joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41f090
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
test byte [0x54c380], 1
push esi
push edi
jne 0x41f1fc
mov eax, dword [0x54c384]
test eax, eax
je 0x41f0c2
push 0
push dword [eax + 4]
call sym.ProcessHacker.exe_PhGetFullPath
mov esi, eax
mov dword [0x5491d8], esi
jmp 0x41f0c8
mov esi, dword [0x5491d8]
or edi, 0xffffffff
test esi, esi
jne 0x41f12e
push 0x546370
push dword [0x5491d4]
call sym.ProcessHacker.exe_PhConcatStringRef2
mov esi, eax
push dword [esi + 4]
call dword [sym.imp.ntdll.dll_RtlDoesFileExists_U]
test al, al
je 0x41f0f6
mov dword [0x5491d8], esi
jmp 0x41f10e
lea ecx, [esi - 8]
mov eax, edi
lock xadd dword [ecx + 4], eax
dec eax
jne 0x41f108
call fcn.004a2a20
mov esi, dword [0x5491d8]
test esi, esi
jne 0x41f12e
push str.Process_Hacker_settings.xml
push 0x1a
call sym.ProcessHacker.exe_PhGetKnownLocation
mov esi, eax
mov dword [0x5491d8], esi
test esi, esi
je 0x41f1fc
push dword [esi + 4]
call sym.ProcessHacker.exe_PhLoadSettings
cmp eax, 0xc0000102
jne 0x41f1fc
push str.If_you_select_No__the_settings_system_will_not_function_properly.
push str.Process_Hackers_settings_file_is_corrupt._Do_you_want_to_reset_it_
push 0xffff
push 6
push 0
call sym.ProcessHacker.exe_PhShowMessage2
add esp, 0x14
cmp eax, 6
jne 0x41f1dc
mov eax, dword [str._settings___settings_]
mov dword [ebp - 0x24], eax
mov eax, dword [0x52780c]
mov dword [ebp - 0x20], eax
mov eax, dword [0x527810]
mov dword [ebp - 0x1c], eax
mov eax, dword [0x527814]
push 0x60
mov dword [ebp - 0x18], eax
mov eax, dword [0x527818]
push 4
mov dword [ebp - 0x14], eax
mov ax, word [0x52781c]
push 5
mov word [ebp - 0x10], ax
mov eax, dword [0x5491d8]
push 0
push 0x120116
push dword [eax + 4]
lea eax, [ebp - 4]
push eax
call sym.ProcessHacker.exe_PhCreateFileWin32
test eax, eax
js 0x41f1fc
mov esi, dword [ebp - 4]
lea eax, [ebp - 0x24]
push 0
push 0
push 0x15
push eax
lea eax, [ebp - 0xc]
push eax
push 0
push 0
push 0
push esi
call dword [sym.imp.ntdll.dll_NtWriteFile]
push esi
call dword [sym.imp.ntdll.dll_NtClose]
jmp 0x41f1fc
mov ecx, dword [0x5491d8]
add ecx, 0xfffffff8
lock xadd dword [ecx + 4], edi
dec edi
jne 0x41f1f2
call fcn.004a2a20
mov dword [0x5491d8], 0
push str.MaxSizeUnit
call sym.ProcessHacker.exe_PhGetIntegerSetting
push str.SampleCountAutomatic
mov dword [0x5484ac], eax
call sym.ProcessHacker.exe_PhGetIntegerSetting
test eax, eax
je 0x41f23c
push 0x4e
call dword [sym.imp.USER32.dll_GetSystemMetrics]
inc eax
mov ecx, 0x800
cdq
sub eax, edx
sar eax, 1
cmp eax, ecx
cmova eax, ecx
push eax
push str.SampleCount
call sym.ProcessHacker.exe_PhSetIntegerSetting
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4235c0
Capabilities:
Lock the desktop

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
add ecx, 0xffff6320
push esi
push edi
cmp ecx, 0x78
ja case.0x4235de.40166
movzx eax, byte [ecx + 0x423728]
jmp dword [eax*4 + 0x423704]
mov edi, dword [sym.ProcessHacker.exe_PhMainWndHandle]
call dword [sym.imp.USER32.dll_LockWorkStation]
test eax, eax
jne 0x423660
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x423607
push eax
call sym.ProcessHacker.exe_PhGetNtMessage
jmp 0x42360d
push eax
call sym.ProcessHacker.exe_PhGetWin32Message
