joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140030b00
Capabilities:
Delete service

Disassembly:
push rsi
push r12
push r14
sub rsp, 0x40
mov r8, qword [rdx + 0x10]
mov rsi, rdx
lea r9, str.Deleting_a_service_can_prevent_the_system_from_starting_or_functioning_properly.
lea rdx, str.delete
xor r14b, r14b
add r8, 0x10
mov r12, rcx
mov byte [rsp + 0x20], 1
mov byte [rsp + 0x68], r14b
call sym.ProcessHacker.exe_PhShowConfirmMessage
test al, al
jne 0x140030b46
add rsp, 0x40
pop r14
pop r12
pop rsi
ret
mov qword [rsp + 0x60], rbx
mov rbx, qword [rsi + 0x10]
mov qword [rsp + 0x70], rbp
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], r13
mov r13d, 1
xor edx, edx
xor ecx, ecx
mov r8d, r13d
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov rdi, rax
test rax, rax
je 0x140030bc5
lea rdx, [rbx + 0x10]
mov r8d, 0x10000
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov rcx, rdi
mov rbp, rax
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
test rbp, rbp
je 0x140030bc5
mov rcx, rbp
call qword [sym.imp.ADVAPI32.dll_DeleteService]
movzx ebx, r14b
mov rcx, rbp
test eax, eax
cmovne ebx, r13d
mov byte [rsp + 0x68], bl
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
test bl, bl
jne 0x140030c81
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jg 0x140030bd9
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
jmp 0x140030be8
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ebx, ax
or ebx, 0xc0070000
mov rdx, qword [rsi + 0x10]
lea rcx, str.Unable_to_delete
add rdx, 0x10
call sym.ProcessHacker.exe_PhConcatStrings2
mov rdi, rax
test rax, rax
je 0x140030c0c
mov rcx, rax
call sym.ProcessHacker.exe_PhaDereferenceObject
mov r8, qword [rsi + 0x10]
lea r9, [0x1400afe14]
lea rdx, str._e__c__ctype_service__caction_delete__cobject__
add r8, 0x10
mov ecx, 3
call sym.ProcessHacker.exe_PhaConcatStrings
lea rcx, [rsp + 0x68]
lea rdx, [rdi + 0x10]
mov qword [rsp + 0x20], rcx
lea r9, [rax + 0x10]
mov r8d, ebx
mov rcx, r12
call fcn.14002d1d0
test al, al
jne 0x140030c7d
mov r8, qword [rsi + 0x10]
lea rdx, str.delete
lea rcx, str.Unable_to__s__s
add r8, 0x10
call sym.ProcessHacker.exe_PhaFormatString
xor r9d, r9d
mov r8d, ebx
add rax, 0x10
mov rcx, r12
mov rdx, rax
call sym.ProcessHacker.exe_PhShowStatus
mov bl, byte [rsp + 0x68]
mov r13, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x70]
mov al, bl
mov rbx, qword [rsp + 0x60]
add rsp, 0x40
pop r14
pop r12
pop rsi
ret
Function at 0x140031330
Capabilities:
Suspend thread

Disassembly:
mov qword [rsp + 0x10], rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0xc0
xor r14d, r14d
mov r12d, r8d
mov rdi, rdx
mov r13, rcx
mov bpl, 1
mov esi, r14d
test r8d, r8d
je 0x1400314d9
mov qword [rsp + 0xf0], rbx
nop word [rax + rax]
mov rax, qword [rdi]
mov rcx, qword [0x1400d62b8]
mov dword [rsp + 0x88], r14d
mov rdx, qword [rax]
xor eax, eax
mov qword [rsp + 0x90], rax
mov qword [rsp + 0x98], rax
mov qword [rsp + 0xa0], rax
mov qword [rsp + 0xa8], rax
mov qword [rsp + 0xb0], rax
