joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140063fe0
Capabilities:
Allocate thread local storage

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x70
mov rbp, rcx
lea rdx, [0x140154778]
lea rcx, [rsp + 0x30]
mov r8b, 2
call qword [sym.imp.ntdll.dll_RtlInitializeSid]
xor edx, edx
lea rcx, [rsp + 0x30]
call qword [sym.imp.ntdll.dll_RtlSubAuthoritySid]
mov edx, 1
lea rcx, [rsp + 0x30]
mov dword [rax], 0x20
call qword [sym.imp.ntdll.dll_RtlSubAuthoritySid]
lea rcx, [0x140157168]
mov dword [rax], 0x220
call qword [sym.imp.ntdll.dll_RtlLengthSid]
lea rcx, [rsp + 0x30]
mov ebx, eax
call qword [sym.imp.ntdll.dll_RtlLengthSid]
mov rcx, qword [sym.ProcessHacker.exe_PhHeapHandle]
mov edx, 4
add eax, 0x48
add ebx, eax
mov r8d, ebx
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov rcx, rax
mov edx, 1
mov rsi, rax
call qword [sym.imp.ntdll.dll_RtlCreateSecurityDescriptor]
lea edx, [rbx - 0x28]
mov ebx, 2
mov r8d, ebx
lea rcx, [rsi + 0x28]
call qword [sym.imp.ntdll.dll_RtlCreateAcl]
lea r9, [rsp + 0x30]
mov r8d, 0x1f0001
mov edx, ebx
lea rcx, [rsi + 0x28]
call qword [sym.imp.ntdll.dll_RtlAddAccessAllowedAce]
lea r9, [0x140157168]
mov edx, ebx
lea r8d, [rbx - 1]
lea rcx, [rsi + 0x28]
call qword [sym.imp.ntdll.dll_RtlAddAccessAllowedAce]
xor r9d, r9d
lea r8, [rsi + 0x28]
mov dl, 1
mov rcx, rsi
call qword [sym.imp.ntdll.dll_RtlSetDaclSecurityDescriptor]
xor eax, eax
mov dword [rsp + 0x40], 0x30
mov r9d, 0xb0
mov qword [rsp + 0x48], rax
lea r8d, [rbx + 2]
mov qword [rsp + 0x68], rax
lea rdx, [rsp + 0x40]
mov dword [rsp + 0x20], eax
lea rcx, [0x140160338]
mov dword [rsp + 0x58], 0x40
mov qword [rsp + 0x50], rbp
mov qword [rsp + 0x60], rsi
call qword [sym.imp.ntdll.dll_NtCreatePort]
mov rcx, qword [sym.ProcessHacker.exe_PhHeapHandle]
mov r8, rsi
xor edx, edx
mov edi, eax
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
test edi, edi
js 0x140064165
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [0x140160330], eax
nop dword [rax]
xor r8d, r8d
lea rdx, [0x140064180]
xor ecx, ecx
call sym.ProcessHacker.exe_PhCreateThread
test rax, rax
je 0x14006415f
mov rcx, rax
call qword [sym.imp.ntdll.dll_NtClose]
sub rbx, 1
jne 0x140064140
lea r11, [rsp + 0x70]
mov eax, edi
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x1400746f0
Capabilities:
Get system information on windows

Disassembly:
sub rsp, 0x28
xor r9d, r9d
lea rdx, [0x1401600e0]
mov r8d, 0x158
lea ecx, [r9 + 2]
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
mov rcx, qword [0x1401600e8]
mov rax, rcx
sub rax, qword [0x140160240]
mov qword [0x140160248], rax
mov qword [0x140160240], rcx
mov rcx, qword [0x1401600f0]
mov rax, rcx
sub rax, qword [0x1401600c0]
mov qword [0x1401600c8], rax
mov qword [0x1401600c0], rcx
