joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140012900
Capabilities:
Encrypt data using rc4 prga

Disassembly:
jmp 0x14029f530
mov dword [rsp + 8], ecx
push rdi
sub rsp, 0x80
lea rdi, [rsp + 0x20]
mov ecx, 0x18
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov ecx, dword [rsp + 0x90]
mov rax, qword [0x1405dc580]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov dword [rsp + 0x54], 0
jmp 0x14029f577
mov eax, dword [rsp + 0x54]
inc eax
mov dword [rsp + 0x54], eax
movsxd rax, dword [rsp + 0x54]
imul rax, rax, 0x10
lea rcx, [0x1405dc220]
cmp qword [rcx + rax + 8], 0
je 0x14029f660
movsxd rax, dword [rsp + 0x54]
imul rax, rax, 0x10
lea rcx, [0x1405dc220]
mov rax, qword [rcx + rax + 8]
mov qword [rsp + 0x60], rax
movsxd rax, dword [rsp + 0x54]
imul rax, rax, 0x10
lea rcx, [0x1405dc220]
mov edx, dword [rsp + 0x90]
cmp dword [rcx + rax], edx
je 0x14029f5cb
jmp 0x14029f56d
mov dword [rsp + 0x20], 6
mov dword [rsp + 0x58], 0
jmp 0x14029f5f1
mov eax, dword [rsp + 0x58]
inc eax
mov dword [rsp + 0x58], eax
mov eax, dword [rsp + 0x20]
inc eax
mov dword [rsp + 0x20], eax
movsxd rax, dword [rsp + 0x58]
mov rcx, qword [rsp + 0x60]
movsx eax, byte [rcx + rax]
test eax, eax
je 0x14029f623
movsxd rax, dword [rsp + 0x58]
movsxd rcx, dword [rsp + 0x20]
lea rdx, str.ERRNO
mov r8, qword [rsp + 0x60]
movzx eax, byte [r8 + rax]
mov byte [rdx + rcx], al
jmp 0x14029f5dd
movsxd rax, dword [rsp + 0x20]
mov qword [rsp + 0x70], rax
cmp qword [rsp + 0x70], 0x80
jae 0x14029f63a
jmp 0x14029f63f
call fcn.140012fb0
lea rax, str.ERRNO
mov rcx, qword [rsp + 0x70]
mov byte [rax + rcx], 0
lea rax, str.ERRNO
jmp 0x14029f72b
mov dword [rsp + 0x54], 0
jmp 0x14029f68a
mov eax, dword [rsp + 0x90]
cdq
mov ecx, 0xa
idiv ecx
mov dword [rsp + 0x90], eax
mov eax, dword [rsp + 0x54]
inc eax
mov dword [rsp + 0x54], eax
cmp dword [rsp + 0x90], 0xa
jle 0x14029f6bd
mov eax, dword [rsp + 0x90]
cdq
mov ecx, 0xa
idiv ecx
mov eax, edx
cdqe
lea rcx, str.0123456789
movsxd rdx, dword [rsp + 0x54]
movzx eax, byte [rcx + rax]
mov byte [rsp + rdx + 0x38], al
jmp 0x14029f66a
mov eax, dword [rsp + 0x90]
cdq
mov ecx, 0xa
idiv ecx
mov eax, edx
cdqe
lea rcx, str.0123456789
movsxd rdx, dword [rsp + 0x54]
movzx eax, byte [rcx + rax]
mov byte [rsp + rdx + 0x38], al
mov dword [rsp + 0x20], 6
jmp 0x14029f702
mov eax, dword [rsp + 0x54]
dec eax
mov dword [rsp + 0x54], eax
mov eax, dword [rsp + 0x20]
inc eax
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x54], 0
jl 0x14029f724
movsxd rax, dword [rsp + 0x54]
movsxd rcx, dword [rsp + 0x20]
lea rdx, str.ERRNO
movzx eax, byte [rsp + rax + 0x38]
mov byte [rdx + rcx], al
jmp 0x14029f6ee
lea rax, str.ERRNO
mov rdi, rax
mov rcx, rsp
lea rdx, [0x14053f690]
call fcn.140015750
mov rax, rdi
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.14000d430
add rsp, 0x80
pop rdi
ret
Function at 0x140012c40
Capabilities:
Hash data using sha256