test rcx, rcx
je 0x140031421
mov dword [rsp + 0x48], 8
lea rax, [rsp + 0x50]
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x38], 0x10
lea rax, [rsp + 0x58]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x78]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov dword [rsp + 0x28], 0x99992190
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x60], 2
call qword [sym.imp.ntdll.dll_NtDeviceIoControlFile]
mov rcx, qword [rsp + 0x108]
test eax, eax
mov ebx, eax
cmovns rcx, qword [rsp + 0x50]
mov qword [rsp + 0x108], rcx
jmp 0x140031455
mov qword [rsp + 0x70], rdx
lea r9, [rsp + 0x68]
lea r8, [rsp + 0x88]
lea rcx, [rsp + 0x108]
mov edx, 2
mov qword [rsp + 0x68], r14
call qword [sym.imp.ntdll.dll_NtOpenThread]
mov rcx, qword [rsp + 0x108]
mov ebx, eax
test ebx, ebx
js 0x140031475
xor edx, edx
call qword [sym.imp.ntdll.dll_NtSuspendThread]
mov rcx, qword [rsp + 0x108]
mov ebx, eax
call qword [sym.imp.ntdll.dll_NtClose]
test ebx, ebx
jns 0x1400314a7
mov rax, qword [rdi]
lea rdx, str.suspend
lea rcx, str.Unable_to__s_thread__u
mov r8d, dword [rax]
xor bpl, bpl
call sym.ProcessHacker.exe_PhaFormatString
xor r9d, r9d
mov r8d, ebx
lea rdx, [rax + 0x10]
mov rcx, r13
call sym.ProcessHacker.exe_PhShowContinueStatus
test al, al
je 0x1400314b6
inc esi
add rdi, 8
cmp esi, r12d
jb 0x140031370
mov rbx, qword [rsp + 0xf0]
mov al, bpl
mov rbp, qword [rsp + 0xf8]
add rsp, 0xc0
pop r14
pop r13
pop r12
pop rdi
pop rsi
ret
mov al, bpl
jmp 0x1400314c1
Function at 0x1400314e0
Capabilities:
Resume thread

Disassembly:
mov qword [rsp + 0x10], rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0xc0
xor r14d, r14d
mov r12d, r8d
mov rdi, rdx
mov r13, rcx
mov bpl, 1
mov esi, r14d
test r8d, r8d
je 0x140031689
mov qword [rsp + 0xf0], rbx
nop word [rax + rax]
mov rax, qword [rdi]
mov rcx, qword [0x1400d62b8]
mov dword [rsp + 0x88], r14d
mov rdx, qword [rax]
xor eax, eax
mov qword [rsp + 0x90], rax
mov qword [rsp + 0x98], rax
mov qword [rsp + 0xa0], rax
mov qword [rsp + 0xa8], rax
mov qword [rsp + 0xb0], rax
test rcx, rcx
je 0x1400315d1
mov dword [rsp + 0x48], 8
lea rax, [rsp + 0x50]
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x38], 0x10
lea rax, [rsp + 0x58]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x78]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov dword [rsp + 0x28], 0x99992190
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x60], 2
call qword [sym.imp.ntdll.dll_NtDeviceIoControlFile]
mov rcx, qword [rsp + 0x108]
test eax, eax
mov ebx, eax
cmovns rcx, qword [rsp + 0x50]
mov qword [rsp + 0x108], rcx
jmp 0x140031605
mov qword [rsp + 0x70], rdx
lea r9, [rsp + 0x68]
lea r8, [rsp + 0x88]
lea rcx, [rsp + 0x108]
mov edx, 2
mov qword [rsp + 0x68], r14
call qword [sym.imp.ntdll.dll_NtOpenThread]
mov rcx, qword [rsp + 0x108]
mov ebx, eax
test ebx, ebx
js 0x140031625
xor edx, edx
call qword [sym.imp.ntdll.dll_NtResumeThread]
mov rcx, qword [rsp + 0x108]
mov ebx, eax
call qword [sym.imp.ntdll.dll_NtClose]
test ebx, ebx
jns 0x140031657