mov rcx, qword [0x1401600f8]
mov rax, rcx
sub rax, qword [0x1401600b0]
mov qword [0x1401600b8], rax
mov qword [0x1401600b0], rcx
add rsp, 0x28
ret
Function at 0x140074a60
Capabilities:
Get system information on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r14
push r15
sub rsp, 0x20
movsx r8d, byte [0x14015f058]
xor r9d, r9d
mov rdx, qword [0x14015fdc8]
mov r15, rcx
shl r8d, 3
lea ecx, [r9 + 0x53]
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
movsx edi, byte [0x14015f058]
xor ebx, ebx
mov r14, qword [0x14015fdc8]
mov r11d, ebx
mov edx, ebx
lea esi, [rbx + 2]
cmp edi, 4
jb 0x140074b27
mov eax, edi
mov r9d, edi
and eax, 3
xorps xmm2, xmm2
sub r9d, eax
movdqa xmm1, xmm2
mov r8d, esi
nop
mov eax, edx
add edx, 4
movq xmm0, qword [r14 + rax*8]
lea eax, [r8 - 1]
movhpd xmm0, qword [r14 + rax*8]
mov eax, r8d
paddq xmm0, xmm2
movdqa xmm2, xmm0
movq xmm0, qword [r14 + rax*8]
lea eax, [r8 + 1]
movhpd xmm0, qword [r14 + rax*8]
add r8d, 4
paddq xmm0, xmm1
movdqa xmm1, xmm0
cmp edx, r9d
jb 0x140074ad0
paddq xmm1, xmm2
movdqa xmm0, xmm1
psrldq xmm0, 8
paddq xmm1, xmm0
movq r11, xmm1
mov r8, rbx
mov r9, rbx
cmp edx, edi
jae 0x140074b72
mov eax, edi
sub eax, edx
cmp eax, esi
jb 0x140074b61
mov eax, edx
lea rcx, [r14 + rax*8]
mov eax, edi
sub eax, edx
sub eax, esi
shr eax, 1
inc eax
mov r10d, eax
lea edx, [rdx + rax*2]
nop
add r8, qword [rcx]
add r9, qword [rcx + 8]
lea rcx, [rcx + 0x10]
sub r10, 1
jne 0x140074b50
cmp edx, edi
jae 0x140074b6b
mov eax, edx
add r11, qword [r14 + rax*8]
lea rax, [r9 + r8]
add r11, rax
mov rdx, qword [0x14015fd98]
lea r8d, [rdi*8]
xor r9d, r9d
mov rax, r11
sub rax, qword [0x14015fd70]
mov qword [0x14015fd78], rax
mov qword [0x14015fd70], r11
lea ecx, [r9 + 0x6c]
mov qword [r15], rax
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
movsx r11d, byte [0x14015f058]
mov r10, rbx
mov rdi, qword [0x14015fd98]
mov edx, ebx
cmp r11d, 4
jb 0x140074c2f
mov eax, r11d
mov r8d, r11d
and eax, 3
xorps xmm2, xmm2
sub r8d, eax
movdqa xmm1, xmm2
nop word [rax + rax]
mov eax, edx
add edx, 4
movq xmm0, qword [rdi + rax*8]
lea eax, [rsi - 1]
movhpd xmm0, qword [rdi + rax*8]
mov eax, esi
paddq xmm0, xmm2
movdqa xmm2, xmm0
movq xmm0, qword [rdi + rax*8]
lea eax, [rsi + 1]
movhpd xmm0, qword [rdi + rax*8]
add esi, 4
paddq xmm0, xmm1
movdqa xmm1, xmm0
cmp edx, r8d
jb 0x140074be0
paddq xmm1, xmm2
movdqa xmm0, xmm1
psrldq xmm0, 8
paddq xmm1, xmm0
movq r10, xmm1
mov r8, rbx
cmp edx, r11d
jae 0x140074c83
mov eax, r11d
sub eax, edx
cmp eax, 2
jb 0x140074c71
mov eax, edx
lea rcx, [rdi + rax*8]
mov eax, r11d
sub eax, edx
sub eax, 2
shr eax, 1
inc eax
mov r9d, eax
lea edx, [rdx + rax*2]
nop dword [rax]
add rbx, qword [rcx]
add r8, qword [rcx + 8]
lea rcx, [rcx + 0x10]
sub r9, 1
jne 0x140074c60
cmp edx, r11d
