joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14004b020
Capabilities:
Check for debugger via api

Disassembly:
sub rsp, 0x28
mov dword [rsp + 0x30], 0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea rdx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
mov eax, dword [rsp + 0x30]
add rsp, 0x28
ret

Function at 0x14004ba50
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x150
mov rsi, rcx
xor edx, edx
mov ecx, 2
xor ebx, ebx
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x14004bae2
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], pe_nt_image_headers64
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32First]
test eax, eax
je 0x14004bafd
nop word [rax + rax]
lea r8, [rsp + 0x4c]
mov rax, rsi
sub r8, rsi
nop dword [rax + rax]
movzx edx, byte [rax]
movzx ecx, byte [rax + r8]
sub edx, ecx
jne 0x14004bac3
inc rax
test ecx, ecx
jne 0x14004bab0
test edx, edx
je 0x14004baf9
lea rdx, [rsp + 0x20]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
jne 0x14004baa0
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
lea r11, [rsp + 0x150]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret
mov ebx, dword [rsp + 0x28]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test ebx, ebx
setne al
jmp 0x14004bae4
Function at 0x14004dfb0
Capabilities:
Enumerate processes

Disassembly:
push rsi
sub rsp, 0x150
mov rsi, rcx
test rcx, rcx
jne 0x14004dfcc
xor eax, eax
add rsp, 0x150
pop rsi
ret
mov qword [rsp + 0x160], rbx
xor edx, edx
mov qword [rsp + 0x168], rbp
mov ecx, 2
mov qword [rsp + 0x170], rdi
xor edi, edi
mov ebx, edi
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], pe_nt_image_headers64
mov rcx, rax
mov rbp, rax
call qword [sym.imp.KERNEL32.dll_Process32First]
lea rdx, [rsp + 0x20]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
je 0x14004e052
mov rdx, rsi
lea rcx, [rsp + 0x4c]
call qword [sym.imp.api_ms_win_crt_multibyte_l1_1_0.dll__mbsicmp]
test eax, eax
jne 0x14004e040
mov eax, dword [rsp + 0x3c]
cmp eax, ebx
jbe 0x14004e040
mov edi, dword [rsp + 0x28]
mov ebx, eax
lea rdx, [rsp + 0x20]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
jne 0x14004e020
mov rbp, qword [rsp + 0x168]
mov eax, edi
mov rdi, qword [rsp + 0x170]
mov rbx, qword [rsp + 0x160]
add rsp, 0x150
pop rsi
ret
Function at 0x14004e080
Capabilities:
Get system information on windows

Disassembly:
sub rsp, 0x68
call fcn.14004df20
mov rcx, rax
call fcn.14004dfb0
test eax, eax
je 0x14004e221
mov r8d, eax
mov dword [0x14025e568], eax
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [0x14025e570], rax
test rax, rax
je 0x14004e221
mov r8d, reloc.WLDAP32.dll_Ordinal_35
lea rdx, str.2X_SOCPE_TRACKING_ACTIVATING.......