mov rax, qword [rdi]
lea rdx, str.resume
lea rcx, str.Unable_to__s_thread__u
mov r8d, dword [rax]
xor bpl, bpl
call sym.ProcessHacker.exe_PhaFormatString
xor r9d, r9d
mov r8d, ebx
lea rdx, [rax + 0x10]
mov rcx, r13
call sym.ProcessHacker.exe_PhShowContinueStatus
test al, al
je 0x140031666
inc esi
add rdi, 8
cmp esi, r12d
jb 0x140031520
mov rbx, qword [rsp + 0xf0]
mov al, bpl
mov rbp, qword [rsp + 0xf8]
add rsp, 0xc0
pop r14
pop r13
pop r12
pop rdi
pop rsi
ret
mov al, bpl
jmp 0x140031671
Function at 0x140034850
Capabilities:
Log keystrokes via polling

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rdx
cmp qword [rcx], rdx
jne 0x14003487d
cmp word [rcx + 0x18], 0x43
jne 0x14003487d
mov ecx, 0x11
call qword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jns 0x14003487d
mov rcx, rbx
call sym.ProcessHacker.exe_PhCopyListView
add rsp, 0x20
pop rbx
ret
Function at 0x1400461e0
Capabilities:
Terminate process

Disassembly:
sub rsp, 0x48
mov rax, qword gs:[0x30]
mov rcx, qword [rax + 0x60]
mov rdx, qword [rcx + 0x20]
lea rcx, [rsp + 0x30]
mov rax, qword [rdx + 0x70]
mov qword [rcx], rax
mov rax, qword [rdx + 0x78]
xor edx, edx
mov qword [rcx + 8], rax
lea rcx, [0x1400d8220]
lea r8d, [rdx + 0x50]
call fcn.14009e740
mov r9d, 3
lea rax, [0x140045ee0]
lea rdx, [0x1400d15f0]
lea rcx, [rsp + 0x30]
lea r8d, [r9 + 0xd]
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], rax
call sym.ProcessHacker.exe_PhParseCommandLine
test al, al
jne 0x140046262
lea r8, str.Command_line_options:_n_n_c_n_ctype_command_type_n_cobject_command_object_n_caction_command_action_n_debug_n_hide_n_installkph_n_nokph_n_nosettings_n_ras_n_settings_filename_n_uninstallkph_n_v_n
mov edx, 0x40
xor ecx, ecx
call sym.ProcessHacker.exe_PhShowMessage
cmp byte [0x1400d8269], 0
mov qword [rsp + 0x40], rbx
je 0x1400462ba
mov rcx, qword [0x1400d82b8]
lea rdx, str.kprocesshacker.sys
add rcx, 0x10
call sym.ProcessHacker.exe_PhConcatStrings2
lea rcx, str.KProcessHacker2
lea rdx, [rax + 0x10]
call sym.ProcessHacker.exe_KphInstall
mov ebx, eax
test eax, eax
jns 0x1400462b1
lea rdx, str.Unable_to_install_KProcessHacker
xor r9d, r9d
mov r8d, eax
xor ecx, ecx
call sym.ProcessHacker.exe_PhShowStatus
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
cmp byte [0x1400d826a], 0
je 0x1400462f2
lea rcx, str.KProcessHacker2
call sym.ProcessHacker.exe_KphUninstall
mov ebx, eax
test eax, eax
jns 0x1400462e9
lea rdx, str.Unable_to_uninstall_KProcessHacker
xor r9d, r9d
mov r8d, eax
xor ecx, ecx
call sym.ProcessHacker.exe_PhShowStatus
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
cmp byte [0x1400d826b], 0
je 0x140046300
call fcn.140037a30
mov rbx, qword [rsp + 0x40]
add rsp, 0x48
ret
Function at 0x14004d390
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 0x20], rbx
push rsi
sub rsp, 0x80
mov eax, dword [rcx + 0x10]
mov rsi, rcx
cmp eax, 0xffffff62
je 0x14004d545
cmp eax, 0xffffff65
je 0x14004d4c0
cmp eax, 0xfffffffb
je 0x14004d3f3
cmp eax, 0xfffffffd
jne 0x14004d5ad
