joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140004474
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400044be
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400044be
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400044be
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400044be
cmp dword [rcx + 0x84], 0xe
jbe 0x1400044be
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x1400044c0
xor al, al
add rsp, 0x28
ret
Function at 0x141d5d058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.141d5d1df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x141d5d089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x141d5d06f
add dl, dl
jne 0x141d5d096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x141d5d0f6
xor eax, eax
add dl, dl
jne 0x141d5d0a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x141d5d1ad
add dl, dl
jne 0x141d5d0b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x141d5d0c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x141d5d0d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x141d5d0dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x141d5d0ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x141d5d07e
mov eax, 1
add dl, dl
jne 0x141d5d106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x141d5d113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x141d5d0fb
sub eax, ebx
mov ebx, 1
jne 0x141d5d14c
mov ecx, 1
add dl, dl
jne 0x141d5d12e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x141d5d13b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x141d5d123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x141d5d07e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x141d5d168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x141d5d175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x141d5d15d
cmp eax, 0x7d00
jae 0x141d5d19b
cmp eax, 0x500
jb 0x141d5d196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x141d5d07e
cmp eax, 0x7f
ja 0x141d5d19e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x141d5d07e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x141d5d1d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x141d5d07e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x14002c110
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
sub rsp, 0x38
or dword [rcx + 0x3ce848d0], 0xa301824c
invalid
invalid

Function at 0x14002d310
Capabilities:
Encode data using xor

Disassembly:
sti
push rdi
sub rsp, 0x38
mov rsi, rcx
mov qword [rsp + 0x68], r9
scasb al, byte [rdi]
and al, 0x7a
cmc
movabs byte [0xe03148000fdd2605], al
mov qword [rsp + 0x30], rax
sbb dword [rax - 0x47], 0xffffffb0
add dword [rax], eax
add bh, cl
je 0x14002d3ab
and al, 0x60
mov cs, word [rcx + 0x48282444]
mov ecx, edx
mov rdx, rax
push rax
out dx, eax
push rsp
add dword [rax], eax
mov rax, rcx
mov rdi, rsi
mov al, 1
add byte [rax], al
invalid
cmp byte [rsi + 0x1e8], 0
je 0x14002d3cb
movsxd rcx, dword [rbp + riz*4 + 0x30]
xor qword [rcx], rcx
fild qword [rdi]
invalid
jno 0x14002d3cb
invalid

Function at 0x14003ff10
Capabilities:
Encode data using xor

Disassembly:
add byte [rbp - 0x77], al
int 0x4d
mov esp, eax
mov dword [r13 + 0x49], esi
mov edi, ecx
mov ebp, ebx
and al, 0x40
pop rsi
pop rsp
add byte [rax - 0x75], cl
add eax, 0xf90eb193
xor rax, rsp
mov qword [rsp + 0xd0], rax
mov ecx, 0x62000001
mov edx, 0xe376
xor dword [r8 + rbp*8 + 0x16], r15d
add al, 0x80
mov rax, rsi
lea rax, [0x1400fe3e8]
movabs rax, 0x6394800c9408886
add byte [rax], dh
add byte [rax + 0x4c], al
mov dword [rsi + 0x10], esp
lea rcx, [rsi + 0x18]
invalid
add byte [rax], al
add byte [rax], al
mov byte [rsi - 0x2a], 0xc
mov byte [rbx], r12b
jbe 0x14003fea2
dec edi
add al, byte [rax]
push 0
in eax, 0x45
out dx, eax
mov qword [rdi + 0xd1d6], 0xffffffffc0570f00
ja 0xc6cb737d
test al, ch
add byte [rax], al
add byte [rax], al
add byte [rax], al
mov ecx, ebp
mov edx, 1
xor r8d, r8d
call qword [0x14012e6d0]
retf

Function at 0x140042710
Capabilities:
Encode data using xor

Disassembly:
outsb dx, byte [rsi]
lodsd eax, dword [rsi]
push rsi
push r13
std
sub al, 0x57
push rbp
push rbx
sub rsp, 0xffffffffffffffcb

