joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1401214b0
Capabilities:
Resolve dns

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x58
lea rbp, [rsp + 0x50]
mov r14, r8
inc r14
sete r13b
je 0x1401216d5
js 0x1401216e1
mov rdi, r9
mov rbx, r8
mov r15, rdx
mov rsi, rcx
movzx eax, byte [0x140194310]
xor ecx, ecx
mov rdx, r14
call fcn.1400eed30
test rax, rax
je 0x1401216e6
mov r12, rax
mov rcx, rax
mov rdx, r15
mov r8, rbx
call fcn.140116da0
cmp rbx, 0x10
jae 0x140121548
test rbx, rbx
je 0x1401215ef
xor eax, eax
nop word cs:[rax + rax]
cmp byte [r15 + rax], 0
je 0x140121657
inc rax
cmp rbx, rax
jne 0x140121530
jmp 0x1401215ef
lea rax, [r15 + 7]
and rax, 0xfffffffffffffff8
sub rax, r15
jne 0x1401215a0
lea rcx, [rbx - 0x10]
xor eax, eax
movdqa xmm0, xmmword [0x1401236e0]
movabs rdx, 0x8080808080808080
nop dword [rax]
movdqu xmm1, xmmword [r15 + rax]
movdqa xmm2, xmm1
paddq xmm2, xmm0
pandn xmm1, xmm2
pshufd xmm2, xmm1, 0xee
por xmm2, xmm1
movq r8, xmm2
test r8, rdx
jne 0x1401215cc
add rax, 0x10
cmp rax, rcx
jbe 0x140121570
jmp 0x1401215cc
cmp rax, rbx
cmovae rax, rbx
xor ecx, ecx
nop dword [rax]
cmp byte [r15 + rcx], 0
je 0x140121657
inc rcx
cmp rax, rcx
jne 0x1401215b0
lea rcx, [rbx - 0x10]
cmp rax, rcx
jbe 0x14012155b
cmp rax, rbx
je 0x1401215ef
nop word cs:[rax + rax]
cmp byte [r15 + rax], 0
je 0x140121657
inc rax
cmp rbx, rax
jne 0x1401215e0
mov qword [rbp - 0x30], r14
mov qword [rbp - 0x28], r12
mov qword [rbp - 0x20], rbx
lea rcx, [rbp - 0x30]
call fcn.1400062c0
mov rbx, rax
mov r14, rdx
pxor xmm0, xmm0
movdqa xmmword [rbp - 0x30], xmm0
movdqa xmmword [rbp - 0x10], xmm0
movdqa xmmword [rbp - 0x20], xmm0
mov dword [rbp - 0x28], 1
mov qword [rbp], 0
lea r8, [rbp - 0x30]
mov r9, rbp
mov rcx, rax
xor edx, edx
call qword [sym.imp.ws2_32.dll_getaddrinfo]
test eax, eax
je 0x14012168f
call qword [sym.imp.ws2_32.dll_WSAGetLastError]
shl rax, 0x20
or rax, 2
mov ecx, 1
jmp 0x1401216a3
lea rax, str.file_name_contained_an_unexpected_NUL_byte
mov qword [rsi + 8], rax
mov qword [rsi], 1
test r13b, r13b
jne 0x1401216c3
mov rcx, qword [0x140194260]
xor edx, edx
mov r8, r12
add rsp, 0x58
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
jmp sub.kernel32.dll_HeapFree
mov rcx, qword [rdi]
mov rax, qword [rbp]
movzx ecx, word [rcx]
mov qword [rsi + 0x10], rax
mov word [rsi + 0x18], cx
xor ecx, ecx
mov qword [rsi + 8], rax
mov qword [rsi], rcx
mov byte [rbx], 0
test r14, r14
je 0x1401216c3
mov rcx, qword [0x140194260]
xor edx, edx
mov r8, rbx
call sub.kernel32.dll_HeapFree
nop
add rsp, 0x58
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
lea rcx, str.library_alloc_src_ffic_str.rs
call fcn.140117f80
call fcn.140006190
mov ecx, 1
mov rdx, r14
call fcn.1401178b0
int3
Function at 0x40158f
Capabilities:
Enumerate processes

