joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400110f0
Capabilities:
Write file on windows

Disassembly:
jmp 0x14001bf30
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x128
lea rbp, [rsp + 0x20]
lea rcx, [0x140034068]
call fcn.140011924
nop
mov rax, qword [rbp + 0x120]
cmp qword [rax + 0x68], 0
je 0x14001bf88
mov r8, qword [rbp + 0x130]
mov rdx, qword [rbp + 0x128]
mov rcx, qword [rbp + 0x120]
call qword [sym.imp.MSVCP140D.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const____ptr64__long_long___int64_____ptr64]
jmp 0x14001c09a
mov rax, qword [rbp + 0x130]
mov qword [rbp + 8], rax
mov rcx, qword [rbp + 0x120]
call qword [sym.imp.MSVCP140D.dll_protected:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::_Pnavail_void_const___ptr64]
mov qword [rbp + 0x28], rax
cmp qword [rbp + 0x130], 0
jle 0x14001c033
cmp qword [rbp + 0x28], 0
jle 0x14001c033
mov rax, qword [rbp + 0x28]
cmp qword [rbp + 0x130], rax
jge 0x14001bfd1
mov rax, qword [rbp + 0x130]
mov qword [rbp + 0x28], rax
mov rcx, qword [rbp + 0x120]
call qword [sym.imp.MSVCP140D.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::pptr_void_const___ptr64]
mov r8, qword [rbp + 0x28]
mov rdx, qword [rbp + 0x128]
mov rcx, rax
call fcn.1400118ac
nop
mov rax, qword [rbp + 0x28]
mov rcx, qword [rbp + 0x128]
add rcx, rax
mov rax, rcx
mov qword [rbp + 0x128], rax
mov rax, qword [rbp + 0x28]
mov rcx, qword [rbp + 0x130]
sub rcx, rax
mov rax, rcx
mov qword [rbp + 0x130], rax
mov edx, dword [rbp + 0x28]
mov rcx, qword [rbp + 0x120]
call qword [sym.imp.MSVCP140D.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::pbump_int____ptr64]
nop
cmp qword [rbp + 0x130], 0
jle 0x14001c089
mov rax, qword [rbp + 0x120]
cmp qword [rax + 0x80], 0
je 0x14001c089
mov rax, qword [rbp + 0x120]
mov r9, qword [rax + 0x80]
mov r8, qword [rbp + 0x130]
mov edx, 1
mov rcx, qword [rbp + 0x128]
call qword [sym.imp.ucrtbased.dll_fwrite]
mov rcx, qword [rbp + 0x130]
sub rcx, rax
mov rax, rcx
mov qword [rbp + 0x130], rax
mov rax, qword [rbp + 0x130]
mov rcx, qword [rbp + 8]
sub rcx, rax
mov rax, rcx
lea rsp, [rbp + 0x108]
pop rdi
pop rbp
ret

Function at 0x140011523
Capabilities:
Terminate process

Disassembly:
jmp 0x14001ee40
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
nop
add rsp, 0x28
ret
Function at 0x14001167c
Capabilities:
Parse pe header

Disassembly:
jmp 0x14001f970
sub rsp, 0x38
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x14001f990
xor al, al
jmp 0x14001fa11
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x14001f9a3
xor al, al
jmp 0x14001fa11
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax], 0x4550
je 0x14001f9cd
xor al, al
jmp 0x14001fa11
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x14001f9e1
xor al, al
jmp 0x14001fa11
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0x84], 0xe
ja 0x14001f9f3
xor al, al
jmp 0x14001fa11
mov eax, 8
imul rax, rax, 0xe
mov rcx, qword [rsp + 0x28]
cmp dword [rcx + rax + 0x88], 0
jne 0x14001fa0f
xor al, al
jmp 0x14001fa11
mov al, 1
add rsp, 0x38
ret
Function at 0x14001190b
Capabilities:
Write file on windows