mov esi, eax
test esi, esi
jne 0x423630
push str.Unable_to_lock_the_computer
push 0x532664
push 0x10
push edi
call sym.ProcessHacker.exe_PhShowMessage
add esp, 0x10
mov al, 1
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push dword [esi + 4]
push 0x52304c
push str.Unable_to_lock_the_computer
push 0xfffe
push 0x20
push edi
call sym.ProcessHacker.exe_PhShowMessage2
add esp, 0x18
lea ecx, [esi - 8]
or eax, 0xffffffff
lock xadd dword [ecx + 4], eax
dec eax
jne 0x423660
call fcn.004a2a20
mov al, 1
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push dword [sym.ProcessHacker.exe_PhMainWndHandle]
call sym.ProcessHacker.exe__PhUiLogoffComputer_4
mov al, 1
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push dword [sym.ProcessHacker.exe_PhMainWndHandle]
call sym.ProcessHacker.exe__PhUiSleepComputer_4
mov al, 1
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push dword [sym.ProcessHacker.exe_PhMainWndHandle]
call sym.ProcessHacker.exe__PhUiHibernateComputer_4
mov al, 1
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push 0
push dword [sym.ProcessHacker.exe_PhMainWndHandle]
call sym.ProcessHacker.exe__PhUiRestartComputer_8
mov al, 1
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push 0x1000000
push dword [sym.ProcessHacker.exe_PhMainWndHandle]
call sym.ProcessHacker.exe__PhUiRestartComputer_8
mov al, 1
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push 0
push dword [sym.ProcessHacker.exe_PhMainWndHandle]
call sym.ProcessHacker.exe__PhUiShutdownComputer_8
mov al, 1
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push 0x400000
push dword [sym.ProcessHacker.exe_PhMainWndHandle]
call sym.ProcessHacker.exe__PhUiShutdownComputer_8
mov al, 1
pop edi
pop esi
mov esp, ebp
pop ebp
ret
pop edi
xor al, al
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x4237b0
Capabilities:
Hide graphical window

Disassembly:
push ebx
push dword [sym.ProcessHacker.exe_PhMainWndHandle]
mov bl, cl
call dword [sym.imp.USER32.dll_IsIconic]
test eax, eax
je 0x4237c7
push 9
jmp 0x4237ed
push dword [sym.ProcessHacker.exe_PhMainWndHandle]
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x4237eb
test bl, bl
je 0x4237f9
push 0
push dword [sym.ProcessHacker.exe_PhMainWndHandle]
call dword [sym.imp.USER32.dll_ShowWindow]
pop ebx
ret
push 5
push dword [sym.ProcessHacker.exe_PhMainWndHandle]
call dword [sym.imp.USER32.dll_ShowWindow]
push dword [sym.ProcessHacker.exe_PhMainWndHandle]
call dword [sym.imp.USER32.dll_SetForegroundWindow]
pop ebx
ret
Function at 0x42a590
Capabilities:
Hide graphical window

Disassembly:
push esi
push edi
push 0x5c
push 4
push dword [0x54b674]
mov edi, edx
mov esi, ecx
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov edx, eax
mov dword [edx], esi
mov dword [edx + 4], edi
lock inc dword [edi - 4]
xor ecx, ecx
cmp dword [edi], ecx
jbe 0x42a5c5
mov eax, dword [edi + 8]
mov eax, dword [eax + ecx*4]
lock inc dword [eax]
inc ecx
cmp ecx, dword [edi]
jb 0x42a5b7
push edx
push 0x42abc0
push 0
push 0xb7
push dword [sym.ProcessHacker.exe_PhInstanceHandle]
call dword [sym.imp.USER32.dll_CreateDialogParamW]
mov esi, eax
push 5
push esi
call dword [sym.imp.USER32.dll_ShowWindow]
push esi
call dword [sym.imp.USER32.dll_SetForegroundWindow]
