joyce8/EMBER2024-capa huggingface dataset:
Function at 0x53ae00
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push rbp
push rbx
sub rsp, 0xa8
mov rbp, rsp
mov qword [rbp + 0x40], 0
mov qword [rbp + 0x78], 0
mov qword [rbp + 0x70], 0
mov qword [rbp + 0x48], rbp
mov qword [rbp + 0xc0], rcx
mov qword [rbp + 0xc8], rdx
nop
lea rcx, [rbp + 0x78]
mov rdx, qword [rbp + 0xc8]
call fcn.0040f800
mov rcx, qword [rbp + 0x78]
call fcn.0053a300
mov byte [rbp + 0x83], al
cmp byte [rbp + 0x83], 0
jne 0x53ae73
lea rcx, [rbp + 0x78]
mov edx, 1
mov r8d, 1
call fcn.004111b0
mov rax, qword [rbp + 0xc0]
mov rax, qword [rax + 8]
mov qword [rbp + 0x98], rax
mov rcx, qword [rbp + 0xc0]
mov rdx, qword [rbp + 0xc8]
call fcn.0053bfe0
mov qword [rbp + 0x90], rax
cmp qword [rbp + 0x90], 0
je 0x53afc6
nop
mov rcx, qword [rbp + 0xc0]
mov rdx, qword [rbp + 0x90]
call fcn.0053a810
mov rcx, qword [rbp + 0xc0]
lea rdx, [rbp + 0x54]
call fcn.0053b130
test al, al
je 0x53afa6
lea rcx, [rbp + 0x70]
xor edx, edx
mov r8d, dword [rbp + 0x58]
add r8d, 1
call fcn.0040f410
mov eax, dword [rbp + 0x54]
sub eax, 1
mov dword [rbp + 0x84], eax
cmp dword [rbp + 0x84], 0
jl 0x53afa5
mov eax, dword [rbp + 0x58]
add eax, 1
mov dword [rbp + 0x88], eax
mov rcx, qword [rbp + 0x70]
call fcn.00410b10
mov rcx, qword [rbp + 0x90]
mov edx, dword [rbp + 0x84]
mov r8, rax
lea r9, [rbp + 0x88]
mov qword [rsp + 0x20], 0
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x38], 0
call sub.advapi32.dll_RegEnumKeyExW
mov rcx, qword [rbp + 0xc0]
mov edx, eax
call fcn.0053a730
test al, al
je 0x53af91
mov rcx, qword [rbp + 0x70]
call fcn.00410b10
lea rcx, [rbp + 0x40]
mov rdx, rax
call fcn.00410ba0
mov rcx, qword [rbp + 0xc0]
mov rdx, qword [rbp + 0x40]
call fcn.0053ae00
sub dword [rbp + 0x84], 1
cmp dword [rbp + 0x84], 0xffffffff
jne 0x53af05
nop
nop
mov rcx, qword [rbp + 0xc0]
mov rdx, qword [rbp + 0x98]
call fcn.0053a810
mov rcx, qword [rbp + 0x90]
call sub.advapi32.dll_RegCloseKey
cmp byte [0x005c9918], 0
je 0x53b025
mov rcx, qword [rbp + 0xc0]
movzx rdx, byte [rbp + 0x83]
call fcn.0053a7f0
mov rbx, rax
mov rcx, qword [rbp + 0x78]
call fcn.00410b10
mov rcx, rbx
mov rdx, rax
mov rax, qword [rbp + 0xc0]
mov r8d, dword [rax + 0x2c]
and r8d, 0x300
xor r9, r9
call sub.advapi32.dll_RegDeleteKeyExW
mov rcx, qword [rbp + 0xc0]
mov edx, eax
call fcn.0053a730
mov byte [rbp + 0x8f], al
jmp 0x53b064
mov rcx, qword [rbp + 0xc0]
movzx rdx, byte [rbp + 0x83]
call fcn.0053a7f0
mov rbx, rax
mov rcx, qword [rbp + 0x78]
call fcn.00410b10
mov rcx, rbx
mov rdx, rax
call sub.advapi32.dll_RegDeleteKeyW
mov rcx, qword [rbp + 0xc0]
mov edx, eax
call fcn.0053a730
mov byte [rbp + 0x8f], al
nop
lea rcx, [rbp + 0x40]
call fcn.0040f110
lea rcx, [rbp + 0x70]
mov edx, 2
call fcn.0040f1f0
movzx rax, byte [rbp + 0x8f]
lea rsp, [rbp + 0xa8]
pop rbx
pop rbp
ret

