joyce8/EMBER2024-capa huggingface dataset:
Function at 0x55db60
Capabilities:
Encode data using base64

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x55dd1e
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rsp + 0x78], rdi
mov r9, qword [rbx + 0x18]
mov r10, qword [r9]
mov r10, qword [r10 + 8]
shl r10, 6
sub r10, qword [r9 + 8]
lea r9, [r10 + 7]
sar r9, 0x3f
shr r9, 0x3d
lea r9, [r9 + r10]
lea r9, [r9 + 7]
sar r9, 3
cmp rsi, r9
jl 0x55dc6a
cmp r8, r9
jb 0x55dd12
mov rdx, r9
shl r9, 3
sub r9, r10
nop
test r9, r9
jle 0x55dca5
test rdi, rdi
jne 0x55dbd9
xor eax, eax
xor edx, edx
xor esi, esi
jmp 0x55dc64
mov qword [rsp + 0x68], rbx
mov qword [rsp + 0x70], rcx
mov qword [rsp + 0x38], r9
test rdx, rdx
ja 0x55dbf9
lea rax, [rsp + 0x28]
xor esi, esi
xor r8d, r8d
jmp 0x55dc2c
mov qword [rsp + 0x40], rdx
mov qword [rsp + 0x78], rdi
lea rax, [rsp + 0x28]
mov rbx, rdx
xor ecx, ecx
mov rdi, rbx
lea rsi, [0x005b7da0]
call fcn.0044eea0
mov rdx, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x78]
mov rsi, rcx
mov r8, rbx
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x28], r8
mov qword [rsp + 0x48], rax
mov rbx, rdi
mov rcx, rdx
call fcn.0046be20
mov rcx, qword [rsp + 0x70]
mov rbx, qword [rsp + 0x68]
mov r9, qword [rsp + 0x38]
mov rax, qword [rsp + 0x28]
mov rdx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x30]
lea r8, [rax - 1]
jmp 0x55dcb0
mov rdx, qword [rbx + 0x18]
mov rax, rcx
mov rbx, rdi
mov rcx, rsi
mov rdi, r8
mov rsi, rdx
nop dword [rax]
call fcn.00549820
test rbx, rbx
jne 0x55dc90
add rsp, 0x50
pop rbp
ret
lea rax, [0x005b7d20]
lea rbx, [0x00656790]
nop
call fcn.00438100
mov rsi, rdx
jmp 0x55dc6a
dec r8
mov rcx, rdi
test r8, r8
jl 0x55dd02
movzx r10d, byte [rdx + r8]
mov rdi, rcx
mov rcx, r9
shr r10b, cl
cmp rcx, 8
sbb r11d, r11d
and r10d, r11d
mov byte [rdx + r8], r10b
test r8, r8
jle 0x55dcaa
lea r11, [rcx - 8]
neg r11
movzx r12d, byte [r8 + rdx - 1]
test r11, r11
jl 0x55dd0d
mov rcx, r11
shl r12d, cl
cmp rcx, 0x20
sbb r11d, r11d
and r12d, r11d
or r10d, r12d
mov byte [rdx + r8], r10b
nop
jmp 0x55dcaa
mov r8, rsi
mov rdi, rdx
mov rdx, rax
jmp 0x55dca5
call fcn.00437540
mov rcx, r9
mov rdx, r8
call fcn.0046b4e0
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x30], r8
nop dword [rax]
call fcn.00469180
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
mov r8, qword [rsp + 0x30]
jmp fcn.0055db60
Function at 0x561300
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x561422
push rbp
mov rbp, rsp
sub rsp, 0x48
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rbx
test byte [rax], al
test byte [rbx], al
lea rcx, [rbx + 0x78]
mov qword [rsp + 0x20], rcx
lea rdx, [rax + 0x28]
mov qword [rsp + 0x40], rdx
lea rsi, [rbx + 0x28]
mov qword [rsp + 0x28], rsi
lea rdi, [rbx + 0x50]
