joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5085a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x50866c
push rbp
mov rbp, rsp
sub rsp, 0x30
movabs rdx, 0x45614749c5697cea
mov qword [rsp + 0x18], rdx
mov word [rsp + 0x20], 0x2961
movabs rdx, 0x601030803000300
mov qword [rsp + 0x22], rdx
movabs rdx, 0x602050200050601
mov qword [rsp + 0x28], rdx
xor eax, eax
jmp 0x508604
movzx r9d, byte [rsp + rsi + 0x18]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x2c]
mov byte [rsp + rdi + 0x18], dl
mov byte [rsp + rsi + 0x18], r8b
add rax, 2
cmp rax, 0xe
jge 0x50863c
movzx edx, byte [rsp + rax + 0x22]
movzx esi, byte [rsp + rax + 0x23]
mov edi, edx
xor edx, esi
add edx, eax
nop word [rax + rax]
cmp rdi, 0xa
jae 0x50865f
movzx r8d, byte [rsp + rdi + 0x18]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x2c]
cmp rsi, 0xa
jb 0x5085ea
jmp 0x508653
xor eax, eax
lea rbx, [rsp + 0x18]
mov ecx, 0xa
call fcn.00441380
add rsp, 0x30
pop rbp
ret
mov eax, esi
mov ecx, 0xa
call fcn.00451880
mov eax, edi
mov ecx, 0xa
call fcn.00451880
nop
call fcn.0044f600
jmp fcn.005085a0

Function at 0x508c80
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x508d3d
push rbp
mov rbp, rsp
sub rsp, 0x30
movabs rdx, 0xbd643a68740cd034
mov qword [rsp + 0x1d], rdx
mov byte [rsp + 0x25], 0x20
movabs rdx, 0x200050507070107
mov qword [rsp + 0x26], rdx
mov word [rsp + 0x2e], 0x100
xor eax, eax
nop
jmp 0x508ce0
movzx r9d, byte [rsp + rsi + 0x1d]
sub r9d, edx
lea edx, [r9 + 0x39]
mov byte [rsp + rdi + 0x1d], dl
lea edx, [r8 + 0x39]
mov byte [rsp + rsi + 0x1d], dl
add rax, 2
nop
cmp rax, 0xa
jge 0x508d0d
movzx edx, byte [rsp + rax + 0x26]
movzx esi, byte [rsp + rax + 0x27]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 9
jae 0x508d30
movzx r8d, byte [rsp + rdi + 0x1d]
sub r8d, edx
cmp rsi, 9
jb 0x508cc2
jmp 0x508d24
xor eax, eax
lea rbx, [rsp + 0x1d]
mov ecx, 9
call fcn.00441380
add rsp, 0x30
pop rbp
ret
mov eax, esi
mov ecx, 9
call fcn.00451880
mov eax, edi
mov ecx, 9
call fcn.00451880
nop
nop dword [rax]
call fcn.0044f600
jmp fcn.00508c80
Function at 0x50a120
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x50a20c
push rbp
mov rbp, rsp
sub rsp, 0x40
movabs rdx, 0x375e3534873206e0
mov qword [rsp + 0x1d], rdx
movabs rdx, 0xc8375e3534873206
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x66e8dc444342ed5f
mov qword [rsp + 0x26], rdx
movabs rdx, 0xa0f06100003
mov qword [rsp + 0x2e], rdx
movabs rdx, 0x10100000a0f0610
mov qword [rsp + 0x30], rdx
movabs rdx, 0x806100e06091001
mov qword [rsp + 0x38], rdx
xor eax, eax
jmp 0x50a1aa
movzx r9d, byte [rsp + rsi + 0x1d]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x50]
mov byte [rsp + rdi + 0x1d], dl
mov byte [rsp + rsi + 0x1d], r8b
add rax, 2
cmp rax, 0x12
jge 0x50a1dc
movzx edx, byte [rsp + rax + 0x2e]
movzx esi, byte [rsp + rax + 0x2f]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x11
jae 0x50a1ff
movzx r8d, byte [rsp + rdi + 0x1d]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x50]
cmp rsi, 0x11
jb 0x50a190
jmp 0x50a1f3
xor eax, eax
lea rbx, [rsp + 0x1d]
mov ecx, 0x11
call fcn.00441380
add rsp, 0x40
pop rbp
ret
mov eax, esi
mov ecx, 0x11
call fcn.00451880
mov eax, edi
mov ecx, 0x11
call fcn.00451880
nop
call fcn.0044f600
jmp fcn.0050a120