mov rcx, qword [sym.ProcessHacker.exe_PhMainWndHandle]
xor r9d, r9d
mov edx, 0x111
mov r8d, 0x9cb1
mov rbx, qword [rsp + 0xa8]
add rsp, 0x80
pop rsi
jmp qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, qword [0x1400d5d60]
lea r8, [rsp + 0x90]
lea rdx, [rsp + 0x98]
call sym.ProcessHacker.exe_PhGetSelectedListViewItemParams
cmp dword [rsp + 0x90], 0
je 0x14004d498
mov rcx, qword [0x1400d8fa0]
mov edx, 0x7c
mov qword [rsp + 0xa0], rdi
call qword [sym.imp.USER32.dll_LoadMenuW]
xor edx, edx
mov rcx, rax
mov rdi, rax
call qword [sym.imp.USER32.dll_GetSubMenu]
xor r8d, r8d
mov edx, 0x9cb1
mov rcx, rax
mov rbx, rax
call qword [sym.imp.USER32.dll_SetMenuDefaultItem]
mov r8d, dword [rsp + 0x90]
mov rdx, qword [rsp + 0x98]
mov rcx, rbx
call fcn.14004d170
mov r9, qword [rsi + 0x2c]
mov rdx, qword [0x1400d5d60]
mov rcx, qword [sym.ProcessHacker.exe_PhMainWndHandle]
mov r8, rbx
call sym.ProcessHacker.exe_PhShowContextMenu
mov rcx, rdi
call qword [sym.imp.USER32.dll_DestroyMenu]
mov rdi, qword [rsp + 0xa0]
mov r8, qword [rsp + 0x98]
mov rcx, qword [0x1400d8fb0]
xor edx, edx
mov rbx, qword [rsp + 0xa8]
add rsp, 0x80
pop rsi
jmp qword [sym.imp.ntdll.dll_RtlFreeHeap]
movzx eax, word [rcx + 0x18]
cmp eax, 0xd
je 0x14004d3c7
cmp eax, 0x2e
je 0x14004d519
cmp eax, 0x43
jne 0x14004d5ad
lea ecx, [rax - 0x32]
call qword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jns 0x14004d5ad
mov rcx, qword [sym.ProcessHacker.exe_PhMainWndHandle]
xor r9d, r9d
mov edx, 0x111
mov r8d, 0x9d06
mov rbx, qword [rsp + 0xa8]
add rsp, 0x80
pop rsi
jmp qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, qword [sym.ProcessHacker.exe_PhMainWndHandle]
xor r9d, r9d
mov edx, 0x111
mov r8d, 0x9cb0
mov rbx, qword [rsp + 0xa8]
add rsp, 0x80
pop rsi
jmp qword [sym.imp.USER32.dll_SendMessageW]
cmp dword [rcx + 0x30], 0
jne 0x14004d5ad
mov eax, dword [rcx + 0x2c]
mov rcx, qword [0x1400d5d60]
lea r9, [rsp + 0x20]
xor r8d, r8d
mov edx, 0x104b
mov dword [rsp + 0x24], eax
mov dword [rsp + 0x20], 4
mov dword [rsp + 0x28], 0
call qword [sym.imp.USER32.dll_SendMessageW]
test eax, eax
je 0x14004d5ad
mov rcx, qword [rsp + 0x48]
call fcn.140041e90
mov rcx, rsi
mov rdx, rax
mov rbx, rax
call sym.ProcessHacker.exe_PhCopyListViewInfoTip
lea rcx, [rbx - 0x20]
or eax, 0xffffffff
lock xadd dword [rcx], eax
add eax, 0xffffffff
jne 0x14004d5ad
call fcn.14001fcd0
mov rbx, qword [rsp + 0xa8]
add rsp, 0x80
pop rsi
ret
Function at 0x14004d710
Capabilities:
Log keystrokes via polling

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x80
mov eax, dword [rcx + 0x10]
mov rsi, rcx
cmp eax, 0xffffff62
je 0x14004d870
cmp eax, 0xffffff65
je 0x14004d822
cmp eax, 0xfffffffb
je 0x14004d76b
cmp eax, 0xfffffffd
jne 0x14004d903
mov rcx, qword [sym.ProcessHacker.exe_PhMainWndHandle]
xor r9d, r9d
mov edx, 0x111
mov r8d, 0x9ccb
add rsp, 0x80
pop rdi
pop rsi
pop rbx
jmp qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, qword [0x1400d5da8]
lea r8, [rsp + 0xa0]
lea rdx, [rsp + 0xb0]