Function at 0x140079547
Capabilities:
Create thread

Disassembly:
or eax, 0x8948000a
add eax, 0xb934f
cmp rbx, qword [rsi + 0x48]
add eax, 0x68480000
sal dword [rdx + 0x7de8c031], 0x38
sti
dec dword [rax - 0x73]
and al, 0x3c
mov qword [rsp + 0x28], rax
mov dword [rsp - 0x1c], 0x85000000
lea r8, [0x1400795c0]
xor dword [rbx], esp
xor edx, edx
mov r9, r14
call qword [sym.imp.KERNEL32.dll_CreateThread]
test rax, rax
je 0x140079597
out dx, al
sar edi, 0x15
mov ecx, 0x4800e047
mov ecx, dword [rdi + rbp*4 + 0x40]
mov rcx, qword [rdi + rbp*4 + 0x40]
xor rcx, rsp
call fcn.1400c8df0
mov rax, rsi
xchg spl, al
and dword [rbp + rbx*2 - 0x67bea182], eax
pop r15
ret

Function at 0x1400bbae0
Capabilities:
Encode data using xor

Disassembly:
cmp r8, 0x10
jb 0x1400bbb21
movzx edx, dl
mov eax, 0x384d0101
imul ebx, dword [rcx - 0x3d91f09a]
xor al, al
add dh, bh
nop dword [rax + riz]
scasd eax, dword [rdi]
movq mm1, qword [rcx]
sbb qword [rdi + 0x25], 0x49
pop rsp
call 0x13f1b2149
enter 0xffffffffffffd466, 0xf
xlatb
ror dword [rax + 0xf], 0x37
xor dword [rbp + 0x28], 0x10f88349
jae 0x1400bbb00
outsd dx, dword [rsi]
or dword [rax - 0x7d], ecx
pop rdi
and eax, 0x3ae85c49
ud0
test r8, r8
je 0x1400bbb3f
sbb word [rdi], cx
invalid
jg 0x1400bbb02
ret
Function at 0x140001c40
Capabilities:
Lock the desktop

Disassembly:
push rdi
sub rsp, 0x30
mov rdi, rcx
call qword [sym.imp.USER32.dll_LockWorkStation]
test eax, eax
je 0x140001c5b
mov al, 1
add rsp, 0x30
pop rdi
ret
mov qword [rsp + 0x40], rbx
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x140001c73
xor ecx, ecx
call sym.ProcessHacker.exe_PhGetNtMessage
jmp 0x140001c7a
mov ecx, eax
call sym.ProcessHacker.exe_PhGetWin32Message
lea r9, str.Unable_to_lock_the_computer
mov rbx, rax
mov edx, 0x10
mov rcx, rdi
test rax, rax
jne 0x140001caa
lea r8, [0x1401339b8]
call sym.ProcessHacker.exe_PhShowMessage
mov rbx, qword [rsp + 0x40]
xor al, al
add rsp, 0x30
pop rdi
ret
mov rax, qword [rbx + 8]
lea r8, str._s:__s
mov qword [rsp + 0x20], rax
call sym.ProcessHacker.exe_PhShowMessage
lea rcx, [rbx - 0x10]
or eax, 0xffffffff
lock xadd dword [rcx + 8], eax
sub eax, 1
jne 0x140001cd5
call fcn.1400ae900
xor al, al
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret

Function at 0x140001cf0
Capabilities:
Shutdown system

Disassembly:
push rdi
sub rsp, 0x30
mov rdi, rcx
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_ExitWindowsEx]
test eax, eax
je 0x140001d0f
mov al, 1
add rsp, 0x30
pop rdi
ret
mov qword [rsp + 0x40], rbx
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x140001d27
xor ecx, ecx
call sym.ProcessHacker.exe_PhGetNtMessage
jmp 0x140001d2e
mov ecx, eax
call sym.ProcessHacker.exe_PhGetWin32Message
lea r9, str.Unable_to_log_off_the_computer
mov rbx, rax
mov edx, 0x10
mov rcx, rdi
test rax, rax
jne 0x140001d5e
lea r8, [0x1401339b8]
call sym.ProcessHacker.exe_PhShowMessage
mov rbx, qword [rsp + 0x40]
xor al, al
add rsp, 0x30
pop rdi
ret
mov rax, qword [rbx + 8]
lea r8, str._s:__s
mov qword [rsp + 0x20], rax
call sym.ProcessHacker.exe_PhShowMessage
lea rcx, [rbx - 0x10]
or eax, 0xffffffff
lock xadd dword [rcx + 8], eax
sub eax, 1
jne 0x140001d89
call fcn.1400ae900
xor al, al
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
Function at 0x140001e40
Capabilities:
Shutdown system

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov rdi, rcx
mov ebx, edx
lea rcx, str.EnableWarnings
call sym.ProcessHacker.exe_PhGetIntegerSetting
test eax, eax
je 0x140001e85
xor r9d, r9d
mov byte [rsp + 0x20], 0
lea r8, str.the_computer
mov rcx, rdi
lea rdx, str.restart
call sym.ProcessHacker.exe_PhShowConfirmMessage
test al, al
je 0x140001f18
or ebx, 2
xor edx, edx
mov ecx, ebx
call qword [sym.imp.USER32.dll_ExitWindowsEx]
test eax, eax
je 0x140001ea3
mov al, 1
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x140001eb6
xor ecx, ecx
call sym.ProcessHacker.exe_PhGetNtMessage
jmp 0x140001ebd
mov ecx, eax
call sym.ProcessHacker.exe_PhGetWin32Message
lea r9, str.Unable_to_restart_the_computer
mov rbx, rax
mov edx, 0x10
mov rcx, rdi
test rax, rax
jne 0x140001eed
lea r8, [0x1401339b8]
call sym.ProcessHacker.exe_PhShowMessage
xor al, al
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
mov rax, qword [rbx + 8]
lea r8, str._s:__s
mov qword [rsp + 0x20], rax
call sym.ProcessHacker.exe_PhShowMessage
lea rcx, [rbx - 0x10]
or eax, 0xffffffff
lock xadd dword [rcx + 8], eax
sub eax, 1
jne 0x140001f18
call fcn.1400ae900
xor al, al
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret

Function at 0x140001f30
Capabilities:
Shutdown system

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov rdi, rcx
mov ebx, edx
lea rcx, str.EnableWarnings
call sym.ProcessHacker.exe_PhGetIntegerSetting
test eax, eax
je 0x140001f75
xor r9d, r9d
mov byte [rsp + 0x20], 0
lea r8, str.the_computer
mov rcx, rdi
lea rdx, str.shut_down
call sym.ProcessHacker.exe_PhShowConfirmMessage
test al, al
je 0x140002019
mov ecx, ebx
xor edx, edx
or ecx, 8
call qword [sym.imp.USER32.dll_ExitWindowsEx]
test eax, eax
je 0x140001f93
mov al, 1
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
or ebx, 1
xor edx, edx
mov ecx, ebx
call qword [sym.imp.USER32.dll_ExitWindowsEx]
test eax, eax
jne 0x140001f86
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x140001fb7
xor ecx, ecx
call sym.ProcessHacker.exe_PhGetNtMessage
jmp 0x140001fbe
mov ecx, eax
call sym.ProcessHacker.exe_PhGetWin32Message
lea r9, str.Unable_to_shut_down_the_computer
mov rbx, rax
mov edx, 0x10
mov rcx, rdi
test rax, rax
jne 0x140001fee
lea r8, [0x1401339b8]
call sym.ProcessHacker.exe_PhShowMessage
xor al, al
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
mov rax, qword [rbx + 8]
lea r8, str._s:__s
mov qword [rsp + 0x20], rax
call sym.ProcessHacker.exe_PhShowMessage
lea rcx, [rbx - 0x10]
or eax, 0xffffffff
lock xadd dword [rcx + 8], eax
sub eax, 1
jne 0x140002019
call fcn.1400ae900
xor al, al
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
Function at 0x140002bd0
Capabilities:
Terminate process