Function at 0x50a740
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x50a878
push rbp
mov rbp, rsp
sub rsp, 0x70
movabs rdx, 0x674769642a63e369
mov qword [rsp + 0x1f], rdx
movabs rdx, 0xd84d2f674769642a
mov qword [rsp + 0x22], rdx
movabs rdx, 0x6c2079646f0901ca
mov qword [rsp + 0x2a], rdx
movabs rdx, 0xce66186674cf6e1f
mov qword [rsp + 0x32], rdx
movabs rdx, 0xb3391cdfc7c55278
mov qword [rsp + 0x3a], rdx
movabs rdx, 0x17201c060d0a0a21
mov qword [rsp + 0x42], rdx
movabs rdx, 0x613030d0c0c1d0b
mov qword [rsp + 0x4a], rdx
movabs rdx, 0x90d1e0621090613
mov qword [rsp + 0x50], rdx
movabs rdx, 0x150a031913171918
mov qword [rsp + 0x58], rdx
movabs rdx, 0x11f2110001a1d0d
mov qword [rsp + 0x60], rdx
movabs rdx, 0x90c2019211a1c22
mov qword [rsp + 0x68], rdx
xor eax, eax
jmp 0x50a818
movzx r9d, byte [rsp + rsi + 0x1f]
sub r9d, edx
lea edx, [r9 - 0x2f]
mov byte [rsp + rdi + 0x1f], dl
lea edx, [r8 - 0x2f]
mov byte [rsp + rsi + 0x1f], dl
add rax, 2
cmp rax, 0x2e
jge 0x50a848
movzx edx, byte [rsp + rax + 0x42]
movzx esi, byte [rsp + rax + 0x43]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x23
jae 0x50a86b
movzx r8d, byte [rsp + rdi + 0x1f]
sub r8d, edx
nop dword [rax]
cmp rsi, 0x23
jb 0x50a7fb
jmp 0x50a85f
xor eax, eax
lea rbx, [rsp + 0x1f]
mov ecx, 0x23
call fcn.00441380
add rsp, 0x70
pop rbp
ret
mov eax, esi
mov ecx, 0x23
call fcn.00451880
mov eax, edi
mov ecx, 0x23
call fcn.00451880
nop
call fcn.0044f600
nop dword [rax]
jmp fcn.0050a740
Function at 0x50f500
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x50f5dd
push rbp
mov rbp, rsp
sub rsp, 0x40
movabs rdx, 0xbd8f747c6967fc9d
mov qword [rsp + 0x18], rdx
movabs rdx, 0xb6784530c26196e8
mov qword [rsp + 0x20], rdx
movabs rdx, 0xb060f080f010c06
mov qword [rsp + 0x28], rdx
movabs rdx, 0xa070b07080a070f
mov qword [rsp + 0x30], rdx
movabs rdx, 0x10a00040f0b0906
mov qword [rsp + 0x38], rdx
xor eax, eax
nop
jmp 0x50f580
movzx r9d, byte [rsp + rsi + 0x18]
sub r9d, edx
lea edx, [r9 - 0x12]
mov byte [rsp + rdi + 0x18], dl
lea edx, [r8 - 0x12]
mov byte [rsp + rsi + 0x18], dl
add rax, 2
nop
cmp rax, 0x18
jge 0x50f5ad
movzx edx, byte [rsp + rax + 0x28]
movzx esi, byte [rsp + rax + 0x29]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x10
jae 0x50f5d0
movzx r8d, byte [rsp + rdi + 0x18]
sub r8d, edx
cmp rsi, 0x10
jb 0x50f562
jmp 0x50f5c4
xor eax, eax
lea rbx, [rsp + 0x18]
mov ecx, 0x10
call fcn.00441380
add rsp, 0x40
pop rbp
ret
mov eax, esi
mov ecx, 0x10
call fcn.00451880
mov eax, edi
mov ecx, 0x10
call fcn.00451880
nop
nop dword [rax]
call fcn.0044f600
jmp fcn.0050f500

