joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400504b0
Capabilities:
Log keystrokes via polling

Disassembly:
push rbx
sub rsp, 0x20
mov ecx, 0x210
call fcn.140012f40
cmp byte [rax], 0
je 0x140050549
mov ecx, 0x210
call fcn.140002e30
cmp byte [rax + 8], 0
jne 0x140050549
mov ecx, 0xa0
call qword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
test al, 1
jne 0x140050549
mov rbx, qword [0x14016a7e0]
test rbx, rbx
jne 0x140050518
mov r8d, 0xfe5
lea rdx, [0x1400e1bb0]
lea rcx, str.GImGui___0___No_current_context._Did_you_call_ImGui::CreateContext___and_ImGui::SetCurrentContext_____
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
mov rbx, qword [0x14016a7e0]
cmp byte [rbx + 0x37a9], 0
je 0x140050535
xorps xmm3, xmm3
lea rcx, [rbx + 8]
xor r8d, r8d
mov edx, 0x210
call fcn.1400035a0
mov dword [rbx + 0x380], 0x210
mov dword [rbx + 0x940], 0xa0
mov ecx, 0x214
call fcn.140012f40
cmp byte [rax], 0
je 0x1400505dc
mov ecx, 0x214
call fcn.140002e30
cmp byte [rax + 8], 0
jne 0x1400505dc
mov ecx, 0xa1
call qword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
test al, 1
jne 0x1400505dc
mov rbx, qword [0x14016a7e0]
test rbx, rbx
jne 0x1400505ab
mov r8d, 0xfe5
lea rdx, [0x1400e1bb0]
lea rcx, str.GImGui___0___No_current_context._Did_you_call_ImGui::CreateContext___and_ImGui::SetCurrentContext_____
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
mov rbx, qword [0x14016a7e0]
cmp byte [rbx + 0x37a9], 0
je 0x1400505c8
xorps xmm3, xmm3
lea rcx, [rbx + 8]
xor r8d, r8d
mov edx, 0x214
call fcn.1400035a0
mov dword [rbx + 0x384], 0x214
mov dword [rbx + 0x950], 0xa1
mov ecx, 0x212
call fcn.140012f40
cmp byte [rax], 0
je 0x14005066f
mov ecx, 0x212
call fcn.140002e30
cmp byte [rax + 8], 0
jne 0x14005066f
mov ecx, 0x5b
call qword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
test al, 1
jne 0x14005066f
mov rbx, qword [0x14016a7e0]
test rbx, rbx
jne 0x14005063e
mov r8d, 0xfe5
lea rdx, [0x1400e1bb0]
lea rcx, str.GImGui___0___No_current_context._Did_you_call_ImGui::CreateContext___and_ImGui::SetCurrentContext_____
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
mov rbx, qword [0x14016a7e0]
cmp byte [rbx + 0x37a9], 0
je 0x14005065b
xorps xmm3, xmm3
lea rcx, [rbx + 8]
xor r8d, r8d
mov edx, 0x212
call fcn.1400035a0
mov dword [rbx + 0x26c], 0x212
mov dword [rbx + 0x948], 0x5b
mov ecx, 0x216
call fcn.140012f40
cmp byte [rax], 0
je 0x140050702
mov ecx, 0x216
call fcn.140002e30
cmp byte [rax + 8], 0
jne 0x140050702
mov ecx, 0x5c
call qword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
test al, 1
jne 0x140050702
mov rbx, qword [0x14016a7e0]
test rbx, rbx
jne 0x1400506d1
mov r8d, 0xfe5
lea rdx, [0x1400e1bb0]
lea rcx, str.GImGui___0___No_current_context._Did_you_call_ImGui::CreateContext___and_ImGui::SetCurrentContext_____
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
mov rbx, qword [0x14016a7e0]
cmp byte [rbx + 0x37a9], 0
je 0x1400506ee
xorps xmm3, xmm3
lea rcx, [rbx + 8]
xor r8d, r8d
mov edx, 0x216
call fcn.1400035a0
mov dword [rbx + 0x270], 0x216
mov dword [rbx + 0x958], 0x5c
add rsp, 0x20
pop rbx
ret
Function at 0x140052fb0
Capabilities:
Check for debugger via api

Disassembly:
