joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40466c
Capabilities:
Delete file

Disassembly:
push rbp
push rbx
sub rsp, 0x258
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x1f0], rcx
mov qword [rbp + 0x1f8], rdx
lea rax, [rbp + 0x18f]
mov rcx, rax
call fcn.0044fb90
lea rdx, [rbp + 0x18f]
lea rax, [rbp + 0x180]
mov r8, rdx
lea rdx, str.https:__linksly.co_api_api37ac654d11094687684e0044de73926987cf536curl
mov rcx, rax
call fcn.00458cf0
lea rax, [rbp + 0x18f]
mov rcx, rax
call fcn.0044fbc0
lea rax, [rbp + 0x190]
mov rcx, qword [rbp + 0x1f8]
lea rdx, [rbp + 0x180]
mov r8, rcx
mov rcx, rax
call fcn.0047ca30
lea rdx, [rbp + 0x190]
lea rax, [rbp + 0x180]
mov rcx, rax
call fcn.004592a0
lea rax, [rbp + 0x190]
mov rcx, rax
call fcn.00459260
lea rax, [rbp + 0x1a0]
lea rdx, [rbp + 0x180]
lea r8, str.formattext
mov rcx, rax
call fcn.0047c9d0
lea rdx, [rbp + 0x1a0]
lea rax, [rbp + 0x180]
mov rcx, rax
call fcn.004592a0
lea rax, [rbp + 0x1a0]
mov rcx, rax
call fcn.00459260
mov rcx, qword [rbp + 0x1f0]
call fcn.00458ec0
lea rax, [rbp + 0x1bf]
mov rcx, rax
call fcn.0044fb90
lea rdx, [rbp + 0x1bf]
lea rax, [rbp + 0x1b0]
mov r8, rdx
lea rdx, str.fk.txt
mov rcx, rax
call fcn.00458cf0
lea rdx, [rbp + 0x180]
lea rax, [rbp + 0x1c0]
mov rcx, rax
call fcn.00458d90
lea rdx, [rbp + 0x1b0]
lea rax, [rbp + 0x1c0]
mov rcx, rax
call fcn.00402c37
lea rax, [rbp + 0x1c0]
mov rcx, rax
call fcn.00459260
lea rax, [rbp + 0x1b0]
mov rcx, rax
call fcn.00459260
lea rax, [rbp + 0x1bf]
mov rcx, rax
call fcn.0044fbc0
lea rax, [rbp - 0x60]
mov r8d, 8
lea rdx, str.fk.txt
mov rcx, rax
call fcn.00466ea0
lea rax, [rbp - 0x60]
mov rdx, qword [rbp + 0x1f0]
mov rcx, rax
call fcn.0047a410
lea rax, [rbp - 0x60]
mov rcx, rax
call fcn.00466e50
lea rcx, str.fk.txt
mov rax, qword [sym.imp.KERNEL32.dll_DeleteFileA]
call rax
nop
lea rax, [rbp - 0x60]
mov rcx, rax
call fcn.00467540
lea rax, [rbp + 0x180]
mov rcx, rax
call fcn.00459260
jmp 0x40490d
mov rax, qword [rbp + 0x1f0]
add rsp, 0x258
pop rbx
pop rbp
ret
Function at 0x40491e
Capabilities:
Delete file