Function at 0x5108e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x510998
push rbp
mov rbp, rsp
sub rsp, 0x30
movabs rdx, 0xbacb6d69ca7465d7
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x307030600060307
mov qword [rsp + 0x26], rdx
mov word [rsp + 0x2e], 0x306
xor eax, eax
jmp 0x510935
movzx r9d, byte [rsp + rsi + 0x1e]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x80]
mov byte [rsp + rdi + 0x1e], dl
mov byte [rsp + rsi + 0x1e], r8b
add rax, 2
cmp rax, 0xa
jge 0x510968
movzx edx, byte [rsp + rax + 0x26]
movzx esi, byte [rsp + rax + 0x27]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 8
jae 0x51098b
movzx r8d, byte [rsp + rdi + 0x1e]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x80]
nop
cmp rsi, 8
jb 0x51091b
jmp 0x51097f
xor eax, eax
lea rbx, [rsp + 0x1e]
mov ecx, 8
call fcn.00441380
add rsp, 0x30
pop rbp
ret
mov eax, esi
mov ecx, 8
call fcn.00451880
mov eax, edi
mov ecx, 8
call fcn.00451880
nop
call fcn.0044f600
nop dword [rax]
jmp fcn.005108e0
Function at 0x511a80
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x511b7b
push rbp
mov rbp, rsp
sub rsp, 0x48
movabs rdx, 0x1d5e72affa52a420
mov qword [rsp + 0x19], rdx
movabs rdx, 0xf692b61d5e72affa
mov qword [rsp + 0x1c], rdx
movabs rdx, 0xffc6d07365b46fcd
mov qword [rsp + 0x24], rdx
movabs rdx, 0x600091103011112
mov qword [rsp + 0x2c], rdx
movabs rdx, 0x2060d07090b0207
mov qword [rsp + 0x34], rdx
movabs rdx, 0x1100d02060d07
mov qword [rsp + 0x38], rdx
movabs rdx, 0x10b08040a0d0b0a
mov qword [rsp + 0x40], rdx
xor eax, eax
jmp 0x511b19
movzx r9d, byte [rsp + rsi + 0x19]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x65]
mov byte [rsp + rdi + 0x19], dl
mov byte [rsp + rsi + 0x19], r8b
add rax, 2
cmp rax, 0x1c
jge 0x511b4b
movzx edx, byte [rsp + rax + 0x2c]
movzx esi, byte [rsp + rax + 0x2d]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x13
jae 0x511b6e
movzx r8d, byte [rsp + rdi + 0x19]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x65]
cmp rsi, 0x13
jb 0x511aff
jmp 0x511b62
xor eax, eax
lea rbx, [rsp + 0x19]
mov ecx, 0x13
call fcn.00441380
add rsp, 0x48
pop rbp
ret
mov eax, esi
mov ecx, 0x13
call fcn.00451880
mov eax, edi
mov ecx, 0x13
call fcn.00451880
nop
nop dword [rax + rax]
call fcn.0044f600
jmp fcn.00511a80