lea rcx, [0x14025e548]
call fcn.140044940
call fcn.14004df20
mov rcx, rax
call fcn.14004dfb0
test eax, eax
je 0x14004e23a
mov r8d, eax
mov dword [0x14025e568], eax
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [0x14025e570], rax
test rax, rax
je 0x14004e23a
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, str.An_unexpected_error_occurred
mov qword [rsp + 0x70], rbx
mov qword [rsp + 0x78], rsi
mov qword [rsp + 0x60], rdi
call fcn.140057cd0
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov rsi, qword [rsp + 0x38]
mov ecx, reloc.WS2_32.dll_send
mov rdi, qword [rsp + 0x40]
call fcn.140124fe8
mov ecx, reloc.WS2_32.dll_send
mov rbx, rax
mov dword [rax], 0x42a0
mov dword [rax + 4], 0x33333fc0
mov dword [rax + 8], 0x4013
mov dword [rax + 0xc], 0x3ff0
mov word [rax + 0x10], 0x4f80
mov byte [rax + 0x12], 1
call fcn.140124fe8
mov r9, rax
mov qword [rsp + 0x20], rbx
mov r8, rdi
mov rdx, rsi
mov dword [rax], 0x42a0
mov dword [rax + 4], 0x33333fc0
mov dword [rax + 8], 0x4013
mov dword [rax + 0xc], 0x3ff0
mov word [rax + 0x10], 0x3f80
mov byte [rax + 0x12], 1
call fcn.14004fdc0
mov rdi, qword [rsp + 0x60]
lea rcx, [0x14025e548]
mov rsi, qword [rsp + 0x78]
mov rbx, qword [rsp + 0x70]
test al, al
je 0x14004e20a
mov r8d, reloc.WLDAP32.dll_Ordinal_27
lea rdx, str.2X_SOCPE_TRACKING_ACTIVATED
call fcn.140044940
cmp byte [0x14025f94b], 0
jne 0x14004e23a
mov edx, 0x20001
lea rcx, str.C:WindowsTempF4X1.wav
call qword [sym.imp.WINMM.dll_sndPlaySoundA]
add rsp, 0x68
ret
mov r8d, Ordinal_32
lea rdx, str.2X_SOCPE_TRACKING_NOT_ACTIVATED
call fcn.140044940
add rsp, 0x68
ret
mov r8d, reloc.WS2_32.dll_socket
lea rdx, str.OPEN_32_BIT_EMULATOR___
lea rcx, [0x14025e548]
call fcn.140044940
add rsp, 0x68
ret
Function at 0x14004e240
Capabilities:
Get system information on windows

Disassembly:
sub rsp, 0x68
call fcn.14004df20
mov rcx, rax
call fcn.14004dfb0
test eax, eax
je 0x14004e3e1
mov r8d, eax
mov dword [0x14025e568], eax
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [0x14025e570], rax
test rax, rax
je 0x14004e3e1
mov r8d, Ordinal_41
lea rdx, str.2X_SOCPE_TRACKING_DEACTIVATING.......
lea rcx, [0x14025e548]
call fcn.140044940
call fcn.14004df20
mov rcx, rax
call fcn.14004dfb0
test eax, eax
je 0x14004e3fa
mov r8d, eax
mov dword [0x14025e568], eax
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [0x14025e570], rax
test rax, rax
je 0x14004e3fa
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, str.An_unexpected_error_occurred
mov qword [rsp + 0x70], rbx
mov qword [rsp + 0x78], rsi
mov qword [rsp + 0x60], rdi
call fcn.140057cd0
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov rsi, qword [rsp + 0x38]
mov ecx, reloc.WS2_32.dll_send
mov rdi, qword [rsp + 0x40]
call fcn.140124fe8
mov ecx, reloc.WS2_32.dll_send
mov rbx, rax
mov dword [rax], 0x42a0
mov dword [rax + 4], 0x33333fc0
mov dword [rax + 8], 0x4013
mov dword [rax + 0xc], 0x3ff0
mov word [rax + 0x10], 0x3f80
mov byte [rax + 0x12], 1
call fcn.140124fe8
mov r9, rax
mov qword [rsp + 0x20], rbx
mov r8, rdi
mov rdx, rsi
mov dword [rax], 0x42a0
mov dword [rax + 4], 0x33333fc0
mov dword [rax + 8], 0x4013
mov dword [rax + 0xc], 0x3ff0
mov word [rax + 0x10], 0x4f80
mov byte [rax + 0x12], 1
call fcn.14004fdc0
mov rdi, qword [rsp + 0x60]
lea rcx, [0x14025e548]
mov rsi, qword [rsp + 0x78]
mov rbx, qword [rsp + 0x70]
test al, al
je 0x14004e3ca
mov r8d, Ordinal_32
lea rdx, str.2X_SOCPE_TRACKING_DEACTIVATED
call fcn.140044940
cmp byte [0x14025f94b], 0
jne 0x14004e3fa
mov edx, 0x20001
lea rcx, str.C:WindowsTempF4X1.wav
call qword [sym.imp.WINMM.dll_sndPlaySoundA]
add rsp, 0x68
ret
mov r8d, reloc.WLDAP32.dll_Ordinal_33
lea rdx, str.2X_SOCPE_TRACKING_NOT_DEACTIVATED
call fcn.140044940
add rsp, 0x68
ret
mov r8d, reloc.WS2_32.dll_socket
lea rdx, str.OPEN_32_BIT_EMULATOR___
lea rcx, [0x14025e548]
call fcn.140044940
add rsp, 0x68
ret
Function at 0x14004e400
Capabilities:
Get system information on windows

Disassembly:
sub rsp, 0x68
call fcn.14004df20
mov rcx, rax
call fcn.14004dfb0
test eax, eax
je 0x14004e55e
mov r8d, eax
mov dword [0x14025e568], eax
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [0x14025e570], rax
test rax, rax
je 0x14004e55e
mov qword [rsp + 0x70], rbx
lea rdx, str.WALL_HACK_BYPASS_ACTIVATING.......