Disassembly:
push rbp
push rbx
sub rsp, 0x258
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x1f0], rcx
mov qword [rbp + 0x1f8], rdx
lea rax, [rbp + 0x18f]
mov rcx, rax
call fcn.0044fb90
lea rdx, [rbp + 0x18f]
lea rax, [rbp + 0x180]
mov r8, rdx
lea rdx, str.https:__shrinkearn.com_api_api1495353a242b3863f072ebc4f9bd2166e9aad299url
mov rcx, rax
call fcn.00458cf0
lea rax, [rbp + 0x18f]
mov rcx, rax
call fcn.0044fbc0
lea rax, [rbp + 0x190]
mov rcx, qword [rbp + 0x1f8]
lea rdx, [rbp + 0x180]
mov r8, rcx
mov rcx, rax
call fcn.0047ca30
lea rdx, [rbp + 0x190]
lea rax, [rbp + 0x180]
mov rcx, rax
call fcn.004592a0
lea rax, [rbp + 0x190]
mov rcx, rax
call fcn.00459260
lea rax, [rbp + 0x1a0]
lea rdx, [rbp + 0x180]
lea r8, str.formattext
mov rcx, rax
call fcn.0047c9d0
lea rdx, [rbp + 0x1a0]
lea rax, [rbp + 0x180]
mov rcx, rax
call fcn.004592a0
lea rax, [rbp + 0x1a0]
mov rcx, rax
call fcn.00459260
mov rcx, qword [rbp + 0x1f0]
call fcn.00458ec0
lea rax, [rbp + 0x1bf]
mov rcx, rax
call fcn.0044fb90
lea rdx, [rbp + 0x1bf]
lea rax, [rbp + 0x1b0]
mov r8, rdx
lea rdx, str.fk.txt
mov rcx, rax
call fcn.00458cf0
lea rdx, [rbp + 0x180]
lea rax, [rbp + 0x1c0]
mov rcx, rax
call fcn.00458d90
lea rdx, [rbp + 0x1b0]
lea rax, [rbp + 0x1c0]
mov rcx, rax
call fcn.00402c37
lea rax, [rbp + 0x1c0]
mov rcx, rax
call fcn.00459260
lea rax, [rbp + 0x1b0]
mov rcx, rax
call fcn.00459260
lea rax, [rbp + 0x1bf]
mov rcx, rax
call fcn.0044fbc0
lea rax, [rbp - 0x60]
mov r8d, 8
lea rdx, str.fk.txt
mov rcx, rax
call fcn.00466ea0
lea rax, [rbp - 0x60]
mov rdx, qword [rbp + 0x1f0]
mov rcx, rax
call fcn.0047a410
lea rax, [rbp - 0x60]
mov rcx, rax
call fcn.00466e50
lea rcx, str.fk.txt
mov rax, qword [sym.imp.KERNEL32.dll_DeleteFileA]
call rax
nop
lea rax, [rbp - 0x60]
mov rcx, rax
call fcn.00467540
lea rax, [rbp + 0x180]
mov rcx, rax
call fcn.00459260
jmp 0x404bbf
mov rax, qword [rbp + 0x1f0]
add rsp, 0x258
pop rbx
pop rbp
ret
Function at 0x404bd0
Capabilities:
Delete file

Disassembly:
push rbp
push rbx
sub rsp, 0x258
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x1f0], rcx
mov qword [rbp + 0x1f8], rdx
lea rax, [rbp + 0x18f]
mov rcx, rax
call fcn.0044fb90
lea rdx, [rbp + 0x18f]
lea rax, [rbp + 0x180]
mov r8, rdx
lea rdx, str.https:__shrinkme.io_api_apifc22a85dd4c4674b789d67aef7a6edebeecfa241url
mov rcx, rax
call fcn.00458cf0
lea rax, [rbp + 0x18f]
mov rcx, rax
call fcn.0044fbc0
lea rax, [rbp + 0x190]
mov rcx, qword [rbp + 0x1f8]
lea rdx, [rbp + 0x180]
mov r8, rcx
mov rcx, rax
call fcn.0047ca30
lea rdx, [rbp + 0x190]
lea rax, [rbp + 0x180]
mov rcx, rax
call fcn.004592a0
lea rax, [rbp + 0x190]
mov rcx, rax
call fcn.00459260
lea rax, [rbp + 0x1a0]
lea rdx, [rbp + 0x180]
lea r8, str.formattext
mov rcx, rax
call fcn.0047c9d0
lea rdx, [rbp + 0x1a0]
lea rax, [rbp + 0x180]
mov rcx, rax
call fcn.004592a0
lea rax, [rbp + 0x1a0]
mov rcx, rax
call fcn.00459260
mov rcx, qword [rbp + 0x1f0]
call fcn.00458ec0
lea rax, [rbp + 0x1bf]
mov rcx, rax
call fcn.0044fb90
lea rdx, [rbp + 0x1bf]
lea rax, [rbp + 0x1b0]
mov r8, rdx
lea rdx, str.fk.txt
mov rcx, rax
call fcn.00458cf0
lea rdx, [rbp + 0x180]
lea rax, [rbp + 0x1c0]
mov rcx, rax
call fcn.00458d90
lea rdx, [rbp + 0x1b0]
lea rax, [rbp + 0x1c0]
mov rcx, rax
call fcn.00402c37
lea rax, [rbp + 0x1c0]
mov rcx, rax
call fcn.00459260
lea rax, [rbp + 0x1b0]
mov rcx, rax
call fcn.00459260
lea rax, [rbp + 0x1bf]
mov rcx, rax
call fcn.0044fbc0
lea rax, [rbp - 0x60]
mov r8d, 8
lea rdx, str.fk.txt
mov rcx, rax
call fcn.00466ea0
lea rax, [rbp - 0x60]
mov rdx, qword [rbp + 0x1f0]
mov rcx, rax
call fcn.0047a410
lea rax, [rbp - 0x60]
mov rcx, rax
call fcn.00466e50
lea rcx, str.fk.txt
mov rax, qword [sym.imp.KERNEL32.dll_DeleteFileA]
call rax
nop
lea rax, [rbp - 0x60]
mov rcx, rax
call fcn.00467540
lea rax, [rbp + 0x180]
mov rcx, rax
call fcn.00459260
jmp 0x404e71
mov rax, qword [rbp + 0x1f0]
add rsp, 0x258
pop rbx
pop rbp
ret

