joyce8/EMBER2024-capa huggingface dataset:
Function at 0x470db0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x13c
mov eax, dword [0x54a1a4]
push ebx
mov ebx, dword [0x54a1a0]
push esi
mov dword [ebp - 0x10], eax
lea esi, [edx + 1]
push edi
lea eax, [ebp - 0x138]
mov dword [ebp - 0x20], ebx
push eax
call sym.ProcessHacker.exe_PhInitializeAutoPool
lea eax, [ebp - 0xc]
mov dword [ebp - 0x18], esi
push eax
lea eax, [ebp - 0x14]
mov ecx, ebx
push eax
lea edx, [ebp - 0x1c]
call fcn.004bb050
mov ebx, dword [ebp - 0xc]
lea ecx, [ebp - 4]
push ebx
mov edx, esi
call fcn.004babc0
xor edi, edi
test ebx, ebx
je 0x470e74
mov eax, dword [ebp - 0x14]
mov ebx, dword [eax + edi*4]
mov eax, ebx
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x470e10
push dword [0x54b7b4]
sub eax, edx
sar eax, 1
lea ecx, [eax + eax]
lea eax, [eax*2 + 0xa]
mov dword [ebp - 8], ecx
push eax
call sym.ProcessHacker.exe_PhCreateObject
mov esi, eax
xor edx, edx
mov eax, dword [ebp - 8]
lea ecx, [esi + 8]
mov dword [esi], eax
mov dword [esi + 4], ecx
mov word [ecx + eax], dx
test ebx, ebx
je 0x470e5c
push eax
push ebx
push dword [esi + 4]
call fcn.004dd620
add esp, 0xc
push esi
call sym.ProcessHacker.exe_PhAutoDereferenceObject
mov edx, dword [ebp - 4]
mov ebx, dword [ebp - 0xc]
mov ecx, dword [edx]
mov dword [ecx + edi*4], eax
inc edi
cmp edi, ebx
jb 0x470e05
jmp 0x470e77
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 0x10]
xor esi, esi
mov edi, dword [ebp - 0x1c]
mov dword [ebp - 8], 1
cmp dword [eax], esi
jbe 0x470eb2
lea ebx, [ebx]
push ebx
push edi
lea ecx, [ebp - 8]
push ecx
mov ecx, dword [ebp - 0x20]
push edx
mov edx, dword [eax + 8]
push 0
mov edx, dword [edx + esi*4]
call fcn.00470c40
mov eax, dword [ebp - 0x10]
inc esi
mov edx, dword [ebp - 4]
cmp esi, dword [eax]
jb 0x470e90
push edi
push 0
push dword [0x54b674]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
push dword [ebp - 0x14]
push 0
push dword [0x54b674]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
push dword [ebp + 0xc]
mov edx, dword [ebp - 0x18]
mov ecx, dword [ebp - 4]
push ebx
call fcn.004bac50
mov esi, eax
lea eax, [ebp - 0x138]
push eax
call sym.ProcessHacker.exe_PhDrainAutoPool
push dword [0x54ae94]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
lea ecx, [ebp - 0x138]
cmp eax, ecx
jne 0x470f39
push dword [ebp - 0x28]
push dword [0x54ae94]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
je 0x470f39
mov eax, dword [ebp - 0x2c]
test eax, eax
je 0x470f2e
push eax
push 0
push dword [0x54b674]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
push 0xc0000001
call dword [sym.imp.ntdll.dll_RtlRaiseStatus]
int3
Function at 0x47e5e0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
test byte [0x546c00], 1
push esi
push edi
jne 0x47e74f
mov edi, 0x546c00
lock bts dword [edi], 0x1f
jae 0x47e627
test byte [0x546c00], 1
jne 0x47e74f
xor edx, edx
mov ecx, edi
call sym.ProcessHacker.exe_PhfWaitForEvent
cmp dword [0x54a5c8], 0
setne al
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push str.netapi32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ecx, eax
mov dword [0x54a5c8], ecx
test ecx, ecx
je 0x47e6e8
