdit_RegEdit
mov dword [ebp - 8], edi
xor bl, bl
call dword [sym.imp.USER32.dll_FindWindowW]
mov dword [ebp - 0xc], eax
test eax, eax
jne 0x40a006
push edi
push esi
call sym.ProcessHacker.exe_PhShellOpenKey
mov al, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x28]
push eax
call sym.ProcessHacker.exe_PhGetOwnTokenAttributes
test byte [eax + 4], 1
jne 0x40a02a
push 0
push 0
push esi
call sym.ProcessHacker.exe__PhUiConnectToPhSvcEx_12
test al, al
jne 0x40a02a
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0
push 0
push 0
push 0x546110
push 0xfffffffffffffff7
push 0x20006
lea eax, [ebp - 4]
push eax
call sym.ProcessHacker.exe_PhCreateKey
test eax, eax
js 0x40a10c
mov ecx, 7
lea edi, [ebp - 0x78]
mov esi, str.A_ProcessHacker
lea eax, [ebp - 0x5a]
rep movsd dword es:[edi], dword [esi]
push 0x10
push eax
movsw word es:[edi], word [esi]
call sym.ProcessHacker.exe_PhGenerateRandomAlphaString
lea ecx, [ebp - 0x78]
lea edx, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x40a070
sub ecx, edx
sar ecx, 1
add ecx, ecx
mov word [ebp - 0x14], cx
lea eax, [ecx + 2]
mov word [ebp - 0x12], ax
lea eax, [ebp - 0x78]
mov dword [ebp - 0x10], eax
movzx eax, cx
mov ecx, dword [ebp - 8]
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x78]
mov dword [ebp - 0x20], eax
call fcn.0049f2e0
mov esi, eax
mov eax, dword [esi]
add eax, 2
push eax
push dword [esi + 4]
lea eax, [ebp - 0x14]
push 1
push 0
push eax
push dword [ebp - 4]
call dword [sym.imp.ntdll.dll_NtSetValueKey]
lea ecx, [esi - 8]
or eax, 0xffffffff
lock xadd dword [ecx + 4], eax
dec eax
jne 0x40a0d5
call fcn.004a2a20
lea eax, [ebp - 0x38]
push eax
call sym.ProcessHacker.exe_PhGetOwnTokenAttributes
mov ecx, dword [ebp - 0xc]
lea edx, [ebp - 0x24]
mov al, byte [eax + 4]
not al
and al, 1
movzx eax, al
push eax
call fcn.00409e60
mov bl, al
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 4]
call dword [sym.imp.ntdll.dll_NtDeleteValueKey]
push dword [ebp - 4]
call dword [sym.imp.ntdll.dll_NtClose]
lea eax, [ebp - 0x38]
push eax
call sym.ProcessHacker.exe_PhGetOwnTokenAttributes
test byte [eax + 4], 1
jne 0x40a120
call sym.ProcessHacker.exe__PhUiDisconnectFromPhSvc_0
pop edi
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40dd50
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x488
push ebx
mov ebx, dword [ebp + 8]
lea eax, [ebp - 0x280]
push esi
mov dword [ebp - 0x28], eax
mov esi, ecx
push edi
lea eax, [ebp - 0x488]
mov dword [ebp - 0x3c], 0xd
mov dword [ebp - 0x64], eax
mov edi, edx
lea eax, [ebp - 0x3c]
mov dword [ebp - 0x2c], 0xffffffff
push eax
push 0
push 0x104b
push esi
mov dword [ebp - 0x38], edi
mov dword [ebp - 0x34], 0
mov dword [ebp - 0x24], 0x208
mov dword [ebp - 0x78], 0xd
mov dword [ebp - 0x68], 0xffffffff
mov dword [ebp - 0x74], ebx
mov dword [ebp - 0x70], 0
mov dword [ebp - 0x60], 0x208
call dword [sym.imp.USER32.dll_SendMessageW]
test eax, eax
je 0x40de09
lea eax, [ebp - 0x78]
push eax
push 0
push 0x104b
push esi
call dword [sym.imp.USER32.dll_SendMessageW]
test eax, eax
je 0x40de09
lea eax, [ebp - 0x3c]
mov dword [ebp - 0x38], ebx
push eax
push 0
push 0x104c
push esi
mov dword [ebp - 0x74], edi
call dword [sym.imp.USER32.dll_SendMessageW]
lea eax, [ebp - 0x78]
push eax
push 0
push 0x104c
push esi
call dword [sym.imp.USER32.dll_SendMessageW]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4