pop edi
pop esi
ret
Function at 0x42db20
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
mov ebx, dword [0x549a88]
push esi
push edi
mov edi, ecx
cmp edi, ebx
je 0x42dbe6
mov dword [0x549a88], edi
test ebx, ebx
je 0x42db66
mov esi, dword [ebx + 0xc]
mov ecx, esi
push 0
push edi
push 3
push ebx
call dword [0x4fe8dc]
call esi
mov eax, dword [ebx + 0x34]
test eax, eax
je 0x42db66
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
cmp dword [edi + 0x34], 0
jne 0x42dbb6
mov esi, dword [edi + 0xc]
xor eax, eax
push eax
mov dword [ebp - 0x14], eax
mov ecx, esi
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
mov dword [ebp - 4], eax
lea eax, [ebp - 0x14]
push eax
push 5
push edi
call dword [0x4fe8dc]
call esi
test al, al
je 0x42dbb6
cmp byte [ebp - 0x14], 0
jne 0x42dbb6
push dword [ebp - 4]
mov ecx, dword [0x5499b8]
push dword [ebp - 8]
push dword [ebp - 0xc]
push dword [ebp - 0x10]
call fcn.004a3f70
mov dword [edi + 0x34], eax
mov eax, dword [edi + 0x34]
test eax, eax
je 0x42dbc6
push 5
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, edi
call fcn.0042dc40
call fcn.0042dd20
mov esi, dword [edi + 0xc]
mov ecx, esi
push 0
push 0
push 2
push edi
call dword [0x4fe8dc]
call esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x432980
Capabilities:
Check processdebugport

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x549194]
sub esp, 0x2c
add eax, 0x70
mov dword [0x549190], 0x70
push ebx
push esi
push edi
push dword [0x54c298]
mov ebx, ecx
push eax
call sym.ProcessHacker.exe_PhCreateObject
push 0x70
mov edi, eax
push 0
push edi
call fcn.004dce30
add esp, 0xc
push dword [0x54b7c0]
push 0x28
call sym.ProcessHacker.exe_PhCreateObject
mov esi, eax
push 0x80
push 4
push dword [0x54b674]
mov dword [esi], 4
mov dword [esi + 4], 0x432d70
mov dword [esi + 8], 0x432d90
mov dword [esi + 0xc], 0x20
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov ecx, dword [esi + 0xc]
shl ecx, 2
push ecx
push 0xff
push eax
mov dword [esi + 0x10], eax
call fcn.004dce30
mov eax, dword [esi + 0xc]
add esp, 0xc
mov dword [esi + 0x14], eax
lea eax, [eax + eax*2]
shl eax, 2
push eax
push 4
push dword [0x54b674]
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov dword [esi + 0x18], eax
lea ecx, [edi + 0x54]
mov dword [esi + 0x1c], 0
lea eax, [edi + 0x10]
mov dword [esi + 0x20], 0xffffffff
mov edx, 0x410
mov dword [esi + 0x24], 0
mov dword [edi], esi
mov dword [edi + 4], 0
mov dword [edi + 8], 0
mov dword [edi + 0xc], 0
mov dword [eax + 4], eax
mov dword [eax], eax
mov dword [eax + 8], 0
mov dword [eax + 0xc], 0
lea eax, [edi + 0x20]
mov dword [eax + 4], eax
mov dword [eax], eax
mov dword [eax + 8], 0
mov dword [eax + 0xc], 0
lea eax, [edi + 0x30]
mov dword [eax + 4], eax
mov dword [eax], eax
mov dword [eax + 8], 0
mov dword [eax + 0xc], 0
lea eax, [edi + 0x40]
mov dword [eax + 4], eax
mov dword [eax], eax
mov dword [eax + 8], 0
mov dword [eax + 0xc], 0
push ebx
mov dword [edi + 0x50], ebx
mov dword [edi + 0x54], 0
mov dword [edi + 0x58], 0
mov dword [edi + 0x68], 0
call fcn.004ad010
test eax, eax
jns 0x432aea
push ebx
mov edx, 0x1010
lea ecx, [edi + 0x54]
call fcn.004ad010
mov dword [edi + 0x68], eax
cmp dword [sym.ProcessHacker.exe_WindowsVersion], 0x3e
jb 0x432b39