Disassembly:
jmp 0x140265df0
mov qword [rsp + 8], rcx
push rdi
mov eax, 4
imul rax, rax, 0
mov rcx, qword [rsp + 0x10]
mov dword [rcx + rax], 0
mov eax, 4
imul rax, rax, 1
mov rcx, qword [rsp + 0x10]
mov dword [rcx + rax], 0
mov eax, 4
imul rax, rax, 0
mov rcx, qword [rsp + 0x10]
mov dword [rcx + rax + 8], 0x6a09e667
mov eax, 4
imul rax, rax, 1
mov rcx, qword [rsp + 0x10]
mov dword [rcx + rax + 8], 0xbb67ae85
mov eax, 4
imul rax, rax, 2
mov rcx, qword [rsp + 0x10]
mov dword [rcx + rax + 8], 0x3c6ef372
mov eax, 4
imul rax, rax, 3
mov rcx, qword [rsp + 0x10]
mov dword [rcx + rax + 8], 0xa54ff53a
mov eax, 4
imul rax, rax, 4
mov rcx, qword [rsp + 0x10]
mov dword [rcx + rax + 8], 0x510e527f
mov eax, 4
imul rax, rax, 5
mov rcx, qword [rsp + 0x10]
mov dword [rcx + rax + 8], 0x9b05688c
mov eax, 4
imul rax, rax, 6
mov rcx, qword [rsp + 0x10]
mov dword [rcx + rax + 8], 0x1f83d9ab
mov eax, 4
imul rax, rax, 7
mov rcx, qword [rsp + 0x10]
mov dword [rcx + rax + 8], 0x5be0cd19
pop rdi
ret

Function at 0x1400132f0
Capabilities:
Read http header

Disassembly:
jmp 0x14025c250
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x50
lea rdi, [rsp + 0x30]
mov ecx, 8
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x60]
mov dword [rsp + 0x34], 0
mov qword [rsp + 0x28], 0
lea rax, [rsp + 0x34]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov edx, 0x16
mov rax, qword [rsp + 0x60]
mov rcx, qword [rax + 0x10]
call qword [sym.imp.WINHTTP.dll_WinHttpQueryHeaders]
test eax, eax
jne 0x14025c2b8
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
je 0x14025c2b8
xor eax, eax
jmp 0x14025c314
mov eax, dword [rsp + 0x34]
mov edx, eax
xor ecx, ecx
call sym.ProcessHacker.exe_PhCreateStringEx
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x28], 0
lea rax, [rsp + 0x34]
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x48]
mov r9, qword [rax + 8]
xor r8d, r8d
mov edx, 0x16
mov rax, qword [rsp + 0x60]
mov rcx, qword [rax + 0x10]
call qword [sym.imp.WINHTTP.dll_WinHttpQueryHeaders]
test eax, eax
jne 0x14025c30f
mov rcx, qword [rsp + 0x48]
call sym.ProcessHacker.exe_PhDereferenceObject
xor eax, eax
jmp 0x14025c314
mov rax, qword [rsp + 0x48]
mov rdi, rax
mov rcx, rsp
lea rdx, [0x1405189e0]
call fcn.140015750
mov rax, rdi
add rsp, 0x50
pop rdi
ret
Function at 0x140013780
Capabilities:
Terminate process

Disassembly:
jmp 0x1401b09f0
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x20
mov edx, dword [rsp + 0x38]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ntdll.dll_NtTerminateProcess]
add rsp, 0x20
pop rdi
ret
Function at 0x140013df0
Capabilities:
Capture screenshot