call sym.ProcessHacker.exe_PhGetSelectedListViewItemParams
cmp dword [rsp + 0xa0], 0
je 0x14004d800
mov rcx, qword [0x1400d8fa0]
mov edx, 0xa4
call qword [sym.imp.USER32.dll_LoadMenuW]
xor edx, edx
mov rcx, rax
mov rdi, rax
call qword [sym.imp.USER32.dll_GetSubMenu]
xor r8d, r8d
mov edx, 0x9ccb
mov rcx, rax
mov rbx, rax
call qword [sym.imp.USER32.dll_SetMenuDefaultItem]
mov r8d, dword [rsp + 0xa0]
mov rdx, qword [rsp + 0xb0]
mov rcx, rbx
call fcn.14004d5c0
mov r9, qword [rsi + 0x2c]
mov rdx, qword [0x1400d5da8]
mov rcx, qword [sym.ProcessHacker.exe_PhMainWndHandle]
mov r8, rbx
call sym.ProcessHacker.exe_PhShowContextMenu
mov rcx, rdi
call qword [sym.imp.USER32.dll_DestroyMenu]
mov r8, qword [rsp + 0xb0]
mov rcx, qword [0x1400d8fb0]
xor edx, edx
add rsp, 0x80
pop rdi
pop rsi
pop rbx
jmp qword [sym.imp.ntdll.dll_RtlFreeHeap]
movzx eax, word [rcx + 0x18]
cmp eax, 0xd
je 0x14004d745
cmp eax, 0x43
jne 0x14004d903
lea ecx, [rax - 0x32]
call qword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jns 0x14004d903
mov rcx, qword [sym.ProcessHacker.exe_PhMainWndHandle]
xor r9d, r9d
mov edx, 0x111
mov r8d, 0x9d05
add rsp, 0x80
pop rdi
pop rsi
pop rbx
jmp qword [sym.imp.USER32.dll_SendMessageW]
cmp dword [rcx + 0x30], 0
jne 0x14004d903
mov eax, dword [rcx + 0x2c]
mov rcx, qword [0x1400d5da8]
lea r9, [rsp + 0x20]
xor r8d, r8d
mov edx, 0x104b
mov dword [rsp + 0x24], eax
mov dword [rsp + 0x20], 4
mov dword [rsp + 0x28], 0
call qword [sym.imp.USER32.dll_SendMessageW]
test eax, eax
je 0x14004d903
mov rcx, qword [rsp + 0x48]
mov rcx, qword [rcx + 0x38]
call sym.ProcessHacker.exe_PhReferenceProcessItem
mov rdi, rax
test rax, rax
je 0x14004d903
mov rcx, rax
call fcn.140040490
mov rcx, rsi
mov rdx, rax
mov rbx, rax
call sym.ProcessHacker.exe_PhCopyListViewInfoTip
lea rcx, [rbx - 0x20]
or ebx, 0xffffffff
mov edx, ebx
lock xadd dword [rcx], edx
add edx, ebx
jne 0x14004d8f1
call fcn.14001fcd0
lea rcx, [rdi - 0x20]
lock xadd dword [rcx], ebx
add ebx, 0xffffffff
jne 0x14004d903
call fcn.14001fcd0
add rsp, 0x80
pop rdi
pop rsi
pop rbx
ret
Function at 0x140057d40
Capabilities:
Check mutex on windows

Disassembly:
push rdi
sub rsp, 0x40
mov r8, qword [rdx + 8]
mov rdi, rcx
mov rax, rdx
lea rcx, [rsp + 0x60]
mov edx, 1
call qword [rax]
test eax, eax
js 0x140057e88
mov rcx, qword [rsp + 0x60]
mov qword [rsp + 0x50], rbx
xor ebx, ebx
lea r8, [rsp + 0x68]
lea r9d, [rbx + 8]
xor edx, edx
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ntdll.dll_NtQueryMutant]
test eax, eax
js 0x140057dc7
mov r8d, dword [rsp + 0x68]
lea r9d, [rbx + 1]
mov edx, 0x440
mov rcx, rdi
call qword [sym.imp.USER32.dll_SetDlgItemInt]
cmp byte [rsp + 0x6d], bl
lea rax, str.True
lea r8, str.False
mov edx, 0x441
mov rcx, rdi
cmovne r8, rax
call qword [sym.imp.USER32.dll_SetDlgItemTextW]
jmp 0x140057df1
lea r8, [0x1400ae100]
mov edx, 0x440
mov rcx, rdi
call qword [sym.imp.USER32.dll_SetDlgItemTextW]
lea r8, [0x1400ae100]
mov edx, 0x441
mov rcx, rdi
call qword [sym.imp.USER32.dll_SetDlgItemTextW]
cmp dword [0x1400d8fc0], 0x3c
