joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400be200
Capabilities:
Create service
Delete service
Start service

Disassembly:
push rbp
push r13
sub rsp, 0x98
xor edx, edx
mov r13, rcx
xor ecx, ecx
lea r8d, [rdx + 2]
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov rbp, rax
test rax, rax
jne 0x1400be245
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x1400be40f
movzx eax, ax
or eax, 0xc0070000
add rsp, 0x98
pop r13
pop rbp
ret
mov rdx, qword [0x14015e7c8]
lea rcx, str.__s___ras___s_
mov r8, qword [r13 + 0x48]
mov qword [rsp + 0xb0], rbx
mov qword [rsp + 0xc8], rsi
mov rdx, qword [rdx + 8]
mov qword [rsp + 0x90], rdi
mov qword [rsp + 0x88], r14
call sym.ProcessHacker.exe_PhFormatString
mov rdx, qword [r13 + 0x48]
mov rbx, rax
lea rax, [0x140122b94]
mov r9d, 0xf01ff
mov qword [rsp + 0x60], rax
mov r8, rdx
lea rax, str.LocalSystem
mov rcx, qword [rbx + 8]
mov qword [rsp + 0x58], rax
xor eax, eax
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rcx
mov rcx, rbp
mov dword [rsp + 0x30], eax
mov dword [rsp + 0x28], 3
mov dword [rsp + 0x20], 0x10
call qword [sym.imp.ADVAPI32.dll_CreateServiceW]
mov r14, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
or esi, 0xffffffff
lea rcx, [rbx - 0x10]
mov edx, esi
mov edi, eax
lock xadd dword [rcx + 8], edx
cmp edx, 1
jne 0x1400be302
call fcn.1400258b0
mov rcx, rbp
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
test r14, r14
jne 0x1400be324
test edi, edi
jle 0x1400be31d
movzx edi, di
or edi, 0xc0070000
mov eax, edi
jmp 0x1400be3ef
mov qword [rsp + 0x80], r15
call fcn.1400be070
xor r8d, r8d
xor edx, edx
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_StartServiceW]
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_DeleteService]
mov rdx, qword [r13 + 0x48]
lea rcx, str.BaseNamedObjects_
call sym.ProcessHacker.exe_PhConcatStrings2
mov r15, rax
mov edi, 0xa
movzx ecx, word [rax]
mov word [rsp + 0x70], cx
movzx ecx, word [rax]
mov word [rsp + 0x72], cx
mov rcx, qword [rax + 8]
mov qword [rsp + 0x78], rcx
nop dword [rax]
lea rcx, [rsp + 0x70]
call fcn.14009a750
mov ebx, eax
test eax, eax
jns 0x1400be3b1
lea rdx, [rsp + 0xc0]
mov qword [rsp + 0xc0], 0xfffffffffff85ee0
xor ecx, ecx
call qword [sym.imp.ntdll.dll_NtDelayExecution]
add edi, 0xffffffff
jne 0x1400be380
lea rcx, [r15 - 0x10]
lock xadd dword [rcx + 8], esi
mov r15, qword [rsp + 0x80]
cmp esi, 1
jne 0x1400be3cc
call fcn.1400258b0
test ebx, ebx
js 0x1400be3e4
mov rdx, r13
mov ecx, 0xc
call fcn.14009ab30
mov ebx, eax
call fcn.14009a8d0
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, ebx
mov rdi, qword [rsp + 0x90]
mov rsi, qword [rsp + 0xc8]
mov rbx, qword [rsp + 0xb0]
mov r14, qword [rsp + 0x88]
add rsp, 0x98
pop r13
pop rbp
ret