Disassembly:
jmp 0x140140b00
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0xb0
lea rdi, [rsp + 0x50]
mov ecx, 0x18
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0xc0]
mov rax, qword [0x1405dc580]
xor rax, rsp
mov qword [rsp + 0xa8], rax
mov dword [rsp + 0x78], 0
mov dword [rsp + 0x7c], 0
mov rax, qword [rsp + 0xc0]
mov rcx, qword [rsp + 0xc0]
mov ecx, dword [rcx + 0x28]
mov eax, dword [rax + 0x30]
sub eax, ecx
mov dword [rsp + 0x80], eax
mov rax, qword [rsp + 0xc0]
mov rcx, qword [rsp + 0xc0]
mov ecx, dword [rcx + 0x2c]
mov eax, dword [rax + 0x34]
sub eax, ecx
mov dword [rsp + 0x84], eax
mov rax, qword [rsp + 0xc0]
mov rcx, qword [rax + 0x18]
call qword [sym.imp.USER32.dll_GetDC]
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
jne 0x140140baa
jmp 0x140140d1e
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.GDI32.dll_CreateCompatibleDC]
mov qword [rsp + 0x58], rax
mov r8d, dword [rsp + 0x84]
mov edx, dword [rsp + 0x80]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
mov qword [rsp + 0x60], rax
mov rdx, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.GDI32.dll_SelectObject]
mov qword [rsp + 0x68], rax
mov edx, 1
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.GDI32.dll_SetBkMode]
movzx eax, byte [0x1405e7bb8]
test eax, eax
je 0x140140c54
mov eax, dword [0x1405e7ae0]
mov dword [rsp + 0xa0], eax
cmp dword [rsp + 0xa0], 1
je 0x140140c24
jmp 0x140140c52
mov edx, 0x2b2b2b
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.GDI32.dll_SetDCBrushColor]
mov ecx, 0x12
call qword [sym.imp.GDI32.dll_GetStockObject]
mov r8, rax
lea rdx, [rsp + 0x78]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.USER32.dll_FillRect]
jmp 0x140140c82
mov edx, 0xffffff
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.GDI32.dll_SetDCBrushColor]
mov ecx, 0x12
call qword [sym.imp.GDI32.dll_GetStockObject]
mov r8, rax
lea rdx, [rsp + 0x78]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.USER32.dll_FillRect]
mov dword [rsp + 0x40], 0xcc0020
mov dword [rsp + 0x38], 0
mov dword [rsp + 0x30], 0
mov rax, qword [rsp + 0x58]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0xc0]
mov eax, dword [rax + 0x34]
mov dword [rsp + 0x20], eax
mov rax, qword [rsp + 0xc0]
mov r9d, dword [rax + 0x30]
mov rax, qword [rsp + 0xc0]
mov r8d, dword [rax + 0x2c]
mov rax, qword [rsp + 0xc0]
mov edx, dword [rax + 0x28]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.GDI32.dll_BitBlt]
mov rdx, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.GDI32.dll_SelectObject]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.GDI32.dll_DeleteObject]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.GDI32.dll_DeleteDC]
mov rdx, qword [rsp + 0x50]
mov rax, qword [rsp + 0xc0]
mov rcx, qword [rax + 0x18]
call qword [sym.imp.USER32.dll_ReleaseDC]
mov rcx, rsp
lea rdx, [0x1404d0a80]
call fcn.140015750
mov rcx, qword [rsp + 0xa8]
xor rcx, rsp
call fcn.14000d430
add rsp, 0xb0
pop rdi
ret
Function at 0x140013e30
Capabilities:
Read file on windows

