joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14009e700
Capabilities:
Create service
Delete service
Start service

Disassembly:
push rbp
push r13
sub rsp, 0x98
xor edx, edx
mov r13, rcx
xor ecx, ecx
lea r8d, [rdx + 2]
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov rbp, rax
test rax, rax
jne 0x14009e745
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x14009e90f
movzx eax, ax
or eax, 0xc0070000
add rsp, 0x98
pop r13
pop rbp
ret
mov rdx, qword [0x140192530]
lea rcx, str.__s___ras___s_
mov r8, qword [r13 + 0x48]
mov qword [rsp + 0xb0], rbx
mov qword [rsp + 0xc8], rsi
mov rdx, qword [rdx + 8]
mov qword [rsp + 0x90], rdi
mov qword [rsp + 0x88], r14
call sym.ProcessHacker.exe_PhFormatString
mov rdx, qword [r13 + 0x48]
mov rbx, rax
lea rax, [0x14013ca58]
mov r9d, 0xf01ff
mov qword [rsp + 0x60], rax
mov r8, rdx
lea rax, str.LocalSystem
mov rcx, qword [rbx + 8]
mov qword [rsp + 0x58], rax
xor eax, eax
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rcx
mov rcx, rbp
mov dword [rsp + 0x30], eax
mov dword [rsp + 0x28], 3
mov dword [rsp + 0x20], 0x10
call qword [sym.imp.ADVAPI32.dll_CreateServiceW]
mov r14, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
or esi, 0xffffffff
lea rcx, [rbx - 0x10]
mov edx, esi
mov edi, eax
lock xadd dword [rcx + 8], edx
cmp edx, 1
jne 0x14009e802
call fcn.1400c8bc0
mov rcx, rbp
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
test r14, r14
jne 0x14009e824
test edi, edi
jle 0x14009e81d
movzx edi, di
or edi, 0xc0070000
mov eax, edi
jmp 0x14009e8ef
mov qword [rsp + 0x80], r15
call fcn.14009e570
xor r8d, r8d
xor edx, edx
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_StartServiceW]
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_DeleteService]
mov rdx, qword [r13 + 0x48]
lea rcx, str.BaseNamedObjects_
call sym.ProcessHacker.exe_PhConcatStrings2
mov r15, rax
mov edi, 0xa
movzx ecx, word [rax]
mov word [rsp + 0x70], cx
movzx ecx, word [rax]
add cx, 2
mov word [rsp + 0x72], cx
mov rcx, qword [rax + 8]
mov qword [rsp + 0x78], rcx
nop dword [rax]
lea rcx, [rsp + 0x70]
call fcn.140071350
mov ebx, eax
test eax, eax
jns 0x14009e8b1
lea rdx, [rsp + 0xc0]
mov qword [rsp + 0xc0], 0xfffffffffff85ee0
xor ecx, ecx
call qword [sym.imp.ntdll.dll_NtDelayExecution]
add edi, 0xffffffff
jne 0x14009e880
lea rcx, [r15 - 0x10]
lock xadd dword [rcx + 8], esi
mov r15, qword [rsp + 0x80]
cmp esi, 1
jne 0x14009e8cc
call fcn.1400c8bc0
test ebx, ebx
js 0x14009e8e4
mov rdx, r13
mov ecx, 0xc
call fcn.140071600
mov ebx, eax
call fcn.1400714d0
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, ebx
mov rdi, qword [rsp + 0x90]
mov rsi, qword [rsp + 0xc8]
mov rbx, qword [rsp + 0xb0]
mov r14, qword [rsp + 0x88]
add rsp, 0x98
pop r13
pop rbp
ret
Function at 0x14009f240
Capabilities:
Capture screenshot

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push r12
sub rsp, 0x60
mov eax, dword [rdx + 8]
mov rbx, rcx