jae 0x140074c7c
mov eax, edx
add r10, qword [rdi + rax*8]
lea rax, [r8 + rbx]
add r10, rax
mov rbx, qword [rsp + 0x30]
mov rax, r10
sub rax, qword [0x14015fd80]
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x40]
mov r14, qword [rsp + 0x48]
mov qword [0x14015fd88], rax
mov qword [0x14015fd80], r10
add rsp, 0x20
pop r15
ret
Function at 0x1400822a0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
mov rax, rsp
mov dword [rax + 0x20], r9d
mov qword [rax + 0x18], r8
mov qword [rax + 8], rcx
push rbx
push rsi
push rdi
push r12
sub rsp, 0x288
mov ecx, dword [0x14015ec30]
xor ebx, ebx
mov rsi, qword [0x14015de18]
mov edi, edx
mov r12, qword [0x14015de10]
mov dword [rsp + 0x50], ebx
mov qword [rax - 0x50], rbx
mov qword [rax - 0x48], rbx
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ecx, dword [0x14015ec30]
lea rdx, [rsp + 0x50]
mov qword [rsp + 0x268], rax
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
jne 0x14008230e
mov ecx, 0xc0000001
call qword [sym.imp.ntdll.dll_RtlRaiseStatus]
int3
mov qword [rsp + 0x2b8], rbp
lea r9, [rsp + 0x2c0]
mov qword [rsp + 0x280], r13
lea r8, [rsp + 0x40]
mov qword [rsp + 0x278], r14
lea rdx, [rsp + 0x48]
mov qword [rsp + 0x270], r15
mov rcx, r12
lea r15d, [rdi + 1]
mov dword [rsp + 0x2b0], r15d
call fcn.1400c8940
mov ebp, dword [rsp + 0x2c0]
lea rcx, [rsp + 0x2c0]
mov r8d, ebp
mov edx, r15d
call fcn.1400c8380
mov r13, qword [rsp + 0x40]
mov r14, qword [rsp + 0x2c0]
test ebp, ebp
je 0x1400823d2
mov rdi, rbx
mov r15d, ebp
nop word [rax + rax]
mov rcx, qword [rdi + r13]
or rdx, 0xffffffffffffffff
nop dword [rax + rax]
inc rdx
cmp word [rcx + rdx*2], bx
jne 0x1400823a0
add rdx, rdx
call sym.ProcessHacker.exe_PhCreateStringEx
mov rcx, rax
call sym.ProcessHacker.exe_PhAutoDereferenceObject
mov rcx, qword [r14]
mov qword [rdi + rcx], rax
add rdi, 8
sub r15, 1
jne 0x140082390
mov r15d, dword [rsp + 0x2b0]
mov rdi, qword [rsp + 0x48]
mov dword [rsp + 0x2c0], 1
cmp dword [rsi], ebx
jbe 0x140082424
nop word [rax + rax]
mov rdx, qword [rsi + 8]
lea rcx, [rsp + 0x2c0]
mov eax, ebx
mov r9, r14
mov dword [rsp + 0x30], ebp
xor r8d, r8d
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rcx
mov rcx, r12
mov rdx, qword [rdx + rax*8]
call fcn.1400820c0
inc ebx
cmp ebx, dword [rsi]
jb 0x1400823f0
mov rcx, qword [sym.ProcessHacker.exe_PhHeapHandle]
mov r8, rdi
xor edx, edx
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
mov rcx, qword [sym.ProcessHacker.exe_PhHeapHandle]
mov r8, r13
xor edx, edx
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
mov r9d, dword [rsp + 0x2c8]
mov r8d, ebp
mov edx, r15d
mov rcx, r14
call fcn.1400c8460
lea rcx, [rsp + 0x50]
mov rbx, rax
call sym.ProcessHacker.exe_PhDrainAutoPool