mov qword [rsp + 0x18], rdi
lea r8, [rax + 0x50]
mov qword [rsp + 0x38], r8
lea r9, [rax + 0x78]
mov qword [rsp + 0x30], r9
mov qword [rsp], rax
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rcx
call fcn.005434a0
xorps xmm15, xmm15
mov r14, qword [0x00806ff0]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x40]
mov qword [rsp], rax
mov rax, qword [rsp + 0x28]
mov qword [rsp + 8], rax
mov rcx, qword [rsp + 0x18]
mov qword [rsp + 0x10], rcx
call fcn.005434a0
xorps xmm15, xmm15
mov r14, qword [0x00806ff0]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x38]
mov qword [rsp], rax
mov rax, qword [rsp + 0x18]
mov qword [rsp + 8], rax
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x10], rax
call fcn.005434a0
xorps xmm15, xmm15
mov r14, qword [0x00806ff0]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x30]
mov qword [rsp], rax
mov rax, qword [rsp + 0x60]
mov qword [rsp + 8], rax
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x10], rax
call fcn.005434a0
xorps xmm15, xmm15
mov r14, qword [0x00806ff0]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x58]
add rsp, 0x48
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.00469180
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
nop dword [rax + rax]
jmp fcn.00561300
Function at 0x5645c0
Capabilities:
Enumerate pe sections

Disassembly:
lea r12, [rsp - 0x28]
cmp r12, qword [r14 + 0x10]
jbe 0x564826
push rbp
mov rbp, rsp
sub rsp, 0xa0
movzx ecx, byte [rbx + 0x1f]
shl rcx, 0x38
mov qword [rsp + 0x98], rcx
movzx edx, byte [rbx + 0x1e]
shl rdx, 0x30
mov qword [rsp + 0x90], rdx
movzx esi, byte [rbx + 0x1d]
shl rsi, 0x28
mov qword [rsp + 0x88], rsi
movzx edi, byte [rbx + 0x1c]
shl rdi, 0x20
mov qword [rsp + 0x80], rdi
movzx r8d, byte [rbx + 0x1b]
shl r8, 0x18
mov qword [rsp + 0x78], r8
movzx r9d, byte [rbx + 0x1a]
shl r9, 0x10
mov qword [rsp + 0x70], r9
movzx r10d, byte [rbx + 0x19]
shl r10, 8
mov qword [rsp + 0x68], r10
movzx r11d, byte [rbx + 0x18]
mov qword [rsp + 0x60], r11
movzx r12d, byte [rbx + 0x17]
shl r12, 0x38
mov qword [rsp + 0x58], r12
movzx r13d, byte [rbx + 0x16]
shl r13, 0x30
mov qword [rsp + 0x50], r13
movzx r15d, byte [rbx + 0x15]
shl r15, 0x28
mov qword [rsp + 0x48], r15
movzx ecx, byte [rbx + 0x14]
shl rcx, 0x20
mov qword [rsp + 0x40], rcx
movzx edx, byte [rbx + 0x13]
shl rdx, 0x18
mov qword [rsp + 0x38], rdx
movzx esi, byte [rbx + 0x12]
shl rsi, 0x10
mov qword [rsp + 0x30], rsi
movzx edi, byte [rbx + 0x11]
shl rdi, 8
mov qword [rsp + 0x28], rdi
movzx r8d, byte [rbx + 0x10]
mov qword [rsp + 0x20], r8
movzx r9d, byte [rbx + 0xf]
shl r9, 0x38
mov qword [rsp + 0x18], r9
movzx r10d, byte [rbx + 0xe]
shl r10, 0x30
mov qword [rsp + 0x10], r10
movzx r11d, byte [rbx + 0xd]
shl r11, 0x28
mov qword [rsp + 8], r11