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x158
xor edx, edx
mov rbp, rcx
mov ecx, 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov rbx, rax
xor eax, eax
cmp rbx, 0xffffffffffffffff
je 0x401616
lea rsi, [rsp + 0x20]
mov ecx, 0x4c
lea rdi, [rsp + 0x20]
mov rdx, rsi
rep stosd dword [rdi], eax
mov rcx, rbx
mov dword [rsp + 0x20], 0x130
call sub.KERNEL32.dll_Process32First
lea rdi, [rsi + 0x2c]
test eax, eax
je 0x40160b
mov rdx, rbp
mov rcx, rdi
call sub.msvcrt.dll_strcmp
test eax, eax
jne 0x4015fe
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [rsp + 0x28]
jmp 0x401616
mov rdx, rsi
mov rcx, rbx
call sub.KERNEL32.dll_Process32Next
jmp 0x4015dc
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
add rsp, 0x158
pop rbx
pop rsi
pop rdi
pop rbp
ret

Function at 0x401682
Capabilities:
Execute command

Disassembly:
sub rsp, 0x28
lea rcx, str.Launching_Pixel_Gun_3D_via_Steam...
call fcn.00411e30
lea rcx, str.start_steam:__rungameid_2524890
add rsp, 0x28
jmp 0x40cea8
jmp qword [sym.imp.msvcrt.dll_system]
Function at 0x4016a2
Capabilities:
Allocate or change rwx memory
Enumerate threads
Execute shellcode via indirect call
Inject apc

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x58
mov r9d, 0x1000
mov rax, qword [rdx + 8]
mov rbx, rcx
mov rdi, rdx
mov dword [rsp + 0x20], 0x40
xor edx, edx
lea r8, [rax + 1]
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
test rax, rax
mov rsi, rax
jne 0x4016eb
lea rcx, str.Failed_to_allocate_memory_in_remote_process.
call fcn.00411e70
jmp 0x401816
mov rax, qword [rdi + 8]
mov rcx, rbx
mov rdx, rsi
mov qword [rsp + 0x20], 0
mov r8, qword [rdi]
lea r9, [rax + 1]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
lea rcx, str.Failed_to_write_DLL_path_to_remote_process.
test eax, eax
je 0x4017d6
lea rcx, str.Kernel32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, str.LoadLibraryA
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rcx, str.Failed_to_find_LoadLibraryA_address.
test rax, rax
mov r12, rax
je 0x4017d6
xor edx, edx
mov ecx, 4
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
lea rcx, str.Failed_to_take_a_snapshot_of_the_threads.
cmp rax, 0xffffffffffffffff
mov rbp, rax
je 0x4017d6
lea r13, [rsp + 0x34]
mov rcx, rax
mov dword [rsp + 0x34], 0x1c
mov rdx, r13
call sub.KERNEL32.dll_Thread32First
test eax, eax
je 0x4017bc
mov edi, dword [rsp + 0x40]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcessId]
cmp edi, eax
je 0x4017a0
mov rdx, r13
mov rcx, rbp
call sub.KERNEL32.dll_Thread32Next
jmp 0x40177e
xor edx, edx
mov r8d, dword [rsp + 0x3c]
mov ecx, 0x1f03ff
call qword [sym.imp.KERNEL32.dll_OpenThread]
test rax, rax
mov rdi, rax
je 0x401793
jmp 0x4017be
xor edi, edi
mov rcx, rbp
mov rbp, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rbp
test rdi, rdi
jne 0x4017dd
lea rcx, str.Failed_to_open_a_thread_in_the_remote_process.
call fcn.00411e70
jmp 0x401801
mov r8, rsi
mov rdx, rdi
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_QueueUserAPC]
test eax, eax
jne 0x40181a
lea rcx, str.Failed_to_queue_the_APC_for_DLL_injection.
call fcn.00411e70
mov rcx, rdi
call rbp
mov r9d, 0x8000
xor r8d, r8d
mov rdx, rsi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualFreeEx]
xor eax, eax
jmp 0x401821
mov rcx, rdi
call rbp
mov al, 1
add rsp, 0x58
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
Function at 0x40b440
Capabilities:
Allocate or change rwx memory