Function at 0x404e82
Capabilities:
Create process on windows

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov qword [rbp + 0x10], rcx
mov rcx, qword [rbp + 0x10]
call fcn.0042f540
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov r9d, 0
mov r8, rax
mov edx, 0
mov ecx, 0
mov rax, qword [sym.imp.SHELL32.dll_ShellExecuteA]
call rax
nop
add rsp, 0x30
pop rbp
ret
Function at 0x40504c
Capabilities:
Execute command

Disassembly:
push rbp
push rbx
sub rsp, 0x208
lea rbp, [rsp + 0x80]
lea rax, [rbp - 0x60]
mov r8d, 8
lea rdx, str.C:_ss.txt
mov rcx, rax
call fcn.00466ea0
lea rax, [rbp - 0x60]
add rax, 0xd0
mov rcx, rax
call fcn.00448fe0
test rax, rax
setne al
test al, al
je 0x4050a8
lea rax, [rbp - 0x60]
mov rcx, rax
call fcn.00466e50
mov ebx, 0
jmp 0x40519a
lea rax, [rbp - 0x60]
mov rcx, rax
call fcn.00466e50
lea rcx, [0x00496003]
call sub.msvcrt.dll_system
lea rdx, str.Select_Get_key_method................_n
mov rcx, qword [0x0049c9d0]
call fcn.0047c280
lea rdx, str.Method_1__Method_2_n
mov rcx, qword [0x0049c9d0]
call fcn.0047c280
lea rdx, [0x00496118]
mov rcx, qword [0x0049c9d0]
call fcn.0047c280
lea rax, [rbp + 0x17f]
mov rdx, rax
mov rcx, qword [0x0049c9a0]
call fcn.0047cfc0
movzx eax, byte [rbp + 0x17f]
cmp al, 0x31
jne 0x405139
lea rcx, [0x00496003]
call sub.msvcrt.dll_system
call fcn.004051d5
lea rcx, [0x00496003]
call sub.msvcrt.dll_system
jmp 0x405195
movzx eax, byte [rbp + 0x17f]
cmp al, 0x32
jne 0x405163
lea rcx, [0x00496003]
call sub.msvcrt.dll_system
call fcn.00405485
lea rcx, [0x00496003]
call sub.msvcrt.dll_system
jmp 0x405195
lea rdx, str.Invalid_choice..............._n
mov rcx, qword [0x0049c9d0]
call fcn.0047c280
mov ecx, 0x3e8
mov rax, qword [sym.imp.KERNEL32.dll_Sleep]
call rax
lea rcx, [0x00496003]
call sub.msvcrt.dll_system
jmp 0x4050b4
mov ebx, 1
lea rax, [rbp - 0x60]
mov rcx, rax
call fcn.00467540
cmp ebx, 1
je 0x4051ad
jmp 0x4051cb
nop
jmp 0x4051cb
add rsp, 0x208
pop rbx
pop rbp
ret
Function at 0x4051d5
Capabilities:
Execute command