Disassembly:
jmp 0x140077390
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0xd0
lea rdi, [rsp + 0x50]
mov ecx, 0x20
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0xe0]
mov rax, qword [0x1405dc580]
xor rax, rsp
mov qword [rsp + 0xc0], rax
mov dword [rsp + 0x30], 0x60
mov dword [rsp + 0x28], 1
mov dword [rsp + 0x20], 1
mov r9d, 0x80
mov r8d, 0x120089
mov rdx, qword [rsp + 0xe0]
lea rcx, [rsp + 0x68]
call sym.ProcessHacker.exe_PhCreateFileWin32
mov dword [rsp + 0x50], eax
cmp dword [rsp + 0x50], 0
jge 0x14007741c
mov eax, dword [rsp + 0x50]
jmp 0x1400774ce
mov dword [rsp + 0x80], 0x400
mov eax, dword [rsp + 0x80]
mov ecx, eax
call sym.ProcessHacker.exe_PhAllocate
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x38], 0
mov eax, dword [rsp + 0x80]
mov dword [rsp + 0x30], eax
mov rax, qword [rsp + 0x78]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x98]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ntdll.dll_NtReadFile]
mov dword [rsp + 0x50], eax
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ntdll.dll_NtClose]
cmp dword [rsp + 0x50], 0
jl 0x1400774c0
mov rax, qword [rsp + 0xe8]
mov rcx, qword [rsp + 0x78]
mov qword [rax], rcx
mov rax, qword [rsp + 0xf0]
mov ecx, dword [rsp + 0xa0]
mov dword [rax], ecx
mov eax, dword [rsp + 0x50]
jmp 0x1400774ce
mov rcx, qword [rsp + 0x78]
call sym.ProcessHacker.exe_PhFree
mov eax, dword [rsp + 0x50]
mov rdi, rax
mov rcx, rsp
lea rdx, [0x1403e4300]
call fcn.140015750
mov rax, rdi
mov rcx, qword [rsp + 0xc0]
xor rcx, rsp
call fcn.14000d430
add rsp, 0xd0
pop rdi
ret
Function at 0x140014790
Capabilities:
Terminate process

Disassembly:
jmp 0x140341300
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x28
mov ecx, 0x17
call qword [sym.imp.KERNEL32.dll_IsProcessorFeaturePresent]
test eax, eax
je 0x14034132e
mov ecx, 5
int 0x29
mov r8d, 1
mov edx, 0xc0000417
mov ecx, 2
call fcn.140017f50
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000417
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x28
ret

Function at 0x1400147e0
Capabilities:
Read http header

Disassembly:
jmp 0x14025c440
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x90
lea rdi, [rsp + 0x30]
mov ecx, 0x18
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0xa0]
mov dword [rsp + 0x34], 0
mov dword [rsp + 0x54], 0
mov dword [rsp + 0x74], 4
mov r9d, 2
lea r8, [0x1405187e0]
mov edx, dword [rsp + 0xa8]
lea rcx, [rsp + 0x34]
call sym.ProcessHacker.exe_PhMapFlags1
mov eax, dword [rsp + 0x34]
bts eax, 0x1d
mov qword [rsp + 0x28], 0
lea rcx, [rsp + 0x74]
mov qword [rsp + 0x20], rcx
lea r9, [rsp + 0x54]
xor r8d, r8d
mov edx, eax
mov rax, qword [rsp + 0xa0]
mov rcx, qword [rax + 0x10]
call qword [sym.imp.WINHTTP.dll_WinHttpQueryHeaders]
test eax, eax
je 0x14025c4f2
mov rax, qword [rsp + 0xb0]
mov ecx, dword [rsp + 0x54]
mov dword [rax], ecx
mov al, 1
jmp 0x14025c4f4
xor al, al
mov rdi, rax
mov rcx, rsp
lea rdx, [0x140518b40]
call fcn.140015750
mov rax, rdi
add rsp, 0x90
pop rdi
ret
Function at 0x140014a60
Capabilities:
Start service