mov qword [rsp + 0x78], rsi
lea rcx, [0x14025e548]
mov r8d, Ordinal_35
mov qword [rsp + 0x60], rdi
call fcn.140044940
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov rsi, qword [rsp + 0x38]
mov ecx, reloc.WS2_32.dll_recvfrom
mov rdi, qword [rsp + 0x40]
call fcn.140124fe8
mov ecx, reloc.WLDAP32.dll_Ordinal_30
mov rbx, rax
mov dword [rax], 0x441890ae
mov dword [rax + 4], 0x3ff0ef3f
mov dword [rax + 8], 0x94a0dce1
mov dword [rax + 0xc], 0x5a0000e5
mov byte [rax + 0x10], 0x3f
call fcn.140124fe8
mov r9, rax
mov qword [rsp + 0x20], rbx
mov r8, rdi
mov rdx, rsi
mov dword [rax], 0x21710e8
mov dword [rax + 4], 0x2fff3ce3
mov dword [rax + 8], 0x94a0dce1
mov dword [rax + 0xc], 0x5a0000e5
mov dword [rax + 0x10], 0xfe3
mov dword [rax + 0x14], 0x5800001a
mov dword [rax + 0x18], 0x1e3
mov word [rax + 0x1c], reloc.WLDAP32.dll_Ordinal_26
call fcn.14004fdc0
mov rdi, qword [rsp + 0x60]
lea rcx, [0x14025e548]
mov rsi, qword [rsp + 0x78]
mov rbx, qword [rsp + 0x70]
test al, al
je 0x14004e547
mov r8d, reloc.WLDAP32.dll_Ordinal_26
lea rdx, str.WALL_HACK_BYPASS_ACTIVATED
call fcn.140044940
cmp byte [0x14025f94b], 0
jne 0x14004e577
mov edx, 0x20001
lea rcx, str.C:WindowsTempF4X1.wav
call qword [sym.imp.WINMM.dll_sndPlaySoundA]
add rsp, 0x68
ret
mov r8d, reloc.WLDAP32.dll_Ordinal_30
lea rdx, str.WALL_HACK_BYPASS_NOT_ACTIVATED
call fcn.140044940
add rsp, 0x68
ret
mov r8d, reloc.WS2_32.dll_socket
lea rdx, str.OPEN_32_BIT_EMULATOR___
lea rcx, [0x14025e548]
call fcn.140044940
add rsp, 0x68
ret
Function at 0x14004f260
Capabilities:
Get system information on windows

Disassembly:
sub rsp, 0x68
call fcn.14004df20
mov rcx, rax
call fcn.14004dfb0
test eax, eax
je 0x14004f408
mov r8d, eax
mov dword [0x14025e568], eax
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [0x14025e570], rax
test rax, rax
je 0x14004f408
mov r8d, Ordinal_32
lea rdx, str.SNIPER_AIM_ACTIVATING.......