sub eax, dword [rdx]
xor r12d, r12d
mov rcx, qword [rcx + 0x18]
mov rsi, rdx
mov dword [rsp + 0x58], eax
mov eax, dword [rdx + 0xc]
sub eax, dword [rdx + 4]
mov dword [rsp + 0x5c], eax
mov qword [rsp + 0x50], r12
call qword [sym.imp.USER32.dll_GetWindowDC]
mov rbp, rax
test rax, rax
je 0x14009f3be
mov qword [rsp + 0x80], rdi
mov rcx, rax
mov qword [rsp + 0x88], r14
mov qword [rsp + 0x90], r15
call qword [sym.imp.GDI32.dll_CreateCompatibleDC]
mov r8d, dword [rsp + 0x5c]
mov rcx, rbp
mov edx, dword [rsp + 0x58]
mov rdi, rax
call qword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
mov rdx, rax
mov rcx, rdi
mov r14, rax
call qword [sym.imp.GDI32.dll_SelectObject]
mov ecx, dword [rbx]
mov r15, rax
test cl, 2
je 0x14009f2d9
mov r8, qword [rbx + 0x48]
jmp 0x14009f2e8
test cl, 1
je 0x14009f2e4
mov r8, qword [rbx + 0x50]
jmp 0x14009f2e8
mov r8, qword [rbx + 0x40]
lea rdx, [rsp + 0x50]
mov rcx, rdi
call qword [sym.imp.USER32.dll_FillRect]
mov rcx, qword [rbx + 0x18]
call qword [sym.imp.USER32.dll_GetWindowTextLengthW]
mov ecx, dword [rbx + 0x10]
mov r9d, dword [rbx + 0xc]
mov edx, dword [rsp + 0x50]
mov r8d, dword [rsp + 0x54]
mov dword [rsp + 0x40], 3
mov qword [rsp + 0x38], r12
mov dword [rsp + 0x30], r12d
mov dword [rsp + 0x28], ecx
mov rcx, rdi
mov dword [rsp + 0x20], r9d
test eax, eax
jle 0x14009f33a
mov r9, qword [rbx + 0x30]
inc edx
jmp 0x14009f344
mov r9, qword [rbx + 0x38]
inc r8d
add edx, 2
call qword [sym.imp.USER32.dll_DrawIconEx]
mov eax, dword [rsi + 0xc]
mov rcx, rbp
mov r9d, dword [rsi + 8]
mov r8d, dword [rsi + 4]
mov edx, dword [rsi]
mov dword [rsp + 0x40], 0xcc0020
mov dword [rsp + 0x38], r12d
mov dword [rsp + 0x30], r12d
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], eax
call qword [sym.imp.GDI32.dll_BitBlt]
mov rdx, r15
mov rcx, rdi
call qword [sym.imp.GDI32.dll_SelectObject]
mov rcx, r14
call qword [sym.imp.GDI32.dll_DeleteObject]
mov rcx, rdi
call qword [sym.imp.GDI32.dll_DeleteDC]
mov rcx, qword [rbx + 0x18]
mov rdx, rbp
call qword [sym.imp.USER32.dll_ReleaseDC]
mov r15, qword [rsp + 0x90]
mov r14, qword [rsp + 0x88]
mov rdi, qword [rsp + 0x80]
mov rbx, qword [rsp + 0x98]
add rsp, 0x60
pop r12
pop rsi
pop rbp
ret
Function at 0x1400a7470
Capabilities:
Query or enumerate registry key

Disassembly:
mov rax, rsp
push rsi
sub rsp, 0x90
test byte [rcx + 0x140], 4
mov rsi, rcx
jne 0x1400a76ac
mov rdx, qword [0x140196800]
mov qword [rax + 0x20], rbx
mov rbx, qword [0x14018da70]
mov qword [rax - 0x18], rdi
mov qword [rax - 0x28], r15
mov rax, qword [rcx + 0x58]
mov rdi, qword [rax + 0x10]
add rbx, qword [rdi]
lea rcx, [rbx + 0x12]
call sym.ProcessHacker.exe_PhCreateObject
mov r15, rax
lea rcx, [rax + 0x10]
mov qword [rax], rbx
mov qword [rax + 8], rcx
xor eax, eax
mov word [rcx + rbx], ax
mov r8, qword [0x14018da70]
mov rdx, qword [str.SystemCurrentControlSetServices_]
mov rcx, qword [r15 + 8]
call fcn.14010e700
mov rcx, qword [0x14018da70]