Disassembly:
jmp 0x1400184c0
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x1a8
lea rbp, [rsp + 0x30]
lea rdi, [rsp + 0x30]
mov ecx, 0x2e
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x1c8]
mov rax, qword [0x14002d040]
xor rax, rbp
mov qword [rbp + 0x168], rax
lea rcx, [0x140034068]
call fcn.140011924
nop
mov rax, qword [rbp + 0x190]
cmp qword [rax + 0x68], 0
je 0x140018527
mov rax, qword [rbp + 0x190]
movzx eax, byte [rax + 0x71]
test eax, eax
jne 0x14001852e
mov al, 1
jmp 0x14001867e
call fcn.140011294
mov rcx, qword [rbp + 0x190]
mov rcx, qword [rcx]
mov qword [rbp + 0x158], rcx
mov edx, eax
mov rcx, qword [rbp + 0x190]
mov rax, qword [rbp + 0x158]
call qword [rax + 0x18]
mov dword [rbp + 0x160], eax
call fcn.140011294
mov ecx, dword [rbp + 0x160]
mov edx, ecx
mov ecx, eax
call fcn.14001176c
movzx eax, al
test eax, eax
je 0x14001857f
xor al, al
jmp 0x14001867e
mov qword [rbp + 8], 0x20
lea rax, [rbp + 0x48]
mov rcx, qword [rbp + 0x190]
add rcx, 0x74
lea rdx, [rbp + 0x68]
mov qword [rsp + 0x20], rdx
mov r9, rax
lea r8, [rbp + 0x28]
mov rdx, rcx
mov rax, qword [rbp + 0x190]
mov rcx, qword [rax + 0x68]
call qword [sym.imp.MSVCP140D.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
mov dword [rbp + 0x154], eax
cmp dword [rbp + 0x154], 0
je 0x1400185e4
cmp dword [rbp + 0x154], 1
je 0x1400185ef
cmp dword [rbp + 0x154], 3
je 0x14001866d
jmp 0x14001867c
mov rax, qword [rbp + 0x190]
mov byte [rax + 0x71], 0
lea rax, [rbp + 0x28]
mov rcx, qword [rbp + 0x68]
sub rcx, rax
mov rax, rcx
mov qword [rbp + 0x88], rax
cmp qword [rbp + 0x88], 0
jbe 0x14001863f
mov rax, qword [rbp + 0x190]
mov r9, qword [rax + 0x80]
mov r8, qword [rbp + 0x88]
mov edx, 1
lea rcx, [rbp + 0x28]
call qword [sym.imp.ucrtbased.dll_fwrite]
cmp qword [rbp + 0x88], rax
je 0x14001863f
xor al, al
jmp 0x14001867e
mov rax, qword [rbp + 0x190]
movzx eax, byte [rax + 0x71]
test eax, eax
jne 0x14001865a
mov dword [rbp + 0x154], 1
jmp 0x140018664
mov dword [rbp + 0x154], 0
movzx eax, byte [rbp + 0x154]
jmp 0x14001867e
mov rax, qword [rbp + 0x190]
mov byte [rax + 0x71], 0
mov al, 1
jmp 0x14001867e
xor al, al
mov rdi, rax
lea rcx, [rbp - 0x30]
lea rdx, [0x1400275f0]
call fcn.1400117bc
mov rax, rdi
mov rcx, qword [rbp + 0x168]
xor rcx, rbp
call fcn.14001146a
lea rsp, [rbp + 0x178]
pop rdi
pop rbp
ret
Function at 0x14001d260
Capabilities:
Terminate process