movzx r12d, byte [rbx + 0xc]
shl r12, 0x20
mov qword [rsp], r12
movzx r13d, byte [rbx + 0xb]
shl r13, 0x18
movzx r15d, byte [rbx + 0xa]
shl r15, 0x10
movzx ecx, byte [rbx + 9]
shl rcx, 8
movzx edx, byte [rbx + 8]
movzx esi, byte [rbx + 7]
shl rsi, 0x38
movzx edi, byte [rbx + 6]
shl rdi, 0x30
movzx r8d, byte [rbx + 5]
shl r8, 0x28
movzx r9d, byte [rbx + 4]
shl r9, 0x20
movzx r10d, byte [rbx + 3]
shl r10, 0x18
movzx r11d, byte [rbx + 2]
shl r11, 0x10
movzx r12d, byte [rbx + 1]
shl r12, 8
movzx ebx, byte [rbx]
add rbx, r12
add rbx, r11
add rbx, r10
add rbx, r9
add rbx, r8
add rbx, rdi
add rbx, rsi
mov qword [rax], rbx
add rcx, rdx
add rcx, r15
add rcx, r13
mov rdx, qword [rsp]
add rcx, rdx
mov rdx, qword [rsp + 8]
add rcx, rdx
mov rdx, qword [rsp + 0x10]
add rcx, rdx
mov rdx, qword [rsp + 0x18]
add rcx, rdx
mov qword [rax + 8], rcx
mov rcx, qword [rsp + 0x28]
mov rdx, qword [rsp + 0x20]
add rcx, rdx
mov rdx, qword [rsp + 0x30]
add rcx, rdx
mov rdx, qword [rsp + 0x38]
add rcx, rdx
mov rdx, qword [rsp + 0x40]
add rcx, rdx
mov rdx, qword [rsp + 0x48]
add rcx, rdx
mov rdx, qword [rsp + 0x50]
add rcx, rdx
mov rdx, qword [rsp + 0x58]
add rcx, rdx
mov qword [rax + 0x10], rcx
mov rcx, qword [rsp + 0x68]
mov rdx, qword [rsp + 0x60]
add rcx, rdx
mov rdx, qword [rsp + 0x70]
add rcx, rdx
mov rdx, qword [rsp + 0x78]
add rcx, rdx
mov rdx, qword [rsp + 0x80]
add rcx, rdx
mov rdx, qword [rsp + 0x88]
add rcx, rdx
mov rdx, qword [rsp + 0x90]
add rcx, rdx
mov rdx, qword [rsp + 0x98]
add rcx, rdx
mov qword [rax + 0x18], rcx
add rsp, 0xa0
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.00469180
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
nop
jmp fcn.005645c0
Function at 0x567540
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x56774b
push rbp
mov rbp, rsp
sub rsp, 0x48
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x68], rcx
add qword [rax + 0x58], rcx
mov rdx, qword [rax + 0x50]
test rdx, rdx
jle 0x567664
cmp rdx, 0x40
ja 0x56773d
mov qword [rsp + 0x70], rdi
mov qword [rsp + 0x60], rbx
lea rsi, [rdx - 0x40]
mov r8, rsi
neg rsi
sar r8, 0x3f
and r8, rdx
lea rdx, [rax + r8]
lea rdx, [rdx + 0x10]
cmp rcx, rsi
cmovl rsi, rcx
mov qword [rsp + 0x28], rsi
cmp rbx, rdx
je 0x5675d4
mov rax, rdx
mov rcx, rsi
call fcn.0046be20
mov rax, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x68]
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x28]
mov rdi, qword [rsp + 0x70]
mov rdx, qword [rax + 0x50]
add rdx, rsi
mov qword [rax + 0x50], rdx
nop
cmp rdx, 0x40
jne 0x567640
mov qword [rsp], rax
lea rcx, [rax + 0x10]
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], 0x40
mov qword [rsp + 0x18], 0x40
call fcn.005679c0
xorps xmm15, xmm15
mov r14, qword [0x00806ff0]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x58]