Disassembly:
push rbp
push rbx
sub rsp, 0xa8
lea rbp, [rsp + 0x80]
mov ecx, 0
call sub.msvcrt.dll__time64
mov ecx, eax
call sub.msvcrt.dll_srand
lea rdx, str.You_will_redirected_to_get_your_free_key_n
mov rcx, qword [0x0049c9d0]
call fcn.0047c280
mov ecx, 0x7d0
mov rax, qword [sym.imp.KERNEL32.dll_Sleep]
call rax
lea rdx, str.Go_and_copy_your_key_n
mov rcx, qword [0x0049c9d0]
call fcn.0047c280
lea rax, [rbp - 0x40]
mov rcx, rax
call fcn.00404ecb
lea rax, [rbp - 0x40]
mov rdx, rax
lea rcx, [0x004bb058]
call fcn.004592a0
lea rax, [rbp - 0x40]
mov rcx, rax
call fcn.00459260
lea rax, [rbp - 0x50]
mov rcx, rax
call fcn.00458ec0
lea rax, [rbp - 0x30]
lea r8, [0x004bb058]
lea rdx, str.https:__www.google.com_search_qyourkey_20
mov rcx, rax
call fcn.0047c930
lea rdx, [rbp - 0x30]
lea rax, [rbp - 0x50]
mov rcx, rax
call fcn.004592a0
lea rax, [rbp - 0x30]
mov rcx, rax
call fcn.00459260
lea rdx, [rbp - 0x50]
lea rax, [rbp + 0x10]
mov rcx, rax
call fcn.00458d90
mov rax, rbp
lea rdx, [rbp + 0x10]
mov rcx, rax
call fcn.00404bd0
lea rax, [rbp - 0x10]
mov rdx, rbp
mov rcx, rax
call fcn.0040491e
lea rax, [rbp - 0x20]
lea rdx, [rbp - 0x10]
mov rcx, rax
call fcn.0040466c
lea rax, [rbp - 0x20]
mov rcx, rax
call fcn.00404e82
lea rax, [rbp - 0x20]
mov rcx, rax
call fcn.00459260
lea rax, [rbp - 0x10]
mov rcx, rax
call fcn.00459260
mov rax, rbp
mov rcx, rax
call fcn.00459260
lea rax, [rbp + 0x10]
mov rcx, rax
call fcn.00459260
lea rax, [rbp - 0x60]
mov rcx, rax
call fcn.00458ec0
lea rdx, str.Paste_your_key_n
mov rcx, qword [0x0049c9d0]
call fcn.0047c280
lea rdx, [0x00496118]
mov rcx, qword [0x0049c9d0]
call fcn.0047c280
lea rax, [rbp - 0x60]
mov rdx, rax
mov rcx, qword [0x0049c9a0]
call fcn.0047d200
lea rax, [rbp - 0x60]
mov rdx, rax
lea rcx, [0x004bb058]
call fcn.0047c150
test al, al
je 0x405387
lea rdx, str.login_successfull_n
mov rcx, qword [0x0049c9d0]
call fcn.0047c280
mov ebx, 0
jmp 0x4053b9
lea rdx, str.Wrong_key........_n
mov rcx, qword [0x0049c9d0]
call fcn.0047c280
mov ecx, 0x3e8
mov rax, qword [sym.imp.KERNEL32.dll_Sleep]
call rax
lea rcx, [0x00496003]
call sub.msvcrt.dll_system
mov ebx, 1
lea rax, [rbp - 0x60]
mov rcx, rax
call fcn.00459260
cmp ebx, 1
jne 0x4053d0
nop
jmp 0x405311
lea rax, [rbp - 0x50]
mov rcx, rax
call fcn.00459260
jmp 0x40547b
add rsp, 0xa8
pop rbx
pop rbp
ret
Function at 0x405485
Capabilities:
Execute command

Disassembly:
push rbp
push rbx
sub rsp, 0xa8
lea rbp, [rsp + 0x80]
mov ecx, 0
call sub.msvcrt.dll__time64
mov ecx, eax
call sub.msvcrt.dll_srand
lea rdx, str.You_will_redirected_to_get_your_free_key_n
mov rcx, qword [0x0049c9d0]
call fcn.0047c280
mov ecx, 0x7d0
mov rax, qword [sym.imp.KERNEL32.dll_Sleep]
call rax
lea rdx, str.Go_and_copy_your_key_n
mov rcx, qword [0x0049c9d0]
call fcn.0047c280
lea rax, [rbp - 0x40]
mov rcx, rax
call fcn.00404ecb
lea rax, [rbp - 0x40]
mov rdx, rax
lea rcx, [0x004bb058]
call fcn.004592a0
lea rax, [rbp - 0x40]
mov rcx, rax
call fcn.00459260
lea rax, [rbp - 0x50]
mov rcx, rax
call fcn.00458ec0
lea rax, [rbp - 0x30]
lea r8, [0x004bb058]
lea rdx, str.https:__www.google.com_search_qyourkey_20
mov rcx, rax
call fcn.0047c930
lea rdx, [rbp - 0x30]
lea rax, [rbp - 0x50]
mov rcx, rax
call fcn.004592a0
lea rax, [rbp - 0x30]
mov rcx, rax
call fcn.00459260
lea rdx, [rbp - 0x50]
lea rax, [rbp + 0x10]
mov rcx, rax
call fcn.00458d90
mov rax, rbp
lea rdx, [rbp + 0x10]
mov rcx, rax
call fcn.00404bd0
lea rax, [rbp - 0x10]
mov rdx, rbp
mov rcx, rax
call fcn.0040491e
lea rax, [rbp - 0x20]
lea rdx, [rbp - 0x10]
mov rcx, rax
call fcn.0040466c
lea rax, [rbp - 0x20]
mov rcx, rax
call fcn.00404e82
lea rax, [rbp - 0x20]
mov rcx, rax
call fcn.00459260
lea rax, [rbp - 0x10]
mov rcx, rax
call fcn.00459260
mov rax, rbp
mov rcx, rax
call fcn.00459260
lea rax, [rbp + 0x10]
mov rcx, rax
call fcn.00459260
lea rax, [rbp - 0x60]
mov rcx, rax
call fcn.00458ec0
lea rdx, str.Paste_your_key_n
mov rcx, qword [0x0049c9d0]
call fcn.0047c280
lea rdx, [0x00496118]
mov rcx, qword [0x0049c9d0]
call fcn.0047c280
lea rax, [rbp - 0x60]
mov rdx, rax
mov rcx, qword [0x0049c9a0]
call fcn.0047d200
lea rax, [rbp - 0x60]
mov rdx, rax
lea rcx, [0x004bb058]
call fcn.0047c150
test al, al
je 0x405637
lea rdx, str.login_successfull_n
mov rcx, qword [0x0049c9d0]
call fcn.0047c280
mov ebx, 0
jmp 0x405669
lea rdx, str.Wrong_key........_n
mov rcx, qword [0x0049c9d0]
call fcn.0047c280
mov ecx, 0x3e8
mov rax, qword [sym.imp.KERNEL32.dll_Sleep]
call rax
lea rcx, [0x00496003]
call sub.msvcrt.dll_system
mov ebx, 1
lea rax, [rbp - 0x60]
mov rcx, rax
call fcn.00459260
cmp ebx, 1
jne 0x405680
nop
jmp 0x4055c1
lea rax, [rbp - 0x50]
mov rcx, rax
call fcn.00459260
jmp 0x40572b
add rsp, 0xa8
pop rbx
pop rbp
ret
Function at 0x405d5d
Capabilities:
Delete file
Move file