sub rsp, 0x28
mov dword [rsp + 0x30], 0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea rdx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
mov eax, dword [rsp + 0x30]
add rsp, 0x28
ret
Function at 0x140055940
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x170
mov rbx, rcx
xor edi, edi
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov edx, reloc.WLDAP32.dll_Ordinal_26
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetFolderPathA]
xorps xmm0, xmm0
test eax, eax
jne 0x140055a31
movups xmmword [rsp + 0x38], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x48], xmm1
lea rax, [rsp + 0x60]
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rax + r8], dil
jne 0x140055994
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x38]
call fcn.14004e750
nop
mov r8d, Ordinal_32
lea rdx, str.NINJA_HEX_V1login_data1.txt
lea rcx, [rsp + 0x38]
call fcn.14004dc80
xorps xmm0, xmm0
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], rdi
mov qword [rbx + 0x18], rdi
movups xmm0, xmmword [rax]
movups xmmword [rbx], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbx + 0x10], xmm1
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov rdx, qword [rsp + 0x50]
cmp rdx, 0xf
jbe 0x140055a43
inc rdx
mov rcx, qword [rsp + 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140055a2a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140055a2a
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400cdc6c
jmp 0x140055a43
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], rdi
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], dil
mov rax, rbx
mov rbx, qword [rsp + 0x180]
add rsp, 0x170
pop rdi
ret

Function at 0x140055d70
Capabilities:
Enumerate processes

Disassembly:
push rsi
sub rsp, 0x150
mov rsi, rdx
test rdx, rdx
jne 0x140055d8c
xor eax, eax
add rsp, 0x150
pop rsi
ret
mov qword [rsp + 0x160], rbx
xor edx, edx
mov qword [rsp + 0x168], rbp
mov ecx, 2
mov qword [rsp + 0x170], rdi
xor edi, edi
mov ebx, edi
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x130
mov rcx, rax
mov rbp, rax
call qword [sym.imp.KERNEL32.dll_Process32First]
lea rdx, [rsp + 0x20]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
je 0x140055e12
mov rdx, rsi
lea rcx, [rsp + 0x4c]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__stricmp]
test eax, eax
jne 0x140055e00
mov eax, dword [rsp + 0x3c]
cmp eax, ebx
jbe 0x140055e00
mov edi, dword [rsp + 0x28]
mov ebx, eax
lea rdx, [rsp + 0x20]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
jne 0x140055de0
mov rbp, qword [rsp + 0x168]
mov eax, edi
mov rdi, qword [rsp + 0x170]
mov rbx, qword [rsp + 0x160]
add rsp, 0x150
pop rsi
ret
Function at 0x140058b80
Capabilities:
Enumerate processes

Disassembly:
mov rax, rsp
mov qword [rax + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x150
mov rsi, rdx
mov r14, rcx
test rdx, rdx
je 0x140058c59
mov qword [rax + 8], rbx
xor r15d, r15d
xor edx, edx
mov qword [rax + 0x10], rbp
mov ecx, 2
mov edi, r15d
mov ebx, r15d
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x130
mov rcx, rax
mov rbp, rax
call qword [sym.imp.KERNEL32.dll_Process32First]
lea rdx, [rsp + 0x20]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