mov qword [rax + 0x50], 0
mov rcx, qword [rsp + 0x68]
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x28]
mov rdi, qword [rsp + 0x70]
nop dword [rax]
cmp rcx, rsi
jb 0x567735
sub rdi, rsi
mov rdx, rdi
neg rdx
sar rdx, 0x3f
and rdx, rsi
mov r8, rcx
sub r8, rsi
add rbx, rdx
jmp 0x567667
mov r8, rcx
cmp r8, 0x40
jl 0x5676e5
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x38], r8
mov qword [rsp + 0x30], rdi
mov qword [rsp], rax
mov qword [rsp + 8], rbx
and r8, 0xffffffffffffffc0
mov qword [rsp + 0x20], r8
mov qword [rsp + 0x10], r8
mov qword [rsp + 0x18], rdi
call fcn.005679c0
xorps xmm15, xmm15
mov r14, qword [0x00806ff0]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x30]
mov rdx, rax
sub rax, rcx
sar rax, 0x3f
mov r8, qword [rsp + 0x38]
and rax, r8
and rax, 0xffffffffffffffc0
mov rcx, qword [rsp + 0x40]
lea rbx, [rcx + rax]
sub r8, rdx
mov rax, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x68]
test r8, r8
je 0x567728
lea rdx, [rax + 0x10]
cmp r8, 0x40
mov esi, 0x40
cmovl rsi, r8
nop dword [rax + rax]
cmp rbx, rdx
je 0x567724
mov qword [rsp + 0x38], rsi
mov rax, rdx
mov rcx, rsi
call fcn.0046be20
mov rax, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x38]
mov qword [rax + 0x50], rsi
mov rax, rcx
xor ebx, ebx
xor ecx, ecx
add rsp, 0x48
pop rbp
ret
mov rax, rsi
call fcn.0046b520
mov rax, rdx
mov ecx, 0x40
call fcn.0046b520
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
nop
call fcn.00469180
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
jmp fcn.00567540
Function at 0x56a160
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x56a317
push rbp
mov rbp, rsp
sub rsp, 0x48
mov qword [rsp + 0x90], r10
mov qword [rsp + 0x88], r9
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x80], r8
mov qword [rsp + 0x78], rsi
mov qword [rsp + 0x70], rdi
lea rax, [0x005b9bc0]
call fcn.0040ea60
mov qword [rsp + 0x40], rax
xor ecx, ecx
xor edx, edx
xor ebx, ebx
jmp 0x56a1c5
mov rax, rdx
mov rcx, r10
mov rdx, qword [rsp + 0x30]
mov rbx, r8
mov rsi, qword [rsp + 0x60]
cmp rsi, rcx
jle 0x56a2d9
mov qword [rsp + 0x20], rcx
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x30], rdx
mov rdx, qword [rsp + 0x70]
mov rsi, qword [rdx + 0x38]
mov rax, qword [rsp + 0x78]
mov rbx, qword [rsp + 0x80]
mov rcx, qword [rsp + 0x88]
mov rdi, qword [rsp + 0x90]
call rsi
mov rdx, qword [rsp + 0x70]
mov rsi, qword [rdx + 0x38]
mov rax, qword [rsp + 0x78]
mov rbx, qword [rsp + 0x40]
mov ecx, 4
mov rdi, rcx
call rsi
mov rdx, qword [rsp + 0x70]
mov rsi, qword [rdx + 0x30]
mov rax, qword [rsp + 0x78]
mov rbx, qword [rsp + 0x38]
xor ecx, ecx
mov rdi, qword [rsp + 0x30]
call rsi
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x30], rcx
mov rdx, qword [rsp + 0x70]