lea rcx, [0x14025e548]
call fcn.140044940
call fcn.14004df20
mov rcx, rax
call fcn.14004dfb0
test eax, eax
je 0x14004f421
mov r8d, eax
mov dword [0x14025e568], eax
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [0x14025e570], rax
test rax, rax
je 0x14004f421
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, str.An_unexpected_error_occurred
mov qword [rsp + 0x70], rbx
mov qword [rsp + 0x78], rsi
mov qword [rsp + 0x60], rdi
call fcn.140057cd0
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov rsi, qword [rsp + 0x38]
mov ecx, Ordinal_26
mov rdi, qword [rsp + 0x40]
call fcn.140124fe8
mov ecx, Ordinal_45
mov rbx, rax
mov qword [rax], 0
mov dword [rax + 8], 0
mov qword [rax + 0xc], 1
mov dword [rax + 0x14], 0xcb
call fcn.140124fe8
mov r9, rax
mov qword [rsp + 0x20], rbx
mov r8, rdi
mov rdx, rsi
mov qword [rax], 1
mov dword [rax + 8], 0
mov qword [rax + 0xc], 1
mov dword [rax + 0x14], 0xcb
mov qword [rax + 0x18], 0x3f3f3f3f
mov dword [rax + 0x20], 0
mov qword [rax + 0x24], 0x3f3f3f3f
call fcn.14004fdc0
mov rdi, qword [rsp + 0x60]
lea rcx, [0x14025e548]
mov rsi, qword [rsp + 0x78]
mov rbx, qword [rsp + 0x70]
test al, al
je 0x14004f3f1
mov r8d, reloc.WS2_32.dll_sendto
lea rdx, str.SNIPER_AIM_ACTIVATED
call fcn.140044940
cmp byte [0x14025f94b], 0
jne 0x14004f421
mov edx, 0x20001
lea rcx, str.C:WindowsTempF4X1.wav
call qword [sym.imp.WINMM.dll_sndPlaySoundA]
add rsp, 0x68
ret
mov r8d, Ordinal_26
lea rdx, str.SNIPER_AIM_NOT_ACTIVATED
call fcn.140044940
add rsp, 0x68
ret
mov r8d, reloc.WS2_32.dll_socket
lea rdx, str.OPEN_32_BIT_EMULATOR___
lea rcx, [0x14025e548]
call fcn.140044940
add rsp, 0x68
ret
Function at 0x14004f430
Capabilities:
Get system information on windows

Disassembly:
sub rsp, 0x68
call fcn.14004df20
mov rcx, rax
call fcn.14004dfb0
test eax, eax
je 0x14004f5d8
mov r8d, eax
mov dword [0x14025e568], eax
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [0x14025e570], rax
test rax, rax
je 0x14004f5d8
mov r8d, Ordinal_32
lea rdx, str.SNIPER_AIM_ACTIVATING.......