je 0x140058c22
nop dword [rax + rax]
mov rdx, rsi
lea rcx, [rsp + 0x4c]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__stricmp]
test eax, eax
jne 0x140058c10
mov eax, dword [rsp + 0x3c]
cmp eax, ebx
jbe 0x140058c10
mov edi, dword [rsp + 0x28]
mov ebx, eax
lea rdx, [rsp + 0x20]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
jne 0x140058bf0
mov rbp, qword [rsp + 0x178]
mov rbx, qword [rsp + 0x170]
test edi, edi
je 0x140058c59
mov r8d, edi
mov dword [r14], edi
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
test rax, rax
mov qword [r14 + 8], rax
setne r15b
mov eax, r15d
jmp 0x140058c5b
xor eax, eax
mov rsi, qword [rsp + 0x180]
add rsp, 0x150
pop r15
pop r14
pop rdi
ret
Function at 0x140058c70
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x50
mov rbx, r9
mov rdi, r8
mov rbp, rdx
mov r15, qword [rsp + 0x90]
mov rcx, r15
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll__msize]
mov rsi, rax
test eax, eax
jg 0x140058cb6
xor al, al
jmp 0x140058da6
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x30], xmm0
xor r12d, r12d
mov qword [rsp + 0x40], r12
lea rax, [rsp + 0x30]
mov qword [rsp + 0x20], rax
mov r9, rbx
mov r8, rdi
mov rdx, rbp
lea rcx, [0x14018b980]
call fcn.140058dd0
mov rbx, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
cmp rbx, rdi
jne 0x140058cfa
xor dil, dil
jmp 0x140058d61
mov ebp, r12d
sub rdi, rbx
sar rdi, 3
test rdi, rdi
je 0x140058d5e
movsxd r14, esi
mov rsi, rbx
nop
mov edx, dword [rsi]
lea rax, [rsp + 0x98]
mov qword [rsp + 0x20], rax
mov r9d, 0x40
mov r8, r14
mov rcx, qword [0x14018b988]
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
mov qword [rsp + 0x20], r12
mov r9, r14
mov r8, r15
mov rdx, qword [rsi]
mov rcx, qword [0x14018b988]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
inc ebp
lea rsi, [rsi + 8]
movsxd rax, ebp
cmp rax, rdi
jb 0x140058d10
mov dil, 1
test rbx, rbx
je 0x140058da2
mov rdx, qword [rsp + 0x40]
sub rdx, rbx
and rdx, 0xfffffffffffffff8
mov rax, rbx
cmp rdx, 0x1000
jb 0x140058d9a
add rdx, 0x27
mov rbx, qword [rbx - 8]
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140058d9a
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rbx
call fcn.1400cdc6c
movzx eax, dil
lea r11, [rsp + 0x50]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop r12
ret
Function at 0x14005aae0
Capabilities:
Get system information on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 8], rcx
push rbp
push rdi
push r13
push r14
push r15
lea rbp, [rsp - 0x37]
sub rsp, 0xb0
lea rcx, [rbp + 7]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov rdi, qword [rbp + 0xf]
mov rbx, qword [rbp + 0x17]
mov dword [rbp - 0x49], 0x3f000000
mov qword [rbp - 0x45], 0x3e800000
mov dword [rbp - 0x3d], 5
mov dword [rbp - 0x39], 0x3f800000
mov dword [rbp - 0x35], 0x41200000
mov dword [rbp - 0x31], 0x42340000
lea rsi, [rbp - 0x49]
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x29], xmm0
mov qword [rbp - 0x19], 0
mov ecx, Ordinal_32
call fcn.1400cd920
mov r14, rax
mov qword [rbp - 0x29], rax
lea r15, [rax + 0x1c]
mov qword [rbp - 0x19], r15
mov r8d, Ordinal_32
mov rdx, rsi
mov rcx, rax
call sub.VCRUNTIME140.dll_memmove