mov ecx, dword [0x14015ec30]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov r15, qword [rsp + 0x270]
lea rcx, [rsp + 0x50]
mov r14, qword [rsp + 0x278]
mov r13, qword [rsp + 0x280]
mov rbp, qword [rsp + 0x2b8]
cmp rax, rcx
je 0x1400824ad
mov ecx, 0xc0000001
call qword [sym.imp.ntdll.dll_RtlRaiseStatus]
int3
mov rdx, qword [rsp + 0x268]
mov ecx, dword [0x14015ec30]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
jne 0x1400824d1
mov ecx, 0xc0000001
call qword [sym.imp.ntdll.dll_RtlRaiseStatus]
int3
mov r8, qword [rsp + 0x260]
test r8, r8
je 0x1400824ed
mov rcx, qword [sym.ProcessHacker.exe_PhHeapHandle]
xor edx, edx
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
mov rax, rbx
add rsp, 0x288
pop r12
pop rdi
pop rsi
pop rbx
ret
Function at 0x1400839d0
Capabilities:
Create service
Delete service
Start service

Disassembly:
push rbp
push r13
sub rsp, 0x98
xor edx, edx
mov r13, rcx
xor ecx, ecx
lea r8d, [rdx + 2]
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov rbp, rax
test rax, rax
jne 0x140083a15
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x140083bdf
movzx eax, ax
or eax, 0xc0070000
add rsp, 0x98
pop r13
pop rbp
ret
mov rdx, qword [0x1401604c8]
lea rcx, str.__s___ras___s_
mov r8, qword [r13 + 0x48]
mov qword [rsp + 0xb0], rbx
mov qword [rsp + 0xc8], rsi
mov rdx, qword [rdx + 8]
mov qword [rsp + 0x90], rdi
mov qword [rsp + 0x88], r14
call sym.ProcessHacker.exe_PhFormatString
mov rdx, qword [r13 + 0x48]
mov rbx, rax
lea rax, [0x14010bbd8]
mov r9d, 0xf01ff
mov qword [rsp + 0x60], rax
mov r8, rdx
lea rax, str.LocalSystem
mov rcx, qword [rbx + 8]
mov qword [rsp + 0x58], rax
xor eax, eax
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rcx
mov rcx, rbp
mov dword [rsp + 0x30], eax
mov dword [rsp + 0x28], 3
mov dword [rsp + 0x20], 0x10
call qword [sym.imp.ADVAPI32.dll_CreateServiceW]
mov r14, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
or esi, 0xffffffff
lea rcx, [rbx - 0x10]
mov edx, esi
mov edi, eax
lock xadd dword [rcx + 8], edx
cmp edx, 1
jne 0x140083ad2
call fcn.1400ae580
mov rcx, rbp
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
test r14, r14
jne 0x140083af4
test edi, edi
jle 0x140083aed
movzx edi, di
or edi, 0xc0070000
mov eax, edi
jmp 0x140083bbf
mov qword [rsp + 0x80], r15
call fcn.140083840
xor r8d, r8d
xor edx, edx
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_StartServiceW]
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_DeleteService]
mov rdx, qword [r13 + 0x48]
lea rcx, str.BaseNamedObjects_
call sym.ProcessHacker.exe_PhConcatStrings2
mov r15, rax
mov edi, 0xa
movzx ecx, word [rax]
mov word [rsp + 0x70], cx
movzx ecx, word [rax]
mov word [rsp + 0x72], cx
mov rcx, qword [rax + 8]
mov qword [rsp + 0x78], rcx
nop dword [rax]
lea rcx, [rsp + 0x70]
call fcn.14005f6b0