Disassembly:
mov r11, rsp
mov qword [r11 + 0x20], r9
mov qword [r11 + 0x18], r8
mov qword [r11 + 8], rcx
push rbx
push rbp
push rsi
push rdi
sub rsp, 0x78
mov rax, qword [rdx + 0x20]
lea r8, [r11 - 0x60]
mov dword [rsp + 0x38], 0x30
mov rsi, r9
mov qword [r11 - 0x70], rax
lea r9, [r11 - 0x70]
xor eax, eax
mov rbp, rdx
mov qword [r11 - 0x58], rax
mov rdi, rcx
mov dword [rsp + 0x50], eax
lea rcx, [r11 - 0x78]
xorps xmm0, xmm0
mov qword [r11 - 0x50], rax
lea edx, [rax + 1]
mov qword [r11 - 0x68], rax
movdqu xmmword [rsp + 0x58], xmm0
call qword [sym.imp.ntdll.dll_NtOpenProcess]
mov ebx, eax
cmp eax, 0xc0000022
jne 0x140002c58
cmp byte [0x14015e000], 0
je 0x140002c58
lea r8, [rsp + 0x28]
mov edx, 1
lea rcx, [rsp + 0x20]
call fcn.1400c02c0
mov ebx, eax
test ebx, ebx
js 0x140002ca7
cmp byte [0x14015e000], 0
mov rdi, qword [rsp + 0x20]
je 0x140002c80
mov edx, 1
mov rcx, rdi
call fcn.1400c0500
mov ebx, eax
cmp eax, 0xc00000bb
jne 0x140002c90
mov edx, 1
mov rcx, rdi
call qword [sym.imp.ntdll.dll_NtTerminateProcess]
mov ebx, eax
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.ntdll.dll_NtClose]
test ebx, ebx
jns 0x140002cf8
mov rdi, qword [rsp + 0xa0]
cmp qword [rbp + 0x20], 0
lea rdx, str.terminate
mov r8, qword [rbp + 0x30]
mov byte [rsi], 0
mov r8, qword [r8 + 8]
jl 0x140002cd2
mov r9d, dword [rbp + 0x20]
lea rcx, str.Unable_to__s__s__PID__u_
call fcn.1400015b0
jmp 0x140002cde
lea rcx, str.Unable_to__s__s
call fcn.1400015b0
mov rdx, qword [rax + 8]
xor r9d, r9d
mov r8d, ebx
mov rcx, rdi
call sym.ProcessHacker.exe_PhShowContinueStatus
test al, al
je 0x140002d8f
mov rbx, qword [rsp + 0xb0]
or esi, 0xffffffff
mov rcx, qword [rbx + 0x50]
mov rax, qword [rbp + 0x20]
cmp rcx, rax
je 0x140002d66
cmp qword [rbx + 0x58], rax
jne 0x140002d66
call sym.ProcessHacker.exe_PhReferenceProcessItem
mov rdi, rax
test rax, rax
je 0x140002d66
mov rcx, qword [rbp + 0x40]
cmp qword [rax + 0x40], rcx
jl 0x140002d51
mov r9, qword [rsp + 0xb8]
mov rdx, rax
mov r8, qword [rsp + 0xb0]
mov rcx, qword [rsp + 0xa0]
call fcn.140002bd0
test al, al
je 0x140002d7c
lea rcx, [rdi - 0x10]
mov eax, esi
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x140002d66
call fcn.1400ae900
mov eax, dword [rbx]
test eax, eax
je 0x140002d71
add rbx, rax
jne 0x140002d03
mov al, 1
add rsp, 0x78
pop rdi
pop rsi
pop rbp
pop rbx
ret
lea rcx, [rdi - 0x10]
lock xadd dword [rcx + 8], esi
cmp esi, 1
jne 0x140002d8f
call fcn.1400ae900
xor al, al
add rsp, 0x78
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x140004810
Capabilities:
Start service