mov rsi, qword [rdx + 0x20]
mov rax, qword [rsp + 0x78]
call rsi
mov rdx, qword [rsp + 0x28]
mov rsi, qword [rsp + 0x58]
mov r8, qword [rsp + 0x38]
mov r9, qword [rsp + 0x60]
mov r10, qword [rsp + 0x20]
xor eax, eax
jmp 0x56a2f6
mov rdx, qword [rsp + 0x40]
movzx r11d, byte [rdx + 3]
lea r12d, [r11 + 1]
mov byte [rdx + 3], r12b
cmp r11b, 0xff
jne 0x56a1b7
movzx r11d, byte [rdx + 2]
lea r12d, [r11 + 1]
mov byte [rdx + 2], r12b
cmp r11b, 0xff
jne 0x56a1b7
movzx r11d, byte [rdx + 1]
lea r12d, [r11 + 1]
mov byte [rdx + 1], r12b
nop
cmp r11b, 0xff
jne 0x56a1b7
movzx r11d, byte [rdx]
inc r11d
mov byte [rdx], r11b
jmp 0x56a1b7
add rsp, 0x48
pop rbp
ret
movzx r11d, byte [r10 + rsi]
movzx r12d, byte [rax + r8]
xor r11d, r12d
mov byte [rsi + r10], r11b
inc rax
inc r10
cmp rdx, rax
jle 0x56a27f
nop dword [rax + rax]
cmp r9, r10
jle 0x56a27f
ja 0x56a2df
mov rax, r10
mov rcx, r9
call fcn.0046b460
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x30], r8
mov qword [rsp + 0x38], r9
mov qword [rsp + 0x40], r10
nop
call fcn.00469180
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
mov r8, qword [rsp + 0x30]
mov r9, qword [rsp + 0x38]
mov r10, qword [rsp + 0x40]
jmp fcn.0056a160
Function at 0x56a380
Capabilities:
Encode data using base64

Disassembly:
lea r12, [rsp - 0x1f8]
cmp r12, qword [r14 + 0x10]
jbe 0x56a60e
push rbp
mov rbp, rsp
sub rsp, 0x270
mov qword [rsp + 0x280], rax
mov qword [rsp + 0x298], rdi
mov qword [rsp + 0x290], rcx
mov qword [rsp + 0x288], rbx
nop
nop
call fcn.004f8e20
xorps xmm15, xmm15
mov r14, qword [0x00806ff0]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x280]
mov rcx, qword [rax]
mov rax, rcx
call fcn.00549f20
test rbx, rbx
jne 0x56a582
mov qword [rsp + 0x238], rax
lea rdi, [rsp + 0x130]
mov qword [rsp - 0x10], rbp
lea rbp, [rsp - 0x10]
call fcn.0046b714
mov rbp, qword [rbp]
mov qword [rsp + 0x258], 0
movups xmmword [rsp + 0x260], xmm15
mov qword [rsp + 0x260], 0
mov qword [rsp + 0x268], 0x20
lea rdx, [rsp + 0x130]
mov qword [rsp + 0x258], rdx
mov rbx, qword [rsp + 0x288]
mov rcx, qword [rsp + 0x290]
mov rdi, qword [rsp + 0x298]
mov rsi, rax
lea rax, [rsp + 0x258]
call fcn.00549700
nop dword [rax + rax]
test rbx, rbx
jne 0x56a56c
mov rdx, qword [rsp + 0x280]
mov rcx, qword [rdx + 8]
lea rdi, [rsp + 0x30]
nop word [rax + rax]
mov qword [rsp - 0x10], rbp
lea rbp, [rsp - 0x10]
call fcn.0046b714
mov rbp, qword [rbp]
mov qword [rsp + 0x240], 0
movups xmmword [rsp + 0x248], xmm15
mov qword [rsp + 0x248], 0
mov qword [rsp + 0x250], 0x20
lea rdx, [rsp + 0x30]
mov qword [rsp + 0x240], rdx
mov rbx, rax
mov rdi, qword [rsp + 0x238]
lea rax, [rsp + 0x240]
call fcn.0054c880
mov qword [rsp + 0x230], rax
mov rdx, qword [rsp + 0x238]
mov rsi, qword [rdx]
mov rsi, qword [rsi + 8]
shl rsi, 6