Function at 0x1400cd570
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x48
mov edx, 1
mov qword [rsp + 0x30], rcx
lea rcx, [rsp + 0x20]
mov word [rsp + 0x24], dx
xor r8d, r8d
mov dword [rsp + 0x20], 0x4c
call sym.ProcessHacker.exe_PhFormat
mov rcx, rax
add rsp, 0x48
jmp sym.ProcessHacker.exe_PhAutoDereferenceObject

Function at 0x1400cd850
Capabilities:
Get system information on windows

Disassembly:
push rbx
sub rsp, 0x30
movsx eax, byte [0x14015f3d8]
xor ebx, ebx
mov rcx, qword [sym.ProcessHacker.exe_PhHeapHandle]
mov r8d, eax
shl r8, 3
lea edx, [rbx + 4]
mov qword [0x14015dc00], rbx
mov qword [0x14015d890], rbx
mov qword [0x14015dca8], rbx
mov qword [0x14015dcb0], rbx
mov qword [0x14015dc50], rbx
mov dword [0x14015d9d8], eax
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov rcx, qword [sym.ProcessHacker.exe_PhHeapHandle]
lea edx, [rbx + 4]
mov qword [0x14015d9b0], rax
mov eax, dword [0x14015d9d8]
lea r8, [rax + rax*2]
shl r8, 4
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov rcx, qword [sym.ProcessHacker.exe_PhHeapHandle]
lea edx, [rbx + 4]
mov qword [0x14015d888], rax
mov eax, dword [0x14015d9d8]
lea r8, [rax + rax*2]
shl r8, 3
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov rcx, qword [sym.ProcessHacker.exe_PhHeapHandle]
lea edx, [rbx + 4]
mov qword [0x14015dc30], rax
mov eax, dword [0x14015d9d8]
lea r8, [rax + rax*2]
shl r8, 3
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov edx, dword [0x14015d9d8]
xorps xmm0, xmm0
mov qword [0x14015dc28], rax
xorps xmm1, xmm1
mov dword [0x14015dd08], ebx
mov r9, rax
mov byte [0x14015dd0c], bl
mov dword [0x14015dd20], 0xffffffff
movdqu xmmword [0x14015dcf8], xmm0
movdqu xmmword [0x14015dd10], xmm1
test edx, edx
je 0x1400cd986
mov rax, qword [0x14015d888]
mov ecx, edx
add rax, 8
nop dword [rax + rax]
mov dword [rax + 8], ebx
mov qword [rax - 8], rbx
mov qword [rax], rbx
mov byte [rax + 0xc], bl
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbx
mov dword [rax + 0x20], 0xffffffff
lea rax, [rax + 0x30]
sub rcx, 1
jne 0x1400cd960
lea eax, [rdx + rdx*2]
mov dword [0x14015d9dc], ebx
xor edx, edx
shl eax, 3
xor r8d, r8d
mov dword [rsp + 0x20], eax
lea ecx, [rdx + 0xb]
call qword [sym.imp.ntdll.dll_NtPowerInformation]
test eax, eax
jns 0x1400cd9c4
mov eax, dword [0x14015d9d8]
xor edx, edx
mov rcx, qword [0x14015dc28]
lea r8, [rax + rax*2]
shl r8, 3
call fcn.1400e2690
cmp dword [sym.ProcessHacker.exe_WindowsVersion], 0x3d
mov qword [0x14015dc90], rbx
mov qword [0x14015d898], rbx
jb 0x1400cd9e5
add rsp, 0x30
pop rbx
jmp fcn.1400cf6b0
add rsp, 0x30
pop rbx
ret
Function at 0x1400cdbd0
Capabilities:
Get system information on windows

Disassembly:
sub rsp, 0x38
mov eax, dword [0x14015d9d8]
xor r9d, r9d