lea rcx, [0x14025e548]
call fcn.140044940
call fcn.14004df20
mov rcx, rax
call fcn.14004dfb0
test eax, eax
je 0x14004f5f1
mov r8d, eax
mov dword [0x14025e568], eax
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [0x14025e570], rax
test rax, rax
je 0x14004f5f1
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, str.An_unexpected_error_occurred
mov qword [rsp + 0x70], rbx
mov qword [rsp + 0x78], rsi
mov qword [rsp + 0x60], rdi
call fcn.140057cd0
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov rsi, qword [rsp + 0x38]
mov ecx, Ordinal_26
mov rdi, qword [rsp + 0x40]
call fcn.140124fe8
mov ecx, Ordinal_45
mov rbx, rax
mov qword [rax], 1
mov dword [rax + 8], 0
mov qword [rax + 0xc], 1
mov dword [rax + 0x14], 0xcb
call fcn.140124fe8
mov r9, rax
mov qword [rsp + 0x20], rbx
mov r8, rdi
mov rdx, rsi
mov qword [rax], 0
mov dword [rax + 8], 0
mov qword [rax + 0xc], 1
mov dword [rax + 0x14], 0xcb
mov qword [rax + 0x18], 0x3f3f3f3f
mov dword [rax + 0x20], 0
mov qword [rax + 0x24], 0x3f3f3f3f
call fcn.14004fdc0
mov rdi, qword [rsp + 0x60]
lea rcx, [0x14025e548]
mov rsi, qword [rsp + 0x78]
mov rbx, qword [rsp + 0x70]
test al, al
je 0x14004f5c1
mov r8d, reloc.WS2_32.dll_sendto
lea rdx, str.SNIPER_AIM_ACTIVATED
call fcn.140044940
cmp byte [0x14025f94b], 0
jne 0x14004f5f1
mov edx, 0x20001
lea rcx, str.C:WindowsTempF4X1.wav
call qword [sym.imp.WINMM.dll_sndPlaySoundA]
add rsp, 0x68
ret
mov r8d, Ordinal_26
lea rdx, str.SNIPER_AIM_NOT_ACTIVATED
call fcn.140044940
add rsp, 0x68
ret
mov r8d, reloc.WS2_32.dll_socket
lea rdx, str.OPEN_32_BIT_EMULATOR___
lea rcx, [0x14025e548]
call fcn.140044940
add rsp, 0x68
ret
Function at 0x14004f600
Capabilities:
Get system information on windows

Disassembly:
sub rsp, 0x68
call fcn.14004df20
mov rcx, rax
call fcn.14004dfb0
test eax, eax
je 0x14004f825
mov r8d, eax
mov dword [0x14025e568], eax
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [0x14025e570], rax
test rax, rax
je 0x14004f825
call fcn.14004df20
mov rcx, rax
call fcn.14004dfb0
test eax, eax
je 0x14004f83e
mov r8d, eax
mov dword [0x14025e568], eax
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [0x14025e570], rax
test rax, rax
je 0x14004f83e
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, str.An_unexpected_error_occurred
mov qword [rsp + 0x70], rbx
mov qword [rsp + 0x78], rsi
mov qword [rsp + 0x60], rdi
call fcn.140057cd0
mov r8d, Ordinal_26
lea rdx, str.M82B_LOCATION_ACTIVATING
lea rcx, [0x14025e548]
call fcn.140044940
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov rsi, qword [rsp + 0x38]
mov ecx, 0x3e
mov rdi, qword [rsp + 0x40]
call fcn.140124fe8
mov ecx, gethostname
mov rbx, rax
mov dword [rax], Ordinal_32
mov dword [rax + 4], 0x660065
mov dword [rax + 8], 0x650066
mov dword [rax + 0xc], 0x740063
mov dword [rax + 0x10], 0x2f0073
mov dword [rax + 0x14], 0x660076
mov dword [rax + 0x18], 0x5f0078
mov dword [rax + 0x1c], 0x6e0069
mov dword [rax + 0x20], 0x670061
mov dword [rax + 0x24], 0x65006d
mov dword [rax + 0x28], 0x6c005f
mov dword [rax + 0x2c], 0x730061
mov dword [rax + 0x30], 0x720065
mov dword [rax + 0x34], 0x73005f
mov dword [rax + 0x38], 0x6f0068
mov word [rax + 0x3c], reloc.WS2_32.dll_WSASetLastError
call fcn.140124fe8
mov r9, rax
mov qword [rsp + 0x20], rbx