add rcx, qword [r15 + 8]
mov r8, qword [rdi]
mov rdx, qword [rdi + 8]
call fcn.14010e700
movzx eax, word [r15]
mov word [rsp + 0x30], ax
add ax, 2
cmp qword [r15], 0xfffe
mov word [rsp + 0x32], ax
mov rax, qword [r15 + 8]
mov qword [rsp + 0x38], rax
ja 0x1400a767a
xor r8d, r8d
lea rax, [rsp + 0xb0]
lea r9, [rsp + 0x40]
mov qword [rsp + 0x20], rax
lea rdx, [rsp + 0x30]
lea rcx, [r8 - 3]
call fcn.1400da6c0
test eax, eax
js 0x1400a767a
lea r8, [rsp + 0x40]
mov edx, 0x20019
lea rcx, [rsp + 0xa8]
call qword [sym.imp.ntdll.dll_NtOpenKey]
mov rcx, qword [rsp + 0xb0]
mov ebx, eax
test rcx, rcx
je 0x1400a757b
call qword [sym.imp.ntdll.dll_NtClose]
test ebx, ebx
js 0x1400a767a
mov rcx, qword [0x140196670]
mov r8d, 0x100
mov qword [rsp + 0x88], rbp
mov ebp, 0x10
mov qword [rsp + 0x78], r14
mov r14, qword [rsp + 0xa8]
mov dword [rsp + 0xa0], 0x100
lea edx, [rbp - 0xc]
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov rbx, rax
nop dword [rax]
nop word [rax + rax]
mov r9d, dword [rsp + 0xa0]
lea rax, [rsp + 0xa0]
mov r8, rbx
mov qword [rsp + 0x20], rax
xor edx, edx
mov rcx, r14
call qword [sym.imp.ntdll.dll_NtQueryKey]
mov edi, eax
test eax, eax
jns 0x1400a763f
mov rcx, qword [0x140196670]
mov r8, rbx
xor edx, edx
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
cmp edi, 0x80000005
jne 0x1400a7637
mov r8d, dword [rsp + 0xa0]
mov edx, 4
mov rcx, qword [0x140196670]
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov rbx, rax
add ebp, 0xffffffff
jne 0x1400a75d0
jmp 0x1400a763f
mov rbx, qword [rsp + 0xa0]
mov r14, qword [rsp + 0x78]
mov rbp, qword [rsp + 0x88]
test edi, edi
js 0x1400a766c
mov rax, qword [rbx]
mov r8, rbx
mov rcx, qword [0x140196670]
xor edx, edx
mov qword [rsi + 0x1a8], rax
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
mov rcx, qword [rsp + 0xa8]
call qword [sym.imp.ntdll.dll_NtClose]
lea rcx, [r15 - 0x10]
or eax, 0xffffffff
lock xadd dword [rcx + 8], eax
mov r15, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x80]
mov rbx, qword [rsp + 0xb8]
cmp eax, 1
jne 0x1400a76a5
call fcn.1400c8bc0
or dword [rsi + 0x140], 4
add rsp, 0x90
pop rsi
ret
Function at 0x1400b0100
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x48
mov edx, 1
mov qword [rsp + 0x30], rcx
lea rcx, [rsp + 0x20]
mov word [rsp + 0x24], dx
xor r8d, r8d
mov dword [rsp + 0x20], 0x4c
call sym.ProcessHacker.exe_PhFormat
mov rcx, rax
add rsp, 0x48
jmp sym.ProcessHacker.exe_PhAutoDereferenceObject

Function at 0x1400b05d0
Capabilities:
Get system information on windows

Disassembly:
push rbx
sub rsp, 0x30
movsx eax, byte [0x1401967d8]
xor ebx, ebx
mov rcx, qword [0x140196670]
mov r8d, eax
shl r8, 3
lea edx, [rbx + 4]
mov qword [0x140195f58], rbx
mov qword [0x140195ea8], rbx
mov qword [0x140195f90], rbx
mov qword [0x140195f98], rbx
mov qword [0x140195f80], rbx
mov dword [0x140195e84], eax
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov rcx, qword [0x140196670]