mov rdx, qword [0x14015dc30]
mov qword [rsp + 0x40], rbx
xor ebx, ebx
lea r8d, [rax + rax*2]
shl r8d, 3
lea ecx, [rbx + 0x17]
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
mov r10d, dword [0x14015d9d8]
test eax, eax
js 0x1400cdc6f
xor edx, edx
mov qword [rsp + 0x30], rdi
mov rdi, qword [0x14015dc30]
xor r8d, r8d
xor r11d, r11d
cmp r10d, 2
jb 0x1400cdc56
lea eax, [r10 - 2]
shr eax, 1
lea rcx, [rdi + 0x1c]
inc eax
mov r9d, eax
lea r11d, [rax + rax]
nop dword [rax]
nop dword [rax + rax]
mov eax, dword [rcx - 0x18]
lea rcx, [rcx + 0x30]
add rdx, rax
mov eax, dword [rcx - 0x30]
add r8, rax
sub r9, 1
jne 0x1400cdc40
cmp r11d, r10d
jae 0x1400cdc63
lea rcx, [r11 + r11*2]
mov ebx, dword [rdi + rcx*8 + 4]
mov rdi, qword [rsp + 0x30]
lea rax, [r8 + rdx]
add rbx, rax
mov ecx, dword [0x14015e028]
xor edx, edx
mov r9, qword [0x14015dc28]
mov eax, ecx
sub eax, dword [0x14015dc00]
xor r8d, r8d
mov dword [0x14015dc04], eax
mov dword [0x14015dc00], ecx
mov ecx, dword [0x14015e0e8]
mov eax, ecx
sub eax, dword [0x14015d890]
mov dword [0x14015d894], eax
mov rax, rbx
sub rax, qword [0x14015dca8]
mov qword [0x14015dcb0], rax
mov dword [0x14015d890], ecx
mov ecx, dword [0x14015e034]
mov eax, ecx
sub eax, dword [0x14015dc50]
mov dword [0x14015dc54], eax
lea eax, [r10 + r10*2]
shl eax, 3
mov dword [0x14015dc50], ecx
lea ecx, [rdx + 0xb]
mov dword [rsp + 0x20], eax
mov qword [0x14015dca8], rbx
call qword [sym.imp.ntdll.dll_NtPowerInformation]
mov rbx, qword [rsp + 0x40]
test eax, eax
jns 0x1400cdd1a
mov eax, dword [0x14015d9d8]
xor edx, edx
mov rcx, qword [0x14015dc28]
lea r8, [rax + rax*2]
shl r8, 3
call fcn.1400e2690
cmp dword [sym.ProcessHacker.exe_WindowsVersion], 0x3d
jb 0x1400cdd5c
mov r8, qword [0x14015d898]
test r8, r8
je 0x1400cdd3e
mov rcx, qword [sym.ProcessHacker.exe_PhHeapHandle]
xor edx, edx
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
mov rax, qword [0x14015dc90]
mov qword [0x14015d898], rax
mov qword [0x14015dc90], 0
call fcn.1400cf6b0
mov eax, dword [0x14015d9dc]
mov ecx, 2
inc eax
cmp eax, ecx
cmova eax, ecx
mov dword [0x14015d9dc], eax
call fcn.1400ceb70
add rsp, 0x38
jmp fcn.1400cecb0
Function at 0x1400cf6b0
Capabilities:
Get system information on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x20
mov rcx, qword [sym.ProcessHacker.exe_PhHeapHandle]
mov edx, 4
mov r8d, 0x100
mov dword [rsp + 0x30], 0x100
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov r8d, dword [rsp + 0x30]
lea r9, [rsp + 0x30]
mov rdx, rax
mov ecx, 0x64
mov rsi, rax
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
xor ebx, ebx
mov edi, eax
cmp eax, 0xc0000004
jne 0x1400cf764
nop word [rax + rax]
cmp ebx, 8
jae 0x1400cf764
mov rcx, qword [sym.ProcessHacker.exe_PhHeapHandle]
mov r8, rsi