sub rsi, qword [rdx + 8]
lea rdx, [rsi + 7]
sar rdx, 0x3f
shr rdx, 0x3d
lea rcx, [rdx + rsi]
lea rcx, [rcx + 7]
sar rcx, 3
mov qword [rsp + 0x28], rcx
nop
mov rbx, rcx
lea rax, [0x005b7da0]
call fcn.0044edc0
mov rdx, qword [rsp + 0x230]
mov rsi, qword [rdx]
mov rdx, qword [rdx + 8]
mov r8, qword [rsp + 0x28]
mov rcx, r8
xor ebx, ebx
jmp 0x56a5a0
xor eax, eax
mov rdi, rbx
mov rsi, rcx
xor ebx, ebx
mov rcx, rbx
add rsp, 0x270
pop rbp
ret
xor eax, eax
mov rdi, rbx
mov rsi, rcx
xor ebx, ebx
mov rcx, rbx
add rsp, 0x270
pop rbp
ret
inc rbx
mov r8, r10
nop
cmp rbx, rdx
jge 0x56a5b9
mov r9, qword [rsi + rbx*8]
xor edi, edi
jmp 0x56a5d8
test r9, r9
je 0x56a598
jmp 0x56a5ee
mov r10, r8
jmp 0x56a598
mov rbx, rcx
xor edi, edi
xor esi, esi
add rsp, 0x270
pop rbp
ret
mov byte [r8 + rax - 1], r9b
inc rdi
shr r9, 8
mov r8, r10
cmp rdi, 8
jge 0x56a5b4
lea r10, [r8 - 1]
test r10, r10
jl 0x56a5ad
cmp rcx, r10
ja 0x56a5c9
jmp 0x56a605
lea rax, [0x005b7d20]
lea rbx, [0x00656770]
nop dword [rax]
call fcn.00438100
mov rax, r10
call fcn.0046b460
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call fcn.00469180
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
nop dword [rax + rax]
jmp fcn.0056a380
Function at 0x140001e60
Capabilities:
Lock the desktop

Disassembly:
push rdi
sub rsp, 0x30
mov rdi, rcx
call qword [sym.imp.USER32.dll_LockWorkStation]
test eax, eax
je 0x140001e7b
mov al, 1
add rsp, 0x30
pop rdi
ret
mov qword [rsp + 0x40], rbx
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x140001e93
xor ecx, ecx
call sym.ProcessHacker.exe_PhGetNtMessage
jmp 0x140001e9a
mov ecx, eax
call sym.ProcessHacker.exe_PhGetWin32Message
lea r9, str.Unable_to_lock_the_computer.
mov rbx, rax
mov rcx, rdi
test rax, rax
je 0x140001ef7
mov rax, qword [rax + 8]
mov edx, 0x20
mov qword [rsp + 0x28], rax
mov r8d, 0xfffe
lea rax, [0x1401b8d58]
mov qword [rsp + 0x20], rax
call sym.ProcessHacker.exe_PhShowMessage2
lea rcx, ds:[rbx - 0x10]
mov eax, 0xffffffff
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x140001f08
call fcn.1400fbcc0
mov rbx, qword [rsp + 0x40]
xor al, al
add rsp, 0x30
pop rdi
ret
lea r8, [0x1401efb68]
mov edx, 0x10
call sym.ProcessHacker.exe_PhShowMessage
mov rbx, qword [rsp + 0x40]
xor al, al
add rsp, 0x30
pop rdi
ret

Function at 0x140001f20
Capabilities:
Shutdown system

Disassembly:
push rdi
sub rsp, 0x30
mov rdi, rcx
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_ExitWindowsEx]
test eax, eax
je 0x140001f3f
mov al, 1
add rsp, 0x30
pop rdi
ret
mov qword [rsp + 0x40], rbx
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x140001f57
xor ecx, ecx
call sym.ProcessHacker.exe_PhGetNtMessage
jmp 0x140001f5e
mov ecx, eax
call sym.ProcessHacker.exe_PhGetWin32Message
lea r9, str.Unable_to_log_off_the_computer.