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x50
movsxd rsi, dword [0x00426624]
test esi, esi
mov rbx, rcx
mov rbp, rdx
mov rdi, r8
jle 0x40b5c8
mov rax, qword [0x00426628]
xor ecx, ecx
add rax, 0x18
nop
mov rdx, qword [rax]
cmp rbx, rdx
jb 0x40b48c
mov r8, qword [rax + 8]
mov r8d, dword [r8 + 8]
add rdx, r8
cmp rbx, rdx
jb 0x40b515
add ecx, 1
add rax, 0x28
cmp ecx, esi
jne 0x40b470
mov rcx, rbx
call fcn.0040c0e0
test rax, rax
mov r12, rax
je 0x40b5fd
mov rax, qword [0x00426628]
lea rsi, [rsi + rsi*4]
shl rsi, 3
add rax, rsi
mov qword [rax + 0x20], r12
mov dword [rax], 0
call fcn.0040c210
mov ecx, dword [r12 + 0xc]
lea rdx, [rsp + 0x20]
mov r8d, 0x30
add rcx, rax
mov rax, qword [0x00426628]
mov qword [rax + rsi + 0x18], rcx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x40b5e0
mov eax, dword [rsp + 0x44]
lea edx, [rax - 4]
and edx, 0xfffffffb
je 0x40b50e
sub eax, 0x40
and eax, 0xffffffbf
jne 0x40b570
add dword [0x00426624], 1
cmp edi, 8
jae 0x40b543
test dil, 4
jne 0x40b5b4
test edi, edi
je 0x40b538
movzx eax, byte [rbp]
test dil, 2
mov byte [rbx], al
jne 0x40b5cf
add rsp, 0x50
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov eax, edi
sub edi, 1
mov rdx, qword [rbp + rax - 8]
cmp edi, 8
mov qword [rbx + rax - 8], rdx
jb 0x40b538
and edi, 0xfffffff8
xor eax, eax
mov edx, eax
add eax, 8
mov rcx, qword [rbp + rdx]
cmp eax, edi
mov qword [rbx + rdx], rcx
jb 0x40b55c
jmp 0x40b538
add rsi, qword [0x00426628]
mov r8d, 0x40
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x38]
mov r9, rsi
mov qword [rsi + 8], rcx
mov qword [rsi + 0x10], rdx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x40b50e
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.__VirtualProtect_failed_with_code_0x_x
mov edx, eax
call fcn.0041b250
mov eax, dword [rbp]
mov edi, edi
mov dword [rbx], eax
mov eax, dword [rbp + rdi - 4]
mov dword [rbx + rdi - 4], eax
jmp 0x40b538
xor esi, esi
jmp 0x40b497
mov edi, edi
movzx eax, word [rbp + rdi - 2]
mov word [rbx + rdi - 2], ax
jmp 0x40b538
mov rax, qword [0x00426628]
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov edx, dword [r12 + 8]
mov r8, qword [rax + rsi + 0x18]
call fcn.0041b250
lea rcx, str.Address__p_has_no_image_section
mov rdx, rbx
call fcn.0041b250
nop
nop dword [rax]

Function at 0x40bd50
Capabilities:
Get thread local storage value

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
lea rcx, [0x00426900]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x004268e0]
test rbx, rbx
je 0x40bda4
mov rbp, qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, qword [sym.imp.KERNEL32.dll_GetLastError]
nop
mov ecx, dword [rbx]
call rbp
mov rsi, rax
call rdi
test eax, eax
jne 0x40bd9b
test rsi, rsi
je 0x40bd9b
mov rax, qword [rbx + 8]
mov rcx, rsi
call rax
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x40bd80
lea rcx, [0x00426900]
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
Function at 0x40c0e0
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r8, qword [0x0041fd90]
cmp word [r8], 0x5a4d
mov rdx, rcx
jne 0x40c14d
mov rcx, r8
call fcn.0040bfc0
test eax, eax
je 0x40c14d
movsxd rax, dword [r8 + 0x3c]
mov rcx, rdx
sub rcx, r8
add r8, rax
movzx edx, word [r8 + 6]
movzx eax, word [r8 + 0x14]
test edx, edx
lea rax, [r8 + rax + 0x18]
je 0x40c14d
sub edx, 1
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
nop
mov r8d, dword [rax + 0xc]
cmp rcx, r8
mov rdx, r8
jb 0x40c144
add edx, dword [rax + 8]
cmp rcx, rdx
jb 0x40c14f
add rax, 0x28
cmp rax, r9
jne 0x40c130
xor eax, eax
add rsp, 0x28
ret