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r14
push r15
sub rsp, 0x20
mov rax, qword [rdx + 0x10]
mov rsi, rdx
mov r14, rcx
mov r15d, 1
mov r8d, r15d
xor edx, edx
xor ecx, ecx
xor bl, bl
mov rbp, qword [rax + 8]
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov rdi, rax
test rax, rax
je 0x14000489c
lea r8d, [r15 + 0xf]
mov rdx, rbp
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov rcx, rdi
mov rbp, rax
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
test rbp, rbp
je 0x14000489c
xor r8d, r8d
xor edx, edx
mov rcx, rbp
call qword [sym.imp.ADVAPI32.dll_StartServiceW]
movzx ebx, bl
mov rcx, rbp
test eax, eax
cmovne ebx, r15d
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
test bl, bl
jne 0x140004972
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
test eax, eax
jle 0x1400048b1
movzx edi, ax
or edi, 0xc0070000
mov rax, qword [rsi + 0x10]
lea rcx, str.Unable_to_start
mov rdx, qword [rax + 8]
call sym.ProcessHacker.exe_PhConcatStrings2
mov rcx, rax
call sym.ProcessHacker.exe_PhAutoDereferenceObject
lea r9, [rsp + 0x48]
mov r8d, edi
mov rcx, r14
mov rdx, qword [rax + 8]
call fcn.140001780
test al, al
je 0x140004945
cmp byte [rsp + 0x48], 0
je 0x140004972
mov rcx, qword [rsi + 0x10]
mov edx, r15d
mov rcx, qword [rcx + 8]
call fcn.140060a70
mov edi, eax
test eax, eax
js 0x140004911
movzx ebx, r15b
call sym.ProcessHacker.exe_PhUiDisconnectFromPhSvc
jmp 0x140004972
mov r8, qword [rsi + 0x10]
lea rdx, str.start
lea rcx, str.Unable_to__s__s
mov r8, qword [r8 + 8]
call fcn.1400015b0
xor r9d, r9d
mov r8d, edi
mov rcx, r14
mov rdx, qword [rax + 8]
call sym.ProcessHacker.exe_PhShowStatus
call sym.ProcessHacker.exe_PhUiDisconnectFromPhSvc
jmp 0x140004972
mov r8, qword [rsi + 0x10]
lea rdx, str.start
lea rcx, str.Unable_to__s__s
mov r8, qword [r8 + 8]
call fcn.1400015b0
xor r9d, r9d
mov r8d, edi
mov rcx, r14
mov rdx, qword [rax + 8]
call sym.ProcessHacker.exe_PhShowStatus
mov rbp, qword [rsp + 0x50]
movzx eax, bl
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x58]
add rsp, 0x20
pop r15
pop r14
pop rdi
ret
Function at 0x140004990
Capabilities:
Pause service