mov ecx, dword [edi + 0x54]
test ecx, ecx
je 0x432b39
call fcn.004d0b00
mov dword [edi + 0x58], eax
cmp dword [sym.ProcessHacker.exe_WindowsVersion], 0x3f
jb 0x432b39
push 0
push 8
lea eax, [ebp - 8]
mov dword [ebp - 8], 7
push eax
push 0x34
push dword [edi + 0x54]
call dword [sym.imp.ntdll.dll_NtQueryInformationProcess]
test eax, eax
js 0x432b39
mov al, byte [edi + 0x6c]
mov cl, byte [ebp - 4]
and al, 0xfe
and cl, 1
or al, cl
mov byte [edi + 0x6c], al
cmp dword [sym.ProcessHacker.exe_WindowsVersion], 0x64
jb 0x432b75
mov eax, dword [edi + 0x54]
test eax, eax
je 0x432b75
push 0
push 0x20
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x28], 0x20
push ecx
push 0
push eax
call dword [sym.imp.ntdll.dll_NtQueryInformationProcess]
test eax, eax
js 0x432b75
mov eax, dword [ebp - 0xc]
shr eax, 8
add al, al
xor al, byte [edi + 0x6c]
and al, 2
xor byte [edi + 0x6c], al
lea eax, [edi + 0x60]
push eax
call dword [sym.imp.ntdll.dll_RtlInitializeSListHead]
push 0
mov edx, edi
mov ecx, 0x10
call fcn.00410510
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x43db30
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x34
lea eax, [esp]
push ebx
push esi
mov esi, dword [edx]
push edi
push dword [edx + 4]
mov edi, ecx
mov ecx, esi
push 1
push eax
call dword [0x4fe8dc]
call esi
test eax, eax
js 0x43dcbc
push 0
push 8
lea eax, [esp + 0x1c]
push eax
push 0
push dword [esp + 0x1c]
call dword [sym.imp.ntdll.dll_NtQueryMutant]
test eax, eax
js 0x43dbcc
push 0xa
lea eax, [esp + 0x28]
push eax
push dword [esp + 0x1c]
call fcn.004dec00
add esp, 0xc
push 0x440
push edi
call dword [sym.imp.USER32.dll_GetDlgItem]
test eax, eax
je 0x43dba7
lea ecx, [esp + 0x24]
push ecx
push 0
push 0xc
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
cmp byte [esp + 0x19], 0
mov eax, str.False
push 0x441
mov esi, str.True
push edi
cmove esi, eax
call dword [sym.imp.USER32.dll_GetDlgItem]
test eax, eax
je 0x43dc0c
push esi
jmp 0x43dc01
push 0x440
push edi
call dword [sym.imp.USER32.dll_GetDlgItem]
test eax, eax
je 0x43dbec
push 0x5254a4
push 0
push 0xc
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
push 0x441
push edi
call dword [sym.imp.USER32.dll_GetDlgItem]
test eax, eax
je 0x43dc0c
push 0x5254a4
push 0
push 0xc
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
push 0
push 8
lea eax, [esp + 0x24]
push eax
push 1
push dword [esp + 0x1c]
call dword [sym.imp.ntdll.dll_NtQueryMutant]
test eax, eax
js 0x43dc92
cmp dword [esp + 0x1c], 0
je 0x43dc7b
lea eax, [esp + 0x1c]
push eax
call sym.ProcessHacker.exe__PhGetClientIdName_4
mov esi, eax
push 0x41e
push edi
mov ebx, dword [esi + 4]
call dword [sym.imp.USER32.dll_GetDlgItem]
test eax, eax
je 0x43dc57
push ebx
push 0
push 0xc
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
lea ecx, [esi - 8]
or eax, 0xffffffff
lock xadd dword [ecx + 4], eax
dec eax
jne 0x43dcb2
call fcn.004a2a20
push dword [esp + 0xc]
call dword [sym.imp.ntdll.dll_NtClose]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0x41e
push edi
call dword [sym.imp.USER32.dll_GetDlgItem]
test eax, eax
je 0x43dcb2
push 0x5291b0
jmp 0x43dca7
push 0x41e
push edi
call dword [sym.imp.USER32.dll_GetDlgItem]
test eax, eax
je 0x43dcb2
push 0x5254a4
push 0
push 0xc