mov qword [rbp - 0x21], r15
mov dword [rbp + 0x67], 0x3c000000
mov dword [rbp + 0x6b], 0x3cf50000
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x11], xmm0
mov qword [rbp - 1], 0
mov ecx, 8
call fcn.1400cd920
mov rsi, rax
mov qword [rbp - 0x11], rax
lea r13, [rax + 8]
mov qword [rbp - 1], r13
mov rax, qword [rbp + 0x67]
mov qword [rsi], rax
mov qword [rbp - 9], r13
mov qword [rsp + 0x20], rsi
mov r9, r14
mov r8, rbx
mov rdx, rdi
call fcn.140058c70
movzx ebx, al
test rsi, rsi
je 0x14005ac0f
sub r13, rsi
cmp r13, 0x1000
jb 0x14005ac03
add r13, 0x27
mov rcx, qword [rsi - 8]
sub rsi, rcx
lea rax, [rsi - 8]
cmp rax, 0x1f
ja 0x14005ac3f
mov rsi, rcx
mov rdx, r13
mov rcx, rsi
call fcn.1400cdc6c
nop
test r14, r14
je 0x14005ac51
sub r15, r14
mov rax, r14
cmp r15, 0x1000
jb 0x14005ac46
add r15, 0x27
mov r14, qword [r14 - 8]
sub rax, r14
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14005ac46
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
mov rdx, r15
mov rcx, r14
call fcn.1400cdc6c
movzx eax, bl
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop rdi
pop rbp
ret
Function at 0x14005af80
Capabilities:
Get system information on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x37]
sub rsp, 0x100
lea rcx, [rbp + 7]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov rdi, qword [rbp + 0xf]
mov rbx, qword [rbp + 0x17]
mov dword [rsp + 0x30], 0x8ccccd40
mov dword [rsp + 0x34], 0xf5c28f3f
mov dword [rsp + 0x38], 0xcccccd3c
mov qword [rsp + 0x3c], 0x73d
mov dword [rsp + 0x44], 0
mov dword [rsp + 0x48], 0xf0000000
mov dword [rbp - 0x7d], 0x48000041
mov dword [rbp - 0x79], 0x42
mov dword [rbp - 0x75], 0x1333333f
mov dword [rbp - 0x71], 0xb0000040
mov dword [rbp - 0x6d], 0x8000003f
mov dword [rbp - 0x69], 0x13f
lea rsi, [rsp + 0x30]
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x29], xmm0
mov ecx, 0x34
call fcn.1400cd920
mov r14, rax
mov qword [rbp - 0x29], rax
lea r15, [rax + 0x34]
mov qword [rbp - 0x19], r15
mov r8d, gethostname
mov rdx, rsi
mov rcx, rax
call sub.VCRUNTIME140.dll_memmove
mov qword [rbp - 0x21], r15
mov dword [rbp - 0x61], 0xffb1e040
mov dword [rbp - 0x5d], 0xffb1e0ff
mov dword [rbp - 0x59], 0xffb1e0ff
mov dword [rbp - 0x55], 0xffb1e0ff
mov dword [rbp - 0x51], 0xffb1e0ff
mov dword [rbp - 0x4d], 0xff
mov dword [rbp - 0x49], 0xf0000000
mov dword [rbp - 0x45], 0x48000041
mov dword [rbp - 0x41], 0x42
mov dword [rbp - 0x3d], 0x1333333f
mov dword [rbp - 0x39], 0xb0000040
mov dword [rbp - 0x35], 0x8000003f
mov dword [rbp - 0x31], 0x13f
lea r12, [rbp - 0x61]
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x11], xmm0
mov ecx, 0x34
call fcn.1400cd920
mov rsi, rax
mov qword [rbp - 0x11], rax
lea r13, [rax + 0x34]
mov qword [rbp - 1], r13
mov r8d, gethostname
mov rdx, r12
mov rcx, rax
call sub.VCRUNTIME140.dll_memmove
mov qword [rbp - 9], r13
mov qword [rsp + 0x20], rsi
mov r9, r14
mov r8, rbx
mov rdx, rdi
call fcn.140058c70
movzx ebx, al
test rsi, rsi
je 0x14005b12c
sub r13, rsi
cmp r13, 0x1000
jb 0x14005b120
add r13, 0x27
mov rcx, qword [rsi - 8]
sub rsi, rcx
lea rax, [rsi - 8]
cmp rax, 0x1f
ja 0x14005b15c
mov rsi, rcx
mov rdx, r13
mov rcx, rsi