Disassembly:
push rbp
push rbx
sub rsp, 0x3d8
lea rbp, [rsp + 0x80]
mov dword [rbp + 0x34c], 1
lea rax, [rbp + 0x170]
mov r8d, 4
lea rdx, str.sk.txt
mov rcx, rax
call fcn.00466ea0
lea rax, [rbp - 0x60]
mov r8d, 4
lea rdx, str.s.sys
mov rcx, rax
call fcn.00468370
jmp 0x405de3
mov eax, dword [rbp + 0x34c]
mov edx, eax
movzx eax, byte [rbp + 0x34b]
add eax, edx
mov byte [rbp + 0x34b], al
movzx eax, byte [rbp + 0x34b]
movsx edx, al
lea rax, [rbp - 0x60]
mov rcx, rax
call fcn.0047c340
add dword [rbp + 0x34c], 1
lea rax, [rbp + 0x170]
lea rdx, [0x0047ac10]
mov rcx, rax
call fcn.004550b0
mov rcx, rax
lea rax, [rbp + 0x34b]
mov rdx, rax
call fcn.0047cfc0
mov rdx, qword [rax]
sub rdx, 0x18
mov rdx, qword [rdx]
add rax, rdx
mov rcx, rax
call fcn.00448fe0
test rax, rax
setne al
test al, al
jne 0x405daf
lea rax, [rbp - 0x60]
mov rcx, rax
call fcn.00468320
lea rax, [rbp + 0x170]
mov rcx, rax
call fcn.00466e50
lea rdx, str.C:xtreme.sys
lea rcx, str.s.sys
mov rax, qword [sym.imp.KERNEL32.dll_MoveFileA]
call rax
lea rcx, str.sk.txt
mov rax, qword [sym.imp.KERNEL32.dll_DeleteFileA]
call rax
lea rax, [rbp - 0x60]
mov rcx, rax
call fcn.004689b0
lea rax, [rbp + 0x170]
mov rcx, rax
call fcn.00467540
jmp 0x405eb8
add rsp, 0x3d8
pop rbx
pop rbp
ret