Function at 0x512fa0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x51306c
push rbp
mov rbp, rsp
sub rsp, 0x38
movabs rdx, 0xc7939a0436c7411
mov qword [rsp + 0x1b], rdx
movabs rdx, 0x13722745e00c7939
mov qword [rsp + 0x20], rdx
movabs rdx, 0xc00080808040007
mov qword [rsp + 0x28], rdx
movabs rdx, 0xa00040908050408
mov qword [rsp + 0x30], rdx
xor eax, eax
jmp 0x51300f
movzx r9d, byte [rsp + rsi + 0x1b]
sub r9d, edx
lea edx, [r9 + 0x43]
mov byte [rsp + rdi + 0x1b], dl
lea edx, [r8 + 0x43]
mov byte [rsp + rsi + 0x1b], dl
add rax, 2
cmp rax, 0x10
jge 0x51303c
movzx edx, byte [rsp + rax + 0x28]
movzx esi, byte [rsp + rax + 0x29]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xd
jae 0x51305f
movzx r8d, byte [rsp + rdi + 0x1b]
sub r8d, edx
cmp rsi, 0xd
jb 0x512ff2
jmp 0x513053
xor eax, eax
lea rbx, [rsp + 0x1b]
mov ecx, 0xd
call fcn.00441380
add rsp, 0x38
pop rbp
ret
mov eax, esi
mov ecx, 0xd
call fcn.00451880
mov eax, edi
mov ecx, 0xd
call fcn.00451880
nop
call fcn.0044f600
jmp fcn.00512fa0
Function at 0x513880
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x5139c7
push rbp
mov rbp, rsp
sub rsp, 0x70
movabs rdx, 0x7265706f4e1b1a2e
mov qword [rsp + 0x19], rdx
movabs rdx, 0x1416126061726570
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x74fc5e4463334b59
mov qword [rsp + 0x26], rdx
movabs rdx, 0x1e60f365b3653352
mov qword [rsp + 0x2e], rdx
movabs rdx, 0x6d796c6c7f667373
mov qword [rsp + 0x36], rdx
movabs rdx, 0xa0b18020c1c0100
mov qword [rsp + 0x3e], rdx
movabs rdx, 0xc1b0a0b18020c1c
mov qword [rsp + 0x40], rdx
movabs rdx, 0x16031a0a0f16020f
mov qword [rsp + 0x48], rdx
movabs rdx, 0x110b180b0c10241c
mov qword [rsp + 0x50], rdx
movabs rdx, 0xf0e1018111c020b
mov qword [rsp + 0x58], rdx
movabs rdx, 0x15170f090a0d1513
mov qword [rsp + 0x60], rdx
movabs rdx, 0x1519121a19182018
mov qword [rsp + 0x68], rdx
xor eax, eax
jmp 0x513967
movzx r9d, byte [rsp + rsi + 0x19]
sub r9d, edx
lea edx, [r9 + 0x3b]
mov byte [rsp + rdi + 0x19], dl
lea edx, [r8 + 0x3b]
mov byte [rsp + rsi + 0x19], dl
add rax, 2
cmp rax, 0x32
jge 0x513997
movzx edx, byte [rsp + rax + 0x3e]
movzx esi, byte [rsp + rax + 0x3f]
mov edi, edx
xor edx, esi
add edx, eax
nop dword [rax]
cmp rdi, 0x25
jae 0x5139ba
movzx r8d, byte [rsp + rdi + 0x19]
sub r8d, edx
cmp rsi, 0x25
jb 0x51394a
jmp 0x5139ae
xor eax, eax
lea rbx, [rsp + 0x19]
mov ecx, 0x25
call fcn.00441380
add rsp, 0x70
pop rbp
ret
mov eax, esi
mov ecx, 0x25
call fcn.00451880
mov eax, edi
mov ecx, 0x25
call fcn.00451880
nop
call fcn.0044f600
jmp fcn.00513880
Function at 0x1400111a9
Capabilities:
Create thread