lea edx, [rbx + 4]
mov qword [0x140195ec8], rax
mov eax, dword [0x140195e84]
lea r8, [rax + rax*2]
shl r8, 4
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov rcx, qword [0x140196670]
lea edx, [rbx + 4]
mov qword [0x140195ea0], rax
mov eax, dword [0x140195e84]
lea r8, [rax + rax*2]
shl r8, 3
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov rcx, qword [0x140196670]
lea edx, [rbx + 4]
mov qword [0x140195f70], rax
mov eax, dword [0x140195e84]
lea r8, [rax + rax*2]
shl r8, 3
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov edx, dword [0x140195e84]
xorps xmm0, xmm0
mov qword [0x140195f68], rax
xorps xmm1, xmm1
mov dword [0x140195fb0], ebx
mov r9, rax
mov byte [0x140195fb4], bl
mov dword [0x140195fc8], 0xffffffff
movdqu xmmword [0x140195fa0], xmm0
movdqu xmmword [0x140195fb8], xmm1
test edx, edx
je 0x1400b0706
mov rax, qword [0x140195ea0]
mov ecx, edx
add rax, 8
nop dword [rax + rax]
mov dword [rax + 8], ebx
mov qword [rax - 8], rbx
mov qword [rax], rbx
mov byte [rax + 0xc], bl
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbx
mov dword [rax + 0x20], 0xffffffff
lea rax, [rax + 0x30]
sub rcx, 1
jne 0x1400b06e0
lea eax, [rdx + rdx*2]
mov dword [0x140195f48], ebx
xor edx, edx
shl eax, 3
xor r8d, r8d
mov dword [rsp + 0x20], eax
lea ecx, [rdx + 0xb]
call qword [sym.imp.ntdll.dll_NtPowerInformation]
test eax, eax
jns 0x1400b0744
mov eax, dword [0x140195e84]
xor edx, edx
mov rcx, qword [0x140195f68]
lea r8, [rax + rax*2]
shl r8, 3
call fcn.14010ed90
mov qword [0x140195f88], rbx
mov qword [0x140195eb0], rbx
add rsp, 0x30
pop rbx
jmp fcn.1400b21e0
Function at 0x1400b21e0
Capabilities:
Get system information on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x20
mov rcx, qword [0x140196670]
mov edx, 4
mov r8d, 0x100
mov dword [rsp + 0x30], 0x100
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov r8d, dword [rsp + 0x30]
lea r9, [rsp + 0x30]
mov rdx, rax
mov ecx, 0x64
mov rsi, rax
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
xor ebx, ebx
mov edi, eax
cmp eax, 0xc0000004
jne 0x1400b2294
nop word [rax + rax]
cmp ebx, 8
jae 0x1400b2294
mov rcx, qword [0x140196670]
mov r8, rsi
xor edx, edx
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
mov r8d, dword [rsp + 0x30]
mov edx, 4
mov rcx, qword [0x140196670]
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov r8d, dword [rsp + 0x30]
lea r9, [rsp + 0x30]
mov rdx, rax
mov ecx, 0x64
mov rsi, rax
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
inc ebx
mov edi, eax
cmp eax, 0xc0000004
je 0x1400b2240
test edi, edi
js 0x1400b22b1
mov qword [0x140195f88], rsi
mov eax, edi
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
mov rcx, qword [0x140196670]
mov r8, rsi
xor edx, edx
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
mov rbx, qword [rsp + 0x38]
mov eax, edi
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x1400c0330
Capabilities:
Identify system language via api

Disassembly:
push rbx
push rdi
push r15
sub rsp, 0x50
mov eax, ecx
xor r15d, r15d
and eax, 0xfff0000
mov edi, ecx
cmp eax, 0x70000
je 0x1400c039a
lea rax, [0x140158b30]
mov dword [rsp + 0x20], 0x140012
lea r9, [rsp + 0x78]
mov qword [rsp + 0x28], rax
lea r8, [rsp + 0x20]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.ntdll.dll_LdrGetDllHandle]
test eax, eax
mov ebx, r15d
cmovns rbx, qword [rsp + 0x78]
call qword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
movzx r8d, ax
mov r9d, edi
lea edx, [r15 + 0xb]
mov rcx, rbx
call sym.ProcessHacker.exe_PhGetMessage
jmp 0x1400c03a2
movzx ecx, di
call sym.ProcessHacker.exe_PhGetWin32Message
mov rbx, rax
test rax, rax
je 0x1400c03b3
cmp qword [rax], r15
je 0x1400c03b3
xor al, al
jmp 0x1400c03b5
mov al, 1
test al, al
jne 0x1400c04ea
mov rcx, qword [rbx + 8]
mov qword [rsp + 0x48], rsi
call sym.ProcessHacker.exe_PhCountStringZ
or esi, 0xffffffff
lea rdx, [rax + rax]
mov qword [rbx], rdx
cmp rdx, 4
jb 0x1400c041e
mov rcx, qword [rbx + 8]
mov rax, rdx
shr rax, 1
cmp word [rcx + rax*2 - 4], 0xd
jne 0x1400c041e
cmp word [rcx + rax*2 - 2], 0xa
jne 0x1400c041e
add rdx, 0xfffffffffffffffc
call sym.ProcessHacker.exe_PhCreateStringEx
mov rcx, rbx
mov rbx, rax
test rcx, rcx
je 0x1400c041e
add rcx, 0xfffffffffffffff0
mov eax, esi
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x1400c041e
call fcn.1400c8bc0
mov rax, qword [rbx + 8]
cmp word [rax], 0x7b
jne 0x1400c04e5
movups xmm0, xmmword [rbx]
mov edx, 0xa
xor r8d, r8d
mov rcx, rbx
movups xmmword [rsp + 0x30], xmm0
call sym.ProcessHacker.exe_PhFindCharInStringRef
cmp rax, 0xffffffffffffffff
je 0x1400c04e5
mov rdi, qword [rsp + 0x30]
lea rcx, [rax + rax]
mov qword [rsp + 0x80], rbp
sub rdi, rcx
mov rbp, qword [rsp + 0x38]
add rbp, 2
mov qword [rsp + 0x40], r14
add rbp, rcx
sub rdi, 2
jne 0x1400c0483
call sym.ProcessHacker.exe_PhReferenceEmptyString
mov r14, rax
jmp 0x1400c04ba
mov rdx, qword [0x140196800]
lea rcx, [rdi + 0x12]
call sym.ProcessHacker.exe_PhCreateObject
mov r14, rax
mov qword [rax], rdi
add rax, 0x10
mov qword [r14 + 8], rax
mov word [rax + rdi], r15w
test rbp, rbp
je 0x1400c04ba
mov rcx, qword [r14 + 8]
mov r8, rdi
mov rdx, rbp
call fcn.14010e700
mov rbp, qword [rsp + 0x80]
mov rcx, rbx
mov rbx, r14
mov r14, qword [rsp + 0x40]
test rcx, rcx
je 0x1400c04e5
add rcx, 0xfffffffffffffff0
lock xadd dword [rcx + 8], esi
cmp esi, 1
jne 0x1400c04e5
call fcn.1400c8bc0
mov rsi, qword [rsp + 0x48]
mov rax, rbx
add rsp, 0x50
pop r15
pop rdi
pop rbx
ret
Function at 0x1400c0500
Capabilities:
Identify system language via api

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov edi, ecx
mov dword [rsp + 0x20], 0x1a0018
lea rax, str.kernel32.dll
xor ecx, ecx
lea r9, [rsp + 0x50]
mov qword [rsp + 0x28], rax
lea r8, [rsp + 0x20]
xor edx, edx
call qword [sym.imp.ntdll.dll_LdrGetDllHandle]
xor ebx, ebx
test eax, eax