Disassembly:
sub rsp, 0x68
mov ecx, 1
call fcn.14001196f
movzx eax, al
test eax, eax
jne 0x14001d280
mov ecx, 7
call fcn.1400117d5
nop
mov byte [rsp + 0x20], 0
call fcn.14001180c
mov byte [rsp + 0x21], al
cmp dword [0x14002d730], 1
jne 0x14001d2a4
mov ecx, 7
call fcn.1400117d5
nop
jmp 0x14001d2fc
cmp dword [0x14002d730], 0
jne 0x14001d2f7
mov dword [0x14002d730], 1
lea rdx, [0x140026770]
lea rcx, [0x140026440]
call fcn.14001144c
test eax, eax
je 0x14001d2d8
mov eax, 0xff
jmp 0x14001d401
lea rdx, [0x140026330]
lea rcx, [section..rdata]
call fcn.1400117f8
mov dword [0x14002d730], 2
jmp 0x14001d2fc
mov byte [rsp + 0x20], 1
movzx ecx, byte [rsp + 0x21]
call fcn.1400117ad
call fcn.1400116b8
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
cmp qword [rax], 0
je 0x14001d359
mov rcx, qword [rsp + 0x30]
call fcn.140011375
movzx eax, al
test eax, eax
je 0x14001d359
mov rax, qword [rsp + 0x30]
mov rax, qword [rax]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x50], rax
xor r8d, r8d
mov edx, 2
xor ecx, ecx
mov rax, qword [rsp + 0x50]
call qword [0x140035020]
nop
call fcn.14001173a
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
cmp qword [rax], 0
je 0x14001d38d
mov rcx, qword [rsp + 0x38]
call fcn.140011375
movzx eax, al
test eax, eax
je 0x14001d38d
mov rax, qword [rsp + 0x38]
mov rcx, qword [rax]
call fcn.1400118e3
nop
call fcn.14001d4b0
mov dword [rsp + 0x28], eax
call fcn.14001167c
movzx eax, al
test eax, eax
jne 0x14001d3ac
mov ecx, dword [rsp + 0x28]
call fcn.1400110af
nop
movzx eax, byte [rsp + 0x20]
test eax, eax
jne 0x14001d3bb
call fcn.1400118f7
nop
xor edx, edx
mov cl, 1
call fcn.140011343
mov eax, dword [rsp + 0x28]
jmp 0x14001d401
add rsp, 0x68
ret
Function at 0x140003300
Capabilities:
Get system information on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x90
mov rdi, rdx
mov rbx, rcx
mov dword [rsp + 0x20], 0
call fcn.140001750
mov dword [rsp + 0x20], 1
lea rcx, [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov rax, qword [rsp + 0x60]
cmp rax, qword [rsp + 0x68]
jae 0x14000339c
nop dword [rax]
nop dword [rax + rax]
mov r9d, 0x30
lea r8, [rsp + 0x28]
mov rdx, rax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualQueryEx]
cmp rax, 0x30
jne 0x14000339c
cmp dword [rsp + 0x48], 0x1000
jne 0x14000338b
cmp dword [rsp + 0x4c], 1
je 0x14000338b
lea rdx, [rsp + 0x28]
mov rcx, rbx
call fcn.140003610
mov rax, qword [rsp + 0x40]
add rax, qword [rsp + 0x28]
cmp rax, qword [rsp + 0x68]
jb 0x140003350
mov rax, rbx
mov rbx, qword [rsp + 0xa8]
add rsp, 0x90
pop rdi
ret
Function at 0x140003ee0
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x270
mov rax, qword [0x140010040]
xor rax, rsp
mov qword [rsp + 0x260], rax
mov rsi, rcx
xor edx, edx
mov ecx, 2
xor edi, edi
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
cmp rax, 0xffffffffffffffff
jne 0x140003f36
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcerr]
lea rdx, str.Failed_to_take_a_snapshot_of_processes._n
call fcn.140004050
xor eax, eax
jmp 0x140003f8d
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x238
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x140003f82
mov rcx, rsi
call fcn.140003fc0
mov rdx, rax
lea rcx, [rsp + 0x4c]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
test eax, eax
je 0x140003f7e
lea rdx, [rsp + 0x20]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x140003f50
jmp 0x140003f82
mov edi, dword [rsp + 0x28]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.1400085d0
lea r11, [rsp + 0x270]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x140006110
Capabilities:
Write file on windows

Disassembly:
push rbx
push rdi
push r14
sub rsp, 0x20
cmp qword [rcx + 0x68], 0
mov rbx, r8
mov r14, rdx
mov rdi, rcx
je 0x140006138
add rsp, 0x20
pop r14
pop rdi
pop rbx
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const____ptr64__long_long___int64_____ptr64]
mov qword [rsp + 0x40], rbp
mov qword [rsp + 0x48], rsi
mov rsi, rbx
call qword [sym.imp.MSVCP140.dll_protected:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::_Pnavail_void_const___ptr64]
mov rbp, rax
test rbx, rbx
jle 0x1400061ac
test rax, rax
jle 0x14000618c
cmp rbx, rax
mov rcx, rdi
cmovl rbp, rbx
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::pptr_void_const___ptr64]
mov r8, rbp
mov rdx, r14
mov rcx, rax
call fcn.140001c20
mov edx, ebp
mov rcx, rdi
add r14, rbp
sub rbx, rbp
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::pbump_int____ptr64]
test rbx, rbx
jle 0x1400061ac
mov r9, qword [rdi + 0x80]
test r9, r9
je 0x1400061ac
mov r8, rbx
mov edx, 1
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
sub rbx, rax
mov rbp, qword [rsp + 0x40]
sub rsi, rbx
mov rax, rsi
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
pop rdi
pop rbx
ret
Function at 0x1400061d0
Capabilities:
Read file on windows