call fcn.1400cdc6c
nop
test r14, r14
je 0x14005b16e
sub r15, r14
mov rax, r14
cmp r15, 0x1000
jb 0x14005b163
add r15, 0x27
mov r14, qword [r14 - 8]
sub rax, r14
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14005b163
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
mov rdx, r15
mov rcx, r14
call fcn.1400cdc6c
movzx eax, bl
lea r11, [rsp + 0x100]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
Function at 0x14005b4b0
Capabilities:
Get system information on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x37]
sub rsp, 0xb0
lea rcx, [rbp + 7]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov rdi, qword [rbp + 0xf]
mov rbx, qword [rbp + 0x17]
mov dword [rbp - 0x49], 0xe92d4c10
mov dword [rbp - 0x45], 0xe28db008
mov dword [rbp - 0x41], 0xe59f010c
mov dword [rbp - 0x3d], 0xe08f0000
lea rsi, [rbp - 0x49]
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x29], xmm0
mov ecx, reloc.WS2_32.dll_recv
call fcn.1400cd920
mov r14, rax
mov qword [rbp - 0x29], rax
lea r15, [rax + 0x10]
mov qword [rbp - 0x19], r15
mov r8d, reloc.WS2_32.dll_recv
mov rdx, rsi
mov rcx, rax
call sub.VCRUNTIME140.dll_memmove
mov qword [rbp - 0x21], r15
mov dword [rbp - 0x39], 0xe3a00001
mov dword [rbp - 0x35], 0xe12fff1e
mov dword [rbp - 0x31], 0xe59f010c
mov dword [rbp - 0x2d], 0xe08f0000
lea r12, [rbp - 0x39]
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x11], xmm0
mov ecx, reloc.WS2_32.dll_recv
call fcn.1400cd920
mov rsi, rax
mov qword [rbp - 0x11], rax
lea r13, [rax + 0x10]
mov qword [rbp - 1], r13
mov r8d, reloc.WS2_32.dll_recv
mov rdx, r12
mov rcx, rax
call sub.VCRUNTIME140.dll_memmove
mov qword [rbp - 9], r13
mov qword [rsp + 0x20], rsi
mov r9, r14
mov r8, rbx
mov rdx, rdi
call fcn.140058c70
movzx ebx, al
test rsi, rsi
je 0x14005b5dd
sub r13, rsi
cmp r13, 0x1000
jb 0x14005b5d1
add r13, 0x27
mov rcx, qword [rsi - 8]
sub rsi, rcx
lea rax, [rsi - 8]
cmp rax, 0x1f
ja 0x14005b60d
mov rsi, rcx
mov rdx, r13
mov rcx, rsi
call fcn.1400cdc6c
nop
test r14, r14
je 0x14005b61f
sub r15, r14
mov rax, r14
cmp r15, 0x1000
jb 0x14005b614
add r15, 0x27
mov r14, qword [r14 - 8]
sub rax, r14
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14005b614
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
mov rdx, r15
mov rcx, r14
call fcn.1400cdc6c
movzx eax, bl
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
Function at 0x14005b650
Capabilities:
Create directory

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x160
lea rcx, [rsp + 0x40]
call fcn.140055940
nop
lea rbx, [rsp + 0x40]
cmp qword [rsp + 0x58], 0xf
cmova rbx, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x50]
test rdi, rdi
je 0x14005b6f8
xor edx, edx
mov r8d, 0x100
lea rcx, [rsp + 0x60]
call sub.VCRUNTIME140.dll_memset
lea rcx, [0x1400efc90]
lea rdx, [0x1400efc92]
nop dword [rax]
nop word [rax + rax]
movzx eax, byte [rcx]
mov byte [rsp + rax + 0x60], 1
inc rcx
cmp rcx, rdx
jne 0x14005b6b0
lea rax, [rdi - 1]
mov r8, 0xffffffffffffffff
cmp rax, r8
cmovb r8, rax
add r8, rbx
movzx eax, byte [r8]
cmp byte [rsp + rax + 0x60], 0
jne 0x14005b6f3
cmp r8, rbx
je 0x14005b6f8
dec r8
movzx eax, byte [r8]
cmp byte [rsp + rax + 0x60], 0
je 0x14005b6e0