mov esi, 0x5a4d
cmp word [ecx], si
jne 0x47e68d
mov eax, dword [ecx + 0x3c]
test eax, eax
je 0x47e68d
cmp eax, 0x10000000
jae 0x47e68d
cmp dword [ecx + eax], 0x4550
jne 0x47e68d
lea edx, [eax + 0x78]
mov eax, dword [edx + ecx]
add edx, ecx
test eax, eax
je 0x47e68d
cmp dword [edx + 4], 0
je 0x47e68d
push 0
push str.NetUserEnum
add eax, ecx
push eax
push edx
call fcn.004a2140
mov ecx, dword [0x54a5c8]
jmp 0x47e68f
xor eax, eax
mov dword [0x54a624], eax
cmp word [ecx], si
jne 0x47e6df
mov eax, dword [ecx + 0x3c]
test eax, eax
je 0x47e6df
cmp eax, 0x10000000
jae 0x47e6df
cmp dword [ecx + eax], 0x4550
jne 0x47e6df
lea edx, [eax + 0x78]
mov eax, dword [edx + ecx]
add edx, ecx
test eax, eax
je 0x47e6df
cmp dword [edx + 4], 0
je 0x47e6df
push 0
push str.NetApiBufferFree
add eax, ecx
push eax
push edx
call fcn.004a2140
mov ecx, dword [0x54a5c8]
mov dword [0x54a5bc], eax
jmp 0x47e6ed
xor eax, eax
mov dword [0x54a5bc], eax
jmp 0x47e6ed
mov eax, dword [0x54a5bc]
cmp dword [0x54a624], 0
jne 0x47e70b
test eax, eax
jne 0x47e70b
push ecx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov dword [0x54a5c8], 0
lock bts dword [edi], 0
jb 0x47e74f
mov esi, dword [0x546c04]
test esi, esi
je 0x47e725
push 0
push esi
call dword [sym.imp.ntdll.dll_NtSetEvent]
mov eax, 0xfffffffe
lock xadd dword [edi], eax
shr eax, 1
and eax, 0x7fff
sub eax, 1
jne 0x47e74f
test esi, esi
je 0x47e74f
push esi
call dword [sym.imp.ntdll.dll_NtClose]
mov dword [0x546c04], 0
cmp dword [0x54a5c8], 0
pop edi
setne al
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x47e760
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
test byte [0x546c50], 1
push esi
push edi
jne 0x47e97b
mov edi, 0x546c50
lock bts dword [edi], 0x1f
jae 0x47e7a7
test byte [0x546c50], 1
jne 0x47e97b
xor edx, edx
mov ecx, edi
call sym.ProcessHacker.exe_PhfWaitForEvent
cmp dword [0x54a61c], 0
setne al
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push str.comctl32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ecx, eax
mov dword [0x54a61c], ecx
test ecx, ecx
je 0x47e902
mov esi, 0x5a4d
cmp word [ecx], si
jne 0x47e80d
mov eax, dword [ecx + 0x3c]
test eax, eax
je 0x47e80d
cmp eax, 0x10000000
jae 0x47e80d
cmp dword [ecx + eax], 0x4550
jne 0x47e80d
lea edx, [eax + 0x78]
mov eax, dword [edx + ecx]
add edx, ecx
test eax, eax
je 0x47e80d
cmp dword [edx + 4], 0
je 0x47e80d
push 0
push str.CreateMRUListW
add eax, ecx
push eax
push edx
call fcn.004a2140
mov ecx, dword [0x54a61c]
jmp 0x47e80f
xor eax, eax
mov dword [0x54a620], eax
cmp word [ecx], si
jne 0x47e85a
mov eax, dword [ecx + 0x3c]
test eax, eax
je 0x47e85a
cmp eax, 0x10000000
jae 0x47e85a
cmp dword [ecx + eax], 0x4550
jne 0x47e85a
lea edx, [eax + 0x78]
mov eax, dword [edx + ecx]
add edx, ecx
test eax, eax
je 0x47e85a
cmp dword [edx + 4], 0
je 0x47e85a
push 0
push str.AddMRUStringW
add eax, ecx
push eax
push edx
call fcn.004a2140
mov ecx, dword [0x54a61c]
jmp 0x47e85c
xor eax, eax
mov dword [0x54a628], eax
cmp word [ecx], si
jne 0x47e8a7
mov eax, dword [ecx + 0x3c]
test eax, eax
je 0x47e8a7
cmp eax, 0x10000000
jae 0x47e8a7
cmp dword [eax + ecx], 0x4550
jne 0x47e8a7
lea edx, [eax + 0x78]