Function at 0x53b100
Capabilities:
Delete registry value

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
mov rcx, rdx
call fcn.00410b10
mov rcx, qword [rbx + 8]
mov rdx, rax
call sub.advapi32.dll_RegDeleteValueW
mov rcx, rbx
mov edx, eax
call fcn.0053a730
add rsp, 0x20
pop rbx
ret
Function at 0x53c770
Capabilities:
Query or enumerate registry value

Disassembly:
push rbp
push rbx
sub rsp, 0x98
mov rbp, rsp
mov qword [rbp + 0x40], 0
mov qword [rbp + 0x58], 0
mov qword [rbp + 0x48], rbp
mov qword [rbp + 0xb0], rcx
mov qword [rbp + 0xb8], rdx
mov qword [rbp + 0xc0], r8
nop
mov rax, qword [rbp + 0xb0]
mov rax, qword [rax + 0x50]
mov rax, qword [rax + 8]
mov qword [rbp + 0x88], rax
mov rax, qword [rbp + 0xb0]
mov rcx, qword [rax + 0x50]
mov rdx, qword [rbp + 0xb8]
call fcn.0053a810
nop
mov rax, qword [rbp + 0xb0]
mov rcx, qword [rax + 0x50]
lea rdx, [rbp + 0x64]
call fcn.0053b130
test al, al
je 0x53c8f0
mov rcx, qword [rbp + 0xb0]
mov rdx, qword [rbp + 0xb8]
mov r8, qword [rbp + 0xc0]
xor r9, r9
call fcn.0053c5f0
lea rcx, [rbp + 0x58]
xor edx, edx
mov r8d, dword [rbp + 0x70]
add r8d, 1
call fcn.0040f410
xor eax, eax
mov ebx, dword [rbp + 0x6c]
sub ebx, 1
mov dword [rbp + 0x80], eax
cmp dword [rbp + 0x80], ebx
jg 0x53c8ef
sub ebx, eax
add ebx, 1
mov eax, dword [rbp + 0x70]
add eax, 1
mov dword [rbp + 0x84], eax
mov rcx, qword [rbp + 0x58]
call fcn.00410b10
mov rcx, qword [rbp + 0xb8]
mov edx, dword [rbp + 0x80]
mov r8, rax
lea r9, [rbp + 0x84]
mov qword [rsp + 0x20], 0
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x38], 0
call sub.advapi32.dll_RegEnumValueW
mov rcx, qword [rbp + 0xb0]
mov rcx, qword [rcx + 0x50]
mov edx, eax
call fcn.0053a730
test al, al
je 0x53c8dd
mov rcx, qword [rbp + 0x58]
call fcn.00410b10
lea rcx, [rbp + 0x40]
mov rdx, rax
call fcn.00410ba0
mov rcx, qword [rbp + 0xb0]
mov rdx, qword [rbp + 0xb8]
mov r8, qword [rbp + 0xc0]
mov r9, qword [rbp + 0x40]
call fcn.0053c5f0
add dword [rbp + 0x80], 1
sub ebx, 1
test ebx, ebx
jne 0x53c83f
nop
nop
mov rax, qword [rbp + 0xb0]
mov rcx, qword [rax + 0x50]
mov rdx, qword [rbp + 0x88]
call fcn.0053a810
nop
lea rcx, [rbp + 0x40]
call fcn.0040f110
lea rcx, [rbp + 0x58]
call fcn.0040f110
lea rsp, [rbp + 0x98]
pop rbx
pop rbp
ret
Function at 0x548710
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
mov r8, rcx
xor eax, eax
xor r9, r9
sub edx, 1
mov ecx, r9d
cmp ecx, edx
jg 0x548750
sub edx, r9d
add edx, 1
mov ecx, eax
and cx, 0xf800
movzx ecx, cx
shr ecx, 0xb
shl eax, 5
or cx, ax
mov eax, ecx
movzx cx, byte [r8]
xor ax, cx
add r8, 1
sub edx, 1
test edx, edx
jne 0x548728
nop
ret
Function at 0x55d1b0
Capabilities:
Get common file path

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
mov rcx, rbx
mov edx, 0x104
call fcn.00410d80
mov rcx, rbx
call fcn.0040fa50
mov rcx, rax
mov edx, 0x104
call sub.kernel32.dll_GetWindowsDirectoryW
mov rcx, rbx
mov edx, eax
call fcn.00410d80
mov rax, rbx
add rsp, 0x20
pop rbx
ret