jb 0x140057e63
mov rcx, qword [rsp + 0x60]
mov r9d, 0x10
lea r8, [rsp + 0x30]
lea edx, [r9 - 0xf]
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ntdll.dll_NtQueryMutant]
test eax, eax
js 0x140057e63
cmp qword [rsp + 0x30], rbx
je 0x140057e5a
lea rcx, [rsp + 0x30]
call sym.ProcessHacker.exe_PhGetClientIdName
mov edx, 0x41e
mov rcx, rdi
lea r8, [rax + 0x10]
mov rbx, rax
call qword [sym.imp.USER32.dll_SetDlgItemTextW]
lea rcx, [rbx - 0x20]
or eax, 0xffffffff
lock xadd dword [rcx], eax
add eax, 0xffffffff
jne 0x140057e78
call fcn.14001fcd0
jmp 0x140057e78
lea r8, [0x1400b62d0]
jmp 0x140057e6a
lea r8, [0x1400ae100]
mov edx, 0x41e
mov rcx, rdi
call qword [sym.imp.USER32.dll_SetDlgItemTextW]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ntdll.dll_NtClose]
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret
Function at 0x1400591a0
Capabilities:
Delete registry value
Persist via image file execution options registry key
Set registry value

Disassembly:
mov qword [rsp + 0x20], rbx
push rsi
sub rsp, 0x30
mov edx, 0x47b
mov rsi, rcx
call qword [sym.imp.USER32.dll_GetDlgItem]
xor r9d, r9d
xor r8d, r8d
mov rcx, rax
mov edx, 0xf0
call qword [sym.imp.USER32.dll_SendMessageW]
xor ebx, ebx
lea rcx, str.EnableWarnings
cmp eax, 1
mov edx, ebx
sete dl
call sym.ProcessHacker.exe_PhSetIntegerSetting
mov edx, 0x47d
mov rcx, rsi
call qword [sym.imp.USER32.dll_GetDlgItem]
xor r9d, r9d
xor r8d, r8d
mov rcx, rax
mov edx, 0xf0
call qword [sym.imp.USER32.dll_SendMessageW]
mov edx, ebx
lea rcx, str.EnableKph
cmp eax, 1
sete dl
call sym.ProcessHacker.exe_PhSetIntegerSetting
mov edx, 0x45e
mov rcx, rsi
call qword [sym.imp.USER32.dll_GetDlgItem]
xor r9d, r9d
xor r8d, r8d
mov rcx, rax
mov edx, 0xf0
call qword [sym.imp.USER32.dll_SendMessageW]
mov edx, ebx
lea rcx, str.HideUnnamedHandles
cmp eax, 1
sete dl
call sym.ProcessHacker.exe_PhSetIntegerSetting
mov edx, 0x4e5
mov rcx, rsi
call qword [sym.imp.USER32.dll_GetDlgItem]
xor r9d, r9d
xor r8d, r8d
mov rcx, rax
mov edx, 0xf0
call qword [sym.imp.USER32.dll_SendMessageW]
lea rcx, str.EnableStage2
cmp eax, 1
sete bl
mov edx, ebx
call sym.ProcessHacker.exe_PhSetIntegerSetting
mov edx, 0x4bb
mov rcx, rsi
call qword [sym.imp.USER32.dll_GetDlgItem]
mov rcx, rax
call qword [sym.imp.USER32.dll_IsWindowEnabled]
test eax, eax
je 0x1400593b9
mov edx, 0x4bb
mov rcx, rsi
call qword [sym.imp.USER32.dll_GetDlgItem]
xor r9d, r9d
xor r8d, r8d
mov rcx, rax
mov edx, 0xf0
call qword [sym.imp.USER32.dll_SendMessageW]
cmp eax, 1
sete bl
cmp byte [0x1400d5c3a], bl
je 0x1400593b9
lea rax, [rsp + 0x50]
lea rdx, str.SoftwareMicrosoftWindows_NTCurrentVersionImage_File_Execution_Options_taskmgr.exe
mov r9d, 0x20006
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400593b9
mov qword [rsp + 0x40], rdi
test bl, bl
je 0x140059397
mov r8, qword [0x1400d8270]
lea r9, [0x1400afe14]
lea rdx, [0x1400afe14]
lea ecx, [rax + 3]
add r8, 0x10
call sym.ProcessHacker.exe_PhConcatStrings
mov r9d, 1
xor r8d, r8d
movzx edx, word [rax]