Function at 0x405fa0
Capabilities:
Create process on windows

Disassembly:
push rbp
push rbx
sub rsp, 0x3c8
lea rbp, [rsp + 0x80]
mov edx, 0x20
mov ecx, 0x10
call fcn.0047c8c0
mov edx, eax
lea rax, [rbp - 0x60]
mov r8d, edx
lea rdx, str.fuck.txt
mov rcx, rax
call fcn.00468370
lea rax, [rbp - 0x60]
lea rdx, str.Fuck_you_tencent_bitch..............._n
mov rcx, rax
call fcn.0047c280
lea rax, [rbp - 0x60]
lea rdx, str.Do_not_try_to_patch_my_bypass...................._n
mov rcx, rax
call fcn.0047c280
lea rax, [rbp - 0x60]
lea rdx, str.bypass_will_not_work_in_your_pc_tencent_bitch.............._n
mov rcx, rax
call fcn.0047c280
lea rax, [rbp - 0x60]
mov rcx, rax
call fcn.00468320
mov edx, 0x20
mov ecx, 0x10
call fcn.0047c8c0
mov edx, eax
lea rax, [rbp + 0x170]
mov r8d, edx
lea rdx, str.C:WindowsWeb_a.txt
mov rcx, rax
call fcn.00468370
lea rax, [rbp + 0x170]
mov rcx, rax
call fcn.00468320
mov edx, 0
lea rcx, str.cmd.exe__c_fuck.txt
mov rax, qword [sym.imp.KERNEL32.dll_WinExec]
call rax
lea rax, [rbp + 0x170]
mov rcx, rax
call fcn.004689b0
lea rax, [rbp - 0x60]
mov rcx, rax
call fcn.004689b0
jmp 0x4060b7
add rsp, 0x3c8
pop rbx
pop rbp
ret
Function at 0x40618d
Capabilities:
Execute command
Query environment variable

Disassembly:
push rbp
push rbx
sub rsp, 0x38
lea rbp, [rsp + 0x80]
lea rcx, str.LOCALAPPDATA
call sub.msvcrt.dll_getenv
mov qword [rbp - 0x58], rax
lea rax, [rbp - 0x60]
mov rcx, rax
call fcn.00458ec0
cmp qword [rbp - 0x58], 0
je 0x406222
mov rdx, qword [rbp - 0x58]
lea rax, [rbp - 0x60]
mov rcx, rax
call fcn.004592e0
lea rax, [rbp - 0x60]
lea rdx, str.ProgramsMicrosoft_VS_Code
mov rcx, rax
call fcn.004593a0
lea rax, [rbp - 0x60]
mov rcx, rax
call fcn.00406378
test al, al
je 0x40625a
call fcn.004063be
mov r9d, 0x41010
lea r8, str.Dumper.............
lea rdx, str.Fuck_you_dumper.........
mov ecx, 0
mov rax, qword [sym.imp.USER32.dll_MessageBoxA]
call rax
mov ecx, 1
call sub.msvcrt.dll_exit
lea rdx, str.Error:_Unable_to_retrieve_Local_AppData_folder_path.
mov rcx, qword [0x0049c9b0]
call fcn.0047c280
mov rdx, qword [0x0049c9e0]
mov rcx, rax
call fcn.00457100
lea rcx, str.pause
call sub.msvcrt.dll_system
mov ecx, 1
call sub.msvcrt.dll_exit
lea rax, [rbp - 0x60]
mov rcx, rax
call fcn.00459260
jmp 0x406283
add rsp, 0x38
pop rbx
pop rbp
ret

Function at 0x406378
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov qword [rbp + 0x10], rcx
mov rcx, qword [rbp + 0x10]
call fcn.0042f540
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
call rax
mov dword [rbp - 4], eax
cmp dword [rbp - 4], 0xffffffff
je 0x4063b3
mov eax, dword [rbp - 4]
and eax, 0x10
test eax, eax
je 0x4063b3
mov eax, 1
jmp 0x4063b8
mov eax, 0
add rsp, 0x30
pop rbp
ret

Function at 0x4063be
Capabilities:
Create process on windows

Disassembly:
push rbp
push rbx
sub rsp, 0x3c8
lea rbp, [rsp + 0x80]
mov edx, 0x20
mov ecx, 0x10
call fcn.0047c8c0
mov edx, eax
lea rax, [rbp - 0x60]
mov r8d, edx
lea rdx, str.fuck.txt
mov rcx, rax
call fcn.00468370
lea rax, [rbp - 0x60]
lea rdx, str.Fuck_you_dumper_bitch..............._n
mov rcx, rax
call fcn.0047c280
lea rax, [rbp - 0x60]
lea rdx, str.Do_not_try_to_dump_my_bypass...................._n
mov rcx, rax
call fcn.0047c280
lea rax, [rbp - 0x60]
lea rdx, str.you_have_1_more_chance_left_before_your_pc_is_permanently_banned_from_using_my_bypass.............._n
mov rcx, rax
call fcn.0047c280
lea rax, [rbp - 0x60]
mov rcx, rax
call fcn.00468320
mov edx, 0x20
mov ecx, 0x10
call fcn.0047c8c0
mov edx, eax
lea rax, [rbp + 0x170]
mov r8d, edx
lea rdx, str.C:WindowsWeb_a.txt
mov rcx, rax
call fcn.00468370
lea rax, [rbp + 0x170]
mov rcx, rax
call fcn.00468320
mov edx, 0
lea rcx, str.cmd.exe__c_fuck.txt
mov rax, qword [sym.imp.KERNEL32.dll_WinExec]
call rax
lea rax, [rbp + 0x170]
mov rcx, rax
call fcn.004689b0
lea rax, [rbp - 0x60]
mov rcx, rax
call fcn.004689b0
jmp 0x4064d5
add rsp, 0x3c8
pop rbx
pop rbp
ret
Function at 0x406584
Capabilities:
Execute command
Query environment variable