mov ebx, eax
test eax, eax
jns 0x140083b81
lea rdx, [rsp + 0xc0]
mov qword [rsp + 0xc0], 0xfffffffffff85ee0
xor ecx, ecx
call qword [sym.imp.ntdll.dll_NtDelayExecution]
add edi, 0xffffffff
jne 0x140083b50
lea rcx, [r15 - 0x10]
lock xadd dword [rcx + 8], esi
mov r15, qword [rsp + 0x80]
cmp esi, 1
jne 0x140083b9c
call fcn.1400ae580
test ebx, ebx
js 0x140083bb4
mov rdx, r13
mov ecx, 0xc
call fcn.14005fa90
mov ebx, eax
call fcn.14005f830
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, ebx
mov rdi, qword [rsp + 0x90]
mov rsi, qword [rsp + 0xc8]
mov rbx, qword [rsp + 0xb0]
mov r14, qword [rsp + 0x88]
add rsp, 0x98
pop r13
pop rbp
ret
Function at 0x140093a80
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x48
mov edx, 1
mov qword [rsp + 0x30], rcx
lea rcx, [rsp + 0x20]
mov word [rsp + 0x24], dx
xor r8d, r8d
mov dword [rsp + 0x20], 0x4c
call sym.ProcessHacker.exe_PhFormat
mov rcx, rax
add rsp, 0x48
jmp sym.ProcessHacker.exe_PhAutoDereferenceObject

Function at 0x140093d60
Capabilities:
Get system information on windows

Disassembly:
push rbx
sub rsp, 0x30
movsx eax, byte [0x14015f058]
xor ebx, ebx
mov rcx, qword [sym.ProcessHacker.exe_PhHeapHandle]
mov r8d, eax
shl r8, 3
lea edx, [rbx + 4]
mov qword [0x14015eaa0], rbx
mov qword [0x14015e738], rbx
mov qword [0x14015eb50], rbx
mov qword [0x14015eb58], rbx
mov qword [0x14015eaf0], rbx
mov dword [0x14015defc], eax
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov rcx, qword [sym.ProcessHacker.exe_PhHeapHandle]
lea edx, [rbx + 4]
mov qword [0x14015e858], rax
mov eax, dword [0x14015defc]
lea r8, [rax + rax*2]
shl r8, 4
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov rcx, qword [sym.ProcessHacker.exe_PhHeapHandle]
lea edx, [rbx + 4]
mov qword [0x14015e730], rax
mov eax, dword [0x14015defc]
lea r8, [rax + rax*2]
shl r8, 3
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov rcx, qword [sym.ProcessHacker.exe_PhHeapHandle]
lea edx, [rbx + 4]
mov qword [0x14015ead0], rax
mov eax, dword [0x14015defc]
lea r8, [rax + rax*2]
shl r8, 3
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov edx, dword [0x14015defc]
xorps xmm0, xmm0
mov qword [0x14015eac8], rax
xorps xmm1, xmm1
mov dword [0x14015ebb0], ebx
mov r9, rax
mov byte [0x14015ebb4], bl
mov dword [0x14015ebc8], 0xffffffff
movdqu xmmword [0x14015eba0], xmm0
movdqu xmmword [0x14015ebb8], xmm1
test edx, edx
je 0x140093e96
mov rax, qword [0x14015e730]
mov ecx, edx
add rax, 8
nop dword [rax + rax]
mov dword [rax + 8], ebx
mov qword [rax - 8], rbx
mov qword [rax], rbx
mov byte [rax + 0xc], bl
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbx
mov dword [rax + 0x20], 0xffffffff
lea rax, [rax + 0x30]
sub rcx, 1
jne 0x140093e70
lea eax, [rdx + rdx*2]
mov dword [0x14015e998], ebx
xor edx, edx