mov rbx, rax
mov rcx, rdi
test rax, rax
je 0x140001fba
mov rax, qword [rax + 8]
mov edx, 0x20
mov qword [rsp + 0x28], rax
mov r8d, 0xfffe
lea rax, [0x1401b8d58]
mov qword [rsp + 0x20], rax
call sym.ProcessHacker.exe_PhShowMessage2
lea rcx, [rbx - 0x10]
mov eax, 0xffffffff
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x140001fcb
call fcn.1400fbcc0
mov rbx, qword [rsp + 0x40]
xor al, al
add rsp, 0x30
pop rdi
ret
lea r8, [0x1401efb68]
mov edx, 0x10
call sym.ProcessHacker.exe_PhShowMessage
mov rbx, qword [rsp + 0x40]
xor al, al
add rsp, 0x30
pop rdi
ret
Function at 0x140002900
Capabilities:
Shutdown system

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov edi, r8d
mov rbx, rcx
sub edx, 1
je 0x140002ad6
nop dword [rax]
sub edx, 1
je 0x140002a5d
sub edx, 1
je 0x1400029ff
cmp edx, 3
jne 0x140002b4f
lea rcx, str.EnableWarnings
call sym.ProcessHacker.exe_PhGetIntegerSetting
test eax, eax
je 0x140002971
xor r9d, r9d
mov byte [rsp + 0x20], 0
lea r8, str.the_computer
mov rcx, rbx
lea rdx, str.update_and_shutdown
call sym.ProcessHacker.exe_PhShowConfirmMessage
test al, al
je 0x140002b4f
mov r9d, 0x48
mov dword [rsp + 0x20], 0x80000000
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_InitiateShutdownW]
test eax, eax
je 0x140002b2e
mov ecx, eax
call sym.ProcessHacker.exe_PhGetWin32Message
lea r9, str.Unable_to_shut_down_the_computer.
mov rdi, rax
test rax, rax
je 0x140002b3b
mov rcx, qword [rax + 8]
mov edx, 0x20
mov qword [rsp + 0x28], rcx
lea rax, [0x1401b8d58]
mov rcx, rbx
mov qword [rsp + 0x20], rax
mov r8d, 0xfffe
call sym.ProcessHacker.exe_PhShowMessage2
lea rcx, [rdi - 0x10]
mov eax, 0xffffffff
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x140002b4f
call fcn.1400fbcc0
xor al, al
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
lea r8, str.shut_down
lea rdx, str.forces_a_critical
lea rcx, str.This_option__s__s_in_an_disorderly_manner_and_may_cause_corrupted_files_or_instability_in_the_system.
call fcn.140001720
lea r8, str.the_computer
mov byte [rsp + 0x20], 1
lea rdx, str.shut_down
mov rcx, rbx
mov r9, qword [rax + 8]
call sym.ProcessHacker.exe_PhShowConfirmMessage
nop dword [rax + rax]
test al, al
je 0x140002b4f
mov edx, 6
mov r8d, 0x80000000
mov ecx, edx
call qword [sym.imp.ntdll.dll_NtSetSystemPowerState]
jmp 0x140002aa9
lea r8, str.shut_down
lea rdx, str.preforms_a_hard
lea rcx, str.This_option__s__s_in_an_disorderly_manner_and_may_cause_corrupted_files_or_instability_in_the_system.
call fcn.140001720
lea r8, str.the_computer
mov byte [rsp + 0x20], 1
lea rdx, str.shut_down
mov rcx, rbx
mov r9, qword [rax + 8]
call sym.ProcessHacker.exe_PhShowConfirmMessage
test al, al
je 0x140002b4f
mov ecx, 2
call qword [sym.imp.ntdll.dll_NtShutdownSystem]
test eax, eax
jns 0x140002b2e
lfence
xor r9d, r9d
lea rdx, str.Unable_to_shut_down_the_computer.