Function at 0x55d640
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push rbp
push rsi
push rbx
sub rsp, 0x30
mov rbp, rsp
mov qword [rbp + 0x28], rcx
mov qword [rbp + 0x58], rdx
mov qword [rbp + 0x60], r8
mov rcx, qword [rbp + 0x58]
call fcn.0040f2e0
mov rcx, qword [rbp + 0x60]
call fcn.0040f2e0
nop
mov rcx, qword [rbp + 0x28]
call fcn.0040f160
mov rcx, qword [rbp + 0x58]
call fcn.00410b10
mov rbx, rax
mov rcx, qword [rbp + 0x60]
call fcn.00410b10
mov rcx, qword [0x005c3278]
mov rdx, rbx
mov r8, rax
call sub.kernel32.dll_FindResourceW
mov rbx, rax
test rbx, rbx
je 0x55d6ff
mov rcx, qword [0x005c3278]
mov rdx, rbx
call sub.kernel32.dll_SizeofResource
mov esi, eax
test esi, esi
je 0x55d6ff
mov rcx, qword [0x005c3278]
mov rdx, rbx
call sub.kernel32.dll_LoadResource
mov rbx, rax
test rbx, rbx
je 0x55d6ff
mov rcx, rbx
call sub.kernel32.dll_LockResource
test rax, rax
je 0x55d6ff
mov rcx, qword [rbp + 0x28]
mov rdx, rax
xor r8, r8
call fcn.0040fcf0
mov rcx, qword [rbp + 0x28]
mov edx, esi
xor r8, r8
call fcn.004103d0
mov rcx, rbx
call sub.kernel32.dll_FreeResource
nop
lea rcx, [rbp + 0x58]
mov edx, 2
call fcn.0040f1f0
mov rax, qword [rbp + 0x28]
lea rsp, [rbp + 0x30]
pop rbx
pop rsi
pop rbp
ret
Function at 0x55d900
Capabilities:
Get graphical window text

Disassembly:
push rbp
push r14
push r13
push rdi
push rsi
push rbx
sub rsp, 0x68
mov rbp, rsp
mov qword [rbp + 0x20], rcx
mov qword [rbp + 0x30], 0
mov qword [rbp + 0x28], 0
mov qword [rbp + 0x38], 0
mov qword [rbp + 0x58], 0
mov qword [rbp + 0x50], 0
mov qword [rbp + 0x48], 0
nop
mov rcx, qword [rbp + 0x20]
mov rdx, qword [0x0055cd28]
call fcn.00413ed0
xor ebx, ebx
call sub.user32.dll_GetForegroundWindow
mov r13, rax
mov rcx, r13
xor edx, edx
call sub.user32.dll_GetWindow
mov rdi, rax
jmp 0x55daff
mov rcx, rdi
call sub.user32.dll_GetWindowTextLengthW
mov esi, eax
add esi, 1
lea rcx, [rbp + 0x58]
mov edx, esi
call fcn.00410d80
mov rcx, qword [rbp + 0x58]
call fcn.00410b10
mov rcx, rdi
mov rdx, rax
mov r8d, esi
call sub.user32.dll_GetWindowTextW
mov esi, eax
test esi, esi
jle 0x55daef
lea rcx, [rbp + 0x50]
mov rdx, qword [rbp + 0x58]
call fcn.00432260
mov rcx, rdi
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x55daef
mov rax, qword [rbp + 0x20]
mov rax, qword [rax]
test rax, rax
je 0x55d9d6
mov rax, qword [rax - 8]
mov rcx, qword [rbp + 0x20]
mov rdx, qword [0x0055cd28]
mov r8d, 1
lea r9, [rax + 1]
call fcn.00413d00
movsxd rsi, ebx
lea rcx, [rbp + 0x38]
mov rdx, qword [rbp + 0x50]
call fcn.0055d840
mov rax, qword [rbp + 0x20]
mov rax, qword [rax]
mov rcx, rsi
imul rcx, rcx, 0x15
lea rcx, [rax + rcx]
mov rdx, qword [rbp + 0x38]
call fcn.0040f780
mov rax, qword [rbp + 0x20]
mov rax, qword [rax]
mov rcx, rsi
imul rcx, rcx, 0x15
mov dword [rax + rcx + 0x10], edi
lea rcx, [rbp + 0x48]
mov edx, 0x80
xor r8, r8
call fcn.004103d0
xor r14, r14
mov rax, qword [rbp + 0x48]
test rax, rax
je 0x55da4e
mov r14d, dword [rax - 4]
mov rcx, qword [rbp + 0x48]
call fcn.00410330
mov rcx, rdi
mov rdx, rax
mov r8d, r14d
call sub.user32.dll_GetClassNameA
test eax, eax
jle 0x55daa4
lea rcx, [rbp + 0x28]
mov rdx, qword [rbp + 0x48]
call fcn.00410c10
lea rcx, [rbp + 0x30]
mov rdx, qword [rbp + 0x28]
call fcn.0055d840
mov rax, qword [rbp + 0x20]
mov rax, qword [rax]
mov rcx, rsi
imul rcx, rcx, 0x15
lea rcx, [rax + rcx + 8]
mov rdx, qword [rbp + 0x30]
xor r8, r8
call fcn.00410490
jmp 0x55dabc
mov rax, qword [rbp + 0x20]
mov rax, qword [rax]
mov rcx, rsi
imul rcx, rcx, 0x15
lea rcx, [rax + rcx + 8]
call fcn.0040f160
lea rcx, [rbp + 0x48]
call fcn.0040f160
cmp rdi, r13
jne 0x55dadc
mov rax, qword [rbp + 0x20]
mov rax, qword [rax]
imul rsi, rsi, 0x15
mov byte [rax + rsi + 0x14], 1
jmp 0x55daec
mov rax, qword [rbp + 0x20]
mov rax, qword [rax]
imul rsi, rsi, 0x15
mov byte [rax + rsi + 0x14], 0
add ebx, 1
mov rcx, rdi
mov edx, 2
call sub.user32.dll_GetWindow
mov rdi, rax
test rdi, rdi
ja 0x55d970
nop
lea rcx, [rbp + 0x28]
mov edx, 3
call fcn.0040f1f0
lea rcx, [rbp + 0x48]
call fcn.0040f160
lea rcx, [rbp + 0x50]
mov edx, 2
call fcn.0040f1f0
mov rax, qword [rbp + 0x20]
lea rsp, [rbp + 0x68]
pop rbx
pop rsi
pop rdi
pop r13
pop r14
pop rbp
ret
Function at 0x55db80
Capabilities:
Delete file