mov eax, dword [edx + ecx]
add edx, ecx
test eax, eax
je 0x47e8a7
cmp dword [edx + 4], 0
je 0x47e8a7
push 0
push str.EnumMRUListW
add eax, ecx
push eax
push edx
call fcn.004a2140
mov ecx, dword [0x54a61c]
jmp 0x47e8a9
xor eax, eax
mov dword [0x54a5c0], eax
cmp word [ecx], si
jne 0x47e8f9
mov eax, dword [ecx + 0x3c]
test eax, eax
je 0x47e8f9
cmp eax, 0x10000000
jae 0x47e8f9
cmp dword [eax + ecx], 0x4550
jne 0x47e8f9
lea edx, [eax + 0x78]
mov eax, dword [edx + ecx]
add edx, ecx
test eax, eax
je 0x47e8f9
cmp dword [edx + 4], 0
je 0x47e8f9
push 0
push str.FreeMRUList
add eax, ecx
push eax
push edx
call fcn.004a2140
mov ecx, dword [0x54a61c]
mov dword [0x54a62c], eax
jmp 0x47e907
xor eax, eax
mov dword [0x54a62c], eax
jmp 0x47e907
mov eax, dword [0x54a62c]
cmp dword [0x54a620], 0
jne 0x47e937
cmp dword [0x54a628], 0
jne 0x47e937
cmp dword [0x54a5c0], 0
jne 0x47e937
test eax, eax
jne 0x47e937
push ecx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov dword [0x54a61c], 0
lock bts dword [edi], 0
jb 0x47e97b
mov esi, dword [0x546c54]
test esi, esi
je 0x47e951
push 0
push esi
call dword [sym.imp.ntdll.dll_NtSetEvent]
mov eax, 0xfffffffe
lock xadd dword [edi], eax
shr eax, 1
and eax, 0x7fff
sub eax, 1
jne 0x47e97b
test esi, esi
je 0x47e97b
push esi
call dword [sym.imp.ntdll.dll_NtClose]
mov dword [0x546c54], 0
cmp dword [0x54a61c], 0
pop edi
setne al
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x47ef60
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
push dword [0x54b7b0]
mov ebx, edx
mov edi, ecx
push 0xc
mov dword [ebp - 4], ebx
call sym.ProcessHacker.exe_PhCreateObject
push 0x28
mov esi, eax
push 4
push dword [0x54b674]
mov dword [esi], 0
mov dword [esi + 4], 0xa
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
push dword [0x54b7b4]
mov dword [esi + 8], eax
push 0x20a
mov dword [edi + 0x1c], esi
call sym.ProcessHacker.exe_PhCreateObject
mov esi, eax
xor eax, eax
lea ecx, [esi + 8]
push eax
mov dword [esi + 4], ecx
mov dword [esi], 0x200
mov word [ecx + 0x200], ax
mov ecx, dword [esi]
add ecx, 2
push ecx
push dword [esi + 4]
push 2
call dword [sym.imp.USER32.dll_GetProcessWindowStation]
push eax
call dword [sym.imp.USER32.dll_GetUserObjectInformationW]
test eax, eax
je 0x47eff4
push dword [esi + 4]
call sym.ProcessHacker.exe_PhCountStringZ
add eax, eax
mov dword [esi], eax
jmp 0x47f04c
lea ecx, [esi - 8]
or eax, 0xffffffff
lock xadd dword [ecx + 4], eax
dec eax
jne 0x47f007
call fcn.004a2a20
push dword [0x54b7b4]
push 0x18
call sym.ProcessHacker.exe_PhCreateObject
mov esi, eax
xor ecx, ecx
lea eax, [esi + 8]
mov dword [esi + 4], eax
mov dword [esi], 0xe
mov word [eax + 0xe], cx
mov ecx, dword [esi + 4]
mov eax, dword [str.WinSta0]
mov dword [ecx], eax
mov eax, dword [0x53040c]
mov dword [ecx + 4], eax
mov eax, dword [0x530410]
mov dword [ecx + 8], eax
mov ax, word [0x530414]
mov word [ecx + 0xc], ax
push 0
push 0
push 0x14b
push ebx
mov dword [edi + 0x20], esi
call dword [sym.imp.USER32.dll_SendMessageW]
push edi
push 0x47ef00
call dword [sym.imp.USER32.dll_GetProcessWindowStation]
push eax
call dword [sym.imp.USER32.dll_EnumDesktopsW]
mov eax, dword [edi + 0x1c]
xor esi, esi