Disassembly:
jmp 0x140030fb0
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x70
lea rdi, [rsp + 0x30]
mov ecx, 0x10
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x80]
mov rax, qword [0x1405dc580]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov byte [rsp + 0x38], 0
mov rax, qword [rsp + 0x88]
mov rax, qword [rax + 0x10]
mov edx, 0x10
mov rcx, qword [rax + 8]
call sym.ProcessHacker.exe_PhOpenService
mov qword [rsp + 0x30], rax
cmp qword [rsp + 0x30], 0
je 0x140031037
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_StartServiceW]
test eax, eax
je 0x14003102c
mov byte [rsp + 0x38], 1
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
movzx eax, byte [rsp + 0x38]
test eax, eax
jne 0x140031119
call fcn.140010ff0
mov dword [rsp + 0x3c], eax
mov rax, qword [rsp + 0x88]
mov rax, qword [rax + 0x10]
mov rdx, qword [rax + 8]
lea rcx, str.Unable_to_start
call fcn.140002440
lea r9, [rsp + 0x44]
mov r8d, dword [rsp + 0x3c]
mov rdx, qword [rax + 8]
mov rcx, qword [rsp + 0x80]
call fcn.140004440
movzx eax, al
test eax, eax
je 0x1400310f0
movzx eax, byte [rsp + 0x44]
test eax, eax
je 0x1400310ee
mov rax, qword [rsp + 0x88]
mov rax, qword [rax + 0x10]
mov edx, 1
mov rcx, qword [rax + 8]
call fcn.140014c30
mov dword [rsp + 0x3c], eax
cmp dword [rsp + 0x3c], 0
jl 0x1400310c0
mov byte [rsp + 0x38], 1
jmp 0x1400310e9
mov dword [rsp + 0x20], 0
mov r9d, dword [rsp + 0x3c]
mov r8, qword [rsp + 0x88]
lea rdx, str.start
mov rcx, qword [rsp + 0x80]
call fcn.140034aa0
call sym.ProcessHacker.exe_PhUiDisconnectFromPhSvc
jmp 0x140031119
mov dword [rsp + 0x20], 0
mov r9d, dword [rsp + 0x3c]
mov r8, qword [rsp + 0x88]
lea rdx, str.start
mov rcx, qword [rsp + 0x80]
call fcn.140034aa0
movzx eax, byte [rsp + 0x38]
mov edi, eax
mov rcx, rsp
lea rdx, [0x1403c5e80]
call fcn.140015750
mov eax, edi
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.14000d430
add rsp, 0x70
pop rdi
ret

Function at 0x140014bf0
Capabilities:
Terminate process

Disassembly:
jmp 0x1401b0990
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x30
call fcn.140015830
movzx eax, al
test eax, eax
je 0x1401b09cc
mov edx, dword [rsp + 0x48]
mov rcx, qword [rsp + 0x40]
call fcn.140011850
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x20], 0xc00000bb
je 0x1401b09cc
mov eax, dword [rsp + 0x20]
jmp 0x1401b09db
mov edx, dword [rsp + 0x48]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ntdll.dll_NtTerminateProcess]
add rsp, 0x30
pop rdi
ret
Function at 0x140015470
Capabilities:
Get system information on windows

Disassembly:
jmp 0x1401b64b0
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x40
mov dword [rsp + 0x30], 0x200
mov eax, dword [rsp + 0x30]
mov ecx, eax
call sym.ProcessHacker.exe_PhAllocate
mov qword [rsp + 0x28], rax
xor r9d, r9d
mov r8d, dword [rsp + 0x30]
mov rdx, qword [rsp + 0x28]
mov ecx, 0x12
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x20], 0xc0000004
jne 0x1401b652f
mov rcx, qword [rsp + 0x28]
call sym.ProcessHacker.exe_PhFree
mov eax, dword [rsp + 0x30]
shl eax, 1
mov dword [rsp + 0x30], eax
cmp dword [rsp + 0x30], 0x10000000
jbe 0x1401b651d
mov eax, 0xc000009a
jmp 0x1401b6557
mov eax, dword [rsp + 0x30]
mov ecx, eax
call sym.ProcessHacker.exe_PhAllocate
mov qword [rsp + 0x28], rax
jmp 0x1401b64d2
cmp dword [rsp + 0x20], 0
jge 0x1401b6546
mov rcx, qword [rsp + 0x28]
call sym.ProcessHacker.exe_PhFree
mov eax, dword [rsp + 0x20]
jmp 0x1401b6557
mov rax, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x28]
mov qword [rax], rcx
mov eax, dword [rsp + 0x20]
add rsp, 0x40
pop rdi
ret
Function at 0x140016440
Capabilities:
Query or enumerate registry key