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
push dword [esp + 0xc]
call dword [sym.imp.ntdll.dll_NtClose]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x43dd40
Capabilities:
Map section object

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x44
push ebx
push esi
mov esi, dword [edx]
xor eax, eax
push edi
push dword [edx + 4]
mov dword [esp + 0x20], eax
xor edi, edi
push 5
lea eax, [esp + 0x18]
mov dword [esp + 0x28], ecx
push eax
mov ecx, esi
mov dword [esp + 0x20], edx
mov ebx, 0x5254a4
mov dword [esp + 0x24], edi
call dword [0x4fe8dc]
call esi
test eax, eax
jns 0x43dda1
mov esi, dword [esp + 0x14]
lea eax, [esp + 0x10]
push dword [esi + 4]
mov esi, dword [esi]
mov ecx, esi
push 5
push eax
call dword [0x4fe8dc]
call esi
test eax, eax
js 0x43df25
push 0
push 0x10
lea eax, [esp + 0x30]
push eax
push 0
push dword [esp + 0x20]
call dword [sym.imp.ntdll.dll_NtQuerySection]
test eax, eax
js 0x43de30
mov eax, dword [esp + 0x2c]
test eax, 0x8000000
je 0x43ddcc
mov ebx, 0x529620
jmp 0x43ddf7
test eax, 0x800000
je 0x43ddda
mov ebx, 0x5248b8
jmp 0x43ddf7
test eax, 0x1000000
je 0x43dde8
mov ebx, 0x529654
jmp 0x43ddf7
test eax, 0x4000000
mov eax, str.Reserve
cmove eax, ebx
mov ebx, eax
mov al, byte [0x5484ac]
mov byte [esp + 0x42], al
mov eax, dword [esp + 0x30]
mov dword [esp + 0x48], eax
mov eax, dword [esp + 0x34]
push 0
mov dword [esp + 0x50], eax
lea eax, [esp + 0x3c]
push 1
push eax
mov dword [esp + 0x44], 0x10c
call sym.ProcessHacker.exe_PhFormat
push eax
call sym.ProcessHacker.exe_PhAutoDereferenceObject
mov dword [esp + 0x1c], eax
push 2
push 0
push 1
lea eax, [esp + 0x30]
mov dword [esp + 0x30], 1
push eax
push 0
push 0
push 0
lea eax, [esp + 0x30]
mov dword [esp + 0x30], edi
push eax
push 0xffffffffffffffff
push dword [esp + 0x34]
call dword [sym.imp.ntdll.dll_NtMapViewOfSection]
test eax, eax
js 0x43dea0
lea eax, [esp + 0x18]
push eax
push dword [esp + 0x18]
push 0xffffffffffffffff
call sym.ProcessHacker.exe_PhGetProcessMappedFileName
push dword [esp + 0x14]
mov esi, eax
push 0xffffffffffffffff
call dword [sym.imp.ntdll.dll_NtUnmapViewOfSection]
mov edi, dword [esp + 0x18]
test esi, esi
js 0x43dea0
push edi
call sym.ProcessHacker.exe_PhAutoDereferenceObject
push edi
call sym.ProcessHacker.exe_PhResolveDevicePrefix
test eax, eax
je 0x43dea0
push eax
call sym.ProcessHacker.exe_PhAutoDereferenceObject
mov edi, eax
push 0x408
push dword [esp + 0x24]
call dword [sym.imp.USER32.dll_GetDlgItem]
test eax, eax
je 0x43debf
push ebx
push 0
push 0xc
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x43decc
mov esi, dword [eax + 4]
jmp 0x43ded1
mov esi, 0x5254a4
mov ebx, dword [esp + 0x20]
push 0x44a
push ebx
call dword [sym.imp.USER32.dll_GetDlgItem]
test eax, eax
je 0x43def1
push esi
push 0
push 0xc
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
test edi, edi
je 0x43defa
mov esi, dword [edi + 4]
jmp 0x43deff
mov esi, 0x5291b0
push 0x3ee
push ebx
call dword [sym.imp.USER32.dll_GetDlgItem]
test eax, eax
je 0x43df1b
push esi
push 0
push 0xc
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
push dword [esp + 0x10]
call dword [sym.imp.ntdll.dll_NtClose]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x43f210
Capabilities:
Delete registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