cmp dword [eax], esi
jbe 0x47f0cd
jmp 0x47f080
push 4
push 4
push dword [0x54b674]
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov ecx, dword [edi + 0x1c]
mov ebx, eax
mov ecx, dword [ecx + 8]
mov ecx, dword [ecx + esi*4]
mov dword [ebx], ecx
push dword [ecx + 4]
push 0
push 0x143
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_SendMessageW]
cmp eax, 0xffffffff
je 0x47f0c5
push ebx
push eax
push 0x151
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_SendMessageW]
mov eax, dword [edi + 0x1c]
inc esi
cmp esi, dword [eax]
jb 0x47f080
mov dword [eax], 0
or eax, 0xffffffff
mov ecx, dword [edi + 0x20]
add ecx, 0xfffffff8
lock xadd dword [ecx + 4], eax
dec eax
jne 0x47f0e9
call fcn.004a2a20
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x47f180
Capabilities:
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword fs:[0x18]
push ebx
push esi
push edi
mov eax, dword [eax + 0x30]
mov ebx, edx
push 0
push 0
push 0x146
mov ecx, dword [eax + 0x10]
push ebx
movzx eax, word [ecx + 0x78]
mov dword [ebp - 8], eax
mov eax, dword [ecx + 0x7c]
mov dword [ebp - 4], eax
call dword [sym.imp.USER32.dll_SendMessageW]
mov edi, eax
cmp edi, 0xffffffff
je 0x47f1fc
xor esi, esi
test edi, edi
jle 0x47f1fc
push 0
push esi
push 0x150
push ebx
call dword [sym.imp.USER32.dll_SendMessageW]
push 1
lea ecx, [ebp - 8]
push ecx
push dword [eax]
call sym.ProcessHacker.exe_PhEqualStringRef
test al, al
jne 0x47f1ed
inc esi
cmp esi, edi
jl 0x47f1c1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0
push esi
push 0x14e
push ebx
call dword [sym.imp.USER32.dll_SendMessageW]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4801f0
Capabilities:
Create service
Delete service
Start service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
push edi
push 2
push 0
mov edi, ecx
push 0
mov dword [ebp - 4], edi
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov ebx, eax
test ebx, ebx
jne 0x48022d
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x480364
movzx eax, ax
or eax, 0xc0070000
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [0x5491d4]
push dword [edi + 0x28]
push dword [eax + 4]
push str.__s___ras___s_
call sym.ProcessHacker.exe_PhFormatString
add esp, 0xc
mov ecx, dword [edi + 0x28]
mov esi, eax
push 0x5077f0
push str.LocalSystem
push 0
push 0
push 0
push dword [esi + 4]
push 0
push 3
push 0x10
push 0xf01ff
push ecx
push ecx
push ebx
call dword [sym.imp.ADVAPI32.dll_CreateServiceW]
mov dword [ebp - 8], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
lea ecx, [esi - 8]
or edx, 0xffffffff
lock xadd dword [ecx + 4], edx
dec edx
jne 0x48028f
call fcn.004a2a20
push ebx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov ebx, dword [ebp - 8]
test ebx, ebx
jne 0x4802b3
test edi, edi
jle 0x4802aa
movzx edi, di
or edi, 0xc0070000
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
call fcn.004800c0
push 0
push 0
push ebx
call dword [sym.imp.ADVAPI32.dll_StartServiceW]
push ebx
call dword [sym.imp.ADVAPI32.dll_DeleteService]
mov eax, dword [ebp - 4]
push dword [eax + 0x28]
push str.BaseNamedObjects_
call sym.ProcessHacker.exe_PhConcatStrings2
mov ebx, eax
mov edi, 0xa