xor edx, edx
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
mov r8d, dword [rsp + 0x30]
mov edx, 4
mov rcx, qword [sym.ProcessHacker.exe_PhHeapHandle]
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov r8d, dword [rsp + 0x30]
lea r9, [rsp + 0x30]
mov rdx, rax
mov ecx, 0x64
mov rsi, rax
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
inc ebx
mov edi, eax
cmp eax, 0xc0000004
je 0x1400cf710
test edi, edi
js 0x1400cf781
mov qword [0x14015dc90], rsi
mov eax, edi
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
mov rcx, qword [sym.ProcessHacker.exe_PhHeapHandle]
mov r8, rsi
xor edx, edx
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
mov rbx, qword [rsp + 0x38]
mov eax, edi
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret

Function at 0x1400cfd80
Capabilities:
Get system information on windows

Disassembly:
sub rsp, 0x28
mov ecx, dword [0x14015df78]
mov eax, ecx
sub eax, dword [0x14015d9e8]
mov dword [0x14015d9ec], eax
mov dword [0x14015d9e8], ecx
mov ecx, dword [0x14015df7c]
mov eax, ecx
sub eax, dword [0x14015dcf0]
mov dword [0x14015dcf4], eax
mov dword [0x14015dcf0], ecx
mov ecx, dword [0x14015df80]
mov eax, ecx
sub eax, dword [0x14015db58]
mov dword [0x14015db5c], eax
mov dword [0x14015db58], ecx
mov ecx, dword [0x14015df84]
mov eax, ecx
sub eax, dword [0x14015db40]
mov dword [0x14015db44], eax
mov dword [0x14015db40], ecx
mov ecx, dword [0x14015df3c]
mov eax, ecx
sub eax, dword [0x14015dcd8]
mov dword [0x14015dcdc], eax
mov dword [0x14015dcd8], ecx
mov ecx, dword [0x14015df50]
mov eax, ecx
sub eax, dword [0x14015d9e0]
mov dword [0x14015d9e4], eax
mov dword [0x14015d9e0], ecx
mov ecx, dword [0x14015df60]
mov eax, ecx
sub eax, dword [0x14015d928]
mov dword [0x14015d92c], eax
mov dword [0x14015d928], ecx
mov ecx, dword [0x14015df68]
mov eax, ecx
sub eax, dword [0x14015dae0]
mov dword [0x14015dae4], eax
mov eax, dword [0x14015dccc]
inc eax
mov dword [0x14015dae0], ecx
mov ecx, 2
cmp eax, ecx
cmova eax, ecx
mov dword [0x14015dccc], eax
call fcn.1400d0a30
add rsp, 0x28
jmp fcn.1400d0b20
Function at 0x1400dce50
Capabilities:
Write file on windows

Disassembly:
mov eax, 0x2088
call fcn.1400fde00
sub rsp, rax
lea rax, [rsp + 0x78]
mov qword [rsp + 0x60], rdx
mov qword [rsp + 0x68], rax
lea rdx, [rsp + 0x60]
lea rax, [rsp + 0x2078]
xor r9d, r9d
mov qword [rsp + 0x70], rax
lea rax, [0x1401583e0]
mov qword [rsp + 0x28], rax
lea rax, [0x1400dd4a0]
mov qword [rsp + 0x20], rax
call fcn.1400df7b0
test eax, eax
jns 0x1400dcead
or eax, 0xffffffff
add rsp, 0x2088
ret
mov rax, qword [rsp + 0x68]
jle 0x1400dcede
cmp rax, qword [rsp + 0x70]
jb 0x1400dcece
lea rcx, [rsp + 0x60]
call fcn.1400dd580
test eax, eax
js 0x1400dcea2
mov rax, qword [rsp + 0x68]