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r14
push r15
sub rsp, 0x40
mov rax, qword [rdx + 0x10]
mov rsi, rdx
mov r14, rcx
mov r15d, 1
mov r8d, r15d
xor edx, edx
xor ecx, ecx
xor bl, bl
mov rbp, qword [rax + 8]
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov rdi, rax
test rax, rax
je 0x140004a20
lea r8d, [r15 + 0x3f]
mov rdx, rbp
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov rcx, rdi
mov rbp, rax
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
test rbp, rbp
je 0x140004a20
lea r8, [rsp + 0x20]
mov rcx, rbp
lea edx, [r15 + 2]
call qword [sym.imp.ADVAPI32.dll_ControlService]
movzx ebx, bl
mov rcx, rbp
test eax, eax
cmovne ebx, r15d
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
test bl, bl
jne 0x140004af8
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
test eax, eax
jle 0x140004a35
movzx edi, ax
or edi, 0xc0070000
mov rax, qword [rsi + 0x10]
lea rcx, str.Unable_to_continue
mov rdx, qword [rax + 8]
call sym.ProcessHacker.exe_PhConcatStrings2
mov rcx, rax
call sym.ProcessHacker.exe_PhAutoDereferenceObject
lea r9, [rsp + 0x68]
mov r8d, edi
mov rcx, r14
mov rdx, qword [rax + 8]
call fcn.140001780
test al, al
je 0x140004acb
cmp byte [rsp + 0x68], 0
je 0x140004af8
mov rcx, qword [rsi + 0x10]
mov edx, 2
mov rcx, qword [rcx + 8]
call fcn.140060a70
mov edi, eax
test eax, eax
js 0x140004a97
movzx ebx, r15b
call sym.ProcessHacker.exe_PhUiDisconnectFromPhSvc
jmp 0x140004af8
mov r8, qword [rsi + 0x10]
lea rdx, str.continue
lea rcx, str.Unable_to__s__s
mov r8, qword [r8 + 8]
call fcn.1400015b0
xor r9d, r9d
mov r8d, edi
mov rcx, r14
mov rdx, qword [rax + 8]
call sym.ProcessHacker.exe_PhShowStatus
call sym.ProcessHacker.exe_PhUiDisconnectFromPhSvc
jmp 0x140004af8
mov r8, qword [rsi + 0x10]
lea rdx, str.continue
lea rcx, str.Unable_to__s__s
mov r8, qword [r8 + 8]
call fcn.1400015b0
xor r9d, r9d
mov r8d, edi
mov rcx, r14
mov rdx, qword [rax + 8]
call sym.ProcessHacker.exe_PhShowStatus
mov rbp, qword [rsp + 0x70]
movzx eax, bl
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x78]
add rsp, 0x40
pop r15
pop r14
pop rdi
ret
Function at 0x140004b20
Capabilities:
Stop service

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r14
push r15
sub rsp, 0x40
mov rax, qword [rdx + 0x10]
mov rsi, rdx
mov r14, rcx
mov r15d, 1
mov r8d, r15d
xor edx, edx
xor ecx, ecx
xor bl, bl
mov rbp, qword [rax + 8]
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov rdi, rax
test rax, rax
je 0x140004bb0
lea r8d, [r15 + 0x3f]
mov rdx, rbp
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov rcx, rdi
mov rbp, rax
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
test rbp, rbp
je 0x140004bb0
lea r8, [rsp + 0x20]
mov rcx, rbp
lea edx, [r15 + 1]
call qword [sym.imp.ADVAPI32.dll_ControlService]
movzx ebx, bl
mov rcx, rbp
test eax, eax
cmovne ebx, r15d
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
test bl, bl
jne 0x140004c88
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
test eax, eax
jle 0x140004bc5
movzx edi, ax
or edi, 0xc0070000
mov rax, qword [rsi + 0x10]
lea rcx, str.Unable_to_pause
mov rdx, qword [rax + 8]
call sym.ProcessHacker.exe_PhConcatStrings2
mov rcx, rax
call sym.ProcessHacker.exe_PhAutoDereferenceObject
lea r9, [rsp + 0x68]
mov r8d, edi
mov rcx, r14
mov rdx, qword [rax + 8]
call fcn.140001780
test al, al
je 0x140004c5b
cmp byte [rsp + 0x68], 0
je 0x140004c88
mov rcx, qword [rsi + 0x10]
mov edx, 3
mov rcx, qword [rcx + 8]
call fcn.140060a70
mov edi, eax
test eax, eax
js 0x140004c27
movzx ebx, r15b
call sym.ProcessHacker.exe_PhUiDisconnectFromPhSvc
jmp 0x140004c88
mov r8, qword [rsi + 0x10]
lea rdx, str.pause
lea rcx, str.Unable_to__s__s
mov r8, qword [r8 + 8]
call fcn.1400015b0
xor r9d, r9d
mov r8d, edi
mov rcx, r14
mov rdx, qword [rax + 8]
call sym.ProcessHacker.exe_PhShowStatus
call sym.ProcessHacker.exe_PhUiDisconnectFromPhSvc
jmp 0x140004c88
mov r8, qword [rsi + 0x10]
lea rdx, str.pause
lea rcx, str.Unable_to__s__s
mov r8, qword [r8 + 8]
call fcn.1400015b0
xor r9d, r9d
mov r8d, edi
mov rcx, r14
mov rdx, qword [rax + 8]
call sym.ProcessHacker.exe_PhShowStatus
mov rbp, qword [rsp + 0x70]
movzx eax, bl
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x78]
add rsp, 0x40
pop r15
pop r14
pop rdi
ret
Function at 0x140004e40
Capabilities:
Delete service