Disassembly:
push rbp
sub rsp, 0x270
mov rbp, rsp
mov qword [rbp + 0x28], rbp
mov qword [rbp + 0x280], rcx
mov rcx, qword [rbp + 0x280]
call fcn.0040f2e0
nop
nop
lea rcx, [rbp + 0x230]
mov edx, 0x38
xor r8, r8
call fcn.0040b030
lea rcx, [rbp + 0x30]
mov edx, 0x200
xor r8, r8
call fcn.0040b030
lea rcx, [rbp + 0x30]
mov rdx, qword [rbp + 0x280]
call fcn.00433c00
mov qword [rbp + 0x230], 0
lea rax, [rbp + 0x30]
mov qword [rbp + 0x240], rax
mov dword [rbp + 0x238], 3
lea rax, [rbp + 0x250]
or word [rax], 0x10
lea rax, [rbp + 0x250]
or word [rax], 4
lea rcx, [rbp + 0x230]
call sub.shell32.dll_SHFileOperationW
test eax, eax
sete al
mov byte [rbp + 0x26f], al
jmp 0x55dc37
nop
lea rcx, [rbp + 0x280]
call fcn.0040f110
movzx rax, byte [rbp + 0x26f]
lea rsp, [rbp + 0x270]
pop rbp
ret

Function at 0x55e130
Capabilities:
Write file on windows

Disassembly:
push rbp
push rbx
sub rsp, 0x68
mov rbp, rsp
mov qword [rbp + 0x80], rcx
mov qword [rbp + 0x88], rdx
mov rcx, qword [rbp + 0x80]
call fcn.0040f2e0
mov rcx, qword [rbp + 0x88]
call fcn.00413fa0
nop
mov rcx, qword [rbp + 0x80]
call fcn.00410b10
mov rcx, rax
mov edx, 0x40000000
mov r8d, 2
xor r9, r9
mov dword [rsp + 0x20], 2
mov dword [rsp + 0x28], 0x80
mov qword [rsp + 0x30], 0
call sub.kernel32.dll_CreateFileW
mov rbx, rax
cmp rbx, 0xffffffffffffffff
je 0x55e1db
mov rax, qword [rbp + 0x88]
test rax, rax
je 0x55e1b4
mov rax, qword [rax - 8]
mov rcx, rbx
mov rdx, qword [rbp + 0x88]
mov r8d, eax
lea r9, [rbp + 0x5c]
mov qword [rsp + 0x20], 0
call sub.kernel32.dll_WriteFile
mov rcx, rbx
call sub.kernel32.dll_CloseHandle
nop
lea rcx, [rbp + 0x80]
call fcn.0040f110
lea rcx, [rbp + 0x88]
mov rdx, qword [0x00406508]
call fcn.00413ed0
movzx rax, byte [rbp + 0x4f]
lea rsp, [rbp + 0x68]
pop rbx
pop rbp
ret