movzx ecx, word [ebx]
mov word [ebp - 0x18], cx
movzx ecx, word [ebx]
add cx, 2
mov word [ebp - 0x16], cx
mov ecx, dword [ebx + 4]
mov dword [ebp - 0x14], ecx
lea esp, [esp]
lea ecx, [ebp - 0x18]
call fcn.00457cb0
mov esi, eax
test esi, esi
jns 0x48032d
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], 0xfff85ee0
push eax
push 0
mov dword [ebp - 0xc], 0xffffffff
call dword [sym.imp.ntdll.dll_NtDelayExecution]
sub edi, 1
jne 0x480300
lea ecx, [ebx - 8]
or eax, 0xffffffff
lock xadd dword [ecx + 4], eax
dec eax
jne 0x480340
call fcn.004a2a20
test esi, esi
js 0x480358
mov edx, dword [ebp - 4]
mov ecx, 0xc
call fcn.00457ee0
mov esi, eax
call fcn.00457de0
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x485320
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
mov ebx, ecx
push esi
push edi
mov dword [ebp - 8], ebx
test byte [ebx + 0xbc], 4
jne 0x48547f
mov eax, dword [ebx + 0x48]
push dword [0x54b7b4]
mov edi, dword [eax + 8]
mov esi, dword [edi]
add esi, dword [0x547a90]
lea eax, [esi + 0xa]
push eax
call sym.ProcessHacker.exe_PhCreateObject
xor edx, edx
mov dword [ebp - 0x10], eax
lea ecx, [eax + 8]
mov dword [eax], esi
mov dword [eax + 4], ecx
mov word [ecx + esi], dx
push dword [0x547a90]
push dword [0x547a94]
push dword [eax + 4]
call fcn.004dd620
mov esi, dword [ebp - 0x10]
push dword [edi]
push dword [edi + 4]
mov eax, dword [esi + 4]
add eax, dword [0x547a90]
push eax
call fcn.004dd620
add esp, 0x18
lea eax, [ebp - 0xc]
push 0
push esi
push 0xfffffffffffffffd
push 0x20019
push eax
call sym.ProcessHacker.exe_PhOpenKey
test eax, eax
js 0x485465
mov eax, dword [ebp - 0xc]
mov ebx, 0x10
push 0x100
push 4
push dword [0x54b674]
mov dword [ebp - 0x14], eax
mov dword [ebp - 4], 0x100
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov esi, eax
lea esp, [esp]
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push esi
push 0
push dword [ebp - 0x14]
call dword [sym.imp.ntdll.dll_NtQueryKey]
mov edi, eax
test edi, edi
jns 0x485431
push esi
push 0
push dword [0x54b674]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
cmp edi, 0x80000005
jne 0x48542a
push dword [ebp - 4]
push 4
push dword [0x54b674]
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov esi, eax
sub ebx, 1
jne 0x4853e0
jmp 0x48542d
mov esi, dword [ebp - 0x14]
test edi, edi
js 0x485456
mov ebx, dword [ebp - 8]
mov eax, dword [esi]
push esi
push 0
push dword [0x54b674]
mov dword [ebx + 0x118], eax
mov eax, dword [esi + 4]
mov dword [ebx + 0x11c], eax
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
jmp 0x485459
mov ebx, dword [ebp - 8]
push dword [ebp - 0xc]
call dword [sym.imp.ntdll.dll_NtClose]
mov esi, dword [ebp - 0x10]
lea ecx, [esi - 8]
or eax, 0xffffffff
lock xadd dword [ecx + 4], eax
dec eax
jne 0x485478
call fcn.004a2a20
or dword [ebx + 0xbc], 4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x48c050
Capabilities:
Hide graphical window

Disassembly:
cmp dword [0x54ab84], 0
push ebx
push esi
push edi
je 0x48c12b
mov eax, dword [0x54ab20]
xor ecx, ecx
xor esi, esi
mov dword [0x54ab84], ecx
mov dword [0x54abc4], ecx
cmp dword [eax], ecx
jbe 0x48c0df
lea esp, [esp]
mov eax, dword [eax + 8]
push 0