Disassembly:
jmp 0x1401b91d0
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x60
lea rdi, [rsp + 0x30]
mov ecx, 0xc
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x70]
mov dword [rsp + 0x54], 0
mov dword [rsp + 0x44], 0x100
mov eax, dword [rsp + 0x44]
mov ecx, eax
call sym.ProcessHacker.exe_PhAllocate
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x44]
mov qword [rsp + 0x28], rax
mov eax, dword [rsp + 0x44]
mov dword [rsp + 0x20], eax
mov r9, qword [rsp + 0x38]
mov r8d, dword [rsp + 0x78]
mov edx, dword [rsp + 0x54]
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.ntdll.dll_NtEnumerateKey]
mov dword [rsp + 0x30], eax
cmp dword [rsp + 0x30], 0x8000001a
jne 0x1401b9264
mov dword [rsp + 0x30], 0
jmp 0x1401b9301
cmp dword [rsp + 0x30], 0x80000005
je 0x1401b9278
cmp dword [rsp + 0x30], 0xc0000023
jne 0x1401b92c1
mov rcx, qword [rsp + 0x38]
call sym.ProcessHacker.exe_PhFree
mov eax, dword [rsp + 0x44]
mov ecx, eax
call sym.ProcessHacker.exe_PhAllocate
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x44]
mov qword [rsp + 0x28], rax
mov eax, dword [rsp + 0x44]
mov dword [rsp + 0x20], eax
mov r9, qword [rsp + 0x38]
mov r8d, dword [rsp + 0x78]
mov edx, dword [rsp + 0x54]
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.ntdll.dll_NtEnumerateKey]
mov dword [rsp + 0x30], eax
cmp dword [rsp + 0x30], 0
jge 0x1401b92ca
jmp 0x1401b9301
mov r8, qword [rsp + 0x88]
mov rdx, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x70]
call qword [rsp + 0x80]
movzx eax, al
test eax, eax
jne 0x1401b92ec
jmp 0x1401b9301
mov eax, dword [rsp + 0x54]
inc eax
mov dword [rsp + 0x54], eax
xor eax, eax
cmp eax, 1
jne 0x1401b921e
mov rcx, qword [rsp + 0x38]
call sym.ProcessHacker.exe_PhFree
mov eax, dword [rsp + 0x30]
mov edi, eax
mov rcx, rsp
lea rdx, [0x1404f2650]
call fcn.140015750
mov eax, edi
add rsp, 0x60
pop rdi
ret
Function at 0x140016610
Capabilities:
Delete registry value

Disassembly:
jmp 0x1401b9130
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x60
lea rdi, [rsp + 0x20]
mov ecx, 0x10
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x70]
cmp qword [rsp + 0x78], 0
je 0x1401b917c
lea rdx, [rsp + 0x38]
mov rcx, qword [rsp + 0x78]
call fcn.1400117c0
movzx eax, al
test eax, eax
jne 0x1401b917a
mov eax, 0xc0000106
jmp 0x1401b91a3
jmp 0x1401b918b
xor r8d, r8d
xor edx, edx
lea rcx, [rsp + 0x38]
call fcn.14001b520
lea rdx, [rsp + 0x38]
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.ntdll.dll_NtDeleteValueKey]
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x20]
mov rdi, rax
mov rcx, rsp
lea rdx, [0x1404f25f0]
call fcn.140015750
mov rax, rdi
add rsp, 0x60
pop rdi
ret

Function at 0x140016860
Capabilities:
Encrypt data using rc4 prga
Hash data using fnv