Disassembly:
jmp 0x140015b00
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x168
lea rbp, [rsp + 0x30]
lea rdi, [rsp + 0x30]
mov ecx, 0x1e
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x188]
mov rax, qword [0x140031040]
xor rax, rbp
mov qword [rbp + 0x120], rax
lea rcx, [0x140037100]
call fcn.140011839
mov edx, 8
lea rcx, [rbp + 8]
call fcn.140011267
mov rdx, qword [rbp + 0x158]
lea rcx, [rbp + 0x108]
call fcn.140011429
mov qword [rbp + 0x118], rax
mov rdx, qword [rbp + 0x118]
lea rcx, [rbp + 8]
call fcn.1400111d1
nop
lea rcx, [rbp + 0x108]
call fcn.14001135c
lea rax, [0x140011596]
mov qword [rbp + 0x28], rax
mov rax, qword [rbp + 0x150]
add rax, 8
mov qword [rbp + 0x118], rax
lea rcx, [rbp + 8]
call fcn.1400115b9
mov rcx, qword [rbp + 0x118]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], 0
mov r9, rax
mov r8, qword [rbp + 0x28]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.ucrtbased.dll__beginthreadex]
mov rcx, qword [rbp + 0x150]
mov qword [rcx], rax
mov rax, qword [rbp + 0x150]
cmp qword [rax], 0
je 0x140015c00
lea rcx, [rbp + 8]
call fcn.14001137f
jmp 0x140015c19
mov rax, qword [rbp + 0x150]
mov dword [rax + 8], 0
mov ecx, 6
call fcn.1400111ef
nop
lea rcx, [rbp + 8]
call fcn.14001135c
lea rcx, [rbp - 0x30]
lea rdx, [0x1400267c0]
call fcn.1400116d1
mov rcx, qword [rbp + 0x120]
xor rcx, rbp
call fcn.140011401
lea rsp, [rbp + 0x138]
pop rdi
pop rbp
ret

Function at 0x1400114c4
Capabilities:
Terminate process

Disassembly:
jmp 0x14001ede0
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x28
ret
Function at 0x1400115d7
Capabilities:
Parse pe header

Disassembly:
jmp 0x14001e1a0
sub rsp, 0x38
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x14001e1c0
xor al, al
jmp 0x14001e241
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x14001e1d3
xor al, al
jmp 0x14001e241
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax], 0x4550
je 0x14001e1fd
xor al, al
jmp 0x14001e241
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x14001e211
xor al, al
jmp 0x14001e241
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0x84], 0xe
ja 0x14001e223
xor al, al
jmp 0x14001e241
mov eax, 8
imul rax, rax, 0xe
mov rcx, qword [rsp + 0x28]
cmp dword [rcx + rax + 0x88], 0
jne 0x14001e23f
xor al, al
jmp 0x14001e241
mov al, 1
add rsp, 0x38
ret
Function at 0x140011816
Capabilities:
Capture network configuration via ipconfig
Delete volume shadow copies
Execute command

Disassembly:
jmp 0x14001b720
push rbp
push rdi
sub rsp, 0xe8
lea rbp, [rsp + 0x20]
lea rcx, [0x140037101]
call fcn.140011839
lea rcx, [0x140026be4]
call qword [sym.imp.ucrtbased.dll_system]
lea rcx, str.NETSH_WINSOCK_RESET
call qword [sym.imp.ucrtbased.dll_system]
lea rcx, str.NETSH_INT_IP_RESET
call qword [sym.imp.ucrtbased.dll_system]
lea rcx, str.NETSH_INTERFACE_IPV4_RESET
call qword [sym.imp.ucrtbased.dll_system]
lea rcx, str.NETSH_INTERFACE_IPV6_RESET
call qword [sym.imp.ucrtbased.dll_system]
lea rcx, str.NETSH_INTERFACE_TCP_RESET
call qword [sym.imp.ucrtbased.dll_system]
lea rcx, str.IPCONFIG__RELEASE
call qword [sym.imp.ucrtbased.dll_system]
lea rcx, str.IPCONFIG__RELEASE
call qword [sym.imp.ucrtbased.dll_system]
lea rcx, str.IPCONFIG__RENEW
call qword [sym.imp.ucrtbased.dll_system]
lea rcx, str.IPCONFIG__FLUSHDNS
call qword [sym.imp.ucrtbased.dll_system]
lea rcx, str.IPCONFIG__RENEW
call qword [sym.imp.ucrtbased.dll_system]
lea rcx, str.net_stop_winmgmt__y__nul_2_1
call qword [sym.imp.ucrtbased.dll_system]
lea rcx, str.vssadmin_delete_shadows__All__Quiet__nul_2_1
call qword [sym.imp.ucrtbased.dll_system]
lea rdx, str.Network_Adapters_reset
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400110e6
lea rdx, [0x140011055]
mov rcx, rax
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rdx, str.Press_any_key_to_go_back_to_the_menu
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400110e6
lea rdx, [0x140011055]
mov rcx, rax
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rcx, str.pause
call qword [sym.imp.ucrtbased.dll_system]
lea rsp, [rbp + 0xc8]
pop rdi
pop rbp
ret
Function at 0x140001e20
Capabilities:
Generate random numbers via winapi
Terminate process