push ecx
push 3
mov ebx, dword [eax + esi*4]
push ebx
mov edi, dword [ebx + 0xc]
mov ecx, edi
call dword [0x4fe8dc]
call edi
mov edi, dword [ebx + 0x20]
push 0xfffffffffffffff0
push edi
call dword [sym.imp.USER32.dll_GetWindowLongW]
or eax, 3
push eax
push 0xfffffffffffffff0
push edi
call dword [sym.imp.USER32.dll_SetWindowLongW]
push 0
push dword [ebx + 0x58]
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [ebx + 0x54]
test eax, eax
je 0x48c0cd
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [0x54ab20]
inc esi
cmp esi, dword [eax]
jae 0x48c0df
mov ecx, dword [0x54ab84]
jmp 0x48c080
push 0
push dword [0x54ab8c]
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
push dword [0x54ab0c]
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
push dword [0x54ab14]
call dword [sym.imp.USER32.dll_ShowWindow]
push 5
push 0x512
push dword [0x54969c]
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
pop edi
pop esi
pop ebx
jmp fcn.0048bab0
pop edi
pop esi
pop ebx
ret
Function at 0x48cd90
Capabilities:
Get system information on windows

Disassembly:
movsx eax, byte [0x54b668]
push esi
mov dword [0x54abec], eax
shl eax, 2
push eax
push 4
push dword [0x54b674]
mov dword [0x54ac50], 0
mov dword [0x54ac54], 0
mov dword [0x54abcc], 0
mov dword [0x54abd0], 0
mov dword [0x54ac90], 0
mov dword [0x54ac94], 0
mov dword [0x54ac98], 0
mov dword [0x54ac9c], 0
mov dword [0x54ac68], 0
mov dword [0x54ac6c], 0
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov dword [0x54abe8], eax
mov eax, dword [0x54abec]
lea ecx, [eax*8]
sub ecx, eax
shl ecx, 2
push ecx
push 4
push dword [0x54b674]
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov dword [0x54abc8], eax
mov eax, dword [0x54abec]
lea eax, [eax + eax*2]
shl eax, 3
push eax
push 4
push dword [0x54b674]
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov dword [0x54ac60], eax
mov eax, dword [0x54abec]
lea eax, [eax + eax*2]
shl eax, 3
push eax
push 4
push dword [0x54b674]
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov edx, dword [0x54abec]
mov esi, eax
mov dword [0x54ac5c], esi
mov dword [0x54ac7c], 0
mov dword [0x54ac74], 0
mov dword [0x54ac78], 0
mov byte [0x54ac80], 0
mov dword [0x54ac84], 0
mov dword [0x54ac88], 0
mov dword [0x54ac8c], 0xffffffff
test edx, edx
je 0x48cf0b
mov eax, dword [0x54abc8]
mov ecx, edx
add eax, 4
mov dword [eax + 4], 0
lea eax, [eax + 0x1c]
mov dword [eax - 0x20], 0
mov dword [eax - 0x1c], 0
mov byte [eax - 0x14], 0
mov dword [eax - 0x10], 0
mov dword [eax - 0xc], 0
mov dword [eax - 8], 0xffffffff
sub ecx, 1
jne 0x48ced5
lea eax, [edx + edx*2]
mov dword [0x54ac48], 0
shl eax, 3
push eax
push esi
push 0
push 0
push 0xb
call dword [sym.imp.ntdll.dll_NtPowerInformation]
pop esi
test eax, eax
jns 0x48cf4a
mov eax, dword [0x54abec]
lea eax, [eax + eax*2]
shl eax, 3
push eax
push 0
push dword [0x54ac5c]
call fcn.004dce30
add esp, 0xc
mov dword [0x54ac70], 0
mov dword [0x54abd4], 0
jmp fcn.0048e450
Function at 0x49b000
Capabilities:
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1c
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov eax, edi
and eax, 0xfff0000
cmp eax, 0x70000
je 0x49b05f