sub r8, rbx
jmp 0x14005b6ff
mov r8, 0xffffffffffffffff
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x30], xmm1
cmp rdi, r8
cmovb r8, rdi
lea rdx, [rsp + 0x40]
cmp qword [rsp + 0x58], 0xf
cmova rdx, qword [rsp + 0x40]
lea rcx, [rsp + 0x20]
call fcn.14004e750
lea rcx, [rsp + 0x20]
cmp qword [rsp + 0x38], 0xf
cmova rcx, qword [rsp + 0x20]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
jne 0x14005b755
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rdx, qword [rsp + 0x38]
cmp rdx, 0xf
jbe 0x14005b795
inc rdx
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14005b790
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14005b790
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400cdc6c
movdqa xmm0, xmmword [0x1400f0b50]
movdqu xmmword [rsp + 0x30], xmm0
mov byte [rsp + 0x20], 0
mov rdx, qword [rsp + 0x58]
cmp rdx, 0xf
jbe 0x14005b7e8
inc rdx
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14005b7e3
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14005b7e3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400cdc6c
mov rbx, qword [rsp + 0x178]
add rsp, 0x160
pop rdi
ret
Function at 0x14005be60
Capabilities:
Create process on windows

Disassembly:
mov rax, rsp
sub rsp, 0xe8
xorps xmm0, xmm0
mov dword [rax - 0x78], 0x68
xor edx, edx
cmp qword [rcx + 0x18], 0xf
movups xmmword [rax - 0x40], xmm0
mov dword [rax - 0x3c], 1
mov word [rax - 0x38], dx
movups xmmword [rax - 0x70], xmm0
movups xmmword [rax - 0x60], xmm0
movups xmmword [rax - 0x50], xmm0
movups xmmword [rax - 0x30], xmm0
movups xmmword [rax - 0x20], xmm0
jbe 0x14005bea3
mov rcx, qword [rcx]
lea rax, [rsp + 0x50]
xor r9d, r9d
mov qword [rsp + 0x48], rax
xor r8d, r8d
lea rax, [rsp + 0x70]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rdx
mov qword [rsp + 0x30], rdx
mov dword [rsp + 0x28], edx
mov dword [rsp + 0x20], edx
mov rdx, rcx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
mov rcx, qword [rsp + 0x50]
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
add rsp, 0xe8
ret
Function at 0x14005bf10
Capabilities:
Enumerate process modules

Disassembly:
push rbx
push r12
push r15
mov eax, 0x1180
call fcn.1400ce150
sub rsp, rax
mov r15, rdx
lea r8, [rsp + 0x11b0]
mov rbx, rcx
mov edx, 0x1000
lea rcx, [rsp + 0x170]
xor r12d, r12d
call qword [sym.imp.KERNEL32.dll_K32EnumProcesses]
test eax, eax
jne 0x14005bf70
xorps xmm0, xmm0
mov rax, rbx
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], r12
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], r12b
add rsp, 0x1180
pop r15
pop r12
pop rbx
ret
mov eax, dword [rsp + 0x11b0]
mov qword [rsp + 0x11a0], rbp
mov ebp, r12d
shr eax, 2
mov qword [rsp + 0x11a8], rsi
mov qword [rsp + 0x1178], rdi
mov qword [rsp + 0x1170], r14
mov dword [rsp + 0x11b0], eax
test eax, eax
je 0x14005c0e7
nop dword [rax]
mov eax, ebp
mov r8d, dword [rsp + rax*4 + 0x170]
test r8d, r8d
je 0x14005c0d8
xor edx, edx
mov ecx, 0x410
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rsi, rax
test rax, rax
je 0x14005c0d8
lea r9, [rsp + 0x11b8]
mov r8d, 8
lea rdx, [rsp + 0x58]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_K32EnumProcessModules]
test eax, eax