Disassembly:
push rbp
push rsi
push rdi
sub rsp, 0x20
mov rdi, r8
mov rbp, rdx
mov rsi, rcx
test r8, r8
jg 0x1400061f0
xor eax, eax
add rsp, 0x20
pop rdi
pop rsi
pop rbp
ret
cmp qword [rcx + 0x68], 0
je 0x140006205
call qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char____ptr64__long_long___int64_____ptr64]
add rsp, 0x20
pop rdi
pop rsi
pop rbp
ret
mov qword [rsp + 0x50], rdi
call qword [sym.imp.MSVCP140.dll_protected:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::_Gnavail_void_const___ptr64]
mov qword [rsp + 0x58], rax
test rax, rax
je 0x140006260
lea rdx, [rsp + 0x58]
mov qword [rsp + 0x40], rbx
lea rcx, [rsp + 0x50]
call fcn.1400020d0
mov rcx, rsi
mov rbx, qword [rax]
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::gptr_void_const___ptr64]
mov r8, rbx
mov rcx, rbp
mov rdx, rax
call fcn.140001c20
sub qword [rsp + 0x50], rbx
mov edx, ebx
mov rcx, rsi
add rbp, rbx
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::gbump_int____ptr64]
mov rbx, qword [rsp + 0x40]
cmp qword [rsi + 0x80], 0
je 0x1400062ef
mov rcx, rsi
call fcn.140006d70
mov rcx, qword [rsp + 0x50]
cmp rcx, 0xfff
jbe 0x1400062bc
mov r9, qword [rsi + 0x80]
mov edx, 1
mov r8d, 0xfff
mov rcx, rbp
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
mov rcx, qword [rsp + 0x50]
add rbp, rax
sub rcx, rax
mov qword [rsp + 0x50], rcx
cmp rax, 0xfff
jne 0x1400062f4
cmp rcx, rax
ja 0x140006284
test rcx, rcx
je 0x1400062f4
mov r9, qword [rsi + 0x80]
mov r8, rcx
mov rcx, rbp
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
mov rcx, qword [rsp + 0x50]
sub rcx, rax
sub rdi, rcx
mov rax, rdi
add rsp, 0x20
pop rdi
pop rsi
pop rbp
ret
mov rcx, qword [rsp + 0x50]
sub rdi, rcx
mov rax, rdi
add rsp, 0x20
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400066c0
Capabilities:
Write file on windows

Disassembly:
push rbp
push rsi
push rdi
sub rsp, 0x80
mov rax, qword [0x140010040]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov ebp, edx
mov rdi, rcx
call fcn.140001bc0
mov edx, ebp
mov ecx, eax
mov esi, eax
call fcn.140001bd0
test al, al
je 0x1400066ff
mov ecx, ebp
call fcn.140007140
jmp 0x140006836
mov rcx, rdi
mov qword [rsp + 0xb0], rbx
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::pptr_void_const___ptr64]
test rax, rax
je 0x14000674b
mov rcx, rdi
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::epptr_void_const___ptr64]
mov rcx, rdi
mov rbx, rax
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::pptr_void_const___ptr64]
cmp rax, rbx
jae 0x14000674b
mov rcx, rdi
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::_Pninc_void____ptr64]
mov ecx, ebp
mov rbx, rax
call fcn.140007170
mov byte [rbx], al
mov eax, ebp
jmp 0x14000682e
cmp qword [rdi + 0x80], 0
je 0x14000682c
mov rcx, rdi
call fcn.140006d70
mov rbx, qword [rdi + 0x68]
mov ecx, ebp
call fcn.140007170
test rbx, rbx
jne 0x140006787
mov rdx, qword [rdi + 0x80]
movzx ecx, al
call fcn.140004e60
test al, al
jmp 0x140006829
mov byte [rsp + 0x40], al
lea rdx, [rdi + 0x74]
lea rax, [rsp + 0x48]
mov rcx, rbx
mov qword [rsp + 0x38], rax
lea r9, [rsp + 0x41]
lea rax, [rsp + 0x78]
mov qword [rsp + 0x30], rax
lea r8, [rsp + 0x40]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet____ptr64__char_const____ptr64__char_const____ptr64__char_const____ptr64____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x1400067ed
sub eax, 1
je 0x1400067ed
cmp eax, 2
jne 0x14000682c
mov rdx, qword [rdi + 0x80]
movzx ecx, byte [rsp + 0x40]
call fcn.140004e60
test al, al
jmp 0x140006829
mov rbx, qword [rsp + 0x48]
lea rax, [rsp + 0x58]
sub rbx, rax
je 0x14000681b
mov r9, qword [rdi + 0x80]
lea rcx, [rsp + 0x58]
mov r8, rbx
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rbx, rax
jne 0x14000682c
lea rax, [rsp + 0x40]
mov byte [rdi + 0x71], 1
cmp qword [rsp + 0x50], rax
cmovne esi, ebp
mov eax, esi
mov rbx, qword [rsp + 0xb0]
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.1400085d0
add rsp, 0x80
pop rdi
pop rsi
pop rbp
ret
Function at 0x140006e00
Capabilities:
Write file on windows