mov byte [rax], 0xa
mov rax, qword [rsp + 0x68]
inc rax
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x2080], rbx
lea rcx, [rsp + 0x78]
xor ebx, ebx
lea rdx, [rsp + 0x60]
cmp rax, rcx
je 0x1400dcf38
mov rcx, qword [rsp + 0x60]
sub eax, edx
sub eax, 0x18
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x38], rbx
xor r9d, r9d
mov dword [rsp + 0x30], eax
xor r8d, r8d
lea rax, [rsp + 0x78]
xor edx, edx
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntdll.dll_NtWriteFile]
test eax, eax
setns bl
dec ebx
mov eax, ebx
mov rbx, qword [rsp + 0x2080]
add rsp, 0x2088
ret

Function at 0x1400dd4f0
Capabilities:
Read file on windows

Disassembly:
push rbx
sub rsp, 0x60
mov rbx, rcx
test rcx, rcx
jne 0x1400dd507
or eax, 0xffffffff
add rsp, 0x60
pop rbx
ret
xor eax, eax
mov qword [rsp + 0x70], rdi
mov qword [rsp + 0x40], rax
lea rdi, [rcx + 0x18]
mov rcx, qword [rcx]
xor r9d, r9d
mov qword [rsp + 0x38], rax
xor r8d, r8d
mov dword [rsp + 0x30], 0x2000
lea rax, [rsp + 0x50]
mov qword [rsp + 0x28], rdi
xor edx, edx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntdll.dll_NtReadFile]
test eax, eax
js 0x1400dd552
mov rax, qword [rsp + 0x58]
test rax, rax
jne 0x1400dd560
or eax, 0xffffffff
mov rdi, qword [rsp + 0x70]
add rsp, 0x60
pop rbx
ret
add rax, 0x18
mov qword [rbx + 8], rdi
mov rdi, qword [rsp + 0x70]
add rax, rbx
mov qword [rbx + 0x10], rax
xor eax, eax
add rsp, 0x60
pop rbx
ret

Function at 0x1400dd580
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x60
mov rbx, rcx
test rcx, rcx
jne 0x1400dd597
lea eax, [rcx + 1]
add rsp, 0x60
pop rbx
ret
mov qword [rsp + 0x70], rdi
lea rdi, [rcx + 0x18]
cmp qword [rcx + 8], rdi
je 0x1400dd5f4
mov eax, dword [rcx + 8]
xor r9d, r9d
sub eax, ecx
xor r8d, r8d
xor ecx, ecx
sub eax, 0x18
mov qword [rsp + 0x40], rcx
xor edx, edx
mov qword [rsp + 0x38], rcx
mov rcx, qword [rbx]
mov dword [rsp + 0x30], eax
lea rax, [rsp + 0x50]
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntdll.dll_NtWriteFile]
test eax, eax
jns 0x1400dd5f0
or eax, 0xffffffff
mov rdi, qword [rsp + 0x70]
add rsp, 0x60
pop rbx
ret
mov qword [rbx + 8], rdi
xor eax, eax
mov rdi, qword [rsp + 0x70]
add rsp, 0x60
pop rbx
ret
Function at 0x1400e1298
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
sub rsp, 0x18
mov r8, rcx
mov eax, 0x5a4d
cmp word [0x140000000], ax
jne 0x1400e1329
movsxd rax, dword [0x14000003c]
lea rdx, [0x140000000]
lea rcx, [rax + rdx]
cmp dword [rcx], 0x4550
jne 0x1400e1329
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400e1329
sub r8, rdx
movzx eax, word [rcx + 0x14]
lea rdx, [rcx + 0x18]
add rdx, rax
movzx eax, word [rcx + 6]
lea rcx, [rax + rax*4]
lea r9, [rdx + rcx*8]
mov qword [rsp], rdx
cmp rdx, r9
je 0x1400e130d
mov ecx, dword [rdx + 0xc]