cmovns rbx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
movzx r8d, ax
mov r9d, edi
mov edx, 0xb
mov rcx, rbx
call sym.ProcessHacker.exe_PhGetMessage
mov rbx, rax
test rax, rax
je 0x1400c05c8
mov rcx, qword [rax + 8]
call sym.ProcessHacker.exe_PhCountStringZ
lea rdx, [rax + rax]
mov qword [rbx], rdx
cmp rdx, 4
jb 0x1400c05c5
mov rcx, qword [rbx + 8]
mov rax, rdx
shr rax, 1
cmp word [rcx + rax*2 - 4], 0xd
jne 0x1400c05c5
cmp word [rcx + rax*2 - 2], 0xa
jne 0x1400c05c5
add rdx, 0xfffffffffffffffc
call sym.ProcessHacker.exe_PhCreateStringEx
mov rdi, rax
test rbx, rbx
je 0x1400c05c8
lea rcx, [rbx - 0x10]
or edx, 0xffffffff
lock xadd dword [rcx + 8], edx
cmp edx, 1
jne 0x1400c05c8
call fcn.1400c8bc0
mov rax, rdi
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
mov rax, rbx
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret

Function at 0x1400c0780
Capabilities:
Identify system language via api

Disassembly:
push rbx
sub rsp, 0x20
mov eax, edx
mov ebx, ecx
test edx, edx
jne 0x1400c07c7
cmp ecx, 0xc0000022
je 0x1400c07b1
cmp ecx, 0xc0000005
je 0x1400c07b1
mov eax, ecx
and eax, 0xfff0000
cmp eax, 0x70000
jne 0x1400c07bb
movzx eax, bx
jmp 0x1400c07b7
call qword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
test eax, eax
jne 0x1400c07c7
mov ecx, ebx
add rsp, 0x20
pop rbx
jmp sym.ProcessHacker.exe_PhGetNtMessage
mov ecx, eax
add rsp, 0x20
pop rbx
jmp sym.ProcessHacker.exe_PhGetWin32Message
Function at 0x1400c0e30
Capabilities:
Hash data using sha1

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r14
push r15
lea rbp, [rsp - 0x3f]
sub rsp, 0xc0
movups xmm1, xmmword [rdx]
mov ebx, r9d
mov rdi, r8
mov rsi, rcx
mov edx, 4
mov rcx, qword [0x140196670]
movups xmmword [rbp - 0x61], xmm1
ror word [rbp - 0x5d], 8
lea r15d, [rbx + 0x10]
ror word [rbp - 0x5b], 8
movd eax, xmm1
mov r8d, r15d
bswap eax
mov dword [rbp - 0x61], eax
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
movups xmm0, xmmword [rbp - 0x61]
mov r8d, ebx
mov rdx, rdi
mov r14, rax
lea rcx, [rax + 0x10]
movups xmmword [rax], xmm0
call fcn.14010e700
movzx ebx, byte [rbp + 0x7f]
xor eax, eax
mov r8d, r15d
mov rdx, r14
cmp bl, 3
jne 0x1400c0eee
lea rcx, [rbp - 0x41]
mov dword [rbp - 0x39], 0x67452301
mov dword [rbp - 0x35], 0xefcdab89
mov dword [rbp - 0x31], 0x98badcfe
mov dword [rbp - 0x2d], 0x10325476
mov qword [rbp - 0x41], rax
call fcn.140103570
lea rcx, [rbp - 0x41]
call fcn.140103670
movups xmm0, xmmword [rbp + 0x17]
jmp 0x1400c0f31
lea rcx, [rbp - 0x41]
mov dword [rbp - 0x29], 0x67452301
mov dword [rbp - 0x25], 0xefcdab89
mov dword [rbp - 0x21], 0x98badcfe
mov dword [rbp - 0x1d], 0x10325476
mov dword [rbp - 0x19], 0xc3d2e1f0
mov qword [rbp - 0x15], rax
call fcn.140105440
lea rdx, [rbp - 0x61]
lea rcx, [rbp - 0x41]
call fcn.140105530
movups xmm0, xmmword [rbp - 0x61]
mov bl, 5
mov rcx, qword [0x140196670]
mov r8, r14
xor edx, edx
movups xmmword [rbp - 0x61], xmm0