Disassembly:
push rsi
sub rsp, 0x60
mov rax, qword [0x140010040]
xor rax, rsp
mov qword [rsp + 0x58], rax
cmp qword [rcx + 0x68], 0
mov rsi, rcx
je 0x140006ef5
cmp byte [rcx + 0x71], 0
je 0x140006ef5
mov rax, qword [rcx]
mov qword [rsp + 0x78], rbx
mov qword [rsp + 0x80], rdi
mov rbx, qword [rax + 0x18]
call fcn.140001bc0
mov edx, eax
mov rcx, rsi
mov edi, eax
call rbx
mov edx, eax
mov ecx, edi
call fcn.140001bd0
mov rdi, qword [rsp + 0x80]
test al, al
jne 0x140006ef1
mov rcx, qword [rsi + 0x68]
lea rax, [rsp + 0x30]
lea rdx, [rsi + 0x74]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x38]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x140006eb6
sub eax, 1
je 0x140006eba
cmp eax, 2
jne 0x140006ef1
mov byte [rsi + 0x71], 0
mov al, 1
mov rbx, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1400085d0
add rsp, 0x60
pop rsi
ret
mov byte [rsi + 0x71], 0
mov rbx, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
sub rbx, rax
je 0x140006ee8
mov r9, qword [rsi + 0x80]
lea rcx, [rsp + 0x38]
mov r8, rbx
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rbx, rax
jne 0x140006ef1
cmp byte [rsi + 0x71], 0
sete al
jmp 0x140006e9e
xor al, al
jmp 0x140006e9e
mov al, 1
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1400085d0
add rsp, 0x60
pop rsi
ret
Function at 0x1400079f0
Capabilities:
Create http request
Read data from internet
Receive data

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
mov eax, 0x1070
call fcn.140009600
sub rsp, rax
mov rax, qword [0x140010040]
xor rax, rsp
mov qword [rsp + 0x1060], rax
mov rdi, rdx
mov rbx, rcx
mov qword [rsp + 0x30], rcx
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
mov edx, 1
lea rcx, str.HTTP_Client
call qword [sym.imp.WININET.dll_InternetOpenW]
mov rsi, rax
test rax, rax
jne 0x140007a84
lea rdx, str.xd_moment
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.140001da0
lea rdx, [0x140001f80]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rdx, [0x14000aaa1]
mov rcx, rbx
call fcn.140004670
jmp 0x140007b81
mov rcx, rdi
call fcn.140001860
mov rdx, rax
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0x80000000
xor r9d, r9d
xor r8d, r8d
mov rcx, rsi
call qword [sym.imp.WININET.dll_InternetOpenUrlA]
mov rdi, rax
test rax, rax
jne 0x140007af7
lea rdx, str.bruh_moment
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.140001da0
lea rdx, [0x140001f80]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, rsi
call qword [sym.imp.WININET.dll_InternetCloseHandle]
lea rdx, [0x14000aaa1]
mov rcx, rbx
call fcn.140004670
jmp 0x140007b81
lea rcx, [rsp + 0x40]
call fcn.140006a40
nop
lea r9, [rsp + 0x30]
mov r8d, 0x1000
lea rdx, [rsp + 0x60]
mov rcx, rdi
call qword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
je 0x140007b57
nop
mov eax, dword [rsp + 0x30]
test eax, eax
je 0x140007b57
mov r8d, eax
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x40]
call fcn.140007da0
lea r9, [rsp + 0x30]
mov r8d, 0x1000
lea rdx, [rsp + 0x60]
mov rcx, rdi
call qword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
jne 0x140007b20
mov rcx, rdi
call qword [sym.imp.WININET.dll_InternetCloseHandle]
mov rcx, rsi
call qword [sym.imp.WININET.dll_InternetCloseHandle]
lea rdx, [rsp + 0x40]
mov rcx, rbx
call fcn.140001880
nop
lea rcx, [rsp + 0x40]
call fcn.140001870
mov rax, rbx
mov rcx, qword [rsp + 0x1060]
xor rcx, rsp
call fcn.1400085d0
lea r11, [rsp + 0x1070]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x140007bb0
Capabilities:
Create process on windows
Terminate process