cmp r8, rcx
jb 0x1400e1307
mov eax, dword [rdx + 8]
add eax, ecx
cmp r8, rax
jb 0x1400e130f
add rdx, 0x28
jmp 0x1400e12ec
xor edx, edx
test rdx, rdx
jne 0x1400e1318
xor al, al
jmp 0x1400e132f
test dword [rdx + 0x24], 0x80000000
je 0x1400e1325
xor al, al
jmp 0x1400e132f
mov al, 1
jmp 0x1400e132f
xor al, al
jmp 0x1400e132f
add rsp, 0x18
ret
Function at 0x1400edfbc
Capabilities:
Read file on windows

Disassembly:
sub rsp, 0x28
mov rdx, rcx
test rcx, rcx
jne 0x1400edf99
call fcn.1400eeb8c
mov dword [rax], 0x16
call fcn.1400f0358
or eax, 0xffffffff
jmp 0x1400edfb6
sub dword [rcx + 0x10], 1
jns 0x1400edfa8
add rsp, 0x28
jmp 0x1400f8434
mov rax, qword [rcx]
movzx ecx, byte [rax]
inc rax
mov qword [rdx], rax
mov eax, ecx
add rsp, 0x28
ret
jmp 0x1400edf78
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov qword [rax + 8], rcx
push rbp
mov rbp, rsp
sub rsp, 0x20
test rcx, rcx
jne 0x1400f80f0
call fcn.1400eeb8c
mov dword [rax], 0x16
call fcn.1400f0358
or eax, 0xffffffff
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop rbp
ret
mov eax, dword [rcx + 0x14]
shr eax, 0xd
test al, 1
je 0x1400f80d8
mov rax, qword [rbp + 0x10]
mov ecx, dword [rax + 0x14]
shr ecx, 0xc
test cl, 1
jne 0x1400f80d8
mov rax, qword [rbp + 0x10]
mov ecx, dword [rax + 0x14]
mov rax, qword [rbp + 0x10]
shr ecx, 1
test cl, 1
je 0x1400f8122
lock or dword [rax + 0x14], 0x10
jmp 0x1400f80d8
lock or dword [rax + 0x14], 1
mov rax, qword [rbp + 0x10]
mov ecx, dword [rax + 0x14]
test ecx, 0x4c0
jne 0x1400f813f
mov rcx, qword [rbp + 0x10]
call fcn.1400fbf14
mov rax, qword [rbp + 0x10]
mov rcx, qword [rax + 8]
mov qword [rax], rcx
mov rbx, qword [rbp + 0x10]
mov rcx, rbx
call fcn.1400f0fdc
mov rdx, qword [rbp + 0x10]
mov ecx, eax
mov r8d, dword [rdx + 0x20]
mov rdx, qword [rdx + 8]
call fcn.1400fc750
mov dword [rbx + 0x10], eax
mov rax, qword [rbp + 0x10]
mov edx, dword [rax + 0x10]
lea ecx, [rdx + 1]
cmp ecx, 1
ja 0x1400f8196
neg edx
sbb ecx, ecx
and ecx, 8
add ecx, 8
lock or dword [rax + 0x14], ecx
mov rax, qword [rbp + 0x10]
and dword [rax + 0x10], 0
jmp 0x1400f80d8
mov ecx, dword [rax + 0x14]
test cl, 6
jne 0x1400f8202
mov rcx, qword [rbp + 0x10]
call fcn.1400f0fdc
cmp eax, 0xffffffff
je 0x1400f81e9
mov rcx, qword [rbp + 0x10]
call fcn.1400f0fdc
cmp eax, 0xfffffffe
je 0x1400f81e9
mov rbx, qword [rbp + 0x10]
mov rcx, rbx
call fcn.1400f0fdc
movsxd rdi, eax
lea rsi, [0x140158c40]
mov rcx, rbx
sar rdi, 6
call fcn.1400f0fdc
and eax, 0x3f
shl rax, 6
add rax, qword [rsi + rdi*8]
jmp 0x1400f81f0
lea rax, [0x140152320]
mov al, byte [rax + 0x38]
and al, 0x82
cmp al, 0x82
jne 0x1400f8202
mov rax, qword [rbp + 0x10]
lock or dword [rax + 0x14], 0x20
mov rax, qword [rbp + 0x10]
cmp dword [rax + 0x20], 0x200