lea rcx, [rax + 0x10]
mov rbx, rax
add edx, 2
mov dword [rsp + 0x28], edx
mov qword [rsp + 0x20], rcx
mov rcx, qword [rsp + 0x50]
lea rdx, str.Debugger
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
lea rcx, [rbx - 0x20]
or edx, 0xffffffff
mov edi, eax
lock xadd dword [rcx], edx
add edx, 0xffffffff
jne 0x14005937c
call fcn.14001fcd0
test edi, edi
je 0x1400593a9
lea rdx, str.Unable_to_replace_Task_Manager
mov r9d, edi
xor r8d, r8d
mov rcx, rsi
call sym.ProcessHacker.exe_PhShowStatus
jmp 0x1400593a9
mov rcx, qword [rsp + 0x50]
lea rdx, str.Debugger
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rdi, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x58]
add rsp, 0x30
pop rsi
ret
Function at 0x140069610
Capabilities:
Get system information on windows

Disassembly:
sub rsp, 0x28
xor r9d, r9d
lea rdx, [0x1400d7e80]
mov r8d, 0x138
lea ecx, [r9 + 2]
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
mov rcx, qword [0x1400d7e90]
mov r11, qword [0x1400d7e88]
mov rax, r11
sub rax, qword [0x1400d7aa0]
mov qword [0x1400d7aa0], r11
mov qword [0x1400d7aa8], rax
mov rax, rcx
sub rax, qword [0x1400d7fe0]
mov qword [0x1400d7fe0], rcx
mov rcx, qword [0x1400d7e98]
mov qword [0x1400d7fe8], rax
mov rax, rcx
sub rax, qword [0x1400d7e50]
mov qword [0x1400d7e50], rcx
mov qword [0x1400d7e58], rax
add rsp, 0x28
ret
Function at 0x14006e330
Capabilities:
Get file system object information

Disassembly:
sub rsp, 0x2f8
mov rax, qword [0x1400d60d0]
test rax, rax
jne 0x14006e38b
lea rcx, [rsp + 0x38]
xor edx, edx
mov r8d, 0x2b0
mov qword [rsp + 0x30], rax
call fcn.14009e740
lea r8, [rsp + 0x30]
lea rcx, str..exe
mov r9d, 0x2b8
mov edx, 0x80
mov dword [rsp + 0x20], 0x111
call qword [sym.imp.SHELL32.dll_SHGetFileInfoW]
mov rax, qword [rsp + 0x30]
mov qword [0x1400d60d0], rax
add rsp, 0x2f8
ret
Function at 0x1400729c0
Capabilities:
Create service
Delete service
Read file on windows
Start service

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rdi
push r12
sub rsp, 0xc0
xor r12d, r12d
mov rbp, rdx
mov rdi, rcx
lea r8d, [r12 + 2]
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x70], r12
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov rbx, rax
test rax, rax
jne 0x140072a1d
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jg 0x140072a0a
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x140072bdc
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx eax, ax
or eax, 0xc0070000
jmp 0x140072bdc
lea rax, [0x1400aa7c0]
mov r9d, 0xf01ff
mov r8, rbp
mov qword [rsp + 0x60], rax
lea rax, str.LocalSystem
mov rdx, rbp
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x50], r12
mov qword [rsp + 0x48], r12
mov qword [rsp + 0x40], r12
mov qword [rsp + 0x38], rdi
mov dword [rsp + 0x30], r12d
mov rcx, rbx
mov dword [rsp + 0x28], 3
mov qword [rsp + 0xe0], rsi
mov dword [rsp + 0x20], 0x10
call qword [sym.imp.ADVAPI32.dll_CreateServiceW]
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, rbx
mov edi, eax
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