shl eax, 3
xor r8d, r8d
mov dword [rsp + 0x20], eax
lea ecx, [rdx + 0xb]
call qword [sym.imp.ntdll.dll_NtPowerInformation]
test eax, eax
jns 0x140093ed4
mov eax, dword [0x14015defc]
xor edx, edx
mov rcx, qword [0x14015eac8]
lea r8, [rax + rax*2]
shl r8, 3
call fcn.1400e3c20
cmp dword [sym.ProcessHacker.exe_WindowsVersion], 0x3d
mov qword [0x14015eb30], rbx
mov qword [0x14015e740], rbx
jb 0x140093ef5
add rsp, 0x30
pop rbx
jmp fcn.140095bc0
add rsp, 0x30
pop rbx
ret
Function at 0x1400940e0
Capabilities:
Get system information on windows

Disassembly:
sub rsp, 0x38
mov eax, dword [0x14015defc]
xor r9d, r9d
mov rdx, qword [0x14015ead0]
mov qword [rsp + 0x40], rbx
xor ebx, ebx
lea r8d, [rax + rax*2]
shl r8d, 3
lea ecx, [rbx + 0x17]
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
mov r10d, dword [0x14015defc]
test eax, eax
js 0x14009417f
xor edx, edx
mov qword [rsp + 0x30], rdi
mov rdi, qword [0x14015ead0]
xor r8d, r8d
xor r11d, r11d
cmp r10d, 2
jb 0x140094166
lea eax, [r10 - 2]
shr eax, 1
lea rcx, [rdi + 0x1c]
inc eax
mov r9d, eax
lea r11d, [rax + rax]
nop dword [rax]
nop dword [rax + rax]
mov eax, dword [rcx - 0x18]
lea rcx, [rcx + 0x30]
add rdx, rax
mov eax, dword [rcx - 0x30]
add r8, rax
sub r9, 1
jne 0x140094150
cmp r11d, r10d
jae 0x140094173
lea rcx, [r11 + r11*2]
mov ebx, dword [rdi + rcx*8 + 4]
mov rdi, qword [rsp + 0x30]
lea rax, [r8 + rdx]
add rbx, rax
mov ecx, dword [0x140160208]
xor edx, edx
mov r9, qword [0x14015eac8]
mov eax, ecx
sub eax, dword [0x14015eaa0]
xor r8d, r8d
mov dword [0x14015eaa4], eax
mov dword [0x14015eaa0], ecx
mov ecx, dword [0x14015fd68]
mov eax, ecx
sub eax, dword [0x14015e738]
mov dword [0x14015e73c], eax
mov rax, rbx
sub rax, qword [0x14015eb50]
mov qword [0x14015eb58], rax
mov dword [0x14015e738], ecx
mov ecx, dword [0x140160214]
mov eax, ecx
sub eax, dword [0x14015eaf0]
mov dword [0x14015eaf4], eax
lea eax, [r10 + r10*2]
shl eax, 3
mov dword [0x14015eaf0], ecx
lea ecx, [rdx + 0xb]
mov dword [rsp + 0x20], eax
mov qword [0x14015eb50], rbx
call qword [sym.imp.ntdll.dll_NtPowerInformation]
mov rbx, qword [rsp + 0x40]
test eax, eax
jns 0x14009422a
mov eax, dword [0x14015defc]
xor edx, edx
mov rcx, qword [0x14015eac8]
lea r8, [rax + rax*2]
shl r8, 3
call fcn.1400e3c20
cmp dword [sym.ProcessHacker.exe_WindowsVersion], 0x3d
jb 0x14009426c
mov r8, qword [0x14015e740]
test r8, r8
je 0x14009424e
mov rcx, qword [sym.ProcessHacker.exe_PhHeapHandle]
xor edx, edx
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
mov rax, qword [0x14015eb30]
mov qword [0x14015e740], rax
mov qword [0x14015eb30], 0
call fcn.140095bc0
mov eax, dword [0x14015e998]
mov ecx, 2
inc eax
cmp eax, ecx
cmova eax, ecx
mov dword [0x14015e998], eax
call fcn.140095080
add rsp, 0x38
jmp fcn.1400951c0