jne 0x1400f8238
mov ecx, dword [rax + 0x14]
shr ecx, 6
test cl, 1
je 0x1400f8234
mov rax, qword [rbp + 0x10]
mov ecx, dword [rax + 0x14]
shr ecx, 8
test cl, 1
jne 0x1400f8234
mov rax, qword [rbp + 0x10]
mov dword [rax + 0x20], 0x1000
mov rax, qword [rbp + 0x10]
dec dword [rax + 0x10]
mov rcx, qword [rax]
movzx edx, byte [rcx]
inc rcx
mov qword [rax], rcx
mov eax, edx
jmp 0x1400f80db
jmp 0x1400f80a8
Function at 0x1400ef738
Capabilities:
Parse pe header

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push r15
sub rsp, 0x20
mov esi, r8d
mov ebx, edx
mov r14d, ecx
test r8d, r8d
jne 0x1400ef50c
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400ef50c
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400ef50c
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400ef50c
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400ef50c
cmp dword [rcx + 0x84], 0xe
jbe 0x1400ef50c
cmp dword [rcx + 0xf8], esi
je 0x1400ef50c
mov ecx, r14d
call fcn.1400ef654
mov ecx, 2
call fcn.1400f4f68
nop
cmp byte [0x140158bd0], 0
jne 0x1400ef5d6
mov r15d, 1
mov eax, r15d
xchg dword [0x140158bc4], eax
test ebx, ebx
jne 0x1400ef57f
mov rdi, qword [0x140152018]
mov edx, edi
and edx, 0x3f
lea ecx, [rbx + 0x40]
sub ecx, edx
xor eax, eax
ror rax, cl
xor rax, rdi
mov rcx, qword [0x140158bc8]
cmp rcx, rax
je 0x1400ef576
xor rdi, rcx
mov ecx, edx
ror rdi, cl
mov rcx, rdi
call qword [sym.ProcessHacker.exe_PhDeleteCallback]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call rdi
lea rcx, [0x140158be0]
jmp 0x1400ef58b
cmp ebx, r15d
jne 0x1400ef591
lea rcx, [0x140158bf8]
call fcn.1400efc98
nop
test ebx, ebx
jne 0x1400ef5a8
lea rdx, [0x140101238]
lea rcx, [0x140101218]
call fcn.1400ef3cc
lea rdx, [0x140101248]
lea rcx, [0x140101240]
call fcn.1400ef3cc
movzx eax, byte [0x140158bd0]
test esi, esi
cmove eax, r15d
mov byte [0x140158bd0], al
jmp 0x1400ef5d6
mov ecx, 2
call fcn.1400f4fbc
test esi, esi
jne 0x1400ef5ed
mov ecx, r14d
call fcn.1400ef608
int3
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x40]
mov r14, qword [rsp + 0x48]
add rsp, 0x20
pop r15
ret
xor r8d, r8d
xor edx, edx
jmp 0x1400ef49c

Function at 0x1400f54b8
Capabilities:
Get geographical location

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x20
mov edi, r9d
mov rsi, r8
mov ebp, edx
lea r9, str.GetLocaleInfoEx
mov r14, rcx
lea r8, [0x140105360]
lea rdx, str.GetLocaleInfoEx
mov ecx, 0xc
call fcn.1400f50b4
mov rbx, rax
test rax, rax
je 0x1400f551b
mov rcx, rax
call qword [sym.ProcessHacker.exe_PhDeleteCallback]
mov r9d, edi
mov r8, rsi
mov edx, ebp
mov rcx, r14
call rbx
jmp 0x1400f5535
xor edx, edx
mov rcx, r14
call fcn.1400f5820
mov ecx, eax
mov r9d, edi
mov r8, rsi
mov edx, ebp
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