Function at 0x40d720
Capabilities:
Allocate thread local storage

Disassembly:
sub rsp, 0x28
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
cmp eax, 0xffffffff
mov dword [0x0041c0d8], eax
je 0x40d73a
add rsp, 0x28
ret
call sub.msvcrt.dll_abort
nop

Function at 0x40dc40
Capabilities:
Print debug messages

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x90
test rcx, rcx
mov rbx, rcx
je 0x40dc63
call fcn.00410ac0
cmp eax, 1
je 0x40dc6e
mov qword [rbx], 0xffffffffffffffff
add rsp, 0x90
pop rbx
pop rsi
pop rdi
ret
lea rdi, [rsp + 0x20]
xor eax, eax
mov ecx, 0xa
lea rsi, str.Error_cleaning_up_spin_keys_for_thread
rep movsd dword [rdi], dword [rsi]
lea rdi, [rsp + 0x48]
mov ecx, 0x43
rep stosb byte [rdi], al
lea rbx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
lea rdx, [rbx + 0x27]
mov r8d, 0xa
mov ecx, eax
call qword [sym.imp.msvcrt.dll__ultoa]
cmp byte [rsp + 0x47], 0
je 0x40dce5
mov eax, 0x28
jmp 0x40dcca
add rax, 1
cmp rax, 0x6b
je 0x40dcd7
cmp byte [rbx + rax], 0
mov edx, eax
jne 0x40dcc0
cmp eax, 0x6a
jne 0x40dcea
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
call sub.msvcrt.dll_abort
mov edx, 0x27
movsxd rax, edx
mov byte [rsp + rax + 0x20], 0xa
lea eax, [rdx + 1]
cdqe
mov byte [rsp + rax + 0x20], 0
jmp 0x40dcd7
Function at 0x40dd90
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x48
cmp dword [0x004269e0], 1
je 0x40dda6
call fcn.0040dd00
mov ecx, dword [0x0041c0d8]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
mov rbx, rax
je 0x40ddd0
mov rax, rbx
add rsp, 0x48
pop rbx
pop rsi
pop rdi
pop rbp
ret
call fcn.0040db80
cmp qword [0x00429050], 0
mov rsi, rax
je 0x40ddba
test rax, rax
je 0x40ddba
mov dword [rax + 0x44], 1
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
xor r9d, r9d
xor r8d, r8d
mov edx, 1
xor ecx, ecx
mov dword [rsi + 0x70], eax
call qword [sym.imp.KERNEL32.dll_CreateEventA]
lea rcx, [rsi + 0x68]
mov qword [rsi + 0x38], 0xffffffffffffffff
mov qword [rsi + 0x30], rax
call fcn.0040dc40
mov rbx, qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [rsi + 0xb8], 0
mov qword [rsi + 0x28], 0
call rbx
mov rbp, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov rdi, rax
call rbx
mov dword [rsp + 0x30], 2
mov r8, rbp
mov rdx, rdi
mov dword [rsp + 0x28], 0
lea r9, [rsi + 0x28]
mov rcx, rax
mov dword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_DuplicateHandle]
test eax, eax
je 0x40dec0
mov rcx, qword [rsi + 0x28]
call qword [sym.imp.KERNEL32.dll_GetThreadPriority]
mov rdx, rsi
mov ecx, dword [0x0041c0d8]
mov dword [rsi + 0xbc], 0
mov dword [rsi + 0xc0], eax
movzx eax, byte [rsi + 0x40]
and eax, 0xffffffcf
or eax, 0x10
mov byte [rsi + 0x40], al
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
je 0x40dec0
mov rbx, rsi
mov rax, rbx
add rsp, 0x48
pop rbx
pop rsi
pop rdi
pop rbp
ret
call sub.msvcrt.dll_abort
nop
nop word cs:[rax + rax]
Function at 0x41ae60
Capabilities:
Set console window title