Disassembly:
push rbp
push rbx
sub rsp, 0x208
lea rbp, [rsp + 0x80]
lea rax, [rbp - 0x60]
mov r8d, 8
lea rdx, str.C:_a.txt
mov rcx, rax
call fcn.00466ea0
lea rax, [rbp - 0x60]
add rax, 0xd0
mov rcx, rax
call fcn.00448fe0
test rax, rax
setne al
test al, al
je 0x4065e0
lea rax, [rbp - 0x60]
mov rcx, rax
call fcn.00466e50
mov ebx, 0
jmp 0x406672
lea rax, [rbp - 0x60]
mov rcx, rax
call fcn.00466e50
lea rcx, [0x00496003]
call sub.msvcrt.dll_system
lea rcx, str.LOCALAPPDATA
call sub.msvcrt.dll_getenv
mov qword [rbp + 0x178], rax
cmp qword [rbp + 0x178], 0
je 0x406635
mov rax, qword [rbp + 0x178]
mov rcx, rax
call fcn.00406856
mov rax, qword [rbp + 0x178]
mov rcx, rax
call fcn.004066ad
jmp 0x40666d
lea rdx, str.Error:_Unable_to_retrieve_Local_AppData_folder_path.
mov rcx, qword [0x0049c9b0]
call fcn.0047c280
mov rdx, qword [0x0049c9e0]
mov rcx, rax
call fcn.00457100
lea rcx, str.pause
call sub.msvcrt.dll_system
mov ecx, 1
call sub.msvcrt.dll_exit
mov ebx, 1
lea rax, [rbp - 0x60]
mov rcx, rax
call fcn.00467540
cmp ebx, 1
je 0x406685
jmp 0x4066a3
nop
jmp 0x4066a3
add rsp, 0x208
pop rbx
pop rbp
ret

Function at 0x4066ad
Capabilities:
Execute command

Disassembly:
push rbp
push rbx
sub rsp, 0x58
lea rbp, [rsp + 0x80]
mov qword [rbp - 0x10], rcx
lea rax, [rbp - 0x31]
mov rcx, rax
call fcn.0044fb90
lea rdx, [rbp - 0x31]
lea rax, [rbp - 0x40]
mov r8, rdx
mov rdx, qword [rbp - 0x10]
mov rcx, rax
call fcn.00458cf0
lea rax, [rbp - 0x31]
mov rcx, rax
call fcn.0044fbc0
lea rax, [rbp - 0x50]
lea rdx, [rbp - 0x40]
lea r8, str.GoogleChromeUser_DataDefaultExtensionscjpalhdlnbpafiamejdnhcphjbkeiagm
mov rcx, rax
call fcn.0047c9d0
lea rax, [rbp - 0x60]
lea rdx, [rbp - 0x40]
lea r8, str.GoogleChromeUser_DataDefaultExtensionsgekdekpbfehejjiecgonmgmepbdnaggp
mov rcx, rax
call fcn.0047c9d0
lea rax, [rbp - 0x60]
mov rcx, rax
call fcn.00406378
test al, al
je 0x406777
lea rdx, str.Please_remove_that_ad_blocker_from_chrome............................_n
mov rcx, qword [0x0049c9d0]
call fcn.0047c280
mov r9d, 0x41010
lea r8, [0x004971ef]
lea rdx, str.Please_remove_that_ad_blocker_from_chrome.................
mov ecx, 0
mov rax, qword [sym.imp.USER32.dll_MessageBoxA]
call rax
lea rcx, str.pause
call sub.msvcrt.dll_system
mov ecx, 1
call sub.msvcrt.dll_exit
lea rax, [rbp - 0x50]
mov rcx, rax
call fcn.00406378
test al, al
je 0x4067d2
lea rdx, str.Please_remove_ublock_origin_from_chrome............................_n
mov rcx, qword [0x0049c9d0]
call fcn.0047c280
mov r9d, 0x41010
lea r8, [0x004971ef]
lea rdx, str.Please_remove_ublock_origin_from_chrome.................
mov ecx, 0
mov rax, qword [sym.imp.USER32.dll_MessageBoxA]
call rax
lea rcx, str.pause
call sub.msvcrt.dll_system
mov ecx, 1
call sub.msvcrt.dll_exit
lea rax, [rbp - 0x60]
mov rcx, rax
call fcn.00459260
lea rax, [rbp - 0x50]
mov rcx, rax
call fcn.00459260
lea rax, [rbp - 0x40]
mov rcx, rax
call fcn.00459260
jmp 0x40684f
add rsp, 0x58
pop rbx
pop rbp
ret
Function at 0x406856
Capabilities:
Execute command