mov r8, rdi
mov rdx, rsi
mov dword [rax], Ordinal_26
mov dword [rax + 4], 0x6e0069
mov dword [rax + 8], 0x610067
mov dword [rax + 0xc], 0x65006d
mov dword [rax + 0x10], 0x70002f
mov dword [rax + 0x14], 0x630069
mov dword [rax + 0x18], 0x75006b
mov dword [rax + 0x1c], 0x2f0070
mov dword [rax + 0x20], 0x690070
mov dword [rax + 0x24], 0x6b0063
mov dword [rax + 0x28], 0x700075
mov dword [rax + 0x2c], 0x62005f
mov dword [rax + 0x30], 0x39006d
mov word [rax + gethostname], 0x34
call fcn.14004fdc0
mov rdi, qword [rsp + 0x60]
lea rcx, [0x14025e548]
mov rsi, qword [rsp + 0x78]
mov rbx, qword [rsp + 0x70]
test al, al
je 0x14004f80e
mov r8d, reloc.WS2_32.dll_socket
lea rdx, str.M82B_LOCATION_ACTIVATED
call fcn.140044940
cmp byte [0x14025f94b], 0
jne 0x14004f83e
mov edx, 0x20001
lea rcx, str.C:WindowsTempF4X1.wav
call qword [sym.imp.WINMM.dll_sndPlaySoundA]
add rsp, 0x68
ret
mov r8d, reloc.WLDAP32.dll_Ordinal_27
lea rdx, str.M82B_LOCATION_NOT_ACTIVATED
call fcn.140044940
add rsp, 0x68
ret
mov r8d, reloc.WS2_32.dll_socket
lea rdx, str.OPEN_32_BIT_EMULATOR___
lea rcx, [0x14025e548]
call fcn.140044940
add rsp, 0x68
ret
Function at 0x14004f850
Capabilities:
Get system information on windows

Disassembly:
sub rsp, 0x68
call fcn.14004df20
mov rcx, rax
call fcn.14004dfb0
test eax, eax
je 0x14004fa75
mov r8d, eax
mov dword [0x14025e568], eax
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [0x14025e570], rax
test rax, rax
je 0x14004fa75
call fcn.14004df20
mov rcx, rax
call fcn.14004dfb0
test eax, eax
je 0x14004fa8e
mov r8d, eax
mov dword [0x14025e568], eax
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [0x14025e570], rax
test rax, rax
je 0x14004fa8e
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, str.An_unexpected_error_occurred
mov qword [rsp + 0x70], rbx
mov qword [rsp + 0x78], rsi
mov qword [rsp + 0x60], rdi
call fcn.140057cd0
mov r8d, reloc.WLDAP32.dll_Ordinal_26
lea rdx, str.M82B_LOCATION_DEACTIVATING
lea rcx, [0x14025e548]
call fcn.140044940
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov rsi, qword [rsp + 0x38]
mov ecx, gethostname
mov rdi, qword [rsp + 0x40]
call fcn.140124fe8
mov ecx, 0x3e
mov rbx, rax
mov dword [rax], Ordinal_26
mov dword [rax + 4], 0x6e0069
mov dword [rax + 8], 0x610067
mov dword [rax + 0xc], 0x65006d
mov dword [rax + 0x10], 0x70002f
mov dword [rax + 0x14], 0x630069
mov dword [rax + 0x18], 0x75006b
mov dword [rax + 0x1c], 0x2f0070
mov dword [rax + 0x20], 0x690070
mov dword [rax + 0x24], 0x6b0063
mov dword [rax + 0x28], 0x700075
mov dword [rax + 0x2c], 0x62005f
mov dword [rax + 0x30], 0x39006d
mov word [rax + gethostname], 0x34
call fcn.140124fe8
mov r9, rax
mov qword [rsp + 0x20], rbx
mov r8, rdi
mov rdx, rsi
mov dword [rax], Ordinal_32
mov dword [rax + 4], 0x660065
mov dword [rax + 8], 0x650066
mov dword [rax + 0xc], 0x740063
mov dword [rax + 0x10], 0x2f0073
mov dword [rax + 0x14], 0x660076
mov dword [rax + 0x18], 0x5f0078
mov dword [rax + 0x1c], 0x6e0069
mov dword [rax + 0x20], 0x670061
mov dword [rax + 0x24], 0x65006d
mov dword [rax + 0x28], 0x6c005f
mov dword [rax + 0x2c], 0x730061
mov dword [rax + 0x30], 0x720065
mov dword [rax + 0x34], 0x73005f
mov dword [rax + 0x38], 0x6f0068
mov word [rax + 0x3c], reloc.WS2_32.dll_WSASetLastError