Disassembly:
jmp 0x1401772f0
mov byte [rsp + 0x10], dl
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x40
mov dword [rsp + 0x20], 0
mov rax, qword [rsp + 0x50]
cmp qword [rax], 0
jne 0x140177318
xor eax, eax
jmp 0x1401773ba
xor edx, edx
mov rax, qword [rsp + 0x50]
mov rax, qword [rax]
mov ecx, 2
div rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x50]
mov rax, qword [rax + 8]
mov qword [rsp + 0x30], rax
movzx eax, byte [rsp + 0x58]
test eax, eax
jne 0x140177360
mov rax, qword [rsp + 0x50]
mov rdx, qword [rax]
mov rax, qword [rsp + 0x50]
mov rcx, qword [rax + 8]
call sym.ProcessHacker.exe_PhHashBytes
jmp 0x1401773ba
mov rax, qword [rsp + 0x30]
movzx eax, word [rax]
mov word [rsp + 0x38], ax
mov rax, qword [rsp + 0x30]
add rax, 2
mov qword [rsp + 0x30], rax
movzx ecx, word [rsp + 0x38]
call qword [sym.imp.ntdll.dll_RtlUpcaseUnicodeChar]
movzx eax, ax
mov ecx, dword [rsp + 0x20]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0x20], eax
imul eax, dword [rsp + 0x20], 0x1000193
mov dword [rsp + 0x20], eax
mov rax, qword [rsp + 0x28]
dec rax
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
jne 0x140177360
mov eax, dword [rsp + 0x20]
add rsp, 0x40
pop rdi
ret
Function at 0x1400169d0
Capabilities:
Pause service

Disassembly:
jmp 0x140031310
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0xb0
lea rdi, [rsp + 0x30]
mov ecx, 0x20
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0xc0]
mov rax, qword [0x1405dc580]
xor rax, rsp
mov qword [rsp + 0xa0], rax
mov byte [rsp + 0x38], 0
mov rax, qword [rsp + 0xc8]
mov rax, qword [rax + 0x10]
mov edx, 0x40
mov rcx, qword [rax + 8]
call sym.ProcessHacker.exe_PhOpenService
mov qword [rsp + 0x30], rax
cmp qword [rsp + 0x30], 0
je 0x1400313a2
lea r8, [rsp + 0x48]
mov edx, 2
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
je 0x140031397
mov byte [rsp + 0x38], 1
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
movzx eax, byte [rsp + 0x38]
test eax, eax
jne 0x14003148a
call fcn.140010ff0
mov dword [rsp + 0x74], eax
mov rax, qword [rsp + 0xc8]
mov rax, qword [rax + 0x10]
mov rdx, qword [rax + 8]
lea rcx, str.Unable_to_pause
call fcn.140002440
lea r9, [rsp + 0x84]
mov r8d, dword [rsp + 0x74]
mov rdx, qword [rax + 8]
mov rcx, qword [rsp + 0xc0]
call fcn.140004440
movzx eax, al
test eax, eax
je 0x140031461
movzx eax, byte [rsp + 0x84]
test eax, eax
je 0x14003145f
mov rax, qword [rsp + 0xc8]
mov rax, qword [rax + 0x10]
mov edx, 3
mov rcx, qword [rax + 8]
call fcn.140014c30
mov dword [rsp + 0x74], eax
cmp dword [rsp + 0x74], 0
jl 0x140031431
mov byte [rsp + 0x38], 1
jmp 0x14003145a
mov dword [rsp + 0x20], 0
mov r9d, dword [rsp + 0x74]
mov r8, qword [rsp + 0xc8]
lea rdx, str.pause
mov rcx, qword [rsp + 0xc0]
call fcn.140034aa0
call sym.ProcessHacker.exe_PhUiDisconnectFromPhSvc
jmp 0x14003148a
mov dword [rsp + 0x20], 0
mov r9d, dword [rsp + 0x74]
mov r8, qword [rsp + 0xc8]
lea rdx, str.pause
mov rcx, qword [rsp + 0xc0]
call fcn.140034aa0
movzx eax, byte [rsp + 0x38]
mov edi, eax
mov rcx, rsp
lea rdx, [0x1403c5fe0]
call fcn.140015750
mov eax, edi
mov rcx, qword [rsp + 0xa0]
xor rcx, rsp
call fcn.14000d430
add rsp, 0xb0
pop rdi
ret