push edi
mov edi, ecx
call fcn.0043f0c0
test al, al
mov ecx, str.Do_you_want_to_make_Process_Hacker_the_default_Windows_Task_Manager_
mov edx, str.Do_you_want_to_restore_the_default_Windows_Task_Manager_
cmove edx, ecx
push edx
push 0x5077f0
push 0xfffd
push 6
push edi
call sym.ProcessHacker.exe_PhShowMessage2
add esp, 0x14
cmp eax, 6
jne 0x43f380
push 0
push 0
push 0x80
push 0x5468c8
push 0xfffffffffffffffd
push 0x2001f
lea eax, [ebp - 4]
push eax
call sym.ProcessHacker.exe_PhCreateKey
mov esi, eax
test esi, esi
js 0x43f2e6
mov dword [ebp - 0x10], 0x120010
mov dword [ebp - 0xc], str.Debugger
call fcn.0043f0c0
test al, al
je 0x43f297
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 4]
call dword [sym.imp.ntdll.dll_NtDeleteValueKey]
jmp 0x43f2d3
mov eax, dword [0x5491d4]
push 0x523054
push dword [eax + 4]
push 0x523054
push 3
call sym.ProcessHacker.exe_PhConcatStrings
add esp, 0x10
push eax
call sym.ProcessHacker.exe_PhAutoDereferenceObject
mov ecx, dword [eax]
add ecx, 2
push ecx
push dword [eax + 4]
lea eax, [ebp - 0x10]
push 1
push 0
push eax
push dword [ebp - 4]
call dword [sym.imp.ntdll.dll_NtSetValueKey]
push dword [ebp - 4]
mov esi, eax
call dword [sym.imp.ntdll.dll_NtClose]
test esi, esi
jns 0x43f36f
cmp esi, 0xc0000022
je 0x43f309
cmp esi, 0xc0000005
je 0x43f309
mov eax, esi
and eax, 0xfff0000
cmp eax, 0x70000
jne 0x43f314
movzx eax, si
jmp 0x43f310
push esi
call dword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
test eax, eax
jne 0x43f31c
push esi
call sym.ProcessHacker.exe_PhGetNtMessage
jmp 0x43f322
push eax
call sym.ProcessHacker.exe_PhGetWin32Message
mov esi, eax
test esi, esi
jne 0x43f33f
push str.Unable_to_replace_Task_Manager
push 0x532664
push 0x10
push edi
call sym.ProcessHacker.exe_PhShowMessage
add esp, 0x10
jmp 0x43f36f
push dword [esi + 4]
push 0x52304c
push str.Unable_to_replace_Task_Manager
push 0xfffe
push 0x20
push edi
call sym.ProcessHacker.exe_PhShowMessage2
add esp, 0x18
lea ecx, [esi - 8]
or eax, 0xffffffff
lock xadd dword [ecx + 4], eax
dec eax
jne 0x43f36f
call fcn.004a2a20
mov eax, dword [0x5491d8]
test eax, eax
je 0x43f380
push dword [eax + 4]
call sym.ProcessHacker.exe_PhSaveSettings
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x458f10
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
push edi
push dword [0x54c158]
mov ebx, edx
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, dword [esi + 4]
mov ecx, dword [eax]
mov eax, dword [esi]
mov edx, dword [ecx + 0x1c]
add edi, edx
add eax, edi
cmp eax, edi
jb 0x458f4b
cmp edi, edx
jb 0x458f4b
cmp eax, dword [ecx + 0x20]
ja 0x458f4b
lea ecx, [ebx - 1]
test edi, ecx
jne 0x458f4b
mov eax, edi
pop edi
pop esi
pop ebx
ret
pop edi
pop esi
xor eax, eax
pop ebx
ret

Function at 0x458fd0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
cmp dword [ebx + 4], 0
je 0x459046
push dword [0x54c158]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, dword [ebx + 4]
mov esi, dword [ebx]
mov eax, dword [eax]
mov edx, dword [eax + 0x1c]
add edi, edx
lea ecx, [esi + edi]
cmp ecx, edi
jb 0x45904c
cmp edi, edx
jb 0x45904c
cmp ecx, dword [eax + 0x20]
ja 0x45904c
test edi, edi
je 0x45904c
push esi
push 0
push dword [0x54b674]