Function at 0x140095bc0
Capabilities:
Get system information on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x20
mov rcx, qword [sym.ProcessHacker.exe_PhHeapHandle]
mov edx, 4
mov r8d, 0x100
mov dword [rsp + 0x30], 0x100
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov r8d, dword [rsp + 0x30]
lea r9, [rsp + 0x30]
mov rdx, rax
mov ecx, 0x64
mov rsi, rax
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
xor ebx, ebx
mov edi, eax
cmp eax, 0xc0000004
jne 0x140095c74
nop word [rax + rax]
cmp ebx, 8
jae 0x140095c74
mov rcx, qword [sym.ProcessHacker.exe_PhHeapHandle]
mov r8, rsi
xor edx, edx
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
mov r8d, dword [rsp + 0x30]
mov edx, 4
mov rcx, qword [sym.ProcessHacker.exe_PhHeapHandle]
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov r8d, dword [rsp + 0x30]
lea r9, [rsp + 0x30]
mov rdx, rax
mov ecx, 0x64
mov rsi, rax
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
inc ebx
mov edi, eax
cmp eax, 0xc0000004
je 0x140095c20
test edi, edi
js 0x140095c91
mov qword [0x14015eb30], rsi
mov eax, edi
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
mov rcx, qword [sym.ProcessHacker.exe_PhHeapHandle]
mov r8, rsi
xor edx, edx
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
mov rbx, qword [rsp + 0x38]
mov eax, edi
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret

Function at 0x1400962a0
Capabilities:
Get system information on windows

Disassembly:
sub rsp, 0x28
mov ecx, dword [0x140160158]
mov eax, ecx
sub eax, dword [0x14015e888]
mov dword [0x14015e88c], eax
mov dword [0x14015e888], ecx
mov ecx, dword [0x14016015c]
mov eax, ecx
sub eax, dword [0x14015eb98]
mov dword [0x14015eb9c], eax
mov dword [0x14015eb98], ecx
mov ecx, dword [0x140160160]
mov eax, ecx
sub eax, dword [0x14015e9f8]
mov dword [0x14015e9fc], eax
mov dword [0x14015e9f8], ecx
mov ecx, dword [0x140160164]
mov eax, ecx
sub eax, dword [0x14015e9e0]
mov dword [0x14015e9e4], eax
mov dword [0x14015e9e0], ecx
mov ecx, dword [0x14016011c]
mov eax, ecx
sub eax, dword [0x14015eb80]
mov dword [0x14015eb84], eax
mov dword [0x14015eb80], ecx
mov ecx, dword [0x140160130]
mov eax, ecx
sub eax, dword [0x14015e880]
mov dword [0x14015e884], eax
mov dword [0x14015e880], ecx
mov ecx, dword [0x140160140]
mov eax, ecx
sub eax, dword [0x14015e840]
mov dword [0x14015e844], eax
mov dword [0x14015e840], ecx
mov ecx, dword [0x140160148]
mov eax, ecx
sub eax, dword [0x14015e980]
mov dword [0x14015e984], eax
mov eax, dword [0x14015eb74]
inc eax
mov dword [0x14015e980], ecx
mov ecx, 2
cmp eax, ecx
cmova eax, ecx
mov dword [0x14015eb74], eax
call fcn.140096f50
add rsp, 0x28
jmp fcn.140097040
Function at 0x1400a3350
Capabilities:
Write file on windows

Disassembly:
mov eax, 0x2088