Function at 0x55e250
Capabilities:
Get file size
Read file on windows

Disassembly:
push rbp
push rsi
push rbx
sub rsp, 0x60
mov rbp, rsp
mov qword [rbp + 0x40], rdx
mov qword [rbp + 0x80], rcx
mov rcx, qword [rbp + 0x80]
call fcn.0040f2e0
nop
xor eax, eax
mov byte [rbp + 0x4f], al
mov rcx, qword [rbp + 0x80]
call fcn.00410b10
mov rcx, rax
mov edx, 0x80000000
mov r8d, 1
xor r9, r9
mov dword [rsp + 0x20], 3
mov dword [rsp + 0x28], 0x8000000
mov qword [rsp + 0x30], 0
call sub.kernel32.dll_CreateFileW
mov rbx, rax
test rbx, rbx
je 0x55e323
mov rcx, rbx
xor edx, edx
call sub.kernel32.dll_GetFileSize
mov esi, eax
test esi, esi
je 0x55e323
mov rcx, rbx
xor edx, edx
xor r8, r8
xor r9, r9
call sub.kernel32.dll_SetFilePointer
mov rcx, qword [rbp + 0x40]
mov rdx, qword [0x00406508]
mov r8d, 1
mov r9d, esi
call fcn.00413d00
mov rcx, rbx
mov rax, qword [rbp + 0x40]
mov rdx, qword [rax]
mov r8d, esi
lea r9, [rbp + 0x5c]
mov qword [rsp + 0x20], 0
call sub.kernel32.dll_ReadFile
test eax, eax
je 0x55e31b
mov al, 1
mov byte [rbp + 0x4f], al
mov rcx, rbx
call sub.kernel32.dll_CloseHandle
nop
lea rcx, [rbp + 0x80]
call fcn.0040f110
movzx rax, byte [rbp + 0x4f]
lea rsp, [rbp + 0x60]
pop rbx
pop rsi
pop rbp
ret
Function at 0x55e360
Capabilities:
Get file size
Read file on windows

Disassembly:
push rbp
push rsi
push rbx
sub rsp, 0x70
mov rbp, rsp
mov qword [rbp + 0x48], rdx
mov qword [rbp + 0x50], r8
mov qword [rbp + 0x90], rcx
mov rcx, qword [rbp + 0x90]
call fcn.0040f2e0
nop
xor eax, eax
mov byte [rbp + 0x5f], al
mov rcx, qword [rbp + 0x90]
call fcn.00410b10
mov rcx, rax
mov edx, 0x80000000
mov r8d, 1
xor r9, r9
mov dword [rsp + 0x20], 3
mov dword [rsp + 0x28], 0x8000000
mov qword [rsp + 0x30], 0
call sub.kernel32.dll_CreateFileW
mov rbx, rax
test rbx, rbx
je 0x55e446
mov rcx, rbx
xor edx, edx
call sub.kernel32.dll_GetFileSize
mov esi, eax
test esi, esi
je 0x55e446
mov eax, esi
mov rcx, qword [rbp + 0x48]
cmp rax, rcx
jle 0x55e3ed
mov rsi, qword [rbp + 0x48]
mov rcx, rbx
xor edx, edx
xor r8, r8
xor r9, r9
call sub.kernel32.dll_SetFilePointer
mov rcx, qword [rbp + 0x50]
mov rdx, qword [0x00406508]
mov r8d, 1
mov r9d, esi
call fcn.00413d00
mov rcx, rbx
mov rax, qword [rbp + 0x50]
mov rdx, qword [rax]
mov r8d, esi
lea r9, [rbp + 0x6c]
mov qword [rsp + 0x20], 0
call sub.kernel32.dll_ReadFile
test eax, eax
je 0x55e43e
mov al, 1
mov byte [rbp + 0x5f], al
mov rcx, rbx
call sub.kernel32.dll_CloseHandle
nop
lea rcx, [rbp + 0x90]
call fcn.0040f110
movzx rax, byte [rbp + 0x5f]
lea rsp, [rbp + 0x70]
pop rbx
pop rsi
pop rbp
ret