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov esi, eax
test esi, esi
jne 0x45902c
pop edi
pop esi
mov eax, 0xc0000017
pop ebx
pop ebp
ret 0xc
push dword [ebx]
push edi
push esi
call fcn.004dd620
mov eax, dword [ebp + 0x10]
add esp, 0xc
pop edi
mov dword [eax], esi
xor eax, eax
pop esi
pop ebx
pop ebp
ret 0xc
cmp byte [ebp + 0xc], 0
jne 0x459058
pop edi
pop esi
mov eax, 0xc0000005
pop ebx
pop ebp
ret 0xc
mov eax, dword [ebp + 0x10]
xor esi, esi
pop edi
mov dword [eax], esi
xor eax, eax
pop esi
pop ebx
pop ebp
ret 0xc
Function at 0x45bce0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
mov esi, ecx
push 0
push dword [esi + 4]
call sym.ProcessHacker.exe_PhGetFullPath
mov edi, eax
test edi, edi
jne 0x45bd01
mov edi, esi
lock inc dword [esi - 4]
movzx eax, word [edi]
mov word [ebp - 0x10], ax
add eax, 2
mov word [ebp - 0xe], ax
mov eax, dword [edi + 4]
mov dword [ebp - 0xc], eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x10]
mov dword [ebp - 8], 2
push eax
lea eax, [ebp - 8]
push eax
push 0
call dword [sym.imp.ntdll.dll_LdrLoadDll]
mov esi, eax
test esi, esi
js 0x45bd9e
mov eax, dword [ebp - 4]
mov ecx, 0x5a4d
cmp word [eax], cx
je 0x45bd4a
mov esi, 0xc00001a3
jmp 0x45bda1
mov ecx, dword [eax + 0x3c]
test ecx, ecx
je 0x45bd43
cmp ecx, 0x10000000
jae 0x45bd43
cmp dword [ecx + eax], 0x4550
lea ebx, [ecx + eax]
je 0x45bd6c
mov esi, 0xc00001a3
jmp 0x45bda1
mov edx, ebx
mov ecx, eax
call fcn.004a22f0
mov esi, eax
test esi, esi
js 0x45bd9e
mov ecx, dword [ebx + 0x28]
mov eax, dword [ebp - 4]
test ecx, ecx
jne 0x45bd8c
mov esi, 0xc0000229
jmp 0x45bda1
push 0
push 1
add ecx, eax
push eax
call ecx
test al, al
jne 0x45bdac
mov esi, 0xc0000142
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ntdll.dll_LdrUnloadDll]
test esi, esi
js 0x45bdc8
lea ecx, [edi - 8]
or eax, 0xffffffff
lock xadd dword [ecx + 4], eax
dec eax
jne 0x45bdbf
call fcn.004a2a20
mov al, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push esi
call sym.ProcessHacker.exe_PhGetNtMessage
push 8
push 4
push dword [0x54b674]
mov ebx, eax
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov dword [ebp - 8], eax
lea ecx, [edi - 4]
mov dword [eax], edi
lock inc dword [ecx]
mov dword [eax + 4], ebx
test ebx, ebx
je 0x45bdf6
lock inc dword [ebx - 4]
mov esi, dword [0x54a038]
test esi, esi
jne 0x45be35
push dword [0x54b7b0]
push 0xc
call sym.ProcessHacker.exe_PhCreateObject
push 8
mov esi, eax
push 4
push dword [0x54b674]
mov dword [esi], 0
mov dword [esi + 4], 2
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov dword [esi + 8], eax
mov dword [0x54a038], esi
mov eax, dword [esi + 4]
cmp dword [esi], eax
jne 0x45be59
add eax, eax
mov dword [esi + 4], eax
shl eax, 2
push eax
push dword [esi + 8]
push 4
push dword [0x54b674]
call dword [sym.imp.ntdll.dll_RtlReAllocateHeap]
mov dword [esi + 8], eax
mov ecx, dword [esi]
mov eax, dword [esi + 8]
mov edx, dword [ebp - 8]
mov dword [eax + ecx*4], edx
inc dword [esi]
or esi, 0xffffffff
test ebx, ebx
je 0x45be7f
lea ecx, [ebx - 8]
mov eax, esi
lock xadd dword [ecx + 4], eax
dec eax
jne 0x45be7f
call fcn.004a2a20
lea eax, [edi - 4]
lock xadd dword [eax], esi
dec esi
jne 0x45be91
lea ecx, [edi - 8]
call fcn.004a2a20
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret