joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400ab090
Capabilities:
Allocate thread local storage

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0xb8
lea rax, [rsp + 0x98]
mov qword [rsp + 0x48], rax
mov r8b, 2
lea rdx, [0x140136ab8]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ntdll.dll_RtlInitializeSid]
xor edx, edx
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ntdll.dll_RtlSubAuthoritySid]
mov dword [rax], 0x20
mov edx, 1
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ntdll.dll_RtlSubAuthoritySid]
mov dword [rax], 0x220
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ntdll.dll_RtlLengthSid]
mov eax, eax
mov qword [rsp + 0x60], rax
lea rcx, [0x1401337e0]
call qword [sym.imp.ntdll.dll_RtlLengthSid]
mov eax, eax
mov rcx, qword [rsp + 0x60]
lea rax, [rcx + rax + 0x48]
mov dword [rsp + 0x40], eax
mov eax, dword [rsp + 0x40]
mov ecx, eax
call sym.ProcessHacker.exe_PhAllocate
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
add rax, 0x28
mov qword [rsp + 0x50], rax
mov edx, 1
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ntdll.dll_RtlCreateSecurityDescriptor]
mov eax, dword [rsp + 0x40]
sub rax, 0x28
mov r8d, 2
mov edx, eax
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ntdll.dll_RtlCreateAcl]
mov r9, qword [rsp + 0x48]
mov r8d, 0x1f0001
mov edx, 2
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ntdll.dll_RtlAddAccessAllowedAce]
lea r9, [0x1401337e0]
mov r8d, 1
mov edx, 2
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ntdll.dll_RtlAddAccessAllowedAce]
xor r9d, r9d
mov r8, qword [rsp + 0x50]
mov dl, 1
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ntdll.dll_RtlSetDaclSecurityDescriptor]
mov dword [rsp + 0x68], 0x30
mov qword [rsp + 0x70], 0
mov dword [rsp + 0x80], 0x40
mov rax, qword [rsp + 0xc0]
mov qword [rsp + 0x78], rax
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x88], rax
mov qword [rsp + 0x90], 0
mov dword [rsp + 0x20], 0
mov r9d, 0x78
mov r8d, 8
lea rdx, [rsp + 0x68]
lea rcx, [0x140140ae0]
call qword [sym.imp.ntdll.dll_NtCreatePort]
mov dword [rsp + 0x34], eax
mov rcx, qword [rsp + 0x38]
call sym.ProcessHacker.exe_PhFree
cmp dword [rsp + 0x34], 0
jge 0x1400ab22f
mov eax, dword [rsp + 0x34]
jmp 0x1400ab285
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [0x140140ad8], eax
mov dword [rsp + 0x30], 0
jmp 0x1400ab24f
mov eax, dword [rsp + 0x30]
inc eax
mov dword [rsp + 0x30], eax
cmp dword [rsp + 0x30], 2
jae 0x1400ab281
xor r8d, r8d
lea rdx, [0x1400ab2b0]
xor ecx, ecx
call sym.ProcessHacker.exe_PhCreateThread
mov qword [rsp + 0x58], rax
cmp qword [rsp + 0x58], 0
je 0x1400ab27f
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ntdll.dll_NtClose]
jmp 0x1400ab245
mov eax, dword [rsp + 0x34]
add rsp, 0xb8
ret
Function at 0x1400b9580
Capabilities:
Check processdebugport

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x48
mov qword [rsp + 0x20], 0
mov r9d, 8
lea r8, [rsp + 0x38]
mov edx, 7
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ntdll.dll_NtQueryInformationProcess]
mov dword [rsp + 0x34], eax
cmp dword [rsp + 0x34], 0
jl 0x1400b95e3
cmp qword [rsp + 0x38], 0
je 0x1400b95cf
mov dword [rsp + 0x30], 1
jmp 0x1400b95d7
mov dword [rsp + 0x30], 0
mov rax, qword [rsp + 0x58]
movzx ecx, byte [rsp + 0x30]
mov byte [rax], cl
mov eax, dword [rsp + 0x34]
add rsp, 0x48
ret

Function at 0x1400bb990
Capabilities:
Get system information on windows

Disassembly:
sub rsp, 0x28
xor r9d, r9d
mov r8d, 0x138
lea rdx, [0x140140840]
mov ecx, 2
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
mov rax, qword [0x140140a00]
mov rcx, qword [0x140140848]
sub rcx, rax
mov rax, rcx
mov qword [0x140140a08], rax
mov rax, qword [0x140140848]
mov qword [0x140140a00], rax
mov rax, qword [0x140140820]
mov rcx, qword [0x140140850]
sub rcx, rax
mov rax, rcx
mov qword [0x140140828], rax
mov rax, qword [0x140140850]
mov qword [0x140140820], rax
mov rax, qword [0x140140980]
mov rcx, qword [0x140140858]
sub rcx, rax
mov rax, rcx
mov qword [0x140140988], rax
mov rax, qword [0x140140858]
mov qword [0x140140980], rax
add rsp, 0x28
ret
Function at 0x1400bbf10
Capabilities:
Get system information on windows

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x38
movsx eax, byte [0x140141098]
mov eax, eax
shl rax, 3
xor r9d, r9d
mov r8d, eax
mov rdx, qword [0x140140410]
mov ecx, 0x53
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
jmp 0x1400bbf5b
mov eax, dword [rsp + 0x20]
inc eax
mov dword [rsp + 0x20], eax
movsx eax, byte [0x140141098]
cmp dword [rsp + 0x20], eax
jae 0x1400bbf89
mov eax, dword [rsp + 0x20]
mov rcx, qword [0x140140410]
mov rax, qword [rcx + rax*8]
mov rcx, qword [rsp + 0x28]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
jmp 0x1400bbf51
mov rax, qword [0x1401403b0]
mov rcx, qword [rsp + 0x28]
sub rcx, rax
mov rax, rcx
mov qword [0x1401403b8], rax
mov rax, qword [rsp + 0x28]
mov qword [0x1401403b0], rax
mov rax, qword [rsp + 0x40]
mov rcx, qword [0x1401403b8]
mov qword [rax], rcx
movsx eax, byte [0x140141098]
mov eax, eax
shl rax, 3
xor r9d, r9d
mov r8d, eax
mov rdx, qword [0x1401403f0]
mov ecx, 0x6c
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
jmp 0x1400bbfff
mov eax, dword [rsp + 0x20]
inc eax
mov dword [rsp + 0x20], eax
movsx eax, byte [0x140141098]
cmp dword [rsp + 0x20], eax
jae 0x1400bc02d
mov eax, dword [rsp + 0x20]
mov rcx, qword [0x1401403f0]
mov rax, qword [rcx + rax*8]
mov rcx, qword [rsp + 0x28]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
jmp 0x1400bbff5
mov rax, qword [0x1401403e0]
mov rcx, qword [rsp + 0x28]
sub rcx, rax
mov rax, rcx
mov qword [0x1401403e8], rax
mov rax, qword [rsp + 0x28]
mov qword [0x1401403e0], rax
add rsp, 0x38
ret
Function at 0x1400bf7c0
Capabilities:
Link many functions at runtime

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x28
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov qword [0x14013c838], rax
cmp qword [0x14013c838], 0
je 0x1400bf8f7
lea rdx, [0x140120c54]
mov rcx, qword [0x14013c838]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x14013c7f8], rax
lea rdx, [0x140120c5c]
mov rcx, qword [0x14013c838]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x14013c848], rax
lea rdx, str.Read
mov rcx, qword [0x14013c838]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x14013c828], rax
lea rdx, str.ReadDesktopInfo
mov rcx, qword [0x14013c838]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x14013c840], rax
lea rdx, str.ReadServerInfo
mov rcx, qword [0x14013c838]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x14013d070], rax
lea rdx, [0x140120c90]
mov rcx, qword [0x14013c838]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x14013c810], rax
lea rdx, str.WriteDesktopInfo
mov rcx, qword [0x14013c838]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x14013d058], rax
lea rdx, str.WriteServerInfo
mov rcx, qword [0x14013c838]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x14013c820], rax
lea rdx, [0x140120cc0]
mov rcx, qword [0x14013c838]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x14013c7e8], rax
lea rdx, str.Unlock
mov rcx, qword [0x14013c838]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x14013c818], rax
xor eax, eax
add rsp, 0x28
ret
Function at 0x1400c2e40
Capabilities:
Get system information on windows

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x48
mov rax, qword [rsp + 0x50]
cmp qword [rax + 0x68], 0
jne 0x1400c2f23
movsx eax, byte [0x140141098]
mov eax, eax
shl rax, 3
mov rcx, rax
call sym.ProcessHacker.exe_PhAllocate
mov qword [rsp + 0x30], rax
movsx eax, byte [0x140141098]
mov eax, eax
shl rax, 3
xor r9d, r9d
mov r8d, eax
mov rdx, qword [rsp + 0x30]
mov ecx, 0x53
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
test eax, eax
jl 0x1400c2f17
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
jmp 0x1400c2eb7
mov eax, dword [rsp + 0x20]
inc eax
mov dword [rsp + 0x20], eax
movsx eax, byte [0x140141098]
cmp dword [rsp + 0x20], eax
jae 0x1400c2ee3
mov eax, dword [rsp + 0x20]
mov rcx, qword [rsp + 0x30]
mov rax, qword [rcx + rax*8]
mov rcx, qword [rsp + 0x28]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
jmp 0x1400c2ead
mov rax, qword [rsp + 0x50]
mov rax, qword [rax + 0x5c0]
mov rcx, qword [rsp + 0x28]
sub rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0x50]
mov qword [rcx + 0x5c8], rax
mov rax, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x28]
mov qword [rax + 0x5c0], rcx
mov rcx, qword [rsp + 0x30]
call sym.ProcessHacker.exe_PhFree
jmp 0x1400c2f82
mov rax, qword [rsp + 0x50]
mov rax, qword [rax + 0x70]
cmp qword [rax + 0x48], 0
je 0x1400c2f82
mov rax, qword [rsp + 0x50]
mov rax, qword [rax + 0x70]
lea rdx, [rsp + 0x38]
mov rcx, qword [rax + 0x48]
call fcn.1400ad900
test eax, eax
jl 0x1400c2f82
mov rax, qword [rsp + 0x50]
mov rax, qword [rax + 0x5c0]
mov rcx, qword [rsp + 0x38]
sub rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0x50]
mov qword [rcx + 0x5c8], rax
mov rax, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x38]
mov qword [rax + 0x5c0], rcx
mov rax, qword [rsp + 0x50]
cmp qword [rax + 0x5c0], 0
je 0x1400c2fba
mov dl, 1
mov rax, qword [rsp + 0x50]
mov rcx, qword [rax + 0x5c0]
call sym.ProcessHacker.exe_PhFormatUInt64
mov rcx, qword [rsp + 0x50]
add rcx, 0x800
mov rdx, rax
call fcn.140040cb0
jmp 0x1400c2fcf
mov rax, qword [rsp + 0x50]
add rax, 0x800
xor edx, edx
mov rcx, rax
call fcn.140040cb0
mov rax, qword [rsp + 0x50]
cmp qword [rax + 0x5c8], 0
je 0x1400c3007
mov dl, 1
mov rax, qword [rsp + 0x50]
mov rcx, qword [rax + 0x5c8]
call sym.ProcessHacker.exe_PhFormatUInt64
mov rcx, qword [rsp + 0x50]
add rcx, 0x808
mov rdx, rax
call fcn.140040cb0
jmp 0x1400c301c
mov rax, qword [rsp + 0x50]
add rax, 0x808
xor edx, edx
mov rcx, rax
call fcn.140040cb0
add rsp, 0x48
ret
Function at 0x1400ccc30
Capabilities:
Create service
Delete service
Start service

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0xc8
mov r8d, 2
xor edx, edx
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov qword [rsp + 0x90], rax
cmp qword [rsp + 0x90], 0
jne 0x1400ccc69
call fcn.140021c20
jmp 0x1400cce84
mov rax, qword [rsp + 0xd0]
mov r8, qword [rax + 0x48]
mov rax, qword [0x140140c70]
mov rdx, qword [rax + 8]
lea rcx, str.__s___ras___s_
call sym.ProcessHacker.exe_PhFormatString
mov qword [rsp + 0x98], rax
lea rax, [0x140110d6c]
mov qword [rsp + 0x60], rax
lea rax, str.LocalSystem
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x50], 0
mov qword [rsp + 0x48], 0
mov qword [rsp + 0x40], 0
mov rax, qword [rsp + 0x98]
mov rax, qword [rax + 8]
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], 0
mov dword [rsp + 0x28], 3
mov dword [rsp + 0x20], 0x10
mov r9d, 0xf01ff
mov rax, qword [rsp + 0xd0]
mov r8, qword [rax + 0x48]
mov rax, qword [rsp + 0xd0]
mov rdx, qword [rax + 0x48]
mov rcx, qword [rsp + 0x90]
call qword [sym.imp.ADVAPI32.dll_CreateServiceW]
mov qword [rsp + 0x80], rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x74], eax
mov rcx, qword [rsp + 0x98]
call sym.ProcessHacker.exe_PhDereferenceObject
mov rcx, qword [rsp + 0x90]
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
cmp qword [rsp + 0x80], 0
jne 0x1400ccd8e
cmp dword [rsp + 0x74], 0
jg 0x1400ccd68
mov eax, dword [rsp + 0x74]
mov dword [rsp + 0x88], eax
jmp 0x1400ccd82
mov eax, dword [rsp + 0x74]
and eax, 0xffff
or eax, 0x70000
or eax, 0xc0000000
mov dword [rsp + 0x88], eax
mov eax, dword [rsp + 0x88]
jmp 0x1400cce84
call fcn.1400cca80
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.ADVAPI32.dll_StartServiceW]
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.ADVAPI32.dll_DeleteService]
mov rax, qword [rsp + 0xd0]
mov rdx, qword [rax + 0x48]
lea rcx, str.BaseNamedObjects_
call sym.ProcessHacker.exe_PhConcatStrings2
mov qword [rsp + 0xa0], rax
mov rax, qword [rsp + 0xa0]
lea rdx, [rsp + 0xb0]
mov rcx, rax
call fcn.140023330
mov dword [rsp + 0x78], 0xa
xor edx, edx
lea rcx, [rsp + 0xb0]
call fcn.1400a8220
mov dword [rsp + 0x70], eax
cmp dword [rsp + 0x70], 0
jl 0x1400cce10
jmp 0x1400cce3d
mov qword [rsp + 0xa8], 0xfffffffffff85ee0
lea rdx, [rsp + 0xa8]
xor ecx, ecx
call qword [sym.imp.ntdll.dll_NtDelayExecution]
mov eax, dword [rsp + 0x78]
dec eax
mov dword [rsp + 0x78], eax
cmp dword [rsp + 0x78], 0
jne 0x1400ccdf4
mov rcx, qword [rsp + 0xa0]
call sym.ProcessHacker.exe_PhDereferenceObject
cmp dword [rsp + 0x70], 0
jl 0x1400cce67
mov rcx, qword [rsp + 0xd0]
call fcn.1400a9530
mov dword [rsp + 0x70], eax
call fcn.1400a8420
cmp qword [rsp + 0x80], 0
je 0x1400cce80
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, dword [rsp + 0x70]
add rsp, 0xc8
ret
Function at 0x1400cfd00
Capabilities:
Create directory

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0xa8
lea rdx, str.settings
xor ecx, ecx
call sym.ProcessHacker.exe_mxmlNewElement
mov qword [rsp + 0x58], rax
lea rcx, [0x14013d088]
call fcn.140001210
lea rdx, [rsp + 0x88]
mov rcx, qword [0x1401402f0]
call fcn.14005e840
lea rcx, [rsp + 0x88]
call fcn.14005e8a0
mov qword [rsp + 0x48], rax
cmp qword [rsp + 0x48], 0
je 0x1400cfd99
mov rdx, qword [rsp + 0x48]
mov rax, qword [rsp + 0x48]
mov ecx, dword [rax]
call fcn.1400cf080
mov qword [rsp + 0x70], rax
mov rax, qword [rsp + 0x70]
mov rcx, qword [rsp + 0x48]
add rcx, 8
mov r8, rax
mov rdx, rcx
mov rcx, qword [rsp + 0x58]
call fcn.1400cfc40
mov rcx, qword [rsp + 0x70]
call sym.ProcessHacker.exe_PhDereferenceObject
jmp 0x1400cfd3f
mov dword [rsp + 0x40], 0
jmp 0x1400cfdad
mov eax, dword [rsp + 0x40]
inc eax
mov dword [rsp + 0x40], eax
mov rax, qword [0x1401402f8]
mov eax, dword [rax]
cmp dword [rsp + 0x40], eax
jae 0x1400cfe08
mov eax, dword [rsp + 0x40]
mov rcx, qword [0x1401402f8]
mov rcx, qword [rcx + 8]
mov rax, qword [rcx + rax*8]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x48]
mov rax, qword [rax + 0x28]
mov qword [rsp + 0x80], rax
mov rax, qword [rsp + 0x80]
mov rcx, qword [rsp + 0x48]
add rcx, 8
mov r8, rax
mov rdx, rcx
mov rcx, qword [rsp + 0x58]
call fcn.1400cfc40
jmp 0x1400cfda3
lea rcx, [0x14013d088]
call fcn.1400012a0
lea rdx, [rsp + 0x54]
mov rcx, qword [rsp + 0xb0]
call sym.ProcessHacker.exe_PhGetFullPath
mov qword [rsp + 0x60], rax
cmp qword [rsp + 0x60], 0
je 0x1400cfe7a
cmp dword [rsp + 0x54], 0xffffffff
je 0x1400cfe70
mov eax, dword [rsp + 0x54]
mov r8d, eax
xor edx, edx
mov rcx, qword [rsp + 0x60]
call fcn.140006f30
mov qword [rsp + 0x78], rax
xor r8d, r8d
mov rax, qword [rsp + 0x78]
mov rdx, qword [rax + 8]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHCreateDirectoryExW]
mov rcx, qword [rsp + 0x78]
call sym.ProcessHacker.exe_PhDereferenceObject
mov rcx, qword [rsp + 0x60]
call sym.ProcessHacker.exe_PhDereferenceObject
mov dword [rsp + 0x30], 0x60
mov dword [rsp + 0x28], 5
mov dword [rsp + 0x20], 1
xor r9d, r9d
mov r8d, 0x120116
mov rdx, qword [rsp + 0xb0]
lea rcx, [rsp + 0x68]
call sym.ProcessHacker.exe_PhCreateFileWin32
mov dword [rsp + 0x50], eax
cmp dword [rsp + 0x50], 0
jge 0x1400cfec8
mov rcx, qword [rsp + 0x58]
call sym.ProcessHacker.exe_mxmlDelete
mov eax, dword [rsp + 0x50]
jmp 0x1400cfef5
lea r8, [0x1400cfbc0]
mov rdx, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x58]
call sym.ProcessHacker.exe_mxmlSaveFd
mov rcx, qword [rsp + 0x58]
call sym.ProcessHacker.exe_mxmlDelete
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ntdll.dll_NtClose]
xor eax, eax
add rsp, 0xa8
ret
Function at 0x1400d7f70
Capabilities:
Hide graphical window

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x48
cmp dword [0x14013ee6c], 0
jne 0x1400d7f8c
mov dword [rsp + 0x28], 1
jmp 0x1400d7f94
mov dword [rsp + 0x28], 0
movzx eax, byte [rsp + 0x28]
mov byte [rsp + 0x20], al
mov dword [0x14013ee6c], 1
mov rax, qword [0x14013f018]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x50]
mov qword [0x14013f018], rax
mov dword [rsp + 0x24], 0
jmp 0x1400d7fd3
mov eax, dword [rsp + 0x24]
inc eax
mov dword [rsp + 0x24], eax
mov rax, qword [0x14013edc0]
mov eax, dword [rax]
cmp dword [rsp + 0x24], eax
jae 0x1400d80e6
mov eax, dword [rsp + 0x24]
mov rcx, qword [0x14013edc0]
mov rcx, qword [rcx + 8]
mov rax, qword [rcx + rax*8]
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov eax, dword [rax + 0x98]
and eax, 0xfffffffb
mov rcx, qword [rsp + 0x30]
mov dword [rcx + 0x98], eax
movsxd rax, dword [0x14013ee6c]
mov r9, qword [0x14013f018]
mov r8, rax
mov edx, 3
mov rcx, qword [rsp + 0x30]
mov rax, qword [rsp + 0x30]
call qword [rax + 0x18]
movzx eax, byte [rsp + 0x20]
test eax, eax
je 0x1400d8070
xor r8d, r8d
mov edx, 3
mov rax, qword [rsp + 0x30]
mov rcx, qword [rax + 0x40]
call fcn.1400790e0
mov edx, 5
mov rax, qword [rsp + 0x30]
mov rcx, qword [rax + 0xa8]
call qword [sym.imp.USER32.dll_ShowWindow]
mov rax, qword [0x14013f018]
cmp qword [rsp + 0x30], rax
jne 0x1400d8097
mov rax, qword [rsp + 0x30]
cmp qword [rax + 0xa0], 0
jne 0x1400d8097
mov rcx, qword [rsp + 0x30]
call fcn.1400d83f0
mov rax, qword [rsp + 0x30]
cmp qword [rax + 0xa0], 0
je 0x1400d80e1
mov rax, qword [0x14013f018]
cmp qword [rsp + 0x30], rax
jne 0x1400d80cd
mov edx, 5
mov rax, qword [rsp + 0x30]
mov rcx, qword [rax + 0xa0]
call qword [sym.imp.USER32.dll_ShowWindow]
jmp 0x1400d80e1
xor edx, edx
mov rax, qword [rsp + 0x30]
mov rcx, qword [rax + 0xa0]
call qword [sym.imp.USER32.dll_ShowWindow]
jmp 0x1400d7fc9
mov edx, 5
mov rcx, qword [0x14013ed28]
call qword [sym.imp.USER32.dll_ShowWindow]
mov edx, 5
mov rcx, qword [0x14013ef98]
call qword [sym.imp.USER32.dll_ShowWindow]
mov edx, 5
mov rcx, qword [0x14013edc8]
call qword [sym.imp.USER32.dll_ShowWindow]
mov edx, 0x512
mov rcx, qword [0x14013d108]
call qword [sym.imp.USER32.dll_GetDlgItem]
xor edx, edx
mov rcx, rax
call qword [sym.imp.USER32.dll_ShowWindow]
cmp qword [rsp + 0x38], 0
je 0x1400d815b
mov r8d, 1
xor edx, edx
mov rax, qword [rsp + 0x38]
mov rcx, qword [rax + 0xa8]
call qword [sym.imp.USER32.dll_InvalidateRect]
mov r8d, 1
xor edx, edx
mov rax, qword [rsp + 0x50]
mov rcx, qword [rax + 0xa8]
call qword [sym.imp.USER32.dll_InvalidateRect]
call fcn.1400d7c20
add rsp, 0x48
ret
Function at 0x1400d8180
Capabilities:
Hide graphical window

Disassembly:
sub rsp, 0x38