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x1a8
call fcn.0040afd0
lea rbp, [rsp + 0x9c]
lea rsi, [rsp + 0x38]
mov rdi, rbp
lea rcx, str.PG3D_Injector_by_Dari
call qword [sym.imp.KERNEL32.dll_SetConsoleTitleA]
xor ecx, ecx
mov rdx, rbp
mov r8d, 0x104
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea rax, [rsi + 0x10]
or rcx, 0xffffffffffffffff
mov qword [rsp + 0x38], rax
lea rbx, [rsp + 0x78]
xor eax, eax
repne scasb al, byte [rdi]
mov rdx, rcx
not rdx
mov rcx, rdx
dec rcx
lea rdi, [rbp + rcx]
cmp rcx, 0xf
mov qword [rsp + 0x78], rcx
jbe 0x41aef1
xor r8d, r8d
mov rdx, rbx
mov rcx, rsi
call fcn.00419440
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x78]
mov qword [rsp + 0x48], rax
mov rcx, qword [rsp + 0x38]
mov r8, rdi
mov rdx, rbp
call fcn.004181f0
mov rax, qword [rsp + 0x78]
or r8, 0xffffffffffffffff
mov rcx, rsi
mov rdx, qword [rsp + 0x38]
mov qword [rsp + 0x40], rax
mov byte [rdx + rax], 0
lea rdx, [0x0041d1ac]
call fcn.004142f0
xor r8d, r8d
mov rdx, rsi
mov rcx, rbx
mov r9, rax
call fcn.00414ab0
mov rdx, rbx
mov rcx, rsi
call fcn.00419ca0
mov rcx, rbx
call fcn.00417b10
mov rdx, rsi
mov rcx, rbx
call fcn.004197d0
lea rdx, [0x0041d1af]
mov rcx, rbx
call fcn.00418640
jmp 0x41af6c
lea rdx, str.nazimod_runtime.dll
mov rcx, rbx
call fcn.00418640
lea rdi, [rsp + 0x58]
mov rdx, rax
mov rcx, rdi
call fcn.004196a0
mov rcx, rbx
call fcn.00417b10
mov rcx, rdi
call fcn.00401574
test al, al
jne 0x41afde
lea rcx, str.DLL_file_not_found.
call fcn.00411e70
lea rdx, str.nazimod_runtime.dll
lea rcx, str._s__n
call sub.msvcrt.dll_printf
lea rcx, str.Ensure_that_the_DLL_is_in_the_same_folder_as_the_injector.
call fcn.00411e30
mov ecx, 0xa
call fcn.00401622
mov ebx, 1
jmp 0x41b0fa
lea rcx, str.Checking_if_Pixel_Gun_3D_is_already_running...
call fcn.00411e30
lea rcx, str.Pixel_Gun_3D.exe
call fcn.0040158f
test eax, eax
mov ebp, eax
jne 0x41b042
lea rcx, str.Pixel_Gun_3D_not_found._Launching_the_game...
call fcn.00411eb0
call fcn.00401682
lea r12, str.Waiting_for_Pixel_Gun_3D_to_start...
lea r13, str.Pixel_Gun_3D.exe
mov rcx, r12
call fcn.00411eb0
mov qword [rsp + 0x78], 2
mov rcx, rbx
call fcn.004171e0
mov rcx, r13
call fcn.0040158f
test eax, eax
mov ebp, eax
je 0x41b01b
lea rcx, str.Pixel_Gun_3D_process_found_
call fcn.00411e30
mov r8d, ebp
xor edx, edx
mov ecx, 0x1f0fff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
test rax, rax
mov rbx, rax
jne 0x41b077
lea rcx, str.Error_opening_Pixel_Gun_3D_process.
call fcn.00411e70
jmp 0x41afca
mov rdx, rdi
mov rcx, rax
call fcn.004016a2
test al, al
mov rbp, qword [sym.imp.KERNEL32.dll_CloseHandle]
jne 0x41b0a3
lea rcx, str.DLL_injection_failed.
call fcn.00411e70
mov rcx, rbx
call rbp
jmp 0x41afca
lea rcx, str.DLL_injected_successfully.
call fcn.00411e30
mov rcx, rbx
call rbp
mov ecx, 0xa
call fcn.00401622
xor ebx, ebx
jmp 0x41b0fa
mov rcx, rdi
call fcn.00417b10
mov rcx, rsi
call fcn.00417b10
mov eax, ebx
add rsp, 0x1a8
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
Function at 0x41b250
Capabilities:
Write file on windows