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
movups xmm0, xmmword [rbp - 0x61]
shl bl, 4
lea r11, [rsp + 0xc0]
mov rdi, qword [r11 + 0x30]
movups xmmword [rsi], xmm0
mov eax, dword [rsi]
bswap eax
mov dword [rsi], eax
movzx eax, word [rsi + 4]
ror ax, 8
mov word [rsi + 4], ax
movzx eax, word [rsi + 6]
ror ax, 8
mov word [rsi + 6], ax
and byte [rsi + 8], 0x3f
shr ax, 8
and al, 0xf
or al, bl
mov rbx, qword [r11 + 0x20]
or byte [rsi + 8], 0x80
mov byte [rsi + 7], al
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
Function at 0x1400c1f10
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r14
push r15
sub rsp, 0x60
xor r14d, r14d
lea rsi, [0x140196228]
test byte [0x14018dbe8], 1
lea r15, [0x140196240]
movzx ebx, r8b
mov edi, edx
mov rbp, rcx
jne 0x1400c1fc8
lock bts qword [0x14018dbe8], 0x1f
jae 0x1400c1f70
test byte [0x14018dbe8], 1
jne 0x1400c1fc8
xor edx, edx
lea rcx, [0x14018dbe8]
call sym.ProcessHacker.exe_PhfWaitForEvent
jmp 0x1400c1fc8
mov r9d, 4
mov r8, rsi
mov ecx, 0x400
lea edx, [r9 + 0xa]
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
jne 0x1400c1f96
mov dword [0x140196228], 0x2e
mov r9d, 4
mov r8, r15
mov ecx, 0x400
lea edx, [r9 + 0xb]
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
jne 0x1400c1fbc
mov dword [0x140196240], 0x2c
lea rcx, [0x14018dbe8]
call sym.ProcessHacker.exe_PhfSetEvent
neg bl
mov dword [rsp + 0x28], r14d
lea r9, [rsp + 0x30]
mov dword [rsp + 0x30], edi
sbb eax, eax
mov dword [rsp + 0x34], r14d
and eax, 3
mov qword [rsp + 0x40], rsi
mov r8, rbp
mov dword [rsp + 0x38], eax
xor edx, edx
mov qword [rsp + 0x48], r15
mov ecx, 0x400
mov dword [rsp + 0x50], 1
mov qword [rsp + 0x20], r14
call qword [sym.imp.KERNEL32.dll_GetNumberFormatW]
mov rdx, qword [0x140196800]
mov edi, eax
lea ecx, [rax + rax]
mov ebx, ecx
add rcx, 0x12
call sym.ProcessHacker.exe_PhCreateObject
mov dword [rsp + 0x28], edi
lea r9, [rsp + 0x30]
mov r8, rbp
mov ecx, 0x400
mov rsi, rax
lea rdx, [rax + 0x10]
mov qword [rax], rbx
mov qword [rax + 8], rdx
mov word [rdx + rbx], r14w
mov rdx, qword [rax + 8]
mov qword [rsp + 0x20], rdx
xor edx, edx
call qword [sym.imp.KERNEL32.dll_GetNumberFormatW]
test eax, eax
jne 0x1400c2077
lea rcx, [rsi - 0x10]
or eax, 0xffffffff
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x1400c2073
call fcn.1400c8bc0
xor eax, eax
jmp 0x1400c2089
mov rcx, qword [rsi + 8]
call sym.ProcessHacker.exe_PhCountStringZ
add rax, rax
mov qword [rsi], rax
mov rax, rsi
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rdi
ret
Function at 0x1400c2190
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push rbp
sub rsp, 0x50
xor edx, edx
lea r8d, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rbp, rax
test rax, rax
je 0x1400c226a
lea r9, [rsp + 0x70]
mov qword [rsp + 0x20], 0x10
mov r8d, 3
mov qword [rsp + 0x28], 1
lea rdx, [rsp + 0x20]
mov qword [rsp + 0x30], 0
mov rcx, rax
call qword [sym.imp.ntdll.dll_LdrFindResource_U]