Disassembly:
push rsi
push rdi
push r14
sub rsp, 0x30
mov r8, qword [rdx + 0x10]
lea r9, str.Deleting_a_service_can_prevent_the_system_from_starting_or_functioning_properly.
mov rsi, rdx
mov byte [rsp + 0x20], 1
lea rdx, [0x14010ceb8]
mov r14, rcx
xor dil, dil
mov r8, qword [r8 + 8]
call sym.ProcessHacker.exe_PhShowConfirmMessage
test al, al
jne 0x140004e7f
add rsp, 0x30
pop r14
pop rdi
pop rsi
ret
mov rax, qword [rsi + 0x10]
xor edx, edx
mov qword [rsp + 0x50], rbx
xor ecx, ecx
mov qword [rsp + 0x60], rbp
mov qword [rsp + 0x68], r15
mov r15d, 1
mov rbp, qword [rax + 8]
mov r8d, r15d
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov rbx, rax
test rax, rax
je 0x140004ef9
mov r8d, 0x10000
mov rdx, rbp
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov rcx, rbx
mov rbp, rax
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
test rbp, rbp
je 0x140004ef9
mov rcx, rbp
call qword [sym.imp.ADVAPI32.dll_DeleteService]
movzx edi, dil
mov rcx, rbp
test eax, eax
cmovne edi, r15d
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
test dil, dil
jne 0x140004fd1
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
test eax, eax
jle 0x140004f0e
movzx ebx, ax
or ebx, 0xc0070000
mov rax, qword [rsi + 0x10]
lea rcx, str.Unable_to_delete
mov rdx, qword [rax + 8]
call sym.ProcessHacker.exe_PhConcatStrings2
mov rcx, rax
call sym.ProcessHacker.exe_PhAutoDereferenceObject
lea r9, [rsp + 0x58]
mov r8d, ebx
mov rcx, r14
mov rdx, qword [rax + 8]
call fcn.140001780
test al, al
je 0x140004fa4
cmp byte [rsp + 0x58], 0
je 0x140004fd1
mov rcx, qword [rsi + 0x10]
mov edx, 5
mov rcx, qword [rcx + 8]
call fcn.140060a70
mov ebx, eax
test eax, eax
js 0x140004f70
movzx edi, r15b
call sym.ProcessHacker.exe_PhUiDisconnectFromPhSvc
jmp 0x140004fd1
mov r8, qword [rsi + 0x10]
lea rdx, [0x14010ceb8]
lea rcx, str.Unable_to__s__s
mov r8, qword [r8 + 8]
call fcn.1400015b0
xor r9d, r9d
mov r8d, ebx
mov rcx, r14
mov rdx, qword [rax + 8]
call sym.ProcessHacker.exe_PhShowStatus
call sym.ProcessHacker.exe_PhUiDisconnectFromPhSvc
jmp 0x140004fd1
mov r8, qword [rsi + 0x10]
lea rdx, [0x14010ceb8]
lea rcx, str.Unable_to__s__s
mov r8, qword [r8 + 8]
call fcn.1400015b0
xor r9d, r9d
mov r8d, ebx
mov rcx, r14
mov rdx, qword [rax + 8]
call sym.ProcessHacker.exe_PhShowStatus
mov r15, qword [rsp + 0x68]
movzx eax, dil
mov rbp, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x50]
add rsp, 0x30
pop r14
pop rdi
pop rsi
ret