test rsi, rsi
jne 0x140072aaa
test edi, edi
jle 0x140072bc2
movzx edi, di
or edi, 0xc0070000
jmp 0x140072bc2
lea rcx, str.DeviceMailslot_
mov rdx, rbp
call sym.ProcessHacker.exe_PhConcatStrings2
lea r9, [rsp + 0x80]
lea r8, [rsp + 0x90]
mov rbx, rax
mov qword [rsp + 0xa0], rax
lea rax, [rsp + 0x78]
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], r12d
lea rcx, [rsp + 0x70]
mov edx, 0x120089
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x78], 0xfffffffffd050f80
mov dword [rsp + 0x20], 0x20
mov dword [rsp + 0x90], 0x30
mov qword [rsp + 0x98], r12
mov dword [rsp + 0xa8], 0x40
mov qword [rsp + 0xb0], r12
mov qword [rsp + 0xb8], r12
call qword [sym.imp.ntdll.dll_NtCreateMailslotFile]
lea rcx, [rbx - 0x20]
or edx, 0xffffffff
mov edi, eax
lock xadd dword [rcx], edx
add edx, 0xffffffff
jne 0x140072b4e
call fcn.14001fcd0
test edi, edi
js 0x140072bb9
call fcn.1400721d0
xor r8d, r8d
xor edx, edx
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_StartServiceW]
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_DeleteService]
mov rcx, qword [rsp + 0x70]
mov qword [rsp + 0x40], r12
mov qword [rsp + 0x38], r12
lea rax, [rsp + 0xf0]
mov dword [rsp + 0x30], 4
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x80]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntdll.dll_NtReadFile]
mov edi, eax
test eax, eax
cmovns edi, dword [rsp + 0xf0]
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, qword [rsp + 0x70]
mov rsi, qword [rsp + 0xe0]
test rcx, rcx
je 0x140072bda
call qword [sym.imp.ntdll.dll_NtClose]
mov eax, edi
mov rbx, qword [rsp + 0xe8]
add rsp, 0xc0
pop r12
pop rdi
pop rbp
ret
Function at 0x140072f80
Capabilities:
Terminate process
Write file on windows

Disassembly:
mov rax, rsp
mov dword [rax + 8], ecx
sub rsp, 0x98
mov rdx, qword [0x1400d6158]
test rdx, rdx
je 0x140073087
mov qword [rax + 0x20], rbx
lea rcx, str.DeviceMailslot_
add rdx, 0x10
mov qword [rax - 8], rdi
call sym.ProcessHacker.exe_PhConcatStrings2
xor edi, edi
lea r9, [rsp + 0x50]
lea r8, [rsp + 0x60]
lea rcx, [rsp + 0xb0]
mov edx, 0x120116
mov dword [rsp + 0x28], 0x20
mov rbx, rax
mov qword [rsp + 0x70], rax
mov dword [rsp + 0x60], 0x30
mov qword [rsp + 0x68], rdi
mov dword [rsp + 0x78], 0x40
mov qword [rsp + 0x80], rdi
mov qword [rsp + 0x88], rdi
mov dword [rsp + 0x20], 3
call qword [sym.imp.ntdll.dll_NtOpenFile]
test eax, eax
js 0x140073062
mov rcx, qword [rsp + 0xb0]
mov qword [rsp + 0x40], rdi
mov qword [rsp + 0x38], rdi
lea rax, [rsp + 0xa0]
mov dword [rsp + 0x30], 4
xor r9d, r9d
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x50]
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntdll.dll_NtWriteFile]
mov rcx, qword [rsp + 0xb0]
call qword [sym.imp.ntdll.dll_NtClose]
lea rcx, [rbx - 0x20]
or eax, 0xffffffff
lock xadd dword [rcx], eax
add eax, 0xffffffff
mov rdi, qword [rsp + 0x90]
mov rbx, qword [rsp + 0xb8]
jne 0x140073087
call fcn.14001fcd0
mov ecx, dword [rsp + 0xa0]
call qword [sym.imp.KERNEL32.dll_ExitProcess]