test eax, eax
js 0x1400c2261
mov rdx, qword [rsp + 0x70]
lea r9, [rsp + 0x68]
lea r8, [rsp + 0x78]
mov rcx, rbp
call qword [sym.imp.ntdll.dll_LdrAccessResource]
test eax, eax
js 0x1400c2261
mov rcx, qword [0x140196670]
mov edx, 4
mov qword [rsp + 0x60], rbx
mov ebx, dword [rsp + 0x68]
mov qword [rsp + 0x48], rsi
mov r8d, ebx
mov qword [rsp + 0x40], rdi
mov rdi, qword [rsp + 0x78]
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov r8d, ebx
mov rdx, rdi
mov rcx, rax
mov rsi, rax
call fcn.14010e700
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rdi, qword [rsp + 0x40]
mov rax, rsi
mov rsi, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
xor eax, eax
add rsp, 0x50
pop rbp
ret

Function at 0x1400c3060
Capabilities:
Get windows directory from kuser_shared_data

Disassembly:
sub rsp, 0x38
mov rax, qword [0x1401937f8]
test rax, rax
je 0x1400c3079
lock inc dword [rax - 8]
add rsp, 0x38
ret
cmp qword [0x140196238], 0
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rsi
mov qword [rsp + 0x30], rdi
je 0x1400c30a0
movups xmm0, xmmword [0x140196230]
movaps xmmword [rsp + 0x20], xmm0
jmp 0x1400c30f0
mov ecx, 0x7ffe0030
mov qword [rsp + 0x28], 0x7ffe0030
call sym.ProcessHacker.exe_PhCountStringZ
add rax, rax
mov qword [rsp + 0x20], rax
cmp word [rax + 0x7ffe002e], 0x5c
jne 0x1400c30ce
add rax, 0xfffffffffffffffe
mov qword [rsp + 0x20], rax
movaps xmm0, xmmword [rsp + 0x20]
movdqa xmmword [rsp + 0x20], xmm0
mov qword [0x140196230], rax
lock or dword [rsp], 0
mov qword [0x140196238], 0x7ffe0030
mov rbx, qword [0x14018dbd8]
mov rdi, qword [rsp + 0x20]
mov rdx, qword [0x140196800]
add rbx, rdi
lea rcx, [rbx + 0x12]
call sym.ProcessHacker.exe_PhCreateObject
mov rdx, qword [rsp + 0x28]
mov rsi, rax
mov r8, rdi
lea rcx, [rax + 0x10]
mov qword [rax], rbx
mov qword [rax + 8], rcx
xor eax, eax
mov word [rcx + rbx], ax
mov rcx, qword [rsi + 8]
call fcn.14010e700
mov rcx, qword [rsi + 8]
mov r8, qword [0x14018dbd8]
add rcx, rdi
mov rdx, qword [str.System32]
call fcn.14010e700
mov rdi, qword [rsp + 0x30]
xor eax, eax
mov rbx, qword [rsp + 0x40]
lock cmpxchg qword [0x1401937f8], rsi
jne 0x1400c3169
lock inc dword [rsi - 8]
mov rax, rsi
mov rsi, qword [rsp + 0x48]
add rsp, 0x38
ret
Function at 0x1400c3180
Capabilities:
Get windows directory from kuser_shared_data

Disassembly:
push rbx
sub rsp, 0x30
cmp qword [0x140196238], 0
mov rbx, rcx
je 0x1400c31a3
movups xmm0, xmmword [0x140196230]
movups xmmword [rcx], xmm0
add rsp, 0x30
pop rbx
ret
mov ecx, 0x7ffe0030
mov qword [rsp + 0x28], 0x7ffe0030
call sym.ProcessHacker.exe_PhCountStringZ
add rax, rax
mov qword [rsp + 0x20], rax
cmp word [rax + 0x7ffe002e], 0x5c
jne 0x1400c31d1
add rax, 0xfffffffffffffffe
mov qword [rsp + 0x20], rax
movups xmm0, xmmword [rsp + 0x20]
mov qword [0x140196230], rax
movups xmmword [rbx], xmm0
lock or dword [rsp], 0
mov qword [0x140196238], 0x7ffe0030
add rsp, 0x30
pop rbx
ret