Function at 0x55e760
Capabilities:
Compare security identifiers

Disassembly:
push r13
push rdi
push rsi
push rbx
sub rsp, 0x88
xor ebx, ebx
call sub.kernel32.dll_GetCurrentThread
mov rcx, rax
mov edx, 8
or r8d, 0xffffffff
lea r9, [rsp + 0x78]
call sub.advapi32.dll_OpenThreadToken
mov edi, eax
test edi, edi
jne 0x55e7b5
call sub.kernel32.dll_GetLastError
cmp eax, 0x3f0
jne 0x55e7b5
call sub.kernel32.dll_GetCurrentProcess
mov rcx, rax
mov edx, 8
lea r8, [rsp + 0x78]
call sub.advapi32.dll_OpenProcessToken
mov edi, eax
test edi, edi
je 0x55e8b1
mov ecx, 0x400
call fcn.004091d0
mov rsi, rax
mov rcx, qword [rsp + 0x78]
mov edx, 2
mov r8, rsi
mov r9d, 0x400
lea rax, [rsp + 0x74]
mov qword [rsp + 0x20], rax
call sub.advapi32.dll_GetTokenInformation
mov edi, eax
mov rcx, qword [rsp + 0x78]
call sub.kernel32.dll_CloseHandle
test edi, edi
je 0x55e8a9
lea rax, [0x005b8554]
mov qword [rsp + 0x60], rax
mov rcx, qword [rsp + 0x60]
mov dl, 2
mov r8d, 0x20
mov r9d, 0x220
mov dword [rsp + 0x20], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x30], 0
mov dword [rsp + 0x38], 0
mov dword [rsp + 0x40], 0
mov dword [rsp + 0x48], 0
lea rax, [rsp + 0x68]
mov qword [rsp + 0x50], rax
call sub.advapi32.dll_AllocateAndInitializeSid
xor eax, eax
mov r13d, dword [rsi]
sub r13d, 1
mov edi, eax
cmp edi, r13d
jg 0x55e89e
sub r13d, eax
add r13d, 1
mov rcx, qword [rsp + 0x68]
movsxd rax, edi
add rax, rax
mov rdx, qword [rsi + rax*8 + 8]
call sub.advapi32.dll_EqualSid
test eax, eax
je 0x55e892
mov bl, 1
jmp 0x55e89e
add edi, 1
sub r13d, 1
test r13d, r13d
jne 0x55e875
nop
mov rcx, qword [rsp + 0x68]
call sub.advapi32.dll_FreeSid
mov rcx, rsi
call fcn.00409200
mov eax, ebx
add rsp, 0x88
pop rbx
pop rsi
pop rdi
pop r13
ret
Function at 0x55ee50
Capabilities:
Get memory capacity

Disassembly:
push rbx
sub rsp, 0x60
xor ebx, ebx
lea rcx, [rsp + 0x20]
mov edx, 0x40
xor r8, r8
call fcn.0040b030
mov dword [rsp + 0x20], 0x40
lea rcx, [rsp + 0x20]
call sub.kernel32_GlobalMemoryStatusEx
test eax, eax
je 0x55eea6
mov rax, qword [rsp + 0x28]
cvtsi2sd xmm0, rax
test rax, rax
jge 0x55ee96
addsd xmm0, qword [0x0055eeb0]
divsd xmm0, qword [0x0055eeb8]
call fcn.0040ad60
mov rbx, rax
mov eax, ebx
add rsp, 0x60
pop rbx
ret

Function at 0x55f050
Capabilities:
Create process on windows

Disassembly:
push rbp
sub rsp, 0xb0
mov rbp, rsp
mov qword [rbp + 0x20], rcx
mov dword [rbp + 0x28], r9d
mov qword [rbp + 0x30], 0
mov qword [rbp + 0x38], 0
mov qword [rbp + 0xc8], rdx
mov qword [rbp + 0xd0], r8
mov rcx, qword [rbp + 0xc8]
call fcn.0040f2e0
mov rcx, qword [rbp + 0xd0]
call fcn.0040f2e0
nop
lea rcx, [rbp + 0x40]
mov edx, 0x70
xor r8, r8
call fcn.0040b030
mov dword [rbp + 0x40], 0x70
mov rax, qword [rbp + 0x20]
mov qword [rbp + 0x48], rax
mov dword [rbp + 0x44], 0x500
lea rax, [0x0055f194]
mov qword [rbp + 0x50], rax
lea rcx, [rbp + 0x38]
mov rdx, qword [rbp + 0xc8]
call fcn.00410c70
mov rcx, qword [rbp + 0x38]
call fcn.004105e0
mov qword [rbp + 0x58], rax
cmp qword [rbp + 0xd0], 0
je 0x55f110
lea rcx, [rbp + 0x30]
mov rdx, qword [rbp + 0xd0]
call fcn.00410c70
mov rcx, qword [rbp + 0x30]
call fcn.004105e0
mov qword [rbp + 0x60], rax
mov eax, dword [rbp + 0x28]
mov dword [rbp + 0x70], eax
lea rcx, [rbp + 0x40]
call sub.shell32.dll_ShellExecuteExW
test eax, eax
setne al
mov byte [rbp + 0x2f], al
nop
lea rcx, [rbp + 0x30]
mov edx, 2
call fcn.0040f290
lea rcx, [rbp + 0xc8]
mov edx, 2
call fcn.0040f1f0
movzx rax, byte [rbp + 0x2f]
lea rsp, [rbp + 0xb0]
pop rbp
ret
Function at 0x5648f0
Capabilities:
Check for software breakpoints