Disassembly:
sub rsp, 0x88
mov rax, qword [0x140010040]
xor rax, rsp
mov qword [rsp + 0x70], rax
lea rdx, str.https:__raw.githubusercontent.com_049_1_ks2_main_ks3
lea rcx, [rsp + 0x50]
call fcn.140004670
nop
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x30]
call fcn.1400079f0
lea rcx, [rsp + 0x30]
call fcn.140007e90
test al, al
jne 0x140007c48
mov r9d, 0x30
lea r8, str.DH_PC_Check_Tool_v1.0.0
lea rdx, str.Program_is_outdated__please_join_the_discord_server_for_updates.
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
cmp eax, 1
jne 0x140007c3c
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], 0
xor r9d, r9d
lea r8, str.https:__discord.gg_QBAkp6cFM8
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
lea rcx, [rsp + 0x30]
call fcn.140001870
nop
lea rcx, [rsp + 0x50]
call fcn.140001870
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.1400085d0
add rsp, 0x88
ret

Function at 0x140007c80
Capabilities:
Execute command

Disassembly:
sub rsp, 0x28
call fcn.140004350
call fcn.1400033c0
call fcn.1400081b0
call fcn.140005630
lea rcx, str.pause
add rsp, 0x28
jmp qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
Function at 0x140007cb0
Capabilities:
Create process on windows

Disassembly:
sub rsp, 0x38
call fcn.140007bb0
mov r9d, 0x24
lea r8, [0x14000b150]
lea rdx, str.This_program_is_a_PC_Checking_Tool._This_program_does_not_collect_nor_store_any_type_of_data__and_only_checks_things_that_are_necessary_in_a_PC_Check._Do_you_agree_to_run_this_program_
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
xor ecx, ecx
lea r8, str.DH_PC_Check_Tool_v1.0.1
cmp eax, 6
jne 0x140007d76
mov r9d, 0x40
lea rdx, str.Programs_will_now_start_executing.
call qword [sym.imp.USER32.dll_MessageBoxW]
mov r9d, 0x44
lea r8, str.Discord_server
lea rdx, str.Click_Yes_to_join_my_Discord_server_for_updates_and_information._Click_No_to_skip.
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
cmp eax, 6
jne 0x140007d45
mov dword [rsp + 0x28], 1
lea r8, str.https:__discord.gg_QBAkp6cFM8
xor r9d, r9d
mov qword [rsp + 0x20], 0
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
mov ecx, 0xb
call fcn.140003140
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, str._n_________________________________________________________________________________________________n_____________________________________________________________________________________________n____________________________________________________________________________________n_______________________________________________________________________________________________n___________.___________________________________________________________________________n__________________________________________________________________________________________________________n
call fcn.140001da0
mov rcx, rax
call fcn.140007ea0
call fcn.140007c80
xor eax, eax
add rsp, 0x38
ret
mov r9d, 0x30
lea rdx, str.Exiting_the_program._Nothing_was_executed.
call qword [sym.imp.USER32.dll_MessageBoxW]
mov eax, 1
add rsp, 0x38
ret