Disassembly:
push rbp
push rbx
sub rsp, 0x58
lea rbp, [rsp + 0x80]
mov qword [rbp - 0x10], rcx
lea rax, [rbp - 0x31]
mov rcx, rax
call fcn.0044fb90
lea rdx, [rbp - 0x31]
lea rax, [rbp - 0x40]
mov r8, rdx
mov rdx, qword [rbp - 0x10]
mov rcx, rax
call fcn.00458cf0
lea rax, [rbp - 0x31]
mov rcx, rax
call fcn.0044fbc0
lea rax, [rbp - 0x50]
lea rdx, [rbp - 0x40]
lea r8, str.MicrosoftEdgeUser_DataDefaultExtensionscjpalhdlnbpafiamejdnhcphjbkeiagm
mov rcx, rax
call fcn.0047c9d0
lea rax, [rbp - 0x60]
lea rdx, [rbp - 0x40]
lea r8, str.MicrosoftEdgeUser_DataDefaultExtensionskkkldohdhcfhpjchcefpkfhjfeapdmek
mov rcx, rax
call fcn.0047c9d0
lea rax, [rbp - 0x60]
mov rcx, rax
call fcn.00406378
test al, al
je 0x406920
lea rdx, str.Please_remove_that_ad_blocker_from_edge............................_n
mov rcx, qword [0x0049c9d0]
call fcn.0047c280
mov r9d, 0x41010
lea r8, [0x004971ef]
lea rdx, str.Please_remove_that_ad_blocker_from_edge.................
mov ecx, 0
mov rax, qword [sym.imp.USER32.dll_MessageBoxA]
call rax
lea rcx, str.pause
call sub.msvcrt.dll_system
mov ecx, 1
call sub.msvcrt.dll_exit
lea rax, [rbp - 0x50]
mov rcx, rax
call fcn.00406378
test al, al
je 0x40697b
lea rdx, str.Please_remove_ublock_origin_from_edge............................_n
mov rcx, qword [0x0049c9d0]
call fcn.0047c280
mov r9d, 0x41010
lea r8, [0x004971ef]
lea rdx, str.Please_remove_ublock_origin_from_edge.................
mov ecx, 0
mov rax, qword [sym.imp.USER32.dll_MessageBoxA]
call rax
lea rcx, str.pause
call sub.msvcrt.dll_system
mov ecx, 1
call sub.msvcrt.dll_exit
lea rax, [rbp - 0x60]
mov rcx, rax
call fcn.00459260
lea rax, [rbp - 0x50]
mov rcx, rax
call fcn.00459260
lea rax, [rbp - 0x40]
mov rcx, rax
call fcn.00459260
jmp 0x4069f8
add rsp, 0x58
pop rbx
pop rbp
ret

Function at 0x406af5
Capabilities:
Enumerate processes

Disassembly:
push rbp
sub rsp, 0x160
lea rbp, [rsp + 0x80]
mov eax, 0x130
mov dword [rbp - 0x60], eax
mov edx, 0
mov ecx, 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov qword [rbp + 0xd8], rax
lea rdx, [rbp - 0x60]
mov rax, qword [rbp + 0xd8]
mov rcx, rax
call sub.KERNEL32.dll_Process32First
cmp eax, 1
sete al
test al, al
je 0x406b81
jmp 0x406b64
lea rax, [rbp - 0x60]
add rax, 0x2c
lea rdx, str.AndroidEmulatorEn.exe
mov rcx, rax
call sub.msvcrt.dll_strcmp
test eax, eax
jne 0x406b64
mov eax, 1
jmp 0x406b99
lea rdx, [rbp - 0x60]
mov rax, qword [rbp + 0xd8]
mov rcx, rax
call sub.KERNEL32.dll_Process32Next
cmp eax, 1
sete al
test al, al
jne 0x406b42
mov rax, qword [rbp + 0xd8]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov eax, 0
add rsp, 0x160
pop rbp
ret