lea eax, [esp + 0xc]
mov dword [esp + 0x18], 0x140012
push eax
lea eax, [esp + 0x1c]
mov dword [esp + 0x20], 0x522ce8
push eax
push 0
push 0
call dword [sym.imp.ntdll.dll_LdrGetDllHandle]
xor esi, esi
test eax, eax
push edi
cmovns esi, dword [esp + 0x10]
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
movzx eax, ax
push eax
push 0xb
push esi
call sym.ProcessHacker.exe_PhGetMessage
jmp 0x49b068
movzx eax, di
push eax
call sym.ProcessHacker.exe_PhGetWin32Message
mov esi, eax
test esi, esi
je 0x49b077
cmp dword [esi], 0
je 0x49b077
xor al, al
jmp 0x49b079
mov al, 1
test al, al
jne 0x49b14d
push dword [esi + 4]
call sym.ProcessHacker.exe_PhCountStringZ
add eax, eax
mov dword [esi], eax
cmp eax, 4
jb 0x49b0ce
mov edx, dword [esi + 4]
mov ecx, eax
shr ecx, 1
cmp word [edx + ecx*2 - 4], 0xd
jne 0x49b0ce
cmp word [edx + ecx*2 - 2], 0xa
jne 0x49b0ce
add eax, 0xfffffffc
push eax
push edx
call sym.ProcessHacker.exe_PhCreateStringEx
mov ecx, esi
mov esi, eax
test ecx, ecx
je 0x49b0ce
add ecx, 0xfffffff8
or eax, 0xffffffff
lock xadd dword [ecx + 4], eax
dec eax
jne 0x49b0ce
call fcn.004a2a20
mov eax, dword [esi + 4]
cmp word [eax], 0x7b
jne 0x49b14d
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x24]
push eax
push 0xa
push esi
call sym.ProcessHacker.exe_PhSplitStringRefAtChar
test al, al
je 0x49b14d
mov ebx, dword [esp + 0x10]
test ebx, ebx
jne 0x49b0fe
call sym.ProcessHacker.exe_PhReferenceEmptyString
mov edi, eax
jmp 0x49b132
push dword [0x54b7b4]
lea eax, [ebx + 0xa]
push eax
call sym.ProcessHacker.exe_PhCreateObject
mov edi, eax
xor ecx, ecx
lea eax, [edi + 8]
mov dword [edi + 4], eax
mov dword [edi], ebx
mov word [eax + ebx], cx
mov eax, dword [esp + 0x14]
test eax, eax
je 0x49b132
push ebx
push eax
push dword [edi + 4]
call fcn.004dd620
add esp, 0xc
mov ecx, esi
mov esi, edi
test ecx, ecx
je 0x49b14d
add ecx, 0xfffffff8
or eax, 0xffffffff
lock xadd dword [ecx + 4], eax
dec eax
jne 0x49b14d
call fcn.004a2a20
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x49b160
Capabilities:
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push esi
push edi
lea eax, [ebp - 8]
mov dword [ebp - 0x14], 0x1a0018
push eax
lea eax, [ebp - 0x14]
mov dword [ebp - 0x10], str.kernel32.dll
push eax
push 0
push 0
call dword [sym.imp.ntdll.dll_LdrGetDllHandle]
push dword [ebp + 8]
xor esi, esi
test eax, eax
cmovns esi, dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
movzx eax, ax
push eax
push 0xb
push esi
call sym.ProcessHacker.exe_PhGetMessage
mov esi, eax
test esi, esi
je 0x49b202
push dword [esi + 4]
call sym.ProcessHacker.exe_PhCountStringZ
add eax, eax
mov dword [esi], eax
cmp eax, 4
jb 0x49b200
mov edx, dword [esi + 4]
mov ecx, eax
shr ecx, 1
cmp word [edx + ecx*2 - 4], 0xd
jne 0x49b200
cmp word [edx + ecx*2 - 2], 0xa
jne 0x49b200
add eax, 0xfffffffc
push eax
push edx
call sym.ProcessHacker.exe_PhCreateStringEx
mov edi, eax
test esi, esi
je 0x49b202
lea ecx, [esi - 8]
or edx, 0xffffffff
lock xadd dword [ecx + 4], edx
dec edx
jne 0x49b202
call fcn.004a2a20
mov eax, edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
mov eax, esi
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4