cmp dword [0x14013ee6c], 0
jne 0x1400d8192
jmp 0x1400d82ac
mov dword [0x14013ee6c], 0
mov qword [0x14013f018], 0
mov dword [rsp + 0x20], 0
jmp 0x1400d81bb
mov eax, dword [rsp + 0x20]
inc eax
mov dword [rsp + 0x20], eax
mov rax, qword [0x14013edc0]
mov eax, dword [rax]
cmp dword [rsp + 0x20], eax
jae 0x1400d825a
mov eax, dword [rsp + 0x20]
mov rcx, qword [0x14013edc0]
mov rcx, qword [rcx + 8]
mov rax, qword [rcx + rax*8]
mov qword [rsp + 0x28], rax
movsxd rax, dword [0x14013ee6c]
xor r9d, r9d
mov r8, rax
mov edx, 3
mov rcx, qword [rsp + 0x28]
mov rax, qword [rsp + 0x28]
call qword [rax + 0x18]
mov r8d, 3
mov edx, 3
mov rax, qword [rsp + 0x28]
mov rcx, qword [rax + 0x40]
call fcn.1400790e0
xor edx, edx
mov rax, qword [rsp + 0x28]
mov rcx, qword [rax + 0xa8]
call qword [sym.imp.USER32.dll_ShowWindow]
mov rax, qword [rsp + 0x28]
cmp qword [rax + 0xa0], 0
je 0x1400d8255
xor edx, edx
mov rax, qword [rsp + 0x28]
mov rcx, qword [rax + 0xa0]
call qword [sym.imp.USER32.dll_ShowWindow]
jmp 0x1400d81b1
xor edx, edx
mov rcx, qword [0x14013ed28]
call qword [sym.imp.USER32.dll_ShowWindow]
xor edx, edx
mov rcx, qword [0x14013ef98]
call qword [sym.imp.USER32.dll_ShowWindow]
xor edx, edx
mov rcx, qword [0x14013edc8]
call qword [sym.imp.USER32.dll_ShowWindow]
mov edx, 0x512
mov rcx, qword [0x14013d108]
call qword [sym.imp.USER32.dll_GetDlgItem]
mov edx, 5
mov rcx, rax
call qword [sym.imp.USER32.dll_ShowWindow]
call fcn.1400d7ac0
add rsp, 0x38
ret
Function at 0x1400d82c0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x68
mov r8d, 5
mov rdx, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov qword [rsp + 0x40], rax
cmp qword [rsp + 0x40], 0
jne 0x1400d8302
xor eax, eax
jmp 0x1400d83e2
mov rdx, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [rsp + 0x30], eax
cmp dword [rsp + 0x30], 0
jne 0x1400d8324
xor eax, eax
jmp 0x1400d83e2
mov rdx, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov qword [rsp + 0x48], rax
cmp qword [rsp + 0x48], 0
jne 0x1400d8348
xor eax, eax
jmp 0x1400d83e2
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_LockResource]
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
jne 0x1400d8364
xor eax, eax
jmp 0x1400d83e2
mov eax, dword [rsp + 0x30]
mov edx, eax
mov rcx, qword [rsp + 0x50]
call fcn.140015d10
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
movzx eax, word [rax + 2]
cmp eax, 0xffff
jne 0x1400d8397
mov rax, qword [rsp + 0x38]
mov dword [rax + 0xc], 0x40000448
jmp 0x1400d83a2
mov rax, qword [rsp + 0x38]
mov dword [rax], 0x40000448
mov rax, qword [rsp + 0x88]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x80]
mov r8, qword [0x14013ed28]
mov rdx, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.USER32.dll_CreateDialogIndirectParamW]
mov qword [rsp + 0x58], rax
mov rcx, qword [rsp + 0x38]
call sym.ProcessHacker.exe_PhFree
mov rax, qword [rsp + 0x58]
add rsp, 0x68
ret
Function at 0x1400d95b0
Capabilities:
Get system information on windows

Disassembly:
push rdi
sub rsp, 0x50
mov qword [rsp + 0x38], 0