call fcn.1400ff380
sub rsp, rax
lea rax, [rsp + 0x78]
mov qword [rsp + 0x60], rdx
mov qword [rsp + 0x68], rax
lea rdx, [rsp + 0x60]
lea rax, [rsp + 0x2078]
xor r9d, r9d
mov qword [rsp + 0x70], rax
lea rax, [0x140156790]
mov qword [rsp + 0x28], rax
lea rax, [0x1400a39a0]
mov qword [rsp + 0x20], rax
call fcn.1400a5cb0
test eax, eax
jns 0x1400a33ad
or eax, 0xffffffff
add rsp, 0x2088
ret
mov rax, qword [rsp + 0x68]
jle 0x1400a33de
cmp rax, qword [rsp + 0x70]
jb 0x1400a33ce
lea rcx, [rsp + 0x60]
call fcn.1400a3a80
test eax, eax
js 0x1400a33a2
mov rax, qword [rsp + 0x68]
mov byte [rax], 0xa
mov rax, qword [rsp + 0x68]
inc rax
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x2080], rbx
lea rcx, [rsp + 0x78]
xor ebx, ebx
lea rdx, [rsp + 0x60]
cmp rax, rcx
je 0x1400a3438
mov rcx, qword [rsp + 0x60]
sub eax, edx
sub eax, 0x18
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x38], rbx
xor r9d, r9d
mov dword [rsp + 0x30], eax
xor r8d, r8d
lea rax, [rsp + 0x78]
xor edx, edx
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntdll.dll_NtWriteFile]
test eax, eax
setns bl
dec ebx
mov eax, ebx
mov rbx, qword [rsp + 0x2080]
add rsp, 0x2088
ret

Function at 0x1400a39f0
Capabilities:
Read file on windows

Disassembly:
push rbx
sub rsp, 0x60
mov rbx, rcx
test rcx, rcx
jne 0x1400a3a07
or eax, 0xffffffff
add rsp, 0x60
pop rbx
ret
xor eax, eax
mov qword [rsp + 0x70], rdi
mov qword [rsp + 0x40], rax
lea rdi, [rcx + 0x18]
mov rcx, qword [rcx]
xor r9d, r9d
mov qword [rsp + 0x38], rax
xor r8d, r8d
mov dword [rsp + 0x30], 0x2000
lea rax, [rsp + 0x50]
mov qword [rsp + 0x28], rdi
xor edx, edx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntdll.dll_NtReadFile]
test eax, eax
js 0x1400a3a52
mov rax, qword [rsp + 0x58]
test rax, rax
jne 0x1400a3a60
or eax, 0xffffffff
mov rdi, qword [rsp + 0x70]
add rsp, 0x60
pop rbx
ret
add rax, 0x18
mov qword [rbx + 8], rdi
mov rdi, qword [rsp + 0x70]
add rax, rbx
mov qword [rbx + 0x10], rax
xor eax, eax
add rsp, 0x60
pop rbx
ret

Function at 0x1400a3a80
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x60
mov rbx, rcx
test rcx, rcx
jne 0x1400a3a97
lea eax, [rcx + 1]
add rsp, 0x60
pop rbx
ret
mov qword [rsp + 0x70], rdi
lea rdi, [rcx + 0x18]
cmp qword [rcx + 8], rdi
je 0x1400a3af4
mov eax, dword [rcx + 8]
xor r9d, r9d
sub eax, ecx
xor r8d, r8d
xor ecx, ecx
sub eax, 0x18
mov qword [rsp + 0x40], rcx
xor edx, edx
mov qword [rsp + 0x38], rcx
mov rcx, qword [rbx]
mov dword [rsp + 0x30], eax
lea rax, [rsp + 0x50]
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntdll.dll_NtWriteFile]
test eax, eax
jns 0x1400a3af0
or eax, 0xffffffff
mov rdi, qword [rsp + 0x70]
add rsp, 0x60
pop rbx
ret
mov qword [rbx + 8], rdi
xor eax, eax
mov rdi, qword [rsp + 0x70]
add rsp, 0x60
pop rbx
ret