Disassembly:
push rbp
push rsi
sub rsp, 0x28
lea rbp, [rsp + 0x20]
mov rsi, rcx
mov eax, dword [rsi + 0x24]
cmp eax, 0xcc
je 0x5649c6
cmp eax, 0xcb
je 0x564957
cmp eax, 0xca
jne 0x564939
mov rcx, rsi
call fcn.005650b0
cmp dword [rsi + 0x58], 0
je 0x564950
mov dword [rsi + 0x24], 0xcf
mov eax, 1
jmp 0x5649d3
mov rcx, qword [rsi]
mov dword [rcx + 0x28], 0x14
mov dword [rcx + 0x2c], eax
mov rax, qword [rsi]
mov rcx, rsi
call qword [rax]
jmp 0x5649c6
mov dword [rsi + 0x24], 0xcb
mov rax, qword [rsi + 0x240]
cmp dword [rax + 0x20], 0
je 0x5649ba
mov rdx, qword [rsi + 0x10]
jmp 0x564979
add eax, dword [rsi + 0x1a4]
mov dword [rdx + 0xc], eax
test rdx, rdx
je 0x564983
mov rcx, rsi
call qword [rdx]
mov rax, qword [rsi + 0x240]
mov rcx, rsi
call qword [rax]
test eax, eax
je 0x5649d1
cmp eax, 2
je 0x5649ba
mov rdx, qword [rsi + 0x10]
or eax, 2
cmp eax, 3
jne 0x564979
test rdx, rdx
je 0x564979
mov ecx, dword [rdx + 8]
mov eax, dword [rdx + 0xc]
inc ecx
mov dword [rdx + 8], ecx
cmp ecx, eax
jl 0x564979
jmp 0x564970
mov eax, dword [rsi + 0xac]
mov dword [rsi + 0xb4], eax
mov rcx, rsi
add rsp, 0x28
pop rsi
pop rbp
jmp 0x5649e0
xor eax, eax
add rsp, 0x28
pop rsi
pop rbp
ret
push rbp
push r14
push rsi
push rdi
push rbx
sub rsp, 0x20
lea rbp, [rsp + 0x20]
mov rsi, rcx
cmp dword [rsi + 0x24], 0xcc
je 0x564a18
mov rax, qword [rsi + 0x220]
mov rcx, rsi
call qword [rax]
mov dword [rsi + 0xa8], 0
mov dword [rsi + 0x24], 0xcc
mov rdx, qword [rsi + 0x220]
cmp dword [rdx + 0x10], 0
je 0x564abd
lea r14, [rsi + 0xa8]
mov eax, dword [rsi + 0xa8]
mov ecx, dword [rsi + 0x8c]
cmp eax, ecx
jae 0x564a8e
mov rdx, qword [rsi + 0x10]
test rdx, rdx
je 0x564a5a
mov dword [rdx + 8], eax
mov dword [rdx + 0xc], ecx
mov rcx, rsi
call qword [rdx]
mov eax, dword [rsi + 0xa8]
mov edi, eax
mov rax, qword [rsi + 0x228]
xor ebx, ebx
xor edx, edx
xor r9d, r9d
mov rcx, rsi
mov r8, r14
call qword [rax + 8]
mov eax, dword [rsi + 0xa8]
cmp eax, edi
je 0x564ad1
mov ecx, dword [rsi + 0x8c]
cmp eax, ecx
jb 0x564a40
mov rdx, qword [rsi + 0x220]
mov rcx, rsi
call qword [rdx + 8]
mov rax, qword [rsi + 0x220]
mov rcx, rsi
call qword [rax]
mov dword [rsi + 0xa8], 0
mov rdx, qword [rsi + 0x220]
xor eax, eax
cmp dword [rdx + 0x10], 0
jne 0x564a36
cmp dword [rsi + 0x5c], 1
mov eax, 0xce
sbb eax, 0
mov dword [rsi + 0x24], eax
mov ebx, 1
mov eax, ebx
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r14
pop rbp
ret
Function at 0x5649e0
Capabilities:
Check for software breakpoints