call fcn.14004fdc0
mov rdi, qword [rsp + 0x60]
lea rcx, [0x14025e548]
mov rsi, qword [rsp + 0x78]
mov rbx, qword [rsp + 0x70]
test al, al
je 0x14004fa5e
mov r8d, Ordinal_26
lea rdx, str.M82B_LOCATION_DEACTIVATED
call fcn.140044940
cmp byte [0x14025f94b], 0
jne 0x14004fa8e
mov edx, 0x20001
lea rcx, str.C:WindowsTempF4X1.wav
call qword [sym.imp.WINMM.dll_sndPlaySoundA]
add rsp, 0x68
ret
mov r8d, Ordinal_32
lea rdx, str.M82B_LOCATION_NOT_DEACTIVATED
call fcn.140044940
add rsp, 0x68
ret
mov r8d, reloc.WS2_32.dll_socket
lea rdx, str.OPEN_32_BIT_EMULATOR___
lea rcx, [0x14025e548]
call fcn.140044940
add rsp, 0x68
ret
Function at 0x14004fdc0
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x50
mov rbx, r9
mov rdi, r8
mov rbp, rdx
mov r15, qword [rsp + 0x90]
mov rcx, r15
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll__msize]
mov rsi, rax
test eax, eax
jg 0x14004fe06
xor al, al
jmp 0x14004fef6
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x30], xmm0
xor r12d, r12d
mov qword [rsp + 0x40], r12
lea rax, [rsp + 0x30]
mov qword [rsp + 0x20], rax
mov r9, rbx
mov r8, rdi
mov rdx, rbp
call fcn.14004ff20
mov rbx, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
cmp rbx, rdi
jne 0x14004fe43
xor dil, dil
jmp 0x14004feb1
mov ebp, r12d
sub rdi, rbx
sar rdi, 3
test rdi, rdi
je 0x14004feae
movsxd r14, esi
mov rsi, rbx
nop dword [rax + rax]
mov edx, dword [rsi]
lea rax, [rsp + 0x98]
mov qword [rsp + 0x20], rax
mov r9d, 0x40
mov r8, r14
mov rcx, qword [0x14025e570]
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
mov qword [rsp + 0x20], r12
mov r9, r14
mov r8, r15
mov rdx, qword [rsi]
mov rcx, qword [0x14025e570]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
inc ebp
lea rsi, [rsi + 8]
movsxd rax, ebp
cmp rax, rdi
jb 0x14004fe60
mov dil, 1
test rbx, rbx
je 0x14004fef2
mov rdx, qword [rsp + 0x40]
sub rdx, rbx
and rdx, 0xfffffffffffffff8
mov rax, rbx
cmp rdx, 0x1000
jb 0x14004feea
add rdx, 0x27
mov rbx, qword [rbx - 8]
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14004feea
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rbx
call fcn.140124f44
movzx eax, dil
lea r11, [rsp + 0x50]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop r12
ret
Function at 0x140057f60
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdx
push rdi
sub rsp, 0x30
mov rbx, rcx
mov ecx, 1
call fcn.140124bf8
mov qword [rsp + 0x48], rax
lea rdi, [rbx + 8]
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], 0
mov r9, rax
lea r8, [0x140058e10]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rbx], rax
test rax, rax
je 0x140057fbc
mov rax, rbx
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
mov dword [rdi], 0
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3

Function at 0x140057fd0
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdx
push rdi
sub rsp, 0x30
mov rbx, rcx
mov ecx, 1
call fcn.140124bf8
mov qword [rsp + 0x48], rax
lea rdi, [rbx + 8]
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], 0
mov r9, rax
lea r8, [0x140058e40]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rbx], rax
test rax, rax
je 0x14005802c
mov rax, rbx
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
mov dword [rdi], 0
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3