Disassembly:
lea rcx, [0x00401540]
jmp 0x401510
push rsi
push rbx
sub rsp, 0x38
lea rax, [rsp + 0x58]
mov rbx, rcx
mov ecx, 2
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x68], r9
mov qword [rsp + 0x28], rax
call fcn.0040cfe0
mov r8d, 0x1b
mov edx, 1
lea rcx, str.Mingw_w64_runtime_failure:_n
mov r9, rax
call sub.msvcrt.dll_fwrite
mov rsi, qword [rsp + 0x28]
mov ecx, 2
call fcn.0040cfe0
mov rdx, rbx
mov rcx, rax
mov r8, rsi
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
nop
nop
nop
nop
nop
nop
nop
nop
jmp 0x401530
Function at 0x140004790
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x30
mov rax, qword [0x1400d8040]
xor rax, rsp
mov qword [rsp + 0x28], rax
lea rdx, [rsp + 0x20]
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov r8d, dword [rsp + 0x20]
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rcx, rax
xor edx, edx
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.1400cc350
add rsp, 0x30
pop rbx
ret
Function at 0x140007160
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
push rbp
lea rbp, [rsp - 0x1b0]
sub rsp, 0x2b0
mov rax, qword [0x1400d8040]
xor rax, rsp
mov qword [rbp + 0x1a0], rax
lea rdx, str.SOFTWAREWOW6432NodeValveSteam
lea rcx, [rbp - 0x80]
call fcn.140038580
nop
lea rdx, str.Language
lea rcx, [rsp + 0x40]
call fcn.140038580
nop
mov dword [rsp + 0x38], 0x200
lea rdx, [rbp - 0x80]
cmp qword [rbp - 0x68], 7
cmova rdx, qword [rbp - 0x80]
lea rax, [rsp + 0x30]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14000730a
lea rdx, [rsp + 0x40]
cmp qword [rsp + 0x58], 7
cmova rdx, qword [rsp + 0x40]
lea rax, [rsp + 0x38]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x60]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ebx, eax
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
jne 0x14000730a
lea rdx, [rbp - 0x60]
lea rcx, [rsp + 0x60]
call fcn.140038580
lea r9, [rsp + 0x60]
mov r10, qword [rsp + 0x60]
mov r11, qword [rsp + 0x78]
cmp r11, 7
cmova r9, r10
mov rdx, qword [rsp + 0x70]
cmp rdx, 8
jne 0x14000728b
mov r8, rdx
lea rcx, str.schinese
test rdx, rdx
je 0x1400072c4
sub r9, rcx
movzx eax, word [rcx]
cmp word [r9 + rcx], ax
jne 0x14000728b
add rcx, 2
sub r8, 1
jne 0x140007273
mov bl, 1
jmp 0x1400072ca
lea r8, [rsp + 0x60]
cmp r11, 7
cmova r8, r10
cmp rdx, 8
jne 0x1400072c8
lea rcx, str.tchinese
test rdx, rdx
je 0x1400072c4
sub r8, rcx
nop dword [rax]
movzx eax, word [rcx]
cmp word [r8 + rcx], ax
jne 0x1400072c8
add rcx, 2
sub rdx, 1
jne 0x1400072b0
mov bl, 1
jmp 0x1400072ca
xor bl, bl
cmp r11, 7
jbe 0x14000730c
lea rdx, [r11*2 + 2]
mov rax, r10
cmp rdx, 0x1000
jb 0x140007300
add rdx, 0x27
mov r10, qword [r10 - 8]
sub rax, r10
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140007300
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, r10
call fcn.1400cc370
jmp 0x14000730c
xor bl, bl
mov rdx, qword [rsp + 0x58]
cmp rdx, 7
jbe 0x140007351
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000734c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000734c
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400cc370
movdqa xmm0, xmmword [0x1400d16c0]
movdqu xmmword [rsp + 0x50], xmm0
xor eax, eax
mov word [rsp + 0x40], ax
mov rdx, qword [rbp - 0x68]
cmp rdx, 7
jbe 0x1400073a9
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400073a4
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400073a4
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400cc370
movzx eax, bl
mov rcx, qword [rbp + 0x1a0]
xor rcx, rsp
call fcn.1400cc350
mov rbx, qword [rsp + 0x2c0]
add rsp, 0x2b0
pop rbp
ret
Function at 0x140007560
Capabilities:
Execute command