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r14
push r15
sub rsp, 0x40
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x38], rax
movsxd rbx, ecx
mov eax, 2
mov rcx, 0xffffffffffffffff
lea rdx, [rbx + 1]
mul rdx
cmovo rax, rcx
mov rcx, rax
call fcn.140005a10
xor r15d, r15d
mov rsi, rax
mov edi, r15d
test rbx, rbx
jle 0x140001edf
mov ebp, 0xff
mov r14d, 0x400
mov rcx, qword [0x14001fc40]
test rcx, rcx
jne 0x140001eb7
lea r9d, [rcx + 1]
mov dword [rsp + 0x20], 0xf0000040
lea rcx, [0x14001fc40]
xor r8d, r8d
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x140001f0d
mov rcx, qword [0x14001fc40]
lea r8, [rsp + 0x30]
mov edx, 4
call qword [sym.imp.ADVAPI32.dll_CryptGenRandom]
movzx eax, word [rsp + 0x30]
and ax, bp
add ax, r14w
mov word [rsi + rdi*2], ax
inc rdi
cmp rdi, rbx
jl 0x140001e82
mov word [rsi + rbx*2], r15w
mov rax, rsi
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.1400059f0
mov rbx, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x40
pop r15
pop r14
pop rdi
ret
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x140006464
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400064ae
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400064ae
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400064ae
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400064ae
cmp dword [rcx + 0x84], 0xe
jbe 0x1400064ae
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x1400064b0
xor al, al
add rsp, 0x28
ret

Function at 0x140008830
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x14000865c

Function at 0x140010b30
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x140010b58
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x140010b58
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret
Function at 0x140011253
Capabilities:
Terminate process

Disassembly:
jmp 0x1400139c0
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x28
ret

Function at 0x1400112ee
Capabilities:
Parse pe header

Disassembly:
jmp 0x140014d10
sub rsp, 0x38
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x140014d30
xor al, al
jmp 0x140014db1
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x140014d43
xor al, al
jmp 0x140014db1
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax], 0x4550
je 0x140014d6d
xor al, al
jmp 0x140014db1
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x140014d81
xor al, al
jmp 0x140014db1
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0x84], 0xe
ja 0x140014d93
xor al, al
jmp 0x140014db1
mov eax, 8
imul rax, rax, 0xe
mov rcx, qword [rsp + 0x28]
cmp dword [rcx + rax + 0x88], 0
jne 0x140014daf
xor al, al
jmp 0x140014db1
mov al, 1
add rsp, 0x38
ret
Function at 0x1400290fc
Capabilities:
Clear file content