mov r8d, eax
mov rcx, rbx
call sym.ProcessHacker.exe_PhShowStatus
xor al, al
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
lea rcx, str.EnableWarnings
nop dword [rax]
call sym.ProcessHacker.exe_PhGetIntegerSetting
test eax, eax
je 0x140002b0b
xor r9d, r9d
mov byte [rsp + 0x20], 0
lea r8, str.the_computer
mov rcx, rbx
lea rdx, str.shut_down
call sym.ProcessHacker.exe_PhShowConfirmMessage
test al, al
je 0x140002b4f
or edi, 8
mov dword [rsp + 0x20], 0x80000000
mov r9d, edi
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_InitiateShutdownW]
test eax, eax
jne 0x140002994
mov al, 1
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
lea r8, [0x1401efb68]
mov edx, 0x10
mov rcx, rbx
call sym.ProcessHacker.exe_PhShowMessage
mov rbx, qword [rsp + 0x40]
xor al, al
add rsp, 0x30
pop rdi
ret
Function at 0x140002b60
Capabilities:
Shutdown system

Disassembly:
push rbp
push rdi
push r14
sub rsp, 0x40
mov rbp, rcx
mov r14d, edx
lea rcx, str.EnableWarnings
mov edi, 0xc0000001
call sym.ProcessHacker.exe_PhGetIntegerSetting
test eax, eax
je 0x140002baf
xor r9d, r9d
mov byte [rsp + 0x20], 0
lea r8, str.the_computer
mov rcx, rbp
lea rdx, str.restart
call sym.ProcessHacker.exe_PhShowConfirmMessage
test al, al
je 0x140002d8a
mov qword [rsp + 0x60], rbx
lea rcx, str.EnableBootObjectsEnumerate
mov qword [rsp + 0x68], rsi
mov qword [rsp + 0x78], r15
call sym.ProcessHacker.exe_PhGetIntegerSetting
test eax, eax
lea rcx, str.EnableUpdateDefaultFirmwareBootEntry
setne bl
call sym.ProcessHacker.exe_PhGetIntegerSetting
test eax, eax
movzx ecx, bl
setne r15b
call fcn.140120980
mov rsi, rax
test rax, rax
je 0x140002cf6
cmp r14d, dword [rax]
jae 0x140002c1e
lfence
mov rcx, qword [rax + 8]
movzx edx, r15b
mov r9, qword [rcx + r14*8]
lea rcx, [rsp + 0x30]
movups xmm0, xmmword [r9]
movaps xmmword [rsp + 0x30], xmm0
call fcn.140120140
mov edi, eax
mov rcx, rsi
mov ebx, edi
call fcn.140120b60
test edi, edi
js 0x140002cb6
mov r9d, 4
mov dword [rsp + 0x20], 0x80000000
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_InitiateShutdownW]
test eax, eax
je 0x140002d7b
mov ecx, eax
call sym.ProcessHacker.exe_PhGetWin32Message
lea r9, str.Unable_to_configure_the_boot_application.
mov rbx, rax
test rax, rax
je 0x140002d67
mov rcx, qword [rax + 8]
mov edx, 0x20
mov qword [rsp + 0x28], rcx
lea rax, [0x1401b8d58]
mov rcx, rbp
mov qword [rsp + 0x20], rax
mov r8d, 0xfffe
call sym.ProcessHacker.exe_PhShowMessage2
lea rcx, [rbx - 0x10]
mov eax, 0xffffffff
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x140002d7b
call fcn.1400fbcc0
jmp 0x140002d7b
cmp edi, 0xc0000022
je 0x140002cdb
nop
cmp edi, 0xc0000005
je 0x140002cdb
mov eax, ebx
and eax, 0xfff0000
cmp eax, 0x70000
jne 0x140002cf6
movzx eax, bx
jmp 0x140002ce6
lfence
mov ecx, edi
call qword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
test eax, eax
je 0x140002cf6
lfence
mov ecx, eax
call sym.ProcessHacker.exe_PhGetWin32Message
jmp 0x140002d05
lfence
mov ecx, edi
call sym.ProcessHacker.exe_PhGetNtMessage
lea r9, str.Unable_to_configure_the_boot_application.
mov rbx, rax
test rax, rax
je 0x140002d67
lfence
lfence
mov rax, qword [rax + 8]
mov edx, 0x20
mov qword [rsp + 0x28], rax
mov r8d, 0xfffe
lea rax, [0x1401b8d58]
mov rcx, rbp
mov qword [rsp + 0x20], rax
call sym.ProcessHacker.exe_PhShowMessage2
lea rcx, [rbx - 0x10]
mov eax, 0xffffffff
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x140002d7b
lfence
call fcn.1400fbcc0
jmp 0x140002d7b
lea r8, [0x1401efb68]
mov edx, 0x10
mov rcx, rbp
call sym.ProcessHacker.exe_PhShowMessage
mov rsi, qword [rsp + 0x68]
mov rbx, qword [rsp + 0x60]
mov r15, qword [rsp + 0x78]
add rsp, 0x40
pop r14
pop rdi
pop rbp
ret