Disassembly:
push rbx
sub rsp, 0x60
mov rbx, rcx
mov rcx, qword [rcx + 0x10]
movabs rax, 0x7fffffffffffffff
sub rax, rcx
cmp rax, 6
jb 0x140007662
mov rax, rbx
cmp qword [rbx + 0x18], 0xf
jbe 0x140007591
mov rax, qword [rbx]
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 6
lea r9, str.start
lea rcx, [rsp + 0x40]
call fcn.1400cb7f0
lea rcx, [rsp + 0x40]
cmp qword [rsp + 0x58], 0xf
cmova rcx, qword [rsp + 0x40]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov rdx, qword [rsp + 0x58]
cmp rdx, 0xf
jbe 0x14000760c
inc rdx
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140007607
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140007607
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400cc370
mov rdx, qword [rbx + 0x18]
cmp rdx, 0xf
jbe 0x140007642
inc rdx
mov rcx, qword [rbx]
cmp rdx, 0x1000
jb 0x14000763d
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14000765b
mov rcx, r8
call fcn.1400cc370
mov qword [rbx + 0x10], 0
mov qword [rbx + 0x18], 0xf
mov byte [rbx], 0
add rsp, 0x60
pop rbx
ret
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140003960
int3

Function at 0x140008170
Capabilities:
Get session user name

Disassembly:
push rbx
sub rsp, 0x140
mov rax, qword [0x1400d8040]
xor rax, rsp
mov qword [rsp + 0x130], rax
mov rbx, rcx
mov dword [rsp + 0x20], 0x100
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_GetUserNameA]
xorps xmm0, xmm0
movups xmmword [rbx], xmm0
xor eax, eax
mov qword [rbx + 0x10], rax
mov qword [rbx + 0x18], rax
lea rax, [rsp + 0x30]
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rax + r8], 0
jne 0x1400081c2
lea rdx, [rsp + 0x30]
mov rcx, rbx
call fcn.1400cb110
mov rax, rbx
mov rcx, qword [rsp + 0x130]
xor rcx, rsp
call fcn.1400cc350
add rsp, 0x140
pop rbx
ret

Function at 0x140008200
Capabilities:
Get hostname

Disassembly:
push rbx
sub rsp, 0x140
mov rax, qword [0x1400d8040]
xor rax, rsp
mov qword [rsp + 0x130], rax
mov rbx, rcx
mov dword [rsp + 0x20], 0x100
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetComputerNameA]
xorps xmm0, xmm0
movups xmmword [rbx], xmm0
xor eax, eax
mov qword [rbx + 0x10], rax
mov qword [rbx + 0x18], rax
lea rax, [rsp + 0x30]
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rax + r8], 0
jne 0x140008252
lea rdx, [rsp + 0x30]
mov rcx, rbx
call fcn.1400cb110
mov rax, rbx
mov rcx, qword [rsp + 0x130]
xor rcx, rsp
call fcn.1400cc350
add rsp, 0x140
pop rbx
ret