mov eax, dword [0x14013f0e8]
imul rax, rax, 0x18
xor r9d, r9d
mov r8d, eax
mov rdx, qword [0x14013f108]
mov ecx, 0x17
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
test eax, eax
jl 0x1400d962a
mov dword [rsp + 0x30], 0
jmp 0x1400d95f9
mov eax, dword [rsp + 0x30]
inc eax
mov dword [rsp + 0x30], eax
mov eax, dword [0x14013f0e8]
cmp dword [rsp + 0x30], eax
jae 0x1400d962a
mov eax, dword [rsp + 0x30]
imul rax, rax, 0x18
mov rcx, qword [0x14013f108]
mov eax, dword [rcx + rax + 4]
mov rcx, qword [rsp + 0x38]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x38], rax
jmp 0x1400d95ef
mov eax, dword [0x14013f0c0]
mov ecx, dword [0x140140968]
sub ecx, eax
mov eax, ecx
mov dword [0x14013f0c4], eax
mov eax, dword [0x140140968]
mov dword [0x14013f0c0], eax
mov eax, dword [0x14013ed30]
mov ecx, dword [0x140140748]
sub ecx, eax
mov eax, ecx
mov dword [0x14013ed34], eax
mov eax, dword [0x140140748]
mov dword [0x14013ed30], eax
mov rax, qword [0x14013ed18]
mov rcx, qword [rsp + 0x38]
sub rcx, rax
mov rax, rcx
mov qword [0x14013ed20], rax
mov rax, qword [rsp + 0x38]
mov qword [0x14013ed18], rax
mov eax, dword [0x14013ec50]
mov ecx, dword [0x140140974]
sub ecx, eax
mov eax, ecx
mov dword [0x14013ec54], eax
mov eax, dword [0x140140974]
mov dword [0x14013ec50], eax
mov eax, dword [0x14013f0e8]
imul rax, rax, 0x18
mov dword [rsp + 0x20], eax
mov r9, qword [0x14013ed38]
xor r8d, r8d
xor edx, edx
mov ecx, 0xb
call qword [sym.imp.ntdll.dll_NtPowerInformation]
test eax, eax
jge 0x1400d96fd
mov eax, dword [0x14013f0e8]
imul rax, rax, 0x18
mov qword [rsp + 0x40], rax
mov rdi, qword [0x14013ed38]
xor eax, eax
mov rcx, qword [rsp + 0x40]
rep stosb byte [rdi], al
cmp dword [sym.ProcessHacker.exe_WindowsVersion], 0x3d
jb 0x1400d9741
cmp qword [0x14013edd8], 0
je 0x1400d971c
mov rcx, qword [0x14013edd8]
call sym.ProcessHacker.exe_PhFree
mov rax, qword [0x14013ec40]
mov qword [0x14013edd8], rax
mov qword [0x14013ec40], 0
lea rcx, [0x14013ec40]
call fcn.1400dafb0
mov eax, dword [0x14013ecfc]
inc eax
mov dword [0x14013ecfc], eax
cmp dword [0x14013ecfc], 2
jbe 0x1400d9762
mov dword [0x14013ecfc], 2
call fcn.1400da490
call fcn.1400da5e0
add rsp, 0x50
pop rdi
ret

Function at 0x1400d9f20
Capabilities:
Hide graphical window

Disassembly:
sub rsp, 0x38
movzx eax, byte [0x14013ecfa]
test eax, eax
jne 0x1400d9f39
mov dword [rsp + 0x24], 5
jmp 0x1400d9f41
mov dword [rsp + 0x24], 0
mov edx, dword [rsp + 0x24]
mov rcx, qword [0x14013eef8]
call qword [sym.imp.USER32.dll_ShowWindow]
mov dword [rsp + 0x20], 0
jmp 0x1400d9f66
mov eax, dword [rsp + 0x20]
inc eax
mov dword [rsp + 0x20], eax
mov eax, dword [0x14013f0e8]
cmp dword [rsp + 0x20], eax
jae 0x1400d9faa
movzx eax, byte [0x14013ecfa]
test eax, eax
je 0x1400d9f87
mov dword [rsp + 0x28], 5
jmp 0x1400d9f8f
mov dword [rsp + 0x28], 0
mov eax, dword [rsp + 0x20]
mov edx, dword [rsp + 0x28]
mov rcx, qword [0x14013ed48]
mov rcx, qword [rcx + rax*8]
call qword [sym.imp.USER32.dll_ShowWindow]
jmp 0x1400d9f5c
add rsp, 0x38
ret