Function at 0x1400f843c
Capabilities:
Read file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov qword [rax + 8], rcx
push rbp
push r14
push r15
mov rbp, rsp
sub rsp, 0x20
test rcx, rcx
jne 0x1400f82a2
call fcn.1400eeb8c
mov dword [rax], 0x16
call fcn.1400f0358
mov eax, 0xffff
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x20
pop r15
pop r14
pop rbp
ret
mov eax, dword [rcx + 0x14]
shr eax, 0xd
test al, 1
je 0x1400f8284
mov rax, qword [rbp + 0x20]
mov ecx, dword [rax + 0x14]
shr ecx, 0xc
test cl, 1
jne 0x1400f8284
mov rax, qword [rbp + 0x20]
mov ecx, dword [rax + 0x14]
mov rax, qword [rbp + 0x20]
shr ecx, 1
test cl, 1
je 0x1400f82d4
lock or dword [rax + 0x14], 0x10
jmp 0x1400f8284
lock or dword [rax + 0x14], 1
mov rax, qword [rbp + 0x20]
mov ecx, dword [rax + 0x14]
test ecx, 0x4c0
jne 0x1400f82f1
mov rcx, qword [rbp + 0x20]
call fcn.1400fbf14
mov rax, qword [rbp + 0x20]
cmp dword [rax + 0x10], 1
jne 0x1400f8306
mov rcx, qword [rax]
mov sil, 1
mov r14b, byte [rcx]
jmp 0x1400f830c
xor sil, sil
xor r14b, r14b
mov rcx, qword [rax + 8]
mov qword [rax], rcx
mov rbx, qword [rbp + 0x20]
mov rcx, rbx
call fcn.1400f0fdc
mov rdx, qword [rbp + 0x20]
mov ecx, eax
mov r8d, dword [rdx + 0x20]
mov rdx, qword [rdx + 8]
call fcn.1400fc750
mov dword [rbx + 0x10], eax
mov rax, qword [rbp + 0x20]
mov edx, dword [rax + 0x10]
lea ecx, [rdx + 1]
cmp ecx, 2
ja 0x1400f835f
neg edx
sbb ecx, ecx
and ecx, 8
add ecx, 8
lock or dword [rax + 0x14], ecx
mov rax, qword [rbp + 0x20]
and dword [rax + 0x10], 0
jmp 0x1400f8284
mov ecx, dword [rax + 0x14]
test cl, 6
jne 0x1400f83cb
mov rcx, qword [rbp + 0x20]
call fcn.1400f0fdc
cmp eax, 0xffffffff
je 0x1400f83b2
mov rcx, qword [rbp + 0x20]
call fcn.1400f0fdc
cmp eax, 0xfffffffe
je 0x1400f83b2
mov rbx, qword [rbp + 0x20]
mov rcx, rbx
call fcn.1400f0fdc
movsxd rdi, eax
lea r15, [0x140158c40]
mov rcx, rbx
sar rdi, 6
call fcn.1400f0fdc
and eax, 0x3f
shl rax, 6
add rax, qword [r15 + rdi*8]
jmp 0x1400f83b9
lea rax, [0x140152320]
mov al, byte [rax + 0x38]
and al, 0x82
cmp al, 0x82
jne 0x1400f83cb
mov rax, qword [rbp + 0x20]
lock or dword [rax + 0x14], 0x20
mov rax, qword [rbp + 0x20]
cmp dword [rax + 0x20], 0x200
jne 0x1400f8401
mov ecx, dword [rax + 0x14]
shr ecx, 6
test cl, 1
je 0x1400f83fd
mov rax, qword [rbp + 0x20]
mov ecx, dword [rax + 0x14]
shr ecx, 8
test cl, 1
jne 0x1400f83fd
mov rax, qword [rbp + 0x20]
mov dword [rax + 0x20], 0x1000
mov rax, qword [rbp + 0x20]
mov rcx, qword [rax]
test sil, sil
je 0x1400f841f
movzx edx, byte [rcx]
dec dword [rax + 0x10]
shl dx, 8
movzx ecx, r14b
or dx, cx
inc qword [rax]
jmp 0x1400f842a
movzx edx, word [rcx]
add dword [rax + 0x10], 0xfffffffe
add qword [rax], 2
movzx eax, dx
jmp 0x1400f8289
jmp 0x1400f8250