je 0x14005c0cf
mov rdx, qword [rsp + 0x58]
lea r8, [rsp + 0x60]
mov r9d, 0x104
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_K32GetModuleFileNameExA]
test eax, eax
je 0x14005c0cf
xorps xmm0, xmm0
mov qword [rsp + 0x40], r12
movups xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x48], r12
lea rax, [rsp + 0x60]
mov r8, 0xffffffffffffffff
nop
inc r8
cmp byte [rax + r8], r12b
jne 0x14005c040
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x30]
call fcn.14004e750
cmp qword [r15 + 0x18], 0xf
mov r9, r15
mov rax, qword [r15 + 0x10]
jbe 0x14005c069
mov r9, qword [r15]
mov r14, qword [rsp + 0x48]
lea rcx, [rsp + 0x30]
mov rdi, qword [rsp + 0x30]
cmp r14, 0xf
mov rdx, qword [rsp + 0x40]
cmova rcx, rdi
mov qword [rsp + 0x20], rax
xor r8d, r8d
call fcn.14004e680
cmp rax, 0xffffffffffffffff
jne 0x14005c133
cmp r14, 0xf
jbe 0x14005c0cf
lea rdx, [r14 + 1]
mov rax, rdi
cmp rdx, 0x1000
jb 0x14005c0c7
mov rdi, qword [rdi - 8]
add rdx, 0x27
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14005c12c
mov rcx, rdi
call fcn.1400cdc6c
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
inc ebp
cmp ebp, dword [rsp + 0x11b0]
jb 0x14005bfb0
xorps xmm0, xmm0
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], r12
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], r12b
mov rdi, qword [rsp + 0x1178]
mov rax, rbx
mov rsi, qword [rsp + 0x11a8]
mov rbp, qword [rsp + 0x11a0]
mov r14, qword [rsp + 0x1170]
add rsp, 0x1180
pop r15
pop r12
pop rbx
ret
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
movups xmm0, xmmword [rsp + 0x30]
movups xmm1, xmmword [rsp + 0x40]
movups xmmword [rbx], xmm0
movups xmmword [rbx + 0x10], xmm1
jmp 0x14005c0fc
Function at 0x14005c8c0
Capabilities:
Create process on windows
Self delete
Terminate process

Disassembly:
sub rsp, 0x2b8
mov r8d, 0x104
lea rdx, [rsp + 0x1a0]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea rdx, [rsp + 0x1a0]
lea rcx, [rsp + 0x50]
call fcn.14004dc40
nop
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x70]
call fcn.14005c810
nop
lea rcx, [rsp + 0x50]
call fcn.14001f440
lea rdx, str.C:WindowsSystemdeleteApp.bat
lea rcx, [rsp + 0x30]
call fcn.1400651c0
nop
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x90]
call fcn.140064490
nop
lea rdx, str._echo_off_n
lea rcx, [rsp + 0x90]
call fcn.140066bb0
lea rdx, str.timeout__T_6_n
lea rcx, [rsp + 0x90]
call fcn.140066bb0
lea rdx, str.del__F__Q__
lea rcx, [rsp + 0x90]
call fcn.140066bb0
mov rcx, rax
lea rdx, [rsp + 0x70]
call fcn.140066d90
mov rcx, rax
lea rdx, [0x1400efe94]
call fcn.140066bb0
lea rdx, str.del__F__Q__
lea rcx, [rsp + 0x90]
call fcn.140066bb0
mov rcx, rax
lea rdx, [rsp + 0x30]
call fcn.140066d90
mov rcx, rax
lea rdx, [0x1400efe94]
call fcn.140066bb0
lea rcx, [rsp + 0x90]
call fcn.140064450
lea rcx, [rsp + 0x30]
call fcn.1400651b0
mov r8, rax
xor eax, eax
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rax
xor r9d, r9d
lea rdx, [0x1400efeb8]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
mov r9d, reloc.WS2_32.dll_recv
lea r8, str.You_Are_Banned___
lea rdx, str.You_Are_Banned_From_This_Panel__By_NINJA_HEX
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3