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x20
mov rbx, rdx
mov rsi, r8
xor edx, edx
mov r14d, ecx
lea r8d, [rdx + 1]
call fcn.14001c6f4
xor edx, edx
mov ecx, r14d
mov r12, rax
lea r8d, [rdx + 2]
call fcn.14001c6f4
mov rbp, rbx
sub rbp, rax
cmp r12, 0xffffffffffffffff
je 0x14002924c
cmp rax, 0xffffffffffffffff
je 0x14002924c
xor edi, edi
test rbp, rbp
jle 0x1400291f7
lea edx, [rdi + 1]
mov ecx, 0x1000
call fcn.14001f008
mov rbx, rax
test rax, rax
jne 0x140029184
lea edi, [rax + 0xc]
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], edi
jmp 0x1400291ed
mov edx, 0x8000
mov ecx, r14d
call fcn.14001a028
mov r15d, eax
mov eax, 0x1000
mov r8d, ebp
cmp rbp, rax
mov r9, rsi
mov rdx, rbx
mov ecx, r14d
cmovge r8d, eax
call fcn.14001d3d0
cmp eax, 0xffffffff
je 0x1400291cd
cdqe
sub rbp, rax
test rbp, rbp
jg 0x140029194
mov edx, r15d
mov ecx, r14d
call fcn.14001a028
jmp 0x1400291ed
cmp byte [rsi + 0x38], dil
je 0x1400291e4
cmp dword [rsi + 0x34], 5
jne 0x1400291e4
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], 0xd
cmp byte [rsi + 0x30], dil
je 0x1400291ed
mov edi, dword [rsi + 0x2c]
mov rcx, rbx
call fcn.14001adbc
jmp 0x140029260
jns 0x140029260
xor r8d, r8d
mov rdx, rbx
mov ecx, r14d
call fcn.14001c6f4
cmp rax, 0xffffffffffffffff
jne 0x140029218
cmp byte [rsi + 0x30], dil
je 0x140029260
mov edi, dword [rsi + 0x2c]
jmp 0x140029260
mov ecx, r14d
call fcn.1400184e0
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x140029260
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov byte [rsi + 0x38], 1
mov edi, 0xd
mov dword [rsi + 0x34], eax
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], 0xd
jmp 0x140029260
xor edi, edi
cmp byte [rsi + 0x30], dil
je 0x140029259
mov eax, dword [rsi + 0x2c]
jmp 0x14002925e
mov eax, 0x16
mov edi, eax
xor r8d, r8d
mov rdx, r12
mov ecx, r14d
call fcn.14001c6f4
mov rbx, qword [rsp + 0x40]
mov eax, edi
mov rdi, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop r12
ret

Function at 0x140007290
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r9, qword [0x14000f1b0]
xor edx, edx
cmp word [r9], 0x5a4d
mov r8, rcx
jne 0x1400072ff
mov rcx, r9
call fcn.140007160
test eax, eax
je 0x1400072ff
movsxd rax, dword [r9 + 0x3c]
mov rcx, r8
sub rcx, r9
add r9, rax
movzx eax, word [r9 + 0x14]
lea rdx, [r9 + rax + 0x18]
movzx eax, word [r9 + 6]
test eax, eax
je 0x1400072fd
sub eax, 1
lea rax, [rax + rax*4]
lea r9, [rdx + rax*8 + 0x28]
mov r8d, dword [rdx + 0xc]
cmp rcx, r8
mov rax, r8
jb 0x1400072f4
add eax, dword [rdx + 8]
cmp rcx, rax
jb 0x1400072ff
add rdx, 0x28
cmp rdx, r9
jne 0x1400072e0
xor edx, edx
mov rax, rdx
add rsp, 0x28
ret
Function at 0x140001500
Capabilities:
Connect pipe

Disassembly:
mov rdx, qword [rcx + 0x20]
mov rcx, qword [rcx + 0x18]
jmp qword [sym.imp.KERNEL32.dll_ConnectNamedPipe]

Function at 0x140001560
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x30
mov rbp, r8
mov edi, edx
mov rsi, rcx
mov ebx, 0x200
xor edx, edx
add rcx, 0x2c
mov r8d, ebx
call fcn.1400e4040
cmp dword [rsi + 8], 1
jne 0x1400015c0
test rbp, rbp
je 0x1400015c0
cmp edi, ebx
ja 0x1400015a6
mov ebx, edi
mov r9, qword [rsi + 0x20]
mov rcx, qword [rsi + 0x18]
lea rdx, [rsi + 0x2c]
mov r8d, ebx
mov qword [rsp + 0x20], rbp
call qword [sym.imp.KERNEL32.dll_ReadFileEx]
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
xor eax, eax
add rsp, 0x30
pop r14
ret

Function at 0x1400015f0
Capabilities:
Write file on windows

Disassembly:
sub rsp, 0x38
test rdx, rdx
jne 0x140001600
xor eax, eax
add rsp, 0x38
ret
mov rcx, qword [rcx + 0x18]
mov qword [rsp + 0x30], rbx
xor ebx, ebx
lea r9, [rsp + 0x48]
mov dword [rsp + 0x48], ebx
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, dword [rsp + 0x48]
test eax, eax
cmove ecx, ebx
mov rbx, qword [rsp + 0x30]
mov eax, ecx
add rsp, 0x38
ret