Disassembly:
push rbp
push rsi
sub rsp, 0x28
lea rbp, [rsp + 0x20]
mov rsi, rcx
mov eax, dword [rsi + 0x24]
cmp eax, 0xcc
je 0x5649c6
cmp eax, 0xcb
je 0x564957
cmp eax, 0xca
jne 0x564939
mov rcx, rsi
call fcn.005650b0
cmp dword [rsi + 0x58], 0
je 0x564950
mov dword [rsi + 0x24], 0xcf
mov eax, 1
jmp 0x5649d3
mov rcx, qword [rsi]
mov dword [rcx + 0x28], 0x14
mov dword [rcx + 0x2c], eax
mov rax, qword [rsi]
mov rcx, rsi
call qword [rax]
jmp 0x5649c6
mov dword [rsi + 0x24], 0xcb
mov rax, qword [rsi + 0x240]
cmp dword [rax + 0x20], 0
je 0x5649ba
mov rdx, qword [rsi + 0x10]
jmp 0x564979
add eax, dword [rsi + 0x1a4]
mov dword [rdx + 0xc], eax
test rdx, rdx
je 0x564983
mov rcx, rsi
call qword [rdx]
mov rax, qword [rsi + 0x240]
mov rcx, rsi
call qword [rax]
test eax, eax
je 0x5649d1
cmp eax, 2
je 0x5649ba
mov rdx, qword [rsi + 0x10]
or eax, 2
cmp eax, 3
jne 0x564979
test rdx, rdx
je 0x564979
mov ecx, dword [rdx + 8]
mov eax, dword [rdx + 0xc]
inc ecx
mov dword [rdx + 8], ecx
cmp ecx, eax
jl 0x564979
jmp 0x564970
mov eax, dword [rsi + 0xac]
mov dword [rsi + 0xb4], eax
mov rcx, rsi
add rsp, 0x28
pop rsi
pop rbp
jmp 0x5649e0
xor eax, eax
add rsp, 0x28
pop rsi
pop rbp
ret
push rbp
push r14
push rsi
push rdi
push rbx
sub rsp, 0x20
lea rbp, [rsp + 0x20]
mov rsi, rcx
cmp dword [rsi + 0x24], 0xcc
je 0x564a18
mov rax, qword [rsi + 0x220]
mov rcx, rsi
call qword [rax]
mov dword [rsi + 0xa8], 0
mov dword [rsi + 0x24], 0xcc
mov rdx, qword [rsi + 0x220]
cmp dword [rdx + 0x10], 0
je 0x564abd
lea r14, [rsi + 0xa8]
mov eax, dword [rsi + 0xa8]
mov ecx, dword [rsi + 0x8c]
cmp eax, ecx
jae 0x564a8e
mov rdx, qword [rsi + 0x10]
test rdx, rdx
je 0x564a5a
mov dword [rdx + 8], eax
mov dword [rdx + 0xc], ecx
mov rcx, rsi
call qword [rdx]
mov eax, dword [rsi + 0xa8]
mov edi, eax
mov rax, qword [rsi + 0x228]
xor ebx, ebx
xor edx, edx
xor r9d, r9d
mov rcx, rsi
mov r8, r14
call qword [rax + 8]
mov eax, dword [rsi + 0xa8]
cmp eax, edi
je 0x564ad1
mov ecx, dword [rsi + 0x8c]
cmp eax, ecx
jb 0x564a40
mov rdx, qword [rsi + 0x220]
mov rcx, rsi
call qword [rdx + 8]
mov rax, qword [rsi + 0x220]
mov rcx, rsi
call qword [rax]
mov dword [rsi + 0xa8], 0
mov rdx, qword [rsi + 0x220]
xor eax, eax
cmp dword [rdx + 0x10], 0
jne 0x564a36
cmp dword [rsi + 0x5c], 1
mov eax, 0xce
sbb eax, 0
mov dword [rsi + 0x24], eax
mov ebx, 1
mov eax, ebx
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r14
pop rbp
ret

Function at 0x564c50
Capabilities:
Check for software breakpoints

Disassembly:
push rbp
push rsi
push rdi
sub rsp, 0x20
lea rbp, [rsp + 0x20]
mov edi, edx
mov rsi, rcx
mov eax, dword [rsi + 0x24]
cmp eax, 0xcc
je 0x564c87
cmp eax, 0xcf
je 0x564c87
mov rcx, qword [rsi]
mov dword [rcx + 0x28], 0x14
mov dword [rcx + 0x2c], eax
mov rax, qword [rsi]
mov rcx, rsi
call qword [rax]
test edi, edi
mov eax, 1
cmovg eax, edi
mov rcx, qword [rsi + 0x240]
cmp dword [rcx + 0x24], 0
je 0x564ca9
mov ecx, dword [rsi + 0xac]
cmp eax, ecx
cmovg eax, ecx
mov dword [rsi + 0xb4], eax
mov rcx, rsi
add rsp, 0x20
pop rdi
pop rsi
